Privacy Policy

1. Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "atm168," "we," "us," or "our" — the online gaming platform operating at https://atm168.cam and all associated subdomains, applications, and services.
• "Player," "you," or "your" — any individual who accesses our website, creates an Account, or otherwise interacts with atm168 Services.
• "Personal Data" — any information that directly or indirectly identifies a natural person, including but not limited to names, national identity numbers, email addresses, phone numbers, financial account details, and IP addresses.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, deletion, or destruction.
• "Services" — the sports betting, live casino, slot games, lottery, and all other gaming products and associated features offered through the atm168 platform.
• "KYC" — Know Your Customer; the identity and age verification process through which atm168 confirms a Player's legal identity, age (minimum 21 years), and residency.
• "Cookies" — small text files placed on your device by our website to facilitate functionality, analytics, and personalization.

2. Information We Collect

atm168 collects several categories of Personal Data, described below:

2.1 Identity and Contact Information

• Full legal name as it appears on government-issued identification
• Date of birth (to verify minimum age of 21 years)
• Indonesian national identity number (NIK from KTP) or passport number
• Residential address, including province and postal code
• Email address and mobile phone number
• Selfie photograph submitted during KYC verification

2.2 Financial Information

• Bank account details for deposit and withdrawal purposes (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata, or other accepted Indonesian banks)
• E-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja)
• Transaction history including deposits, withdrawals, bonus claims, and wager amounts
• Source-of-funds documentation when requested during enhanced due diligence

2.3 Account and Gaming Activity

• Username, password (stored in hashed, non-reversible form), and Account preferences
• Gameplay history, betting records, game session durations, and win/loss statistics
• Responsible gaming settings (deposit limits, loss limits, session timers, self-exclusion status)
• Bonus and promotional activity, including claims, wager progression, and redemptions
• Customer support communications, including chat transcripts and email correspondence

2.4 Technical and Device Data

• IP address and geolocation data derived from it
• Device type, operating system, browser type, and version
• Session timestamps, page views, click-stream data, and navigation patterns
• Cookie identifiers and similar tracking technology data (see Section 7)

3. How We Collect Information

atm168 collects Personal Data through the following channels:

3.1 Directly from You

We collect information you voluntarily provide when you register an Account, complete KYC verification, make deposits or withdrawal requests, contact our customer support team, participate in promotions, or otherwise interact with our platform.

3.2 Automatically Through Technology

When you access our website or use our Services, we automatically collect certain technical data through server logs, cookies, web beacons, and similar tracking technologies. This includes your IP address, device identifiers, session information, and browsing behavior on our platform.

3.3 From Third Parties

We may receive information about you from third-party sources including:

• Payment Processors and Indonesian Banks: Transaction confirmation data from BCA, BRI, BNI, Mandiri, and e-wallet providers to verify deposit and withdrawal processing.
• Identity Verification Services: Data from third-party KYC verification providers used to authenticate government-issued identification documents.
• Fraud Prevention Services: Risk signals and fraud indicators from security and anti-fraud service providers.
• Regulatory and Law Enforcement Authorities: Information provided in response to lawful requests, court orders, or mandatory reporting obligations.

4. Purpose of Data Processing

atm168 processes your Personal Data for the following purposes:

• Account Registration and Management: Creating and maintaining your Account, authenticating your identity at login, and managing Account settings and preferences.
• Age and Identity Verification (KYC): Confirming that you meet the minimum age requirement of 21 years and verifying that you are who you claim to be, in compliance with applicable regulations.
• Service Delivery: Processing deposits, executing withdrawal requests, providing access to casino games and sports betting markets, and delivering promotions and bonuses.
• Customer Support: Responding to inquiries, resolving disputes, and providing technical assistance in English and Indonesian.
• Security and Fraud Prevention: Detecting, investigating, and preventing fraudulent transactions, account takeovers, collusion, money laundering, and other prohibited activities.
• Responsible Gaming: Monitoring gaming patterns that may indicate problem gambling, administering self-imposed limits and self-exclusion requests, and facilitating access to responsible gaming resources.
• Legal Compliance: Meeting obligations under applicable anti-money laundering (AML), counter-terrorism financing (CTF), and other regulatory requirements.
• Platform Improvement: Analyzing usage patterns and performance data to improve platform functionality, user experience, and game selection.
• Marketing and Promotions: Sending promotional communications about bonuses and special offers to Players who have consented to receive such communications. You may opt out at any time.

