Privacy Policy — km226

1.Introduction

1.1 km226 is committed to protecting the privacy and personal data of all Members. We recognize that trust is the foundation of any long-term relationship with our players, and we take our data protection obligations seriously. This Policy has been drafted to be clear, specific, and actionable — it tells you exactly what data we hold, why we hold it, and what you can do about it.

1.2 This Policy applies to all personal data collected through the km226 website at https://km226.cam, any mobile web interface, all customer support communications, and all related services offered by km226, regardless of the channel through which you access them.

1.3 This Policy should be read alongside the km226 Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference and together form the complete set of agreements governing your use of the Platform.

2.Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information that identifies or could reasonably identify you as an individual, including your name, national identity number, email address, device identifiers, and transaction history.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, erasure, or destruction.
• "Data Controller" means km226, the entity that determines the purposes and means of processing Personal Data.
• "Data Processor" means a third party that processes Personal Data on behalf of km226 under a binding data processing agreement.
• "KYC Data" means identity and address verification documents submitted by a Member during the Know Your Customer process, including KTP copies, proof of address, and selfie images.
• "Consent" means freely given, specific, informed, and unambiguous agreement to the processing of Personal Data for a stated purpose.
• "Sensitive Data" means a subset of Personal Data that warrants heightened protection, including financial account details and government-issued identity document numbers.

3.Personal Data We Collect

3.1 km226 collects the following categories of Personal Data:

3.1 Registration Data

When you create a km226 account, we collect your full legal name, date of birth, residential address in Indonesia, email address, and a username and password of your choosing. This data is required to establish and maintain your account.

3.2 KYC & Verification Data

To comply with anti-money laundering (AML) obligations and to verify that you meet the 21+ age requirement, we collect copies of your Kartu Tanda Penduduk (KTP), proof of address documents (such as utility bills or bank statements), and selfie verification images. This data is handled with the highest level of security and is processed only for identity verification purposes.

3.3 Financial Transaction Data

We collect records of all deposits and withdrawals processed through your account, including the payment method used (e.g., BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja), transaction amounts in Indonesian Rupiah (IDR / Rp), timestamps, and transaction reference numbers. We do not store full bank account numbers or e-wallet PINs.

3.4 Gaming & Betting Activity Data

We maintain a complete record of your betting and gaming history on the Platform, including game types played, bet amounts, outcomes, bonus usage, and session durations. This data is used for account management, dispute resolution, responsible gaming monitoring, and — where you have consented — personalized promotions.

3.5 Technical & Device Data

We automatically collect certain technical information when you access the Platform, including your IP address, browser type and version, operating system, device identifiers, screen resolution, and session timestamps. This data is used for security monitoring, fraud prevention, and platform optimization.

3.6 Communications Data

When you contact km226 via email or live chat, we retain records of those communications, including the content of your messages and our responses. This allows us to maintain continuity of support and to resolve any disputes that may arise.

4.How We Collect Personal Data

km226 collects Personal Data through the following channels:

• Directly from you — through account registration forms, KYC document uploads, deposit and withdrawal requests, support correspondence, and any surveys or feedback forms you voluntarily complete;
• Automatically — via server logs, cookies, and similar technologies that record your interactions with the Platform (see Section 9 for full cookie details);
• From payment service providers — our bank and e-wallet partners share confirmation data (transaction reference, amount, and sender account identifier) to validate your deposit and withdrawal requests;
• From fraud prevention and identity verification services — we may use licensed third-party services to cross-reference identity documents and detect fraudulent patterns.

5.Purpose & Legal Basis for Processing

5.1 km226 processes Personal Data only where a lawful basis exists. The table below summarizes our primary processing activities, their purposes, and the legal grounds on which we rely:

Data Processing Activity	Purpose	Legal Basis
Account registration and login management	To establish and maintain your account, authenticate your identity, and provide access to platform services	Contract performance — necessary to provide the services you have requested
KYC and identity verification	To verify your age (21+ requirement), confirm your identity, and comply with AML/CTF regulations	Legal obligation — required by anti-money laundering and gaming license compliance standards
Processing deposits and withdrawals	To credit funds to your account and process requested withdrawals to your registered payment method	Contract performance — necessary to fulfill your deposit and withdrawal requests
Gaming history and betting records	To settle bets, maintain transaction integrity, resolve disputes, and monitor for responsible gaming concerns	Contract performance and legal obligation — necessary to operate the gaming service and meet regulatory requirements
Security monitoring and fraud prevention	To detect unusual activity, prevent bonus abuse, identify multi-accounting, and protect the platform from fraud	Legitimate interest — necessary to protect the integrity of the platform and the interests of all Members
Customer support communications	To respond to inquiries, resolve technical issues, and provide assistance with account management	Contract performance and legitimate interest — necessary to provide support and maintain service quality
Marketing communications (email, SMS)	To send promotional offers, bonus announcements, and personalized gaming recommendations	Consent — only where you have explicitly opted in to receive marketing communications
Platform analytics and performance optimization	To analyze aggregate usage patterns, optimize site performance, and improve user experience	Legitimate interest — necessary to maintain and improve platform quality

5.2 Where we rely on Consent as the legal basis for processing your data (specifically, for marketing communications), you have the absolute right to withdraw that consent at any time without affecting the lawfulness of processing that occurred before withdrawal. To withdraw consent, contact support at [email protected] or use the unsubscribe link in any marketing email.

6.When We Share Personal Data

6.1 km226 does not sell, rent, or trade your Personal Data to third parties for marketing purposes. However, we do share data with trusted third-party service providers in the following circumstances:

6.1 Payment Service Providers

We share transaction details with banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) to process deposits and withdrawals. These providers are bound by their own privacy policies and applicable Indonesian banking regulations.

6.2 Game Studio Partners

Third-party game content providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft) receive minimal pseudonymized data (player ID, bet amount, game outcome) to operate their games and calculate payouts. These studios process data under strict data processing agreements.

6.3 Identity Verification Services

Licensed KYC verification services may receive copies of your identity documents to validate authenticity and detect fraudulent submissions. These services are contractually required to delete your documents immediately after verification is complete.

6.4 Legal and Regulatory Authorities

km226 may disclose Personal Data to law enforcement, tax authorities, regulatory bodies, or courts where required by law, by court order, or where necessary to protect the legal rights of km226 or third parties. Such disclosures are made only to the extent legally required.

6.2 All third-party data processors engaged by km226 are selected based on their data protection standards and are bound by formal data processing agreements that require them to protect your Personal Data to the same standard km226 applies internally.

7.Data Retention Periods

7.1 km226 retains Personal Data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable legal obligations. Our standard retention periods are as follows:

• Account and profile data: Retained while your account is active, plus 7 years following voluntary account closure to comply with AML and tax record-keeping requirements.
• KYC documents: Retained for 7 years following account closure, as required by anti-money laundering regulations in most jurisdictions.
• Financial transaction records: Retained for 7 years following the transaction date for tax, audit, and regulatory compliance purposes.
• Betting and gaming history: Retained for 5 years following the bet settlement date to support dispute resolution and responsible gaming monitoring.
• Support correspondence: Retained for 3 years following the last interaction to maintain continuity of service and resolve any delayed disputes.
• Technical logs and IP addresses: Retained for 90 days unless longer retention is required for an active fraud investigation or legal proceeding.
• Marketing consent records: Retained indefinitely or until you withdraw consent, to demonstrate compliance with consent-based marketing regulations.

7.2 At the end of the applicable retention period, Personal Data is securely deleted or anonymized such that it can no longer identify you as an individual.

8.Your Data Protection Rights

8.1 As a data subject, you have the following rights in relation to your Personal Data held by km226:

8.2 To exercise any of these rights, contact km226 Data Protection at [email protected] with the subject line "Data Subject Rights Request". We will respond within 30 days. Verification of your identity will be required before any access or deletion request is fulfilled.

8.3 You also have the right to lodge a complaint with a data protection supervisory authority if you believe km226 has not handled your Personal Data in compliance with applicable data protection laws.

9.Cookies & Similar Technologies

9.1 km226 uses cookies — small text files stored on your device — to enable core platform functionality and to analyze site usage patterns. Cookies help us recognize your device, maintain your login session, and understand how Members interact with the Platform.

