Privacy Policy

km555 operates Indonesia's premier online betting and casino platform at https://km555.bio, offering sportsbook, live casino, slots, togel (Indonesia's traditional numbers lottery), esports, and keno products to adult players aged 21 and over. km555 is licensed and incorporated internationally and takes its obligations as a data controller seriously.

This Privacy Policy describes in clear, plain English how km555 collects, uses, stores, shares, and protects personal data in connection with the operation of the platform. It also describes the rights available to you as a data subject and how you can exercise those rights.

This Policy should be read alongside our Terms & Conditions and our Responsible Gaming policy, both of which form part of the contractual agreement between you and km555 when you register an account.

If you have any questions about this Policy or about how km555 handles your personal data, please contact us at [email protected] before using the platform.

The following definitions apply throughout this Privacy Policy:

"Personal Data"

Any information relating to an identified or identifiable natural person — including name, date of birth, residential address, email address, mobile number, payment details, IP address, and device identifiers.

"Processing"

Any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.

"Data Controller"

km555, the entity that determines the purposes and means of processing your Personal Data.

"Data Processor"

A third party that processes Personal Data on behalf of km555 under a contractual obligation, such as a KYC verification provider or payment gateway.

"User" / "You"

Any individual who accesses, registers on, or uses the km555 platform.

"Platform"

The km555 website at https://km555.bio and all associated services and products accessible through that domain.

"KYC"

Know Your Customer — the identity and age verification process required to confirm a user's identity, age, and residency before certain account functions are enabled.

"Cookie"

A small text file stored on your device by a web browser, used to recognize returning users, maintain session states, and collect anonymous usage analytics.

km555 collects Personal Data through several channels. The categories of data collected and the circumstances in which they are collected are described below:

3.1 Registration Data. When you create a km555 account, we collect your full legal name, date of birth, residential address in Indonesia, email address, and mobile number. This information is required to create and maintain your account and to conduct age and identity verification.

3.2 KYC Documentation. To comply with our anti-money-laundering obligations and international licensing requirements, we may request a government-issued photo ID (Indonesian KTP, passport, or SIM), a proof-of-address document, and a selfie or video verification in certain circumstances. These documents contain sensitive personal data and are handled with enhanced security controls.

3.3 Financial Data. We collect information about the payment methods you use to deposit and withdraw funds, including bank account names, bank account numbers associated with BCA, BRI, BNI, Mandiri, CIMB Niaga, or Bank Permata, e-wallet IDs for OVO, DANA, GoPay, ShopeePay, and LinkAja, and cryptocurrency wallet addresses for USDT, BTC, and ETH transactions. We do not store full card numbers for card payments; card data is processed directly by our PCI-DSS-compliant payment partners.

3.4 Transactional Data. We maintain records of all deposits, withdrawals, bets placed, games played, bonuses claimed, and wagering activity on your account. These records are required for account management, dispute resolution, and regulatory compliance.

3.5 Technical Data. We automatically collect certain technical information when you use the Platform, including your IP address, browser type and version, operating system, device type, screen resolution, session timestamps, pages visited, and click-path data. This data is used for security monitoring, fraud detection, and platform performance optimization.

3.6 Communications Data. We retain records of communications between you and km555 support — including live chat transcripts, emails, and any documents or screenshots shared during a support interaction — for quality assurance, dispute resolution, and regulatory audit purposes.

3.7 Voluntary Data. Any additional personal information you voluntarily provide — such as profile display preferences or self-assessment responses submitted through our Responsible Gaming tools — is collected and processed as described at the point of collection.

km555 uses the Personal Data we collect for the following purposes:

km555 processes your Personal Data on the following legal bases, consistent with the data protection framework of the jurisdiction in which we are licensed:

1. Contractual Necessity: Processing is required to perform the contract between you and km555 — specifically, to create and manage your account, process bets, handle deposits and withdrawals, and deliver the products and services you have requested.
2. Legal Obligation: Processing is required to comply with applicable laws and regulations, including anti-money-laundering (AML) legislation, counter-terrorism financing (CTF) obligations, international gaming licensing requirements, and tax reporting duties.
3. Legitimate Interests: Processing is necessary for km555's legitimate business interests, including fraud detection and prevention, platform security, responsible gaming monitoring, and improving service quality — provided those interests are not overridden by your fundamental rights and freedoms.
4. Consent: Where we rely on consent — specifically for sending direct marketing communications — we will always obtain your explicit opt-in consent before doing so, and you may withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

km555 does not sell, rent, or trade your Personal Data. We share your data only in the circumstances described below, and only to the extent necessary for the stated purpose:

6.1 KYC and Identity Verification Partners. We use licensed, internationally certified third-party KYC providers to verify your identity and age. These providers receive only the data required for verification and are contractually prohibited from using that data for any other purpose.

