Privacy Policy

For the purposes of this Privacy Policy, the following terms carry the meanings defined below:

• "Personal Data" means any information that identifies or can reasonably be used to identify a natural person, either directly (e.g., full name, national ID number) or indirectly (e.g., IP address, device identifier combined with other data).
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, alteration, or deletion.
• "Data Controller" means gm199, the entity that determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Processor" means any third-party service provider that processes Personal Data on gm199's behalf and under gm199's documented instructions (e.g., payment processors, KYC verification services).
• "Player" means a natural person who has completed registration and holds an active Account on gm199.
• "Visitor" means any natural person who accesses publicly available areas of gm199 without holding a registered Account.
• "KYC Data" means identity verification documents and related information collected to confirm a Player's identity, age, and residential address, including national identity documents, passport copies, and proof-of-address records.
• "Cookies" means small text files placed on a user's device by the Platform to enable functionality, analyze usage patterns, and deliver a personalized experience.

gm199 collects the following categories of Personal Data from Players and Visitors. In each case, collection is limited to what is necessary for the stated purpose.

gm199 collects Personal Data through the following channels and mechanisms:

• Direct Provision by You: When you register an Account, complete KYC verification, make a deposit or withdrawal request, contact customer support, or update your Account settings, you directly provide us with Personal Data.
• Automated Technical Collection: When you access the Platform, our servers and analytics tools automatically record Technical Data and Usage Data as described in Section 02. This collection occurs through server logs, cookies, and similar tracking technologies detailed in Section 09.
• Payment and Banking Partners: When you initiate a transaction via local Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, BSI) or e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja), our payment processing partners share transaction confirmation data — including the sending account name and transaction reference — with gm199 for the purpose of crediting your Account and maintaining accurate financial records.
• Third-Party KYC Providers: gm199 may use accredited third-party identity verification services to cross-reference identity documents against official databases. These providers supply verification results (pass/fail/flag) to gm199 but do not retain your KYC documents on gm199's behalf beyond their contracted processing period.
• Publicly Available Sources: In limited circumstances where fraud prevention or AML compliance requires it, gm199 may reference publicly available information — such as published sanctions lists or adverse media databases — to assess the risk profile associated with a Player's Account.

gm199 uses collected Personal Data exclusively for the following stated purposes. We do not use your data in ways that are incompatible with the purposes for which it was originally collected.

• Account Management: To create, maintain, and administer your Player Account, including processing login credentials and managing Account settings.
• Identity Verification (KYC): To confirm that you meet the eligibility requirements set out in our Terms & Conditions — specifically that you are a resident of Indonesia and at least 21 years of age — and to comply with internationally recognized anti-money laundering standards.
• Payment Processing: To process your deposit and withdrawal requests through Indonesian banking channels and e-wallet integrations, and to maintain accurate transaction records in your Account history.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, multi-accounting, bonus abuse, money laundering, and unauthorized access to the Platform.
• Customer Support: To respond to your queries, resolve disputes, handle complaints, and provide assistance regarding your Account, transactions, or gameplay.
• Platform Improvement: To analyze anonymized or aggregated Usage Data to improve Platform performance, identify popular features, fix technical issues, and optimize the user experience for Indonesian players.
• Personalization: To tailor the gaming experience, display relevant promotions (e.g., localized offers during Idul Fitri, Ramadhan, or BRI Liga 1 season peaks), and recommend games or betting markets based on your activity history.
• Marketing Communications: To send promotional emails, SMS messages, or in-Platform notifications about bonuses, new game launches, and special events — but only where you have explicitly opted in to receive such communications.
• Legal and Regulatory Compliance: To fulfill gm199's obligations under applicable international anti-money laundering regulations, to respond to lawful requests from competent authorities, and to enforce our Terms & Conditions.
• Responsible Gaming: To monitor gameplay patterns that may indicate problem gambling behavior and, where appropriate, to proactively reach out to Players or apply protective account restrictions in accordance with our Responsible Gaming policy.

gm199 processes your Personal Data on the following legal grounds, consistent with internationally recognized data protection principles:

• Contractual Necessity: Processing that is necessary to perform the contract between you and gm199 — specifically, to provide you with access to the Platform, manage your Account, and process your financial transactions. Without this processing, gm199 cannot provide its services.
• Legal Obligation: Processing required to comply with applicable legal and regulatory requirements, including KYC identity verification and AML transaction monitoring.
• Legitimate Interests: Processing carried out in gm199's legitimate business interests — such as fraud detection, platform security, internal analytics, and service improvement — where those interests are not overridden by your privacy rights.
• Consent: Processing of Personal Data for marketing communications and non-essential cookies, which occurs only where you have provided clear, informed, and freely given consent. Consent may be withdrawn at any time without affecting the legality of prior processing.

gm199 does not sell, rent, or trade your Personal Data. We share data with third parties only in the limited circumstances described below, and only to the extent necessary for the stated purpose.

