Privacy Policy

1. Introduction and Scope

This Privacy Policy applies to all users of the cumi22 platform, including visitors to the website, registered account holders, and anyone who interacts with our services. It covers all personal data collected through the website, mobile-optimized versions, customer support channels (live chat, email), payment processing systems, and marketing communications.

cumi22 operates as an online betting platform serving the Indonesian market. We are committed to compliance with Indonesian data protection regulations, including Law No. 27 of 2022 on Personal Data Protection (UU PDP), and international best practices for data security and user privacy. This policy should be read in conjunction with our Terms & Conditions and Responsible Gaming guidelines, which together form the complete legal framework governing your use of cumi22.

2. Data Controller

For the purposes of data protection law, cumi22 is the data controller responsible for your personal information. This means we determine the purposes and means of processing your personal data. If you have any questions, concerns, or requests regarding your personal data, you may contact our Data Protection Officer at [email protected] or via live chat on the platform.

3. What Personal Data We Collect

We collect and process the following categories of personal data to provide, maintain, and improve our services:

3.1 Information You Provide Directly

• Account Registration Data: Full legal name, date of birth, email address, phone number (mobile), residential address, chosen username, and encrypted password. This information is collected during the account registration process.
• Identity Verification (KYC) Data: Government-issued identification documents (KTP – Kartu Tanda Penduduk, passport, or driver's license), proof of residential address (utility bills, bank statements, or government correspondence), and payment method verification documents. These are collected to comply with anti-money laundering regulations and to verify that you meet the 21+ age requirement.
• Financial Data: Bank account details (account number, bank name, account holder name), e-wallet account information (OVO, DANA, GoPay phone number or account ID), transaction history, deposit amounts, withdrawal requests, and account balance records. This data is necessary to process deposits and withdrawals in Indonesian Rupiah (IDR).
• Communication Data: Messages sent through live chat, emails sent to customer support, support ticket content, and any other correspondence between you and cumi22 staff. We retain this data to provide customer service, resolve disputes, and improve support quality.
• Preference and Settings Data: Language preferences, notification settings, responsible gaming limits (deposit limits, loss limits, session time limits, self-exclusion periods), and marketing communication preferences.

3.2 Information We Collect Automatically

• Device and Technical Data: IP address, device type (desktop, mobile, tablet), operating system (Windows, macOS, Android, iOS), browser type and version (Chrome, Safari, Firefox, Edge), screen resolution, and mobile device identifiers (IMEI, advertising ID). This data helps us optimize platform performance and detect fraudulent activity.
• Usage Data: Pages visited, games played, bets placed (date, time, stake amount, odds, outcome), session duration, click patterns, navigation paths, and feature usage statistics. We use this data to understand user behavior, improve the platform, and personalize your experience.
• Location Data: General geographic location derived from your IP address (city and province level, not precise GPS coordinates). This helps us comply with jurisdictional restrictions and tailor content to your region.
• Cookies and Tracking Technologies: Session cookies, persistent cookies, local storage data, and similar tracking technologies. See Section 9 (Cookies Policy) for detailed information on how we use cookies and how you can control them.

3.3 Information from Third-Party Sources

• Payment Processors: Transaction confirmation data, payment success or failure status, and fraud detection signals from Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) and e-wallet providers (OVO, DANA, GoPay).
• Identity Verification Services: Verification results and risk assessment scores from third-party KYC providers used to validate your identity documents and prevent fraud.
• Game Providers: Game outcome data, RTP (Return to Player) statistics, and fair play audit results from third-party game studios (Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, and others) whose games are hosted on our platform.

4. How We Use Your Personal Data

We use your personal data for the following purposes, all of which are necessary to operate the cumi22 platform and provide you with a secure, fair, and enjoyable betting experience:

4.1 Account Management and Service Delivery

• Creating, maintaining, and managing your cumi22 account
• Verifying your identity and age (21+ requirement) through KYC processes
• Processing deposits, withdrawals, and account balance transactions
• Enabling you to place bets on sports events, casino games, togel draws, and other offerings
• Settling bets, crediting winnings, and managing bonus funds
• Providing customer support via live chat, email, and phone

4.2 Legal Compliance and Fraud Prevention

• Complying with Indonesian data protection, anti-money laundering (AML), and counter-terrorism financing (CTF) laws
• Detecting, preventing, and investigating fraudulent activity, bonus abuse, collusion, and account takeovers
• Enforcing our Terms & Conditions and resolving disputes
• Responding to lawful requests from Indonesian government authorities, courts, or regulatory bodies
• Maintaining records required by law (typically 5–7 years from account closure)

4.3 Platform Improvement and Personalization

• Analyzing user behavior to improve platform design, navigation, and game selection
• Personalizing your experience by recommending games, promotions, or features based on your activity
• Conducting A/B testing to optimize user interface elements and promotional offers
• Monitoring platform performance, uptime, and technical issues

