km501 Privacy Policy

The following terms have the meanings set out below throughout this Privacy Policy and all related km501 data protection notices:

• "km501" / "the Company" / "We" / "Us" / "Our" — refers to km501.net, the operator of the online gaming platform accessible at https://km501.net and all associated subdomains, mobile interfaces, and API services.
• "Personal Data" — any information relating to an identified or identifiable natural person, including but not limited to name, date of birth, email address, Indonesian mobile phone number, payment account details, IP address, device identifiers, and browsing behaviour on the km501 Platform.
• "Processing" — any operation performed on Personal Data, whether automated or manual, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" — the entity that determines the purposes and means of Processing Personal Data. For the purposes of this Policy, km501 is the Data Controller in respect of all Personal Data collected through the Platform.
• "Data Processor" — a third party that Processes Personal Data on behalf of km501 under a written contractual agreement, strictly for the purposes instructed by km501.
• "Player" / "User" / "You" — any natural person who accesses or uses the km501 Platform, whether or not a registered Account holder.
• "KYC" (Know Your Customer) — the identity and age verification process conducted by km501 prior to processing a Player's first withdrawal or at any point required for compliance purposes.
• "Cookie" — a small text file placed on your device by the km501 Platform or a third-party service integrated into the Platform, used to recognise your device and session preferences.

km501 is the Data Controller responsible for the Personal Data of all Players who access or use the km501 Platform. km501 operates the Platform primarily for players residing in Indonesia and processes Personal Data in accordance with its international licensing obligations and applicable data protection principles.

If you have any questions, concerns, or requests relating to the handling of your Personal Data, you may contact km501's data protection contact directly using the details provided in Section 15 of this Policy.

km501 collects the following categories of Personal Data from and about its Players:

km501 does not intentionally collect any special categories of sensitive personal data — such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data for identification purposes — beyond what is strictly required for KYC facial liveness checks where mandated by our licensing authority.

km501 collects Personal Data through the following channels:

• Directly from you — when you complete the Account registration form on the km501 Login page, submit KYC documents, make a deposit or withdrawal, contact customer support, or participate in a promotion.
• Automatically — through cookies, web beacons, server logs, and analytics tools that record your interactions with the Platform each time you visit, including pages viewed, links clicked, session duration, and error events.
• From third-party payment processors — confirmation data relating to deposit and withdrawal transactions processed through BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja, and other supported payment channels.
• From identity verification agencies — results and risk scores returned by third-party KYC and fraud detection service providers that km501 uses to verify the identity and age of Players.
• From game studios — session metadata and round results returned by certified third-party game providers including Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Pocket Games Soft, which are integrated into the km501 Platform.

km501 processes your Personal Data for the following specific and documented purposes:

km501 does not use your Personal Data for any purpose incompatible with those listed above. If we intend to process your data for a new purpose, we will update this Privacy Policy and notify you before doing so.

km501 processes your Personal Data on one or more of the following legal bases, depending on the specific purpose:

• Contractual necessity — Processing is necessary to perform the contract between you and km501 (i.e., to operate your Account, process transactions, and deliver the gaming services you have requested). This basis covers Account registration, payment processing, and game delivery.
• Legal obligation — Processing is necessary for km501 to comply with its legal and regulatory obligations, including KYC/AML requirements imposed by our international gaming licence, anti-fraud controls, and audit obligations.
• Legitimate interests — Processing is necessary for km501's legitimate business interests — including fraud detection, platform security, responsible gaming monitoring, and service improvement — where those interests are not overridden by your privacy rights.
• Consent — For marketing communications via email and SMS, km501 relies on your freely given, specific, informed, and unambiguous consent. You may withdraw consent at any time by updating your marketing preferences in your Account settings or by replying "STOP" to any SMS communication from km501.

km501 does not sell your Personal Data to any third party. We share Personal Data only with the following categories of recipients, strictly to the extent necessary to deliver the Platform's services or fulfil legal obligations:

In all cases, km501 requires third-party recipients to maintain confidentiality obligations and to implement appropriate technical and organisational security measures consistent with their role as Data Processors.

km501 operates internationally and your Personal Data may be stored on or transferred to servers located outside Indonesia. Wherever such transfers occur, km501 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that required under the data protection principles applicable in km501's licensing jurisdiction. These safeguards include:

• Contractual data processing agreements with all third-party Data Processors that incorporate standard data protection clauses.
• Transfers to third-party providers located in jurisdictions that maintain adequate data protection standards as assessed by km501's compliance team.
• Technical encryption controls applied during data transmission (TLS 1.2 or higher) and at rest (AES-256 encryption).