• Payment Processors and Banking Partners: We share transaction-relevant data (your name, account number, transaction amount in IDR) with Indonesian bank partners (BCA, BRI, BNI, Mandiri, and others) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) solely to execute deposit and withdrawal instructions. These partners process data under their own published privacy policies and applicable Indonesian financial regulations.
• KYC Verification Providers: Accredited identity verification services receive KYC documents on gm199's behalf for the purpose of confirming Player identity. These providers are contractually bound to process data solely for verification purposes, to maintain confidentiality, and to adhere to data protection standards equivalent to those applied by gm199.
• Game Software Providers: Game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft receive minimal technical identifiers (anonymized player session tokens) to deliver game content. These studios do not receive your full identity or financial data.
• IT Infrastructure and Cloud Providers: gm199 uses trusted technology partners for server hosting, content delivery, and database management. These Data Processors operate under contractual data processing agreements and are authorized to process data only as instructed by gm199.
• Law Enforcement and Regulatory Authorities: gm199 will disclose Personal Data to competent authorities — including law enforcement agencies and financial intelligence units — where required by a lawful court order, regulatory demand, or other legally binding obligation. Where permissible, gm199 will notify the affected Player of such disclosure.
• Business Transfers: In the event of a merger, acquisition, asset sale, or corporate restructuring involving gm199, Player data may be transferred to the acquiring entity, subject to the same or equivalent privacy protections described in this Policy. Players will be notified of any material change in data controller identity.

gm199 retains Personal Data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply:

• Active Account Data: Identity, contact, financial, and KYC data is retained for the full duration of your Account's active status and for a minimum of 5 years following Account closure. This retention period reflects standard international AML compliance expectations.
• Transaction Records: Deposit and withdrawal records, bet history, and account balance statements are retained for a minimum of 5 years from the date of each transaction, to support dispute resolution, regulatory audits, and financial record integrity.
• Customer Support Records: Live chat transcripts and email correspondence related to support cases are retained for 2 years from the date of the most recent interaction in that case thread.
• Technical and Usage Data: Server logs and analytics data are retained in identifiable form for up to 12 months. After this period, data is either deleted or permanently anonymized for aggregated statistical use.
• Marketing Data: Marketing preference records and communication history are retained for the duration of your opted-in status plus 12 months following an opt-out, to suppress future communications and demonstrate compliance with your preference.

Upon expiry of the applicable retention period, Personal Data is securely deleted or rendered permanently anonymous using industry-standard irreversible data destruction methods. Players may request early deletion of non-legally-mandated data by submitting a written request to our support team, subject to the conditions outlined in Section 10.

gm199 implements a layered, defense-in-depth approach to data security. Our technical and organizational security measures include the following:

• Encryption in Transit: All data exchanged between your device and the gm199 Platform is encrypted using TLS 1.3 (Transport Layer Security). The Platform enforces HTTPS on all pages; unencrypted HTTP connections are automatically redirected.
• Encryption at Rest: Sensitive stored data — including KYC documents, financial records, and authentication credentials — is encrypted at rest using AES-256 encryption on secured database infrastructure.
• Access Controls: Internal access to Personal Data is strictly limited on a need-to-know basis. Staff members are granted the minimum level of data access required to perform their specific job functions. All internal access is logged and periodically audited.
• Password Security: Player passwords are stored exclusively as salted cryptographic hashes using bcrypt. gm199 never stores passwords in plain text. Players are encouraged to use unique, strong passwords and to enable two-factor authentication (2FA) where available.
• Fraud and Intrusion Detection: gm199 operates real-time automated systems that monitor for anomalous access patterns, unauthorized login attempts, and suspicious transaction behavior. Detected anomalies trigger automatic protective responses and internal security alerts.
• Vulnerability Management: The Platform undergoes periodic security assessments conducted by independent security professionals. Critical vulnerabilities are remediated on a priority basis. gm199 maintains a responsible disclosure framework for security researchers.
• Incident Response: In the event of a data breach that is likely to affect your rights and interests, gm199 will notify affected Players without undue delay, providing a clear description of what occurred, what data was involved, and what remedial steps gm199 has taken and is taking.

gm199 uses cookies and similar tracking technologies to operate the Platform, analyze usage, and — where you have consented — deliver a personalized experience. The categories of cookies used by gm199 are as follows:

• Strictly Necessary Cookies: These cookies are essential to the functioning of the Platform. They enable core features such as maintaining your logged-in session, remembering items in your bet slip, and applying your security preferences. These cookies cannot be disabled without materially impairing Platform functionality.
• Functional Cookies: These cookies remember your preferences — such as your preferred language, game display settings, and notification preferences — to provide a more consistent experience across visits.
• Analytics Cookies: With your consent, gm199 uses analytics tools to collect anonymized data about how Visitors and Players interact with the Platform. This data helps us identify popular content, diagnose performance issues, and improve navigation. Analytics data is aggregated and does not identify individual users.
• Security Cookies: Certain cookies support our fraud detection and Account security systems, including session integrity verification and detection of concurrent sessions from different geographic locations.

gm199 does not use third-party advertising or retargeting cookies. We do not participate in cross-site tracking networks or allow advertising partners to place cookies on gm199 pages.