4.4 Marketing and Communication

• Sending you promotional emails, SMS messages, or push notifications about bonuses, new games, VIP rewards, or special events (only if you have opted in to marketing communications)
• Providing transactional communications (deposit confirmations, withdrawal updates, account security alerts, password reset emails)
• Administering the VIP loyalty program and notifying you of tier upgrades, cashback credits, and exclusive perks

4.5 Responsible Gaming and Player Protection

• Enforcing responsible gaming limits (deposit limits, loss limits, session time limits) that you have set
• Processing self-exclusion requests and preventing access to your account during exclusion periods
• Identifying potentially problematic gambling behavior and offering support resources
• Providing access to self-assessment quizzes and reality-check reminders

5. Legal Basis for Processing Your Data

Under Indonesian data protection law (UU PDP), we must have a lawful basis to process your personal data. We rely on the following legal grounds:

• Contractual Necessity: Processing is necessary to perform our contract with you (the Terms & Conditions). This covers account creation, bet processing, payment handling, and customer support.
• Legal Obligation: Processing is necessary to comply with Indonesian laws, including KYC requirements, AML regulations, tax reporting obligations, and data retention mandates.
• Legitimate Interests: Processing is necessary for our legitimate business interests, such as fraud prevention, platform security, service improvement, and marketing to existing customers, provided these interests do not override your fundamental privacy rights.
• Consent: For certain activities (e.g., optional marketing communications, non-essential cookies), we rely on your explicit consent, which you can withdraw at any time through your account settings.

6. How We Share Your Personal Data

cumi22 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. However, we do share your data with trusted third-party service providers and partners in the following circumstances:

6.1 Service Providers and Processors

• Payment Processors: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) and e-wallet providers (OVO, DANA, GoPay) receive transaction data necessary to process your deposits and withdrawals.
• KYC Verification Providers: Third-party identity verification services receive copies of your ID documents to validate your identity and age.
• Game Providers: Licensed game studios (Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and others) receive your username and bet data to deliver live casino, slot, and table game experiences.
• Cloud Hosting and IT Infrastructure: Data center providers and cloud hosting services store and process data on our behalf to ensure platform availability and performance.
• Customer Support Tools: Live chat software providers and email service providers receive communication data to help us deliver support.
• Analytics and Marketing Platforms: We may use analytics tools (Google Analytics, Mixpanel, or similar) to understand user behavior, and email marketing platforms to send promotional messages (only if you have opted in).

All third-party service providers are contractually obligated to process your data only for the purposes we specify, to maintain appropriate security measures, and to comply with applicable data protection laws. We conduct due diligence on all providers before sharing your data.

6.2 Legal and Regulatory Disclosures

We may disclose your personal data to Indonesian government authorities, law enforcement agencies, courts, or regulatory bodies if required by law, if we receive a valid legal request (subpoena, court order, warrant), or if necessary to:

• Comply with AML, CTF, or tax reporting obligations
• Investigate suspected fraud, money laundering, or criminal activity
• Protect the safety, rights, or property of cumi22, our users, or the public
• Enforce our Terms & Conditions or defend legal claims

6.3 Business Transfers

In the event that cumi22 undergoes a merger, acquisition, restructuring, or sale of assets, your personal data may be transferred to the acquiring entity as part of the transaction. We will notify you via email and prominently on the platform before any such transfer occurs, and the acquiring entity will be required to continue protecting your data in accordance with this Privacy Policy.

7. How We Protect Your Personal Data

cumi22 employs industry-standard security measures to protect your personal data from unauthorized access, loss, misuse, alteration, or disclosure:

• Encryption: All data transmitted between your device and our servers is encrypted using 256-bit SSL/TLS encryption. Sensitive data (passwords, payment details) is encrypted at rest in our databases using AES-256 encryption.
• Access Controls: Personal data is accessible only to authorized cumi22 employees and contractors who require it to perform their job functions. All staff sign confidentiality agreements and undergo background checks.
• Firewalls and Intrusion Detection: Our servers are protected by enterprise-grade firewalls, intrusion detection systems (IDS), and regular security audits.
• Payment Security: We do not store full credit card numbers or CVV codes. Payment data is tokenized and processed through PCI-DSS compliant payment gateways.
• Regular Security Audits: We conduct regular penetration testing, vulnerability assessments, and third-party security audits to identify and remediate potential weaknesses.
• Data Backup and Recovery: We maintain encrypted backups of all critical data and have disaster recovery procedures to restore services in case of outages or data loss.

While we implement robust security measures, no online platform can guarantee 100% security. You are responsible for maintaining the confidentiality of your account credentials and notifying us immediately if you suspect unauthorized access to your account.

