km787 Privacy Policy

The following terms carry the meanings set out below throughout this Privacy Policy:

• "km787", "we", "us", or "our" refers to the km787 platform and its operating entity, which administers the website at km787.ws.
• "Platform" means the km787 website, mobile site, all associated software and applications, and the full suite of services offered thereon — including the sportsbook, live casino, slot games, togel (Indonesia's traditional numbers lottery) desk, and related products.
• "Member" or "you" refers to any individual who registers for, or uses, an account on the km787 platform.
• "Personal Data" means any information relating to an identified or identifiable natural person — for example, your name, email address, mobile number, bank account details, IP address, or device identifier.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, erasure, or destruction.
• "Data Controller" means the entity that determines the purposes and means of Processing Personal Data — which is km787 in respect of data collected through the Platform.
• "Third Party" means any natural or legal person other than the Member and km787, including payment processors, fraud prevention services, and regulatory authorities.
• "WIB" refers to Western Indonesia Time (UTC+7), the default operational time zone of km787.

km787 acts as the Data Controller for all Personal Data collected from Members through the Platform. As Data Controller, km787 is responsible for determining how and why your data is processed, and for ensuring that such processing complies with applicable data protection principles.

If you have any questions about how km787 handles your Personal Data, or if you wish to exercise any of your data rights as described in Section 12 of this Policy, please contact our Data Protection team at the address set out in Section 16.

km787 collects Personal Data across the following categories:

3.1 Identity & Contact Data

• Full legal name as it appears on your government-issued photo ID.
• Date of birth (used to verify the 21+ age requirement).
• Residential address, including city (e.g., Jakarta, Surabaya, Bandung, Medan, Bali) and postal code.
• Active email address and Indonesian mobile phone number.

3.2 Account & Authentication Data

• Username and hashed password credentials.
• Two-factor authentication (2FA) tokens and session identifiers.
• Account registration date, timestamp, and IP address at registration.

3.3 Financial Data

• Bank account details for BCA, BRI, BNI, Mandiri, CIMB Niaga, or other Indonesian banks used for deposits and withdrawals.
• E-wallet identifiers for OVO, DANA, GoPay, ShopeePay, and LinkAja.
• Transaction history, including deposit amounts, withdrawal amounts, dates, and payment method used.
• Bonus claim history and wagering activity records.

3.4 Technical & Device Data

• IP address and approximate geolocation derived from it.
• Device type, operating system, browser type and version.
• Session duration, pages visited, and in-platform navigation patterns.
• Cookie identifiers and similar tracking technology data (see Section 10).

3.5 Identity Verification (KYC) Data

• Scanned or photographed copies of government-issued ID documents (KTP, SIM, passport).
• Selfie images submitted for liveness verification.
• Proof of payment method ownership documentation.

3.6 Communications Data

• Records of live chat conversations, support tickets, and email correspondence with the km787 support team.
• Feedback, survey responses, and promotional competition entries.

km787 collects Personal Data through the following channels:

• Direct submission: Data you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting customer support, or participating in a promotion.
• Automated collection: Technical and device data collected automatically when you access or interact with the Platform, including through cookies, web beacons, and server log files.
• Third-party sources: Identity verification and fraud screening data received from licensed KYC service providers; transaction data received from payment processors including Indonesian banks and e-wallet operators.
• Public sources: Publicly available records used to verify identity or investigate suspected fraudulent activity, where permitted by applicable law.

km787 processes your Personal Data for the following purposes:

km787 processes your Personal Data on one or more of the following legal bases:

• Contractual necessity: Processing required to perform the contract between you and km787 — including account management, transaction processing, and service delivery.
• Legal obligation: Processing required to comply with applicable anti-money laundering (AML), counter-terrorism financing (CTF), and Know Your Customer (KYC) obligations under the international regulatory frameworks governing km787's licence.
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and internal analytics — where such interests are not overridden by your fundamental privacy rights.
• Consent: Processing for direct marketing communications, where you have given clear and informed consent. You may withdraw marketing consent at any time by updating your communication preferences in Account Settings or by contacting support.

km787 retains Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy, or as required by applicable law. The following general retention guidelines apply:

• Active account data: Retained for the duration of your membership with km787 and for a period of five (5) years following permanent account closure, in compliance with AML record-keeping obligations.
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction.
• KYC documents: Retained for five (5) years following the end of the business relationship, or longer where required by regulatory direction.
• Support communications: Retained for two (2) years from the date of the last interaction, unless the conversation relates to a pending legal matter.
• Marketing data: Retained until you withdraw consent or request erasure, subject to the minimum retention periods above.