You may manage cookie preferences through your browser settings. Most modern browsers allow you to view, block, or delete cookies on a per-site or per-category basis. Please note that disabling strictly necessary cookies will prevent you from logging in and using core Platform features.

As a Player or Visitor whose Personal Data is processed by gm199, you hold the following rights. gm199 will respond to all valid rights requests within 30 days of receipt.

To exercise any of the above rights, please submit a written request to [email protected] with the subject line "Privacy Rights Request". Include your registered email address and Account username so we can locate your records. We may request additional identity verification before processing rights requests to ensure we do not disclose or delete data belonging to another individual.

gm199 is an adults-only (21+) platform. We do not knowingly collect Personal Data from individuals under the age of 21. Age verification is a mandatory step in the KYC process, and gm199 employs both automated checks and manual document review to confirm that all registered Players meet the minimum age requirement.

If gm199 discovers or reasonably suspects that a Player is under 21 years of age, it will:

• Immediately suspend the Account and halt all pending transactions.
• Void all bets, bonuses, and winnings associated with the Account.
• Securely delete all Personal Data collected in connection with the underage Account, to the extent not required for legal reporting purposes.
• Return any net real-money deposit balance (after deducting voided winnings) via the original deposit method if the depositing individual can demonstrate they are a legal guardian of the minor and the funds originated from their own account.

If you are aware that a person under 21 years of age has registered on gm199 or is attempting to access the Platform, please contact us immediately at [email protected]. gm199 treats such reports with the utmost seriousness and will act on them without delay.

The gm199 Platform integrates third-party services — including game studios, payment gateways, and analytics tools — that may independently process certain data as part of delivering their services. gm199 selects third-party partners carefully and requires them to maintain data protection standards consistent with this Privacy Policy.

Key third-party integrations and their data implications are as follows:

• Game Studios: Providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft receive anonymized session tokens to deliver certified game content. Full identity data is never shared with game studios.
• Payment Gateways: Indonesian bank transfer facilitators and e-wallet integrations (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the financial data necessary to complete your requested transactions. These partners are regulated financial institutions subject to Bank Indonesia oversight and applicable financial privacy regulations.
• Customer Support Platform: Our live chat infrastructure provider processes chat message content for the purpose of delivering support. Chat data is retained as described in Section 07 and is not used by the support platform provider for its own commercial purposes.

gm199 is not responsible for the privacy practices of any third-party websites, applications, or services that are not operated by gm199, even if they are referenced in content on the Platform. We encourage you to review the privacy policies of any third-party services you use independently.

gm199 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we offer. When material changes are made, gm199 will notify active Players via the email address registered on their Account, and will update the "Last Updated" date displayed at the top of this page.

Your continued use of the gm199 Platform following the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the changes, you should cease using the Platform and request Account closure before the revised Policy takes effect.

We recommend bookmarking this page and reviewing it periodically — at minimum once every three months if you are an active Player. All previous versions of this Privacy Policy are archived and available upon written request to our support team.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way gm199 handles your Personal Data, please reach out to our team through the following channels:

• Email: [email protected] — for all formal privacy rights requests, data access queries, deletion requests, and policy clarification inquiries. Please use the subject line "Privacy Rights Request" for rights-related correspondence so your message is routed to the correct team.
• Live Chat: Available 24 hours a day, 7 days a week via the chat widget on this Platform — for general questions about this Policy or for guidance on how to submit a formal privacy request.
• Response Time: Privacy rights requests submitted by email are acknowledged within 24 hours (WIB) and receive a substantive response within 30 days. Complex requests involving large volumes of data or legal review may take up to 60 days; you will be informed if an extension is required.

gm199 takes all privacy inquiries seriously. Our support team includes staff with specific training on data privacy matters who are equipped to handle your request professionally and confidentially. Indonesian-speaking agents are available 24/7 should you prefer to communicate in Bahasa Indonesia when discussing your privacy concerns, even though this Policy and the Platform are maintained in English.

For matters relating to responsible gaming, self-exclusion, or problem gambling, please visit our Responsible Gaming page for dedicated guidance and support resources.