8. How Long We Retain Your Personal Data

We retain your personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods include:

• Active Accounts: Your account data, transaction history, and communication records are retained for the duration of your account's active status.
• Closed Accounts: After you close your account (voluntarily or due to a breach of terms), we retain your data for an additional 5–7 years to comply with Indonesian financial record-keeping laws, AML regulations, and tax reporting requirements.
• KYC Documents: Identity verification documents are retained for 7 years from account closure, as required by Indonesian AML law.
• Marketing Data: If you opt out of marketing communications, we retain a suppression record indefinitely to ensure we do not contact you again.
• Technical Logs: Server logs, IP addresses, and usage data are typically retained for 12–24 months unless required for fraud investigations or legal proceedings.

After the applicable retention period expires, we securely delete or anonymize your personal data so that it can no longer be associated with you.

9. Cookies Policy

cumi22 uses cookies and similar tracking technologies (web beacons, pixels, local storage) to enhance your experience, analyze usage patterns, and deliver targeted advertising. A cookie is a small text file stored on your device that allows us to recognize you on return visits.

9.1 Types of Cookies We Use

• Essential Cookies: Required for the platform to function. These enable account login, session management, security features, and load balancing. You cannot disable these cookies without impairing core functionality.
• Performance Cookies: Collect anonymous usage data (pages visited, session duration, error messages) to help us understand how users interact with the platform and identify areas for improvement.
• Functional Cookies: Remember your preferences (language selection, display settings) and personalize your experience.
• Marketing Cookies: Track your activity across cumi22 and partner sites to deliver targeted advertising and measure campaign effectiveness. These are set only with your consent.

9.2 Managing Cookies

Most web browsers allow you to control cookies through your browser settings. You can block all cookies, delete existing cookies, or set your browser to notify you when a new cookie is set. However, disabling essential cookies will prevent you from using cumi22's core features (login, betting, account management).

To manage your cookie preferences on cumi22, visit your account settings and adjust the "Cookie Preferences" section. You can opt out of performance and marketing cookies at any time.

10. Your Privacy Rights

Under Indonesian data protection law (UU PDP), you have the following rights regarding your personal data:

• Right of Access: You can request a copy of all personal data we hold about you. We will provide this information in a structured, commonly used, machine-readable format (typically CSV or PDF).
• Right to Rectification: If any of your personal data is inaccurate or incomplete, you can request corrections. You can update most account information directly through your account settings.
• Right to Erasure ("Right to Be Forgotten"): You can request deletion of your personal data, subject to legal retention requirements (e.g., AML laws require us to retain KYC and transaction data for 7 years).
• Right to Restrict Processing: You can request that we temporarily suspend processing of your data in certain circumstances (e.g., while we verify its accuracy or investigate a complaint).
• Right to Data Portability: You can request a copy of your data in a portable format to transfer to another service provider.
• Right to Object: You can object to processing based on legitimate interests (e.g., marketing) or for research/statistical purposes.
• Right to Withdraw Consent: Where we rely on your consent (e.g., marketing emails), you can withdraw it at any time by unsubscribing or adjusting your account settings.
• Right to Lodge a Complaint: If you believe we have violated your privacy rights, you can lodge a complaint with the Indonesian Data Protection Authority (once established under UU PDP) or contact our Data Protection Officer.

To exercise any of these rights, contact us at [email protected] with your account details and a clear description of your request. We will respond within 30 days.

11. Children's Privacy

cumi22 is strictly for users aged 21 and above. We do not knowingly collect personal data from individuals under 21 years of age. Our KYC process is designed to verify age and prevent underage access.

If we discover that we have inadvertently collected data from a minor, we will immediately delete it and permanently close the associated account. If you believe a minor has accessed cumi22, please contact us immediately at [email protected].

12. International Data Transfers

cumi22 primarily serves the Indonesian market, and your personal data is stored on servers located in Indonesia or the Asia-Pacific region. However, some of our third-party service providers (game studios, cloud hosting providers, analytics platforms) may process data in other jurisdictions.

When we transfer data outside Indonesia, we ensure that:

• The recipient country provides an adequate level of data protection as recognized by Indonesian law, or
• We have implemented appropriate safeguards (standard contractual clauses, binding corporate rules) to protect your data in transit and storage.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or platform features. The "Last Updated" date at the top of this document indicates when the most recent changes were made.

If we make material changes that significantly affect your privacy rights, we will notify you via email (to the address registered on your account) and display a prominent notice on the platform. Continued use of cumi22 after such changes constitutes acceptance of the revised policy.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your data.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Data Protection Officer:

• Email: [email protected]
• Live Chat: Available 24/7 via the cumi22 platform
• Support Hours: Peak response times are 08:00–20:00 WIB daily

We are committed to addressing your privacy concerns promptly and transparently. All privacy-related inquiries are handled with the highest priority by our compliance team.