Privacy Policy — km378 Data Protection

km378, operating at km378.cam, is the data controller responsible for your personal information. This means we determine the purposes and means of processing your personal data and are accountable for its protection under applicable data protection laws.

For any questions, concerns, or requests related to your personal data, you may contact our Data Protection Officer at [email protected]. We aim to respond to all privacy-related enquiries within 5 business days.

km378 collects the following categories of personal information:

2.1 Account Registration Data

• Full legal name (as it appears on your Indonesian National ID or passport)
• Date of birth
• Email address
• Mobile telephone number (Indonesian number preferred)
• Residential address (city, province, postal code)
• Username and password (password is stored in hashed form and is never visible to km378 staff)

2.2 Identity Verification (KYC) Data

• Scanned or photographed copy of Indonesian National ID (KTP) or passport
• Proof of address document (utility bill, bank statement, government correspondence dated within the previous 90 days)
• Selfie photograph holding your ID document (for enhanced verification where required)
• Bank account or e-wallet account verification documents (e.g., bank book cover, OVO/DANA/GoPay account screenshot)

2.3 Financial Transaction Data

• Deposit and withdrawal transaction records, including amounts, dates, times, and payment methods used
• Account balance and transaction history
• Bonus claims and wagering activity

2.4 Gaming Activity Data

• Bet history, including bet types, stakes, odds, outcomes, and timestamps
• Game sessions, including start time, end time, and net win/loss
• Favourite games, preferred sports markets, and other usage preferences

2.5 Technical Data

• IP address, browser type, operating system, device type (desktop, mobile, tablet)
• Session duration, pages visited, referring URL, and clickstream data
• Cookies and similar tracking technologies (see Section 9 for details)

2.6 Customer Support Data

• Live chat transcripts, email correspondence, and support ticket content
• Any additional information you voluntarily provide when contacting our support team

km378 processes your personal data for the following purposes:

1. Account Management: To create, maintain, and manage your km378 account, including authentication and access control.
2. Identity Verification: To verify that you are at least 21 years of age, that you are a resident of Indonesia or an eligible jurisdiction, and that the payment methods you use are registered in your name. This is a regulatory requirement and helps prevent fraud and money laundering.
3. Transaction Processing: To process your deposits, withdrawals, and internal account transfers. We share transaction data with our payment service providers (banks, e-wallet operators) only to the extent necessary to complete the transaction.
4. Game Delivery: To provide access to sports betting markets, live casino games, slots, and other gaming products offered on km378. We share session data with our game studio partners (Pragmatic Play, Evolution Gaming, NetEnt, Pocket Games Soft, Microgaming) to deliver game content.
5. Customer Support: To respond to your enquiries, resolve account issues, and provide technical assistance.
6. Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, collusion, bonus abuse, money laundering, and other prohibited conduct. This includes monitoring for unusual betting patterns, duplicate accounts, and unauthorized access.
7. Responsible Gaming: To enforce deposit limits, self-exclusion periods, and session time reminders that you have requested, and to identify patterns of problem gambling behaviour where appropriate intervention may be needed.
8. Marketing and Promotions: To inform you of new games, bonus offers, VIP promotions, and platform updates. You may opt out of marketing communications at any time by adjusting your account settings or contacting [email protected].
9. Legal Compliance: To comply with applicable laws, regulations, court orders, and lawful requests from government authorities. This may include reporting suspicious transactions to financial intelligence units or responding to law enforcement enquiries.
10. Platform Improvement: To analyse usage patterns, identify technical issues, and improve the overall user experience on km378. This includes A/B testing of new features, performance monitoring, and user interface optimization.

km378 processes your personal data on the following legal grounds:

• Contractual Necessity: Processing is necessary to perform our contract with you (the Terms and Conditions). Without processing your data, we cannot provide you with access to km378 services.
• Legal Obligation: Processing is required to comply with legal obligations, including KYC/AML regulations, tax reporting, and responses to lawful government requests.
• Legitimate Interests: Processing is necessary for our legitimate business interests, such as fraud prevention, security monitoring, and platform improvement, provided that such interests are not overridden by your privacy rights.
• Consent: Where required by law, we obtain your explicit consent before processing certain categories of data, such as marketing communications or the use of non-essential cookies. You may withdraw consent at any time.

km378 does not sell, rent, or trade your personal data. We share your data only with the following categories of third parties, and only to the extent necessary to deliver our services:

All third-party service providers are bound by strict confidentiality obligations and are prohibited from using your data for any purpose other than providing services to km378. We conduct due diligence on all third parties to ensure they maintain adequate data security standards.

km378 retains your personal data for as long as necessary to fulfill the purposes outlined in this Privacy Policy, and to comply with our legal and regulatory obligations. Specific retention periods include:

• Account Data: Retained for the duration of your active account, plus 7 years after account closure (to comply with anti-money-laundering and tax reporting obligations).
• Transaction Records: Retained for 7 years after the transaction date (regulatory requirement).
• KYC Documents: Retained for 7 years after account closure or the last verification event (regulatory requirement).
• Marketing Consent Records: Retained until you withdraw consent, plus 2 years to demonstrate compliance with consent requirements.
• Customer Support Records: Retained for 3 years after the last interaction.
• Technical Logs: Retained for 90 days, except where longer retention is required for security investigations or legal proceedings.

