Privacy Policy — dm200m

In this Privacy Policy, the following terms carry the meanings defined below:

• "dm200m", "we", "us", "our" — the dm200m platform and its affiliated operating entities, accessible at https://dm200m.cam.
• "Personal Data" — any information that identifies, or could reasonably be used to identify, a specific natural person, including but not limited to: name, email address, date of birth, phone number, identification document details, IP address, and payment account information.
• "Processing" — any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.
• "Data Subject" — the individual to whom the Personal Data relates; in the context of dm200m, this is the registered Player.
• "KYC" — Know Your Customer; the identity and age-verification process conducted by dm200m.
• "Cookies" — small text files placed on your device by the dm200m platform to support session management, analytics, and personalisation.
• "Third-Party Processor" — an external service provider engaged by dm200m to process Personal Data on dm200m's behalf under a written data processing agreement.

dm200m acts as the Data Controller in respect of the Personal Data collected from Players using the platform. As Data Controller, dm200m determines the purposes and means of processing your Personal Data and is responsible for ensuring that processing is carried out lawfully, fairly, and transparently.

dm200m operates under an international gaming licence and processes Personal Data in accordance with applicable international data protection standards. Where dm200m engages Third-Party Processors (such as payment gateway providers or KYC verification services), those processors act under binding contractual obligations that restrict their use of your data to the specific purpose for which it was shared.

dm200m collects Personal Data in the following categories. The specific data points collected depend on the nature of your interaction with the platform:

dm200m collects your Personal Data through the following channels:

• Direct submission by you: when you complete the registration form, submit KYC documents, initiate a deposit or withdrawal, contact support, or respond to a promotional survey.
• Automated technical collection: when you visit or use the dm200m platform, our servers and analytics tools automatically collect Technical Data including IP address, device identifiers, browser type, and session behaviour data.
• Payment processors: when you deposit or withdraw funds via Indonesian bank transfer (BCA, BRI, BNI, Mandiri, CIMB Niaga) or e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja), our payment processing partners share transaction confirmation data with dm200m to credit or debit your account balance.
• KYC verification partners: where dm200m uses a third-party identity verification service to cross-check document authenticity, that service may return a verification result and confidence score to dm200m.
• Cookies and similar technologies: see Clause 9 for a full description of dm200m's cookie practices.

dm200m processes your Personal Data for the following purposes, each supported by a defined legal basis:

• Providing platform services (account management, bet settlement, payment processing, VIP programme administration): necessary for the performance of the contract between you and dm200m.
• Identity verification and KYC compliance (verifying your age, identity, and payment method ownership): necessary for compliance with legal obligations under applicable gaming and anti-money-laundering standards.
• Fraud prevention and security (detecting unauthorised account access, multi-accounting, bonus abuse, and suspicious transaction patterns): legitimate interest of dm200m in protecting the integrity of the platform and its players.
• Responsible gaming obligations (enforcing deposit limits, self-exclusion status, and age restrictions): necessary for compliance with legal obligations and legitimate interest in player welfare.
• Customer support (maintaining records of queries, complaints, and resolutions): legitimate interest in delivering effective support and resolving disputes fairly.
• Marketing communications (sending promotional offers, bonus notifications, and platform updates to opted-in players): consent — you may withdraw consent at any time by updating your communication preferences in account settings.
• Platform analytics and improvement (analysing aggregate usage patterns to improve product performance, page load times, and game library curation): legitimate interest in maintaining and improving the platform.

6.1 General Principle. dm200m does not sell, rent, or trade your Personal Data to third parties for their own commercial or marketing purposes. Data sharing is limited to what is necessary to operate the platform and meet legal obligations.