5. Legal Basis for Processing

atm168 processes your Personal Data on the following legal bases:

• Contractual Necessity: Processing required to fulfill our obligations under the Terms & Conditions you accepted at registration — including Account management, payment processing, and service delivery.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including KYC/AML obligations and regulatory reporting requirements.
• Legitimate Interests: Processing necessary for our legitimate business interests in operating a secure and responsible gaming platform, including fraud prevention, security monitoring, and platform improvement — provided such interests are not overridden by your fundamental rights.
• Consent: Processing based on your freely given, specific, and informed consent — particularly for marketing communications and optional analytics cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

6. Data Sharing and Disclosure

atm168 does not sell, rent, or trade your Personal Data to third parties for commercial purposes. We may share your data only in the following limited circumstances:

6.1 Service Providers and Processors

We engage trusted third-party service providers who process data on our behalf under strict contractual data protection obligations. These include:

• Payment processors and Indonesian banking partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) — to facilitate deposits and withdrawals.
• KYC and identity verification providers — to authenticate government-issued identification documents submitted during account verification.
• Game software providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, and others) — to deliver game content. These providers may receive anonymized session data necessary for game functionality.
• Fraud detection and cybersecurity firms — to protect our platform and Players from unauthorized access and financial crime.
• Cloud infrastructure and hosting providers — to store and process data on secure, access-restricted servers.

6.2 Legal and Regulatory Disclosure

We may disclose your Personal Data to government authorities, law enforcement agencies, or regulatory bodies when required to do so by applicable law, court order, subpoena, or other legal process. We will notify you of such disclosures where legally permitted to do so.

6.3 Business Transfers

In the event that atm168 undergoes a merger, acquisition, restructuring, or sale of assets, your Personal Data may be transferred to the acquiring entity. We will notify affected Players and ensure that the receiving entity maintains data protection standards no less protective than those described in this Privacy Policy.

6.4 Consent-Based Sharing

We will share your Personal Data with any other third party only with your express prior consent, which you may withdraw at any time.

7. Cookies and Tracking Technologies

7.1 What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They allow the site to recognize your device, remember your preferences, and collect information about how you interact with our platform. Similar technologies include web beacons, pixel tags, and local storage objects.

7.2 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the operation of our platform — enabling login session management, security token validation, and payment flow continuity. These cannot be disabled without disrupting core functionality.
• Functional Cookies: Store your preferences such as language settings, preferred payment method, and display options to personalize your experience across sessions.
• Analytics Cookies: Collect anonymized data about how Players navigate our platform — pages visited, session duration, error events — to help us improve performance and usability. These are activated only with your consent.
• Security Cookies: Used to detect and prevent fraudulent activity, bot traffic, and unauthorized account access attempts.

7.3 Managing Your Cookie Preferences

You may control cookie behavior through your browser settings. Most modern browsers allow you to block or delete cookies. Please note that disabling strictly necessary cookies may impair your ability to use certain features of the atm168 platform, including login and payment processing. Disabling analytics cookies will not affect your ability to play or transact.

8. Data Retention

atm168 retains your Personal Data only for as long as necessary to fulfill the purposes described in this Privacy Policy or to comply with applicable legal obligations. Our standard retention schedules are as follows:

• Active Account Data: Retained for the duration of your Account relationship with atm168 and for a minimum of five (5) years following Account closure, in accordance with standard anti-money laundering record-keeping requirements.
• KYC and Identity Documents: Retained for a minimum of five (5) years after the end of the business relationship, or longer if required by applicable regulatory obligations.
• Transaction Records: Retained for a minimum of five (5) years following each transaction date, to support financial auditing and regulatory compliance.
• Customer Support Communications: Retained for two (2) years from the date of the last interaction, unless retention is required for active dispute resolution.
• Technical and Log Data: Retained for up to twelve (12) months from the date of collection, after which it is anonymized or deleted.
• Marketing Consent Records: Retained for the duration of your marketing subscription and for one (1) year following withdrawal of consent, to demonstrate compliance.

When Personal Data is no longer required, we securely delete or anonymize it so that it can no longer be associated with you as an individual.