6.2 Payment Processors. To facilitate IDR deposits and withdrawals via BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, OVO, DANA, GoPay, ShopeePay, and LinkAja, and cryptocurrency transactions via USDT, BTC, and ETH gateways, we share the minimum necessary financial data with our certified payment processing partners. All payment partners operate under PCI-DSS or equivalent security standards.

6.3 Fraud Prevention and Security Services. We may share technical data and transactional patterns with third-party fraud detection services to identify suspicious activity, protect the integrity of the Platform, and safeguard other users.

6.4 Gaming Platform Providers. Some games on the km555 Platform are provided by third-party studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft. These providers may receive a session token and anonymized player ID to facilitate game delivery; they do not receive your full registration or financial data.

6.5 Regulatory and Law Enforcement Authorities. km555 may disclose Personal Data to gaming regulators, law enforcement agencies, tax authorities, or other government bodies where required to do so by applicable law, court order, or regulatory directive. In such cases, km555 will disclose only the minimum data required and, where legally permitted, will notify you of the disclosure.

6.6 Corporate Transactions. In the event of a merger, acquisition, restructuring, or sale of assets involving km555, your Personal Data may be transferred to the acquiring entity as part of the transaction, subject to confidentiality obligations and the continuing protections described in this Policy.

km555 uses cookies and similar tracking technologies to operate the Platform effectively and securely. We do not use cross-site tracking cookies or third-party behavioral advertising cookies.

7.1 Essential Cookies. These cookies are strictly necessary to operate the Platform. They enable session authentication, maintain your login state, and protect against cross-site request forgery (CSRF) attacks. The Platform cannot function correctly without these cookies, and they cannot be disabled.

7.2 Performance and Analytics Cookies. We use first-party analytics cookies to understand how users navigate the Platform — which pages are visited most frequently, where users encounter errors, and how platform performance varies across devices and connection speeds. This data is collected in aggregate and does not identify individual users. We do not use Google Analytics or similar third-party analytics services that transmit data to external servers.

7.3 Functional Cookies. These cookies remember your preferences — such as your preferred language, display settings, and recently viewed games — to personalize your experience on return visits.

7.4 Security Cookies. These cookies support our fraud detection systems by detecting unusual login patterns, flagging activity from unexpected geographic locations, and helping identify account-sharing or bot activity.

7.5 Managing Cookies. You can manage or delete cookies at any time through your browser settings. Please note that disabling essential cookies will prevent you from logging in to the Platform or using core features. Disabling performance or functional cookies will not affect your ability to place bets or access games but may reduce the quality of your experience.

km555 retains Personal Data for the minimum period required to fulfill the purposes for which it was collected and to comply with our legal obligations. The following retention periods apply:

After the applicable retention period expires, km555 will securely delete or irreversibly anonymize your Personal Data. Where anonymization is used, the resulting data is no longer considered Personal Data and may be retained indefinitely for aggregate statistical analysis.

km555 implements a layered security architecture to protect Personal Data against unauthorized access, disclosure, alteration, and destruction. Our security measures include:

• Transport Layer Security: All data transmitted between your device and km555 servers uses TLS 1.3 with 256-bit AES encryption. HTTP connections are automatically redirected to HTTPS.
• Encryption at Rest: Sensitive data stored on km555 servers — including KYC documents, financial records, and account credentials — is encrypted using AES-256 encryption at rest.
• Access Controls: Access to production systems and Personal Data is restricted to authorized km555 personnel on a strict need-to-know basis. All access is logged, monitored, and subject to regular review.
• Two-Factor Authentication: km555 offers two-factor authentication (2FA) for all user accounts and enforces 2FA for all internal administrative access to systems holding Personal Data.
• Penetration Testing: km555 engages independent security professionals to conduct regular penetration tests and vulnerability assessments of the Platform and its infrastructure.
• Incident Response: km555 maintains a documented data breach response procedure. In the event of a confirmed breach affecting your Personal Data, we will notify affected users and relevant regulatory authorities within the timeframes required by applicable law.
• Staff Training: All km555 staff with access to Personal Data receive regular training on data protection obligations and information security best practices.