6.2 Categories of Recipients. dm200m may share your Personal Data with the following categories of recipients:

• Payment processors and banking partners: Indonesian bank partners (including BCA, BRI, BNI, Mandiri, and CIMB Niaga) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) receive transaction data necessary to process deposits and withdrawals.
• KYC and identity verification providers: Third-party verification services receive identity document data and return verification results. These providers operate under strict data processing agreements.
• Game content providers: Game studios such as Pragmatic Play, Evolution Gaming, Spribe, and Pocket Games Soft may receive a non-identifiable player session token to facilitate seamless game loading. No personally identifiable data is shared with game providers for their own use.
• IT and infrastructure providers: Cloud hosting, database management, and cybersecurity service providers who process data on dm200m's behalf under binding data processing agreements.
• Legal and regulatory authorities: Where dm200m is required by applicable law, court order, or regulatory directive to disclose Personal Data, we will comply with that obligation. Where legally permissible, dm200m will notify the affected Player of such a disclosure request.
• Professional advisors: Legal counsel, auditors, and compliance consultants who are bound by professional confidentiality obligations.

6.3 Business Transfers. In the event that dm200m undergoes a merger, acquisition, or sale of assets, Player data may form part of the transferred assets. Players will be notified of any such transfer via email and/or an in-platform notification prior to their data being subject to a materially different privacy policy.

7.1 Retention Periods. dm200m retains Personal Data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. Indicative retention periods are as follows:

• Account and identity data: retained for the duration of your active account plus a minimum of 5 years following account closure, in line with standard international gaming compliance and anti-money-laundering record-keeping requirements.
• Financial transaction records: retained for a minimum of 5 years from the date of each transaction.
• KYC documentation: retained for a minimum of 5 years from the date of verification or from account closure, whichever is later.
• Support communications: retained for 3 years from the date of the final communication in each support thread.
• Technical and session data: retained for 13 months from the date of collection, after which it is anonymised or deleted.
• Marketing consent records: retained for the duration of your account plus 2 years following account closure.

7.2 Deletion Requests. You may request deletion of your Personal Data as described in Clause 11 (Your Rights). Note that dm200m may be required to retain certain categories of data beyond your deletion request where a legal retention obligation applies. In such cases, dm200m will inform you of the specific obligation and the expected retention end date.

dm200m implements a layered approach to data security, combining technical, organisational, and procedural controls:

• Encryption in transit: all data exchanged between your device and dm200m is encrypted using 256-bit SSL/TLS encryption. Connections over unencrypted HTTP are automatically redirected to HTTPS.
• Encryption at rest: sensitive Personal Data stored in dm200m's databases (including KYC documents and payment account details) is encrypted at rest using AES-256.
• Access controls: internal access to Player data is restricted on a strict need-to-know basis. Staff with access rights are authenticated using multi-factor authentication and their access activities are logged and periodically audited.
• Password security: Player passwords are stored as one-way cryptographic hashes. dm200m staff cannot view your password. If you forget your password, it must be reset rather than retrieved.
• Intrusion detection: dm200m deploys AI-assisted intrusion detection and anomaly monitoring across its network infrastructure, operating on a continuous 24/7 basis.
• Penetration testing: dm200m commissions independent security assessments of its platform infrastructure on a regular basis.

9.1 What Are Cookies. Cookies are small text files placed on your device when you visit the dm200m platform. They allow the platform to recognise your device across page loads and sessions, enabling features such as maintaining your logged-in state, remembering your language preference, and attributing your visit to a specific referral source.

9.2 Types of Cookies Used by dm200m.

• Strictly Necessary Cookies: Required for the platform to function. These include session cookies that maintain your logged-in state and security tokens that protect your session from CSRF attacks. These cookies cannot be disabled without breaking core platform functionality.
• Performance and Analytics Cookies: Used to collect aggregated, anonymised data about how players navigate the platform — which pages are visited most frequently, where errors occur, and how long players spend in different sections. This data is used solely to improve platform performance and user experience.
• Functional Cookies: Used to remember your preferences such as deposit method defaults, game display settings, and notification preferences.
• Marketing and Attribution Cookies: Used to identify the channel through which you discovered dm200m (e.g., search engine, affiliate partner) for the purpose of attributing registrations and measuring marketing channel effectiveness. These cookies do not track your activity on third-party websites.

9.3 Cookie Management. You may manage your cookie preferences through your browser settings. Most browsers allow you to view, block, or delete cookies. Note that disabling strictly necessary cookies will impair your ability to use the dm200m platform. Disabling analytics or marketing cookies will not affect your ability to bet or access your account.