Upon expiry of the applicable retention period, Personal Data will be securely deleted or irreversibly anonymised.

km787 does not sell your Personal Data to any third party. We may share your data with the following categories of recipient, strictly on a need-to-know basis and subject to appropriate contractual safeguards:

• Payment processors: Indonesian banks (BCA, BRI, BNI, Mandiri) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja), solely to process deposits and withdrawals on your behalf.
• KYC and identity verification providers: Licensed third-party services that assist km787 in verifying the identity and age of Members.
• Fraud and AML screening services: Specialised providers that analyse transaction data to detect and prevent financial crime.
• Technology infrastructure providers: Cloud hosting, content delivery, and cybersecurity vendors who process data solely on km787's instructions under binding data processing agreements.
• Regulatory authorities and law enforcement: Where km787 is required by applicable law, court order, or regulatory directive to disclose Personal Data.
• Professional advisers: Lawyers, accountants, and auditors, subject to binding obligations of confidentiality.

km787 operates infrastructure that may involve the transfer of Personal Data to servers or service providers located outside Indonesia. Where such transfers occur, km787 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to the protections afforded under applicable Indonesian data protection principles, including:

• Binding contractual clauses with all data processors that receive Personal Data from km787.
• Restricting transfers to jurisdictions or service providers that maintain internationally recognised data security standards (such as ISO 27001 certification).
• Internal data transfer policies that limit the scope and volume of Personal Data transferred across borders to the strict minimum necessary.

km787 uses cookies and similar tracking technologies to operate the Platform effectively, remember your preferences, and understand how Members interact with our services. The following cookie categories are in use:

You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair your ability to log in and use core Platform features.

km787 implements a multi-layered security framework to protect your Personal Data against unauthorised access, alteration, disclosure, or destruction:

• 256-bit SSL/TLS encryption on all data transmitted between your device and the km787 Platform.
• AES-256 encryption at rest for stored sensitive data including financial records and KYC documents.
• Role-based access controls ensuring that km787 staff can only access Personal Data necessary for their specific job function.
• Two-factor authentication (2FA) available to all Members and mandatory for km787 administrative accounts.
• Regular penetration testing conducted by independent cybersecurity specialists.
• 24/7 automated monitoring for anomalous login attempts, transaction patterns, and network intrusion indicators.

Despite these measures, no online platform can guarantee absolute security. In the event of a data breach that is likely to result in a risk to your rights, km787 will notify affected Members without undue delay and take all reasonable steps to contain and remediate the incident.

As a km787 Member, you hold the following rights in respect of your Personal Data. To exercise any of these rights, contact our Data Protection team using the details in Section 16. km787 will respond to all valid requests within 30 calendar days.

• Right of Access: You may request a copy of all Personal Data km787 holds about you, together with information about how it is being used.
• Right to Rectification: You may ask km787 to correct any inaccurate or incomplete Personal Data we hold about you.
• Right to Erasure: You may request deletion of your Personal Data where it is no longer necessary for the purpose it was collected, subject to km787's mandatory legal retention obligations (see Section 7).
• Right to Restriction: You may request that km787 limit the processing of your Personal Data in certain circumstances — for example, while a rectification request is being assessed.
• Right to Data Portability: Where processing is based on your consent or on a contract, you may request your Personal Data in a structured, machine-readable format.
• Right to Object: You may object at any time to the processing of your Personal Data for direct marketing purposes. You may also object to processing based on km787's legitimate interests, subject to km787 demonstrating overriding legitimate grounds.
• Right to Withdraw Consent: Where processing is based solely on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

The km787 Platform is strictly intended for adults aged 21 and above. km787 does not knowingly collect Personal Data from individuals under the age of 21. If we become aware that Personal Data has been submitted by a person under 21 — whether through misrepresentation of age at registration or any other means — we will promptly suspend the relevant account, delete the associated Personal Data, and return any deposited funds in accordance with our responsible gaming obligations.

Parents and guardians who believe their minor child may have created a km787 account are urged to contact us immediately at the address in Section 16 so that the matter can be resolved without delay.

The km787 Platform may, from time to time, contain links or references to third-party websites — for example, links to game studios such as Pragmatic Play, Evolution Gaming, NetEnt, or Microgaming for game-rule documentation. This Privacy Policy applies solely to data collected by km787 through the Platform. km787 is not responsible for the privacy practices or content of any third-party website. We encourage you to review the privacy policy of any external site you visit before submitting Personal Data to it.

km787 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform functionality. Where changes are material — for example, where we introduce a new category of data processing or a new category of third-party recipient — km787 will provide notice to Members via email or a prominent on-platform notification at least seven (7) calendar days before the amended Policy takes effect.

The "Last Updated" date at the top of this page will always reflect the most recent revision. Your continued use of the km787 Platform after the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. If you do not agree with the changes, you must close your account before they take effect.

If you have any questions about this Privacy Policy, wish to exercise a data right, or have a concern about how km787 has handled your Personal Data, please contact our Data Protection team through any of the following channels:

• Email: support@km787.ws — please include "Privacy Request" or "Data Rights" in the subject line for expedited routing.
• Live Chat: Available 24/7 directly from the km787 Platform. Identify yourself as submitting a privacy enquiry so the conversation is routed to the compliance team.
• Support Ticket: Submit a formal ticket through the Help Centre in your Member dashboard, selecting the "Privacy & Data" category.

km787 commits to acknowledging all privacy-related enquiries within 48 hours (WIB business hours) and resolving them within 30 calendar days. For complex requests requiring extended investigation, km787 will notify you within the initial 30-day period and provide a revised resolution timeline.