9. Data Security

atm168 implements a comprehensive, layered approach to data security designed to protect your Personal Data against unauthorized access, accidental loss, alteration, disclosure, and destruction. Our security measures include:

• Transport Layer Security (TLS/SSL): All data in transit between your browser or device and our servers is encrypted using industry-standard TLS protocols.
• Database Encryption: Sensitive data fields (including financial account identifiers and identity document numbers) are encrypted at rest using AES-256 or equivalent standards.
• Password Security: Account passwords are stored exclusively in hashed, salted form using a strong one-way hashing algorithm. Our staff cannot retrieve your original password.
• Access Controls: Access to production systems and Player data is restricted on a strict need-to-know basis, governed by role-based access control (RBAC) policies and multi-factor authentication (MFA) requirements for all staff accounts.
• Security Monitoring: Continuous monitoring of system access logs, anomaly detection, and automated alerting for suspicious activity patterns.
• Regular Security Assessments: Periodic penetration testing, vulnerability scanning, and third-party security audits to identify and remediate potential weaknesses.
• Incident Response: A documented data breach response plan to contain, investigate, and notify affected Players of any confirmed data security incident in a timely manner.

10. Your Rights and Choices

As a Player of atm168, you have the following rights in relation to your Personal Data:

• Right of Access: You may request a copy of the Personal Data we hold about you, along with information about how it is processed.
• Right to Rectification: You may request correction of any Personal Data that is inaccurate or incomplete. You can update basic Account information directly through your Account dashboard.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations. Note that we are required to retain certain data (such as KYC and transaction records) for a minimum of five years after Account closure.
• Right to Restriction of Processing: You may request that we restrict processing of your Personal Data in certain circumstances — for example, while you contest the accuracy of data we hold.
• Right to Data Portability: You may request that we provide your Personal Data in a structured, commonly used, machine-readable format where technically feasible.
• Right to Object: You may object to processing of your Personal Data for direct marketing purposes at any time. You may also object to processing based on our legitimate interests, subject to our demonstrating compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, please contact our support team at [email protected]. We will respond to all data-subject requests within thirty (30) calendar days. We may require you to verify your identity before actioning any request.

11. Protection of Minors

atm168 strictly prohibits the use of our platform by individuals under the age of 21. We do not knowingly collect, process, or retain Personal Data from anyone under 21 years of age. Our KYC process is specifically designed to verify that every registered Player meets the minimum age requirement before they are permitted to deposit funds or access gaming services.

If we become aware or have reasonable grounds to believe that we have inadvertently collected Personal Data from an individual under 21, we will take immediate steps to suspend the relevant Account, void any transactions, and permanently delete the associated Personal Data from our systems.

If you are a parent or legal guardian and believe that your child (under 21) has created an Account with atm168, please contact us immediately at [email protected] so that we can investigate and take appropriate action without delay.

12. International Data Transfers

As an online platform serving Players primarily in Indonesia, atm168 may process and store data on servers located outside of Indonesia, including in jurisdictions where our technical infrastructure and third-party service providers operate. Where such international transfers occur, we ensure appropriate safeguards are in place to maintain a level of protection for your Personal Data consistent with the standards described in this Privacy Policy.

Safeguards we employ for international data transfers include:

• Contractual data processing agreements with all third-party processors, incorporating standard data protection clauses and security obligations.
• Transfer impact assessments for transfers to jurisdictions with differing data protection frameworks.
• Technical controls (encryption, access restrictions) that apply regardless of the physical location of data storage.

By using our Services, you acknowledge that your Personal Data may be transferred to and processed in countries other than Indonesia. We take reasonable steps to ensure that any such transfers are conducted securely and in a manner that respects your privacy rights.

13. Changes to This Privacy Policy

atm168 reserves the right to modify, update, or revise this Privacy Policy at any time to reflect changes in our data practices, applicable laws, or platform services. When we make material changes, we will update the "Last Updated" date at the top of this page and, where required, notify affected Players by email or through a prominent notice on our platform.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data. Your continued use of our Services following the posting of a revised Privacy Policy constitutes your acknowledgment of the changes and your acceptance of the updated terms. If you disagree with any modification, you must stop using our Services and contact our support team to close your Account.

14. Contact and Data Inquiries

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data by atm168, please reach out to our support team through the following channels:

• Email: [email protected]
• Live Chat: Available 24/7 through the atm168 platform dashboard
• Response Time: We aim to respond to all privacy-related inquiries within 5 business days (WIB, UTC+7)
• Languages Supported: English and Indonesian

For formal data-subject requests (access, rectification, erasure, portability), please include your full name, registered Account email address, and a clear description of your request. We may require additional verification before processing your request to protect your Account security.