After the applicable retention period expires, we securely delete or anonymize your data so that it can no longer be associated with you.

km378 employs industry-standard technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, alteration, or disclosure. Our security controls include:

• Encryption: All data transmitted between your device and km378 servers is encrypted using TLS 1.3 or higher. Personal data stored on our servers is encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data is restricted to authorised km378 personnel on a need-to-know basis. All staff with data access are bound by confidentiality obligations and undergo regular data protection training.
• Network Security: Our infrastructure is protected by firewalls, intrusion detection systems, and regular vulnerability scanning. We conduct annual third-party security audits to validate our controls.
• Password Security: User passwords are hashed using bcrypt with a high work factor. km378 staff cannot view your password at any time.
• Multi-Factor Authentication: We offer optional two-factor authentication (2FA) for account login. We strongly recommend enabling 2FA for enhanced account security.
• Incident Response: In the event of a data breach affecting your personal data, we will notify you and the relevant supervisory authority within 72 hours, as required by applicable data protection laws.

While we implement robust security measures, no system is completely invulnerable. You are responsible for safeguarding your login credentials and notifying us immediately if you suspect unauthorised access to your account.

Under applicable data protection laws, you have the following rights with respect to your personal data:

1. Right of Access: You may request a copy of all personal data we hold about you. We will provide this information in a structured, commonly used, and machine-readable format within 30 days of your request.
2. Right to Rectification: If any of your personal data is inaccurate or incomplete, you may request that we correct or update it. You can update most account information directly via your account settings page.
3. Right to Erasure (Right to be Forgotten): You may request that we delete your personal data where there is no compelling reason for its continued processing. Note that we may be required to retain certain data for legal or regulatory purposes even after you request deletion.
4. Right to Restrict Processing: You may request that we temporarily restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or object to our processing.
5. Right to Data Portability: You may request that we transfer your personal data to another service provider in a machine-readable format, where technically feasible.
6. Right to Object: You may object to our processing of your personal data for direct marketing purposes at any time. You may also object to processing based on legitimate interests, subject to our demonstration of compelling legitimate grounds.
7. Right to Withdraw Consent: Where we process your data based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted before withdrawal.
8. Right to Lodge a Complaint: If you believe we have violated your data protection rights, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction.

To exercise any of these rights, please contact our Data Protection Officer at [email protected]. We will respond to all requests within 30 days. We may request additional information to verify your identity before processing certain requests.

km378 uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device that help us recognise you, remember your preferences, and analyse how you use the site.

Types of Cookies We Use:

• Essential Cookies: Required for the website to function. These cookies enable core functionality such as account login, session management, and security features. You cannot opt out of essential cookies.
• Performance Cookies: Collect anonymous data on how visitors use km378, such as which pages are visited most often and where error messages occur. This helps us improve website performance and user experience.
• Functional Cookies: Remember your preferences, such as language selection, preferred odds format, and display settings.
• Marketing Cookies: Track your activity across websites to deliver personalised advertisements and measure the effectiveness of marketing campaigns. You can opt out of marketing cookies via your browser settings or our cookie consent banner.

Most web browsers allow you to control cookies through their settings. You can choose to block all cookies, accept only essential cookies, or receive a notification each time a cookie is set. Note that blocking essential cookies may prevent certain parts of km378 from functioning correctly.

For more information on managing cookies, visit your browser's help documentation or consult resources such as aboutcookies.org or allaboutcookies.org.

km378 is not intended for use by individuals under the age of 21. We do not knowingly collect personal data from anyone under 21 years of age. If we become aware that we have inadvertently collected data from a minor, we will take immediate steps to delete that information from our systems.

If you are a parent or guardian and believe your child has provided personal data to km378, please contact us immediately at [email protected] so we can address the matter.

km378 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or business operations. We will notify you of any material changes by posting a notice on the km378 homepage and sending an email to your registered email address at least 7 days before the updated policy takes effect.

The "Last Updated" date at the top of this document indicates when the policy was most recently revised. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data.

Your continued use of km378 after the effective date of any updated Privacy Policy constitutes your acceptance of the new terms.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Data Protection Officer:

• Email: [email protected]
• Live Chat: Available 24/7 via the km378 website
• Indonesian-Speaking Agents: On duty 08:00–24:00 WIB daily

We aim to respond to all privacy-related enquiries within 5 business days. For urgent data protection matters, please mark your message as "URGENT: Data Protection Request" in the subject line.