9.4 No Cross-Site Tracking. dm200m does not deploy third-party advertising cookies that track your behaviour across other websites for the purpose of building advertising profiles or retargeting you on external platforms.

dm200m operates under an international gaming licence and its infrastructure is hosted across multiple jurisdictions. As a result, your Personal Data may be transferred to and stored on servers located outside Indonesia.

Where Personal Data is transferred internationally, dm200m takes the following steps to ensure adequate protection:

• Transfers to Third-Party Processors are governed by written data processing agreements that require those processors to implement security standards equivalent to those applied by dm200m.
• Cloud infrastructure providers engaged by dm200m are required to hold recognised international security certifications (such as ISO/IEC 27001) and to process data only within data centres that meet agreed security standards.
• Transfers for KYC verification purposes are conducted over encrypted channels and the data is used solely for the verification function, after which it is not retained by the verification provider beyond its stated retention period.

dm200m respects your rights in relation to your Personal Data. The following rights are available to all registered Players. To exercise any of these rights, contact the dm200m support team via in-app live chat or email at [email protected].

dm200m will respond to all valid rights requests within 30 calendar days of receipt. Where a request is complex or voluminous, dm200m may extend this period by a further 30 days with notice to you. Requests are processed free of charge unless they are manifestly unfounded or excessive.

dm200m's services are strictly intended for individuals aged 21 and above. dm200m does not knowingly collect Personal Data from persons under the age of 21.

All registration submissions are subject to automated age checks, and accounts flagged as potentially belonging to underage individuals are suspended pending KYC age verification. Where dm200m determines, following verification, that a registered Player is under the age of 21, the account will be immediately and permanently closed, all pending bets will be voided, and any deposited real-money funds (net of any bonus credits) will be returned to the depositing payment method.

If you are a parent or guardian and believe that a person under the age of 21 has registered on dm200m using their details or yours, please contact dm200m support immediately at [email protected] so that the account can be reviewed and closed without delay.

The dm200m platform may contain links to third-party services, or you may access dm200m through a third-party affiliate or referral link. dm200m is not responsible for the privacy practices of any third-party website, service, or application that is not operated by dm200m.

Game content on dm200m is provided by licensed third-party game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft. When you launch a game within the dm200m platform, a session token is passed to the relevant game provider's server to load your game session. This token is non-identifiable and does not include your name, contact details, payment information, or KYC data. Game providers' use of this session data is governed by their own data processing agreements with dm200m.

dm200m encourages Players to review the privacy policies of any third-party services they access independently of the dm200m platform.

dm200m reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or platform operations. Material changes — those that meaningfully affect your rights or how your data is used — will be communicated to registered Players via email and/or a prominent in-platform notification at least 7 calendar days before the change takes effect.

Non-material changes (such as typographical corrections, clarifications that do not alter substantive rights, or updates to contact details) may be made without advance notice. The "Last Updated" date at the top of this document reflects the date of the most recent revision.

Your continued use of the dm200m platform following the effective date of any revised Privacy Policy constitutes your acknowledgement of and agreement to the updated terms. If you do not agree to a material change in this Policy, you may close your account by contacting dm200m support before the change takes effect.

15.1 General Enquiries. For any queries relating to this Privacy Policy, your Personal Data, or to exercise any of the rights described in Clause 11, please contact the dm200m support team through the following channels:

• In-app live chat: available 24/7 from the dm200m platform. Average response time: 2–5 minutes during WIB peak hours.
• Email: [email protected] (plain text — not a clickable link). Response within 24 business hours.

15.2 Formal Complaints. If you are not satisfied with how dm200m has handled a data privacy matter, you have the right to submit a formal complaint. Formal complaints should be submitted in writing to [email protected] with the subject line "Formal Privacy Complaint". dm200m will acknowledge formal complaints within 48 business hours and provide a substantive response within 20 business days.

15.3 Regulatory Complaints. If you remain dissatisfied following dm200m's internal complaint resolution process, you may have the right to escalate your complaint to the relevant data protection supervisory authority in the jurisdiction applicable to dm200m's operations. Details of the applicable authority will be provided upon request.