As a data subject, you have the following rights in relation to the Personal Data km555 holds about you. To exercise any of these rights, contact us at [email protected] with a clear description of your request. We will respond within 30 days.

1. Right of Access: You have the right to request a copy of all Personal Data km555 holds about you, along with information about how it is processed. km555 will provide this in a clear, structured format at no charge for the first request in any 12-month period.
2. Right to Rectification: If any Personal Data held by km555 is inaccurate or incomplete, you have the right to request that it be corrected. You may also update certain data directly through your account settings.
3. Right to Erasure ("Right to be Forgotten"): You have the right to request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected. This right is subject to km555's legal retention obligations — we cannot delete data that we are required to retain under AML or gaming regulations.
4. Right to Restriction of Processing: You have the right to request that km555 temporarily cease active processing of your Personal Data in certain circumstances — for example, while the accuracy of data is being contested, or where you have objected to processing based on legitimate interests.
5. Right to Data Portability: You have the right to receive the Personal Data you have provided to km555 in a structured, commonly used, machine-readable format (such as JSON or CSV) and to request that it be transmitted directly to another controller where technically feasible.
6. Right to Object: You have the right to object to processing of your Personal Data where km555 relies on legitimate interests as the legal basis. If you object, km555 will cease that processing unless there are compelling legitimate grounds that override your interests, rights, and freedoms.
7. Right to Withdraw Consent: Where processing is based on your consent (such as marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

The km555 Platform is strictly intended for adults aged 21 and over. km555 does not knowingly collect Personal Data from individuals under the age of 21. Registration by minors is prohibited under our Terms & Conditions and violates our licensing conditions.

If km555 becomes aware — through KYC review, age verification checks, or any other means — that Personal Data has been collected from a user who is under 21, that account will be immediately closed, any funds held will be dealt with in accordance with our regulatory obligations, and all associated Personal Data will be deleted as quickly as our legal retention obligations permit.

If you are a parent or guardian and believe that a minor in your care has registered an account on km555, please contact us immediately at [email protected] so that we can take appropriate action.

km555 is licensed and operates internationally. Your Personal Data may be transferred to and processed in countries outside of Indonesia where km555's servers, third-party processors, or regulatory bodies are located. Not all such countries have data protection laws equivalent to those in force in Indonesia.

Where Personal Data is transferred outside of Indonesia, km555 takes appropriate safeguards to ensure that the data continues to be protected to a standard consistent with this Privacy Policy. These safeguards include:

• Data processing agreements with all third-party processors that include binding data protection obligations and security requirements.
• Transfers to jurisdictions with adequate data protection frameworks as recognized by relevant regulatory bodies.
• Encryption of data in transit and at rest for all cross-border transfers.
• Contractual restrictions that limit the use of transferred data to the specific purpose for which it was shared.

By using the km555 Platform, you acknowledge that your Personal Data may be transferred internationally in the manner described in this section, subject to the safeguards outlined above.

km555 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or platform features. When we make material changes to this Policy, we will notify registered users via the email address associated with their account at least seven (7) days before the revised Policy takes effect, except where an immediate update is required by law.

The current version of this Privacy Policy will always be available at https://km555.bio/privacy-policy, with the effective date and last-updated date displayed at the top of the document. Your continued use of the Platform after the effective date of any amendment constitutes your acknowledgment of and agreement to the revised Policy.

We encourage you to review this Policy periodically, particularly before making new deposits or sharing additional personal information with km555.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way km555 processes your Personal Data, please reach out to our dedicated privacy support team through any of the following channels:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24/7 via the support widget on the km555 Platform
• Response Target: Privacy-related email queries within 24 hours WIB; live chat within 90 seconds
• Languages: English and Indonesian (native Indonesian-speaking agents available around the clock)

When submitting a data subject rights request by email, please include your full registered name, the email address associated with your km555 account, and a clear description of the request you are making. km555 may need to verify your identity before processing the request to protect your account security.