9.2 The types of cookies we use include:

• Essential Cookies: Required for the Platform to function. These include session cookies that authenticate your login and remember your language preference. You cannot opt out of essential cookies without losing access to the Platform.
• Performance Cookies: Collect aggregate information about how Members use the site (e.g., most-visited pages, error messages encountered). This data is anonymized and used solely to improve platform performance and user experience.
• Security Cookies: Help detect unusual account activity, multiple login attempts, and potential fraud patterns. These cookies are integral to our fraud prevention systems.

9.3 km226 does not use third-party advertising cookies or tracking pixels that follow you across other websites. The only third-party cookies present are those strictly necessary for game content delivery from our licensed studio partners (Pragmatic Play, Evolution Gaming, etc.).

9.4 You can configure your browser to refuse all cookies or to alert you when a cookie is being set. Note that disabling cookies will impair your ability to use many features of the Platform, including logging in and playing games.

10.Security Measures

10.1 km226 employs industry-standard technical and organizational measures to protect Personal Data against unauthorized access, disclosure, alteration, and destruction. Our security framework includes:

• 256-bit SSL/TLS encryption for all data in transit between your device and our servers;
• AES-256 encryption for Personal Data at rest in our databases;
• Role-based access controls ensuring that only authorized personnel can access Personal Data, and only to the extent necessary for their job function;
• Multi-factor authentication for all administrative and support staff accounts;
• Automated monitoring systems that detect and alert on suspicious account activity, unusual login patterns, and potential data breaches;
• Regular third-party security audits and penetration testing to identify and remediate vulnerabilities;
• Secure, geographically distributed data centers with physical access controls and 24/7 surveillance.

10.2 While km226 implements robust security measures, no system is entirely impervious to attack. In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected Members within 72 hours of becoming aware of the breach and will provide clear guidance on protective measures you should take.

11.Protection of Minors

11.1 km226 operates a strict 21+ policy. We do not knowingly collect Personal Data from individuals under the age of 21. Our KYC verification process is designed to prevent minors from accessing the Platform.

11.2 If we become aware that a Member is under 21 years of age, we will immediately suspend the account, forfeit all balances, and delete all Personal Data associated with that account, except where retention is required for legal or regulatory purposes.

11.3 Parents or guardians who believe a minor has accessed the Platform should contact [email protected] immediately. We take all reports seriously and will investigate and act swiftly.

12.Third-Party Websites & Services

12.1 The km226 Platform may contain links to third-party websites or services for informational purposes (e.g., payment provider help pages, responsible gaming resources). km226 is not responsible for the privacy practices of these external sites.

12.2 When you leave the km226 Platform by clicking an external link, you are subject to the privacy policy of the destination site. We recommend reviewing the privacy policy of any third-party service before providing your Personal Data.

13.International Data Transfers

13.1 km226 primarily stores Personal Data in secure data centers located within jurisdictions that provide adequate data protection standards. However, some of our third-party service providers (particularly game studios and payment processors) may be based outside Indonesia.

13.2 Where Personal Data is transferred internationally, km226 ensures that such transfers are protected by appropriate safeguards, including Standard Contractual Clauses approved by data protection authorities, or by transferring data only to countries recognized as providing adequate protection.

13.3 You have the right to request details of the safeguards in place for any specific international transfer of your Personal Data by contacting [email protected].

14.Amendments to This Policy

14.1 km226 may update this Privacy Policy from time to time to reflect changes in our data processing practices, new legal requirements, or enhancements to our security infrastructure. When material changes are made, we will notify active Members via the email address registered to their account at least 14 days before the changes take effect.

14.2 The "Last Updated" date at the top of this Policy indicates when the most recent changes were published. Your continued use of the Platform following notification of changes constitutes your acceptance of the updated Policy.

14.3 We encourage you to review this Policy periodically to stay informed about how km226 is protecting your Personal Data.

15.Contact Information

15.1 If you have any questions, concerns, or requests regarding this Privacy Policy or how km226 processes your Personal Data, please contact our Data Protection team:

15.2 For formal data subject rights requests (access, rectification, erasure, portability), please include "Data Subject Rights Request" in the email subject line and provide sufficient information to verify your identity. We will acknowledge receipt within 2 business days and provide a full response within 30 days.