By registering an Account and using the km501 Platform, you acknowledge and consent to the international transfer of your Personal Data as described in this section.

km501 retains your Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable regulatory and legal obligations. The following retention periods apply as a general guide:

At the end of the applicable retention period, km501 will securely delete or anonymise your Personal Data so that it can no longer be associated with you. Where deletion is not immediately practicable due to system backup cycles, the data will be isolated from active processing until deletion is completed.

km501 implements a multi-layered security framework designed to protect your Personal Data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our key security measures include:

• SSL/TLS Encryption: All data transmitted between your device and the km501 Platform is encrypted using TLS 1.2 or higher, indicated by the padlock icon in your browser's address bar.
• Data-at-Rest Encryption: Sensitive Personal Data stored on km501's servers — including financial data, KYC documents, and hashed passwords — is encrypted using AES-256 encryption.
• Access Controls: Access to Personal Data is restricted on a strict need-to-know basis. km501 staff may only access Personal Data necessary for their specific role, and all access is logged and audited.
• Two-Factor Authentication (2FA): km501 offers 2FA via SMS to all registered Players and applies mandatory 2FA for all staff accounts with access to Player data systems.
• Intrusion Detection and Monitoring: km501's infrastructure is monitored 24/7 for suspicious activity using automated intrusion detection systems and security information event management (SIEM) tools.
• Regular Security Audits: km501 conducts periodic penetration tests and third-party security audits to identify and remediate vulnerabilities in its Platform and data systems.
• Incident Response: In the event of a data breach that is likely to affect your rights, km501 will notify you and the relevant regulatory authority within the timeframes required by applicable law.

km501 uses cookies and similar tracking technologies to enhance the functionality of the Platform, remember your session preferences, analyse usage patterns, and deliver relevant promotional content to opted-in Players. The following categories of cookies are used:

You may manage or disable non-essential cookies at any time through your browser settings. Please note that disabling certain cookies may affect the functionality and performance of the km501 Platform. Detailed cookie settings and the ability to withdraw consent for non-essential cookies are available in your Account preferences panel.

km501 respects your rights in relation to your Personal Data. Subject to the conditions and limitations established by applicable data protection law and km501's regulatory obligations, you have the following rights:

• Right of Access: You may request a copy of the Personal Data km501 holds about you, together with information about how it is processed, to whom it is disclosed, and how long it is retained.
• Right to Rectification: You may request that km501 correct any inaccurate or incomplete Personal Data held about you. For changes to core identity data (name, date of birth), km501 may require documentary evidence before making the correction.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data in certain circumstances — for example, where the data is no longer necessary for the purposes for which it was collected, or where you withdraw consent and no other legal basis applies. This right does not apply where km501 is required to retain data to fulfil a legal obligation.
• Right to Restrict Processing: You may request that km501 temporarily suspend processing of your Personal Data — for example, while the accuracy of data is contested or a legitimate interests objection is being assessed.
• Right to Data Portability: You may request a structured, machine-readable copy of the Personal Data you have provided to km501, to be transferred to you or to another service provider where technically feasible.
• Right to Object: You may object at any time to km501's processing of your Personal Data based on legitimate interests grounds, including profiling for responsible gaming risk assessments or marketing analytics.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, please contact km501 via live chat or by emailing [email protected] with the subject line "Data Rights Request". km501 will acknowledge your request within 72 hours and respond substantively within 30 calendar days. km501 may require you to verify your identity before processing a rights request to prevent unauthorised disclosure.

The km501 Platform is strictly intended for adults aged 21 and above. km501 does not knowingly collect Personal Data from or offer gaming services to any person under the age of 21. The registration process includes an age declaration step, and age is further verified during the KYC process prior to first withdrawal.

If km501 becomes aware that Personal Data has been collected from a person under the age of 21 — whether through a false declaration at registration or any other means — that Account will be immediately suspended, all associated wagers and bonus claims voided, and the Personal Data deleted from km501's systems within 30 days, subject only to any mandatory legal retention obligations.

If you are a parent or guardian and believe that a minor in your care has registered an Account with km501, please contact km501 immediately at [email protected] so that appropriate action can be taken without delay.

km501 reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, our data processing practices, or the structure of the km501 Platform. When a material change is made, km501 will publish the revised Policy on the Platform with an updated version number and date, and will notify registered Players by email where practicable.

Your continued use of the km501 Platform following publication of a revised Privacy Policy constitutes your acceptance of the updated terms. We encourage you to review this Policy periodically. The version number and "Last Updated" date shown at the top of this page confirm the currency of the Policy you are reading.

If you have any questions, concerns, or requests relating to this Privacy Policy or km501's handling of your Personal Data, please contact us through one of the following channels:

• Live Chat: Available 24 hours a day, 7 days a week directly through the km501 Platform. Our support agents include Indonesian-speaking staff and can assist with data rights requests in English.
• Email: [email protected] — please include "Privacy Policy" or "Data Rights Request" in the subject line for fastest routing. Responses are provided within one WIB business day for general enquiries and within 30 days for formal data rights requests.

km501 is committed to resolving all privacy-related queries promptly and transparently. If you are not satisfied with km501's response to a privacy concern, you may have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction.