bm888 Privacy Policy

bm888 ("bm888", "we", "us", "our") operates the online casino and sportsbook platform accessible at https://bm888.pro (the "Platform"). We are committed to protecting the privacy and personal data of every individual who registers an account, visits our website, or interacts with our services. This Privacy Policy sets out the basis on which personal data collected from you — or that you provide to us — will be processed by bm888.

This Policy should be read alongside our Terms & Conditions and our Responsible Gaming Policy, which together form the complete framework governing your relationship with bm888. By registering an account on bm888.pro, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein.

This Privacy Policy applies to all Members who access the Platform from Indonesia and to all personal data collected in connection with the provision of bm888's services, regardless of the device or channel through which you access the Platform.

The following defined terms are used throughout this Privacy Policy:

• "Personal Data" — any information relating to an identified or identifiable natural person, including but not limited to name, date of birth, residential address, email address, telephone number, financial account details, device identifiers, and IP address.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, use, disclosure, erasure, or destruction.
• "Member" — any individual who has registered a bm888 account and is therefore a data subject whose Personal Data is processed under this Policy.
• "KYC" — Know Your Customer verification procedures, including identity document checks and proof-of-address reviews, required to confirm a Member's identity prior to enabling withdrawals or completing account verification.
• "Cookies" — small text files placed on your device by the bm888 Platform to support session management, analytics, and personalization.
• "Third-Party Processor" — any external service provider engaged by bm888 to process Personal Data on bm888's behalf and under bm888's documented instructions, including payment processors, KYC verification providers, and analytics platforms.
• "IDR" — Indonesian Rupiah, the sole currency in which bm888 account balances are denominated and transactions are conducted.

bm888 collects the following categories of Personal Data in connection with the operation of the Platform and delivery of its services to Indonesian Members:

3.1 Registration Data. When you open a bm888 account, we collect your full legal name, date of birth, Indonesian residential address, email address, and mobile telephone number. This information is necessary to establish your account and to conduct baseline identity verification.

3.2 Identity Verification (KYC) Data. To comply with anti-money laundering obligations and to confirm that you are at least 21 years of age, we collect copies of government-issued identity documents. For Indonesian Members, acceptable documents include your Kartu Tanda Penduduk (KTP — Indonesian national identity card), passport, or other valid government-issued photo identification. We may also collect proof of residential address and, where required, proof of payment method ownership.

3.3 Financial Data. We collect information about the payment methods you use to deposit and withdraw funds, including your Indonesian bank account details (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) and e-wallet account details (OVO, DANA, GoPay, ShopeePay, LinkAja). We record deposit and withdrawal transaction histories and amounts denominated in IDR. bm888 does not store full card numbers or banking credentials; payment processing is handled by certified third-party payment processors.

3.4 Gaming Activity Data. We maintain records of your betting and gaming activity on the Platform, including game sessions, wager amounts, bet outcomes, win/loss records, and bonus usage history. This data is used for account management, responsible gaming monitoring, and dispute resolution.

3.5 Technical and Device Data. We automatically collect certain technical information when you access the Platform, including your IP address, browser type and version, operating system, device type, screen resolution, time zone (defaulting to WIB, UTC+7), session duration, pages visited, and referring URLs. This data helps us maintain Platform security and optimize the user experience.

3.6 Communications Data. If you contact bm888 customer support via live chat or email, we retain records of those communications, including the content of messages, timestamps, and the resolution of any support tickets. This enables us to maintain service continuity and quality.

bm888 collects Personal Data through the following channels:

• Direct submission: Data you provide when registering your account, completing KYC verification, submitting deposit or withdrawal requests, or contacting our customer support team.
• Automated technical collection: Data captured automatically by our Platform infrastructure when you visit bm888.pro, including through cookies, server logs, and device fingerprinting technologies.
• Third-party sources: Data received from KYC verification service providers, fraud detection systems, and payment processors to supplement and validate the information you have provided directly.
• Public sources: In limited circumstances where required for AML compliance or fraud investigation purposes, bm888 may consult publicly available information to verify Member-provided data.

bm888 uses the Personal Data we collect for the following specific purposes:

bm888 does not use your Personal Data for automated decision-making that produces significant legal or similarly significant effects on you without human review, except where such processing is required by applicable law or where you have provided explicit consent.

bm888 processes your Personal Data on the following legal bases:

• Contractual Necessity: Processing required to fulfil our obligations under the Terms & Conditions you accepted at registration, including operating your account, processing transactions in IDR, and delivering gaming services.
• Legal Obligation: Processing required to comply with applicable legal requirements, including KYC identity verification, anti-money laundering (AML) checks, age verification (21+ requirement), and responding to lawful requests from competent authorities.
• Legitimate Interest: Processing undertaken for bm888's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and service improvement — where those interests are not overridden by your fundamental privacy rights.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — primarily for optional promotional communications. You may withdraw consent for consent-based processing at any time by contacting our support team, without affecting the lawfulness of processing carried out before withdrawal.

7.1 We Do Not Sell Your Data. bm888 does not sell, rent, or trade your Personal Data to any third party for their own marketing or commercial purposes. Your data is shared only in the limited circumstances described below.

7.2 Third-Party Processors. bm888 engages carefully selected Third-Party Processors to perform specific functions on our behalf. These providers are contractually bound to process your data only in accordance with bm888's instructions and to maintain appropriate security standards. Categories of processors include:

• Payment processing partners facilitating IDR deposits and withdrawals via Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, and others) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja).
• KYC and identity verification service providers for document validation and age confirmation.
• Game content studios (including Pragmatic Play, Evolution Gaming, PG Soft, NetEnt, Microgaming, and others) whose platforms deliver game content within the bm888 environment. These studios may receive limited session and wager data necessary to operate games.
• Platform security, fraud detection, and anti-bot service providers.
• Customer support software providers enabling our live chat and ticketing systems.
• Analytics providers used to measure Platform performance and optimize user experience.

7.3 Legal and Regulatory Disclosure. bm888 may disclose your Personal Data to competent governmental or regulatory authorities, law enforcement agencies, courts, or other bodies when required to do so by applicable law, by a valid legal order, or where bm888 reasonably believes disclosure is necessary to prevent fraud, money laundering, or other serious crimes.

7.4 Business Transfers. In the event that bm888 undergoes a merger, acquisition, corporate restructuring, or sale of all or part of its assets, your Personal Data may be transferred to the acquiring entity as part of that transaction, subject to equivalent privacy protections being maintained.

8.1 Retention Periods. bm888 retains your Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following general retention periods apply:

• Active Account Data: Retained for the full duration of your active membership with bm888, plus a minimum post-closure period of five (5) years to satisfy AML record-keeping obligations.
• KYC and Identity Documents: Retained for a minimum of five (5) years from the date of collection or the date of account closure, whichever is later.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, in accordance with standard financial record-keeping requirements.
• Gaming Activity Records: Retained for a minimum of three (3) years from the date of each gaming session, for dispute resolution and responsible gaming audit purposes.
• Customer Support Communications: Retained for a minimum of two (2) years from the date of the final communication in each support interaction.
• Technical and Device Data (Logs): Retained for a maximum of twelve (12) months from collection, unless retention for a longer period is required in connection with an ongoing security investigation.

8.2 Post-Retention Disposal. Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymized in a manner that prevents reconstruction or re-identification. Anonymized, aggregated data (from which no individual can be identified) may be retained indefinitely for statistical and business analysis purposes.

bm888 implements a comprehensive, layered security framework to protect your Personal Data against unauthorized access, disclosure, alteration, or destruction. Our technical and organizational security measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and bm888 servers is encrypted using industry-standard 256-bit SSL/TLS protocols. This protects your registration data, login credentials, KYC documents, and financial information in transit.
• Encrypted Data Storage: Personal Data stored on bm888's servers is encrypted at rest. Access to stored data is restricted to authorized personnel who require it to perform their legitimate job functions.
• Access Controls: Role-based access controls limit internal access to Personal Data on a strict need-to-know basis. All access to sensitive data by bm888 staff is logged and audited.
• Device Fingerprinting and Session Management: Anomalous login patterns, unusual device changes, and suspicious session activity are automatically flagged for review to detect and prevent unauthorized account access.
• Two-Factor Authentication: bm888 supports and encourages the use of two-factor authentication (2FA) on Member accounts as an additional layer of account security.
• Regular Security Audits: bm888's platform infrastructure and security controls are subject to periodic third-party security audits and penetration testing to identify and remediate vulnerabilities.
• Breach Response Procedures: bm888 maintains documented data breach detection, response, and notification procedures. In the event of a confirmed breach materially affecting your Personal Data, bm888 will notify affected Members within a reasonable timeframe.

While bm888 takes all reasonable technical and organizational measures to protect your data, no online platform can guarantee absolute security against all possible threats. You use the Platform at your own risk in relation to factors that are genuinely outside bm888's reasonable control, such as compromise of your own device or credentials.

10.1 What Are Cookies. Cookies are small text files placed on your device when you visit a website. bm888 uses cookies and similar tracking technologies (including browser local storage and device fingerprinting) to operate the Platform effectively, maintain your session, and improve your experience.

10.2 Types of Cookies Used. The following categories of cookies are deployed on the bm888 Platform:

10.3 Managing Cookies. You can control and manage cookies through your browser settings. Most modern browsers allow you to block or delete cookies. However, please be aware that disabling strictly necessary cookies will prevent the bm888 Platform from functioning correctly — you will not be able to log in or conduct transactions if session cookies are blocked. Disabling functional or analytics cookies will not affect Platform availability but may reduce the quality of your experience.

As a registered Member of bm888, you hold the following rights with respect to your Personal Data. These rights are enforceable by contacting our support team as described in Section 15 of this Policy.

To exercise any of these rights, please contact bm888 customer support via live chat from your account dashboard or by email at [email protected]. We will acknowledge your request within five (5) business days and aim to fulfil it within thirty (30) calendar days. Where a request is complex or voluminous, this period may be extended by up to a further sixty (60) days, with notice provided to you.

The bm888 Platform is strictly intended for adults who are 21 years of age or older. bm888 does not knowingly collect Personal Data from any person under the age of 21. Registration of an account by a person under 21 constitutes a material breach of the bm888 Terms & Conditions and this Privacy Policy.

bm888 employs age verification checks at registration and during KYC review processes to enforce this restriction. Where bm888 becomes aware that Personal Data has been collected from a person under 21, that data will be deleted immediately, the associated account will be permanently closed, and any funds held in that account may be forfeited in accordance with the Terms & Conditions.

If you are a parent or guardian and believe that a person under 21 in your care has registered an account with bm888, please contact our support team immediately at [email protected] so that we can investigate and take appropriate action without delay.

The bm888 Platform integrates game content from certified third-party studios, including Pragmatic Play, Evolution Gaming, PG Soft (Pocket Games Soft), NetEnt, Microgaming, Spribe, and others. While this content is delivered within the bm888 environment, each studio's software operates under its own data processing framework. bm888 ensures that all integrated studios are contracted to maintain appropriate data protection standards consistent with this Policy.

The bm888 Platform does not include outbound links to third-party websites unrelated to the provision of our services. However, if you access the Platform through a link from a third-party website, please note that bm888 has no control over and assumes no responsibility for the privacy practices of that third-party site. This Privacy Policy applies exclusively to data processed on the bm888 Platform itself.

14.1 Right to Update. bm888 reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in applicable law, our data processing practices, or our Platform's technical architecture. The effective date at the top of this page will be updated whenever a change is made.

14.2 Notification of Material Changes. Where a change to this Privacy Policy is material — meaning it significantly affects how your Personal Data is collected, used, or shared — bm888 will notify registered Members via a notification in their account dashboard and/or by email to the address on file, with a minimum of fourteen (14) calendar days' notice before the revised Policy takes effect.

14.3 Continued Use. Your continued use of the bm888 Platform following the effective date of any Privacy Policy update constitutes your acceptance of the revised Policy. If you do not accept the revised terms, you should cease using the Platform and contact support to arrange account closure.

If you have any questions about this Privacy Policy, wish to exercise your data rights, or need to report a privacy concern, please contact bm888 through the following channels:

• Live Chat: Available 24/7 directly from your bm888 account dashboard. This is the fastest channel for privacy enquiries and urgent data requests.
• Email: [email protected] — for formal written privacy requests, data rights submissions, and complaints. We aim to acknowledge all formal privacy communications within five (5) business days.
• Support Hours: 24/7 · WIB (UTC+7). Indonesian-speaking agents are available during peak WIB hours for Members who prefer to communicate in Bahasa Indonesia.

For formal data rights requests (access, erasure, portability, rectification), please submit your request in writing via email and include your registered account email address and a brief description of your request. bm888 may ask you to verify your identity before proceeding.