Privacy Policy — c200m

c200m operates the online betting and gaming platform accessible at https://c200m.lat (the "Platform"). In the course of providing our services — which include sports betting, live casino, slot games, fish shooting, keno, and account management — c200m necessarily collects and processes personal data about our members and platform visitors.

This Privacy Policy sets out the complete framework under which c200m handles personal data. It covers:

• The categories of personal data c200m collects from members and platform visitors.
• The specific purposes for which that data is collected and processed.
• The legal basis on which c200m relies to process your personal data.
• The circumstances under which c200m may share your data with third parties.
• The security measures c200m has in place to protect your data.
• The rights you hold in relation to your personal data and how to exercise them.

This Policy applies to all individuals who access the c200m Platform, whether as registered members or anonymous visitors, including users accessing the Platform from Jakarta, Surabaya, Bandung, Medan, Bali, Semarang, Yogyakarta, and all other locations across Indonesia. It applies regardless of the device used to access the Platform.

This Privacy Policy should be read alongside c200m's Terms & Conditions, which govern your contractual relationship with c200m.

The following definitions apply throughout this Privacy Policy:

• "Personal Data" means any information that identifies, or could reasonably be used to identify, a living natural person, directly or indirectly — including name, identification number, location data, contact details, and online identifiers.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, erasure, or destruction.
• "Data Controller" means c200m, the entity that determines the purposes and means of Processing Personal Data about Members.
• "Data Processor" means any third-party entity that processes Personal Data on behalf of c200m under a written data processing agreement.
• "Member" means any individual who has registered a c200m account on the Platform.
• "Visitor" means any individual who accesses the Platform without registering or logging in to a c200m account.
• "KYC" (Know Your Customer) means the identity and age verification procedures c200m conducts on Member accounts to comply with applicable anti-money laundering and responsible gaming obligations.
• "Cookies" means small text files placed on your device by the Platform that store information about your session, preferences, and browsing activity on the Platform.
• "Services" means the full suite of betting and gaming products offered on the Platform, including sports betting, live casino, slots, fish shooting, and keno.

c200m collects personal data through several channels: directly from you when you register or interact with the Platform, automatically through technical systems as you browse, and — in limited circumstances — from trusted third-party sources for identity verification purposes. The categories of data we collect are set out below.

3.1 Registration & Account Data

• Full legal name and date of birth.
• Username and encrypted account password.
• Email address and mobile phone number.
• Residential address (city, province, country — Indonesia).
• Preferred currency (Indonesian Rupiah / IDR).

3.2 Identity Verification (KYC) Data

• Government-issued photo identification: national identity card (KTP), passport, or driver's licence.
• Selfie or live photo for facial comparison against identity documents.
• Proof of address documentation where required by our compliance team.
• Source of funds documentation for high-value accounts, as required under applicable anti-money laundering standards.

3.3 Financial Transaction Data

• Bank account numbers associated with deposits and withdrawals (BCA, BRI, BNI, Mandiri, and other supported Indonesian banks).
• E-wallet account identifiers for OVO, DANA, GoPay, ShopeePay, and LinkAja transactions.
• Transaction amounts, dates, times, and reference numbers.
• Account balance history and wagering activity records.

3.4 Technical & Device Data

• IP address and approximate geolocation derived from IP.
• Device type, operating system, and browser version.
• Session timestamps, page visit logs, and navigation patterns within the Platform.
• Referral URL (the page from which you arrived at the Platform, if applicable).

3.5 Communications Data

• Records of live chat conversations with c200m's customer support team.
• Email correspondence sent to or received from c200m.
• Responses to surveys, promotions, or feedback forms you voluntarily complete.

c200m uses the personal data it collects exclusively for legitimate operational, legal, and security purposes. We do not sell your personal data to any third party. The specific purposes for which your data is used are as follows:

c200m does not use automated decision-making processes that produce legal or similarly significant effects on Members without a human review stage. Where automated tools are used (for example, in fraud screening or responsible gaming pattern detection), a human compliance officer reviews any outcome before a material account action is taken.

c200m processes your personal data on the following legal bases, depending on the specific processing activity:

• Contractual Necessity. The majority of c200m's data processing activities are necessary to perform the contract between c200m and you as a Member — specifically, to operate your account, process your transactions, and deliver the Services you have requested. Without this processing, c200m would be unable to provide the Services.
• Legal Obligation. Certain processing activities — particularly KYC identity verification, anti-money laundering transaction monitoring, and record-keeping — are required by applicable law and international compliance standards. c200m cannot waive these obligations on the basis of member objection.
• Legitimate Interests. c200m processes technical and device data, navigation logs, and fraud-detection signals on the basis of its legitimate interest in maintaining a secure, fair, and operationally stable platform. This processing is proportionate and does not override your fundamental privacy rights.
• Consent. Where c200m wishes to send you promotional communications, including bonus offers, seasonal promotions tied to events such as Idul Fitri, Ramadhan, or Indonesian Independence Day (17 August), or personalised product recommendations, we will rely on your explicit consent. You may withdraw consent to marketing communications at any time by contacting support or using the opt-out mechanism in any marketing email.

c200m does not sell, rent, or trade your personal data. We share personal data only in the following limited and controlled circumstances:

• Payment Processors. To facilitate deposits and withdrawals, c200m shares necessary financial data with authorised payment processors and the relevant Indonesian banks and e-wallet providers (including BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, and ShopeePay). These processors act as Data Processors under written agreements and are permitted to use your data only to execute the specific transaction.
• KYC and Identity Verification Providers. c200m may engage specialist third-party KYC technology providers to assist with identity document verification and facial comparison. These providers process your KYC data strictly under c200m's instructions and are contractually prohibited from retaining or using your data beyond the scope of verification.
• IT Infrastructure and Hosting Providers. c200m's platform and data are hosted on secure cloud infrastructure. Our hosting providers process data on c200m's behalf and are bound by data processing agreements requiring them to maintain appropriate security standards.
• Legal and Regulatory Authorities. c200m will disclose personal data to law enforcement agencies, regulatory bodies, or courts where required by a valid legal order, warrant, or regulatory obligation. c200m will, where permitted by law, notify affected Members of such disclosures.
• Corporate Transactions. In the event of a merger, acquisition, or sale of substantially all of c200m's assets, your personal data may be transferred to the successor entity, subject to the same privacy protections described in this Policy. Members will be notified of any such transfer in advance.

The c200m Platform uses cookies and similar tracking technologies to ensure the platform functions correctly, to maintain your login session, and to understand how Members interact with the Platform so that we can improve it over time.

Categories of cookies used by c200m:

• Strictly Necessary Cookies. These cookies are essential for the Platform to operate. They maintain your login session, preserve your language and currency preferences, and ensure that security features function correctly. These cookies cannot be disabled without breaking the core functionality of the Platform.
• Functional Cookies. These cookies remember your in-Platform preferences — such as your preferred sports markets, recently viewed games, and notification settings — to provide a more personalised experience across sessions.
• Analytics Cookies. c200m uses privacy-respecting analytics tools to collect aggregated, anonymised data about how visitors and Members navigate the Platform. This data helps us identify performance issues, improve page layouts, and prioritise new features. Analytics data is not linked to individual member identities.
• Security Cookies. These cookies support c200m's fraud detection and account security systems by tracking device fingerprints and unusual session patterns that may indicate unauthorised account access.

You may manage your cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent you from logging in to the Platform. c200m does not use third-party advertising or behavioural tracking cookies.

c200m retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law or regulatory obligation. The following retention guidelines apply:

• Active Account Data. Personal data associated with an active c200m account is retained for the duration of the account's active status, plus a post-closure retention period of at least 5 years to satisfy applicable financial record-keeping and anti-money laundering requirements.
• KYC Documents. Identity verification documents are retained for a minimum of 5 years following account closure, or longer where required by applicable law.
• Transaction Records. All financial transaction records are retained for a minimum of 5 years to comply with applicable financial regulations and to support dispute resolution processes.
• Communications Data. Customer support communications are retained for 2 years following the closure of the relevant support case, and for longer periods where the communication is relevant to an ongoing compliance investigation or legal proceeding.
• Technical Logs. Server and access logs containing IP addresses and session data are retained for 12 months, after which they are anonymised or deleted.
• Visitor Data. Cookie and analytics data from Platform visitors who have not registered an account is retained in anonymised, aggregated form and is not linked to any individual.

Following the expiry of the applicable retention period, c200m will securely delete or anonymise your personal data so that it can no longer be associated with you.

c200m takes the security of your personal data seriously and has implemented a layered set of technical and organisational security measures designed to protect your data against unauthorised access, disclosure, alteration, or destruction:

• 256-Bit SSL/TLS Encryption. All data transmitted between your device and c200m's servers is encrypted using industry-standard 256-bit SSL/TLS protocols. This ensures that your personal and financial data cannot be intercepted in transit.
• Encrypted Data Storage. Sensitive data stored on c200m's servers — including passwords, financial account identifiers, and KYC documents — is encrypted at rest using strong encryption algorithms. Passwords are hashed using a one-way function and are never stored in plain text.
• Access Controls. Access to personal data within c200m's organisation is strictly limited on a need-to-know basis. Staff members are granted access only to the categories of data required to perform their specific job functions, and all data access is logged and audited.
• Segregated Member Funds. Member account balances are held in financial accounts that are fully segregated from c200m's own operational funds, providing an additional layer of financial protection for Member deposits.
• Security Monitoring. c200m's technical infrastructure is subject to continuous security monitoring for anomalous activity, intrusion attempts, and denial-of-service events. The security operations team responds to incidents in real time.
• Vendor Security Standards. All third-party Data Processors engaged by c200m are contractually required to maintain security standards at least equivalent to those maintained by c200m itself.

While c200m takes all reasonable precautions, no internet-based platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for notifying c200m immediately at [email protected] if you suspect any unauthorised access to your account.

As a c200m member or Platform visitor, you hold the following rights in relation to your personal data. To exercise any of these rights, please contact c200m's support team at [email protected] with a clear description of your request. c200m will respond within 30 days of receipt.

• Right of Access. You have the right to request a copy of the personal data c200m holds about you, along with information about how that data is being processed.
• Right to Rectification. If any personal data c200m holds about you is inaccurate or incomplete, you have the right to request that it be corrected. You may also update certain personal details directly from your account dashboard.
• Right to Erasure. In certain circumstances, you have the right to request that c200m delete your personal data. This right is subject to exceptions — for example, c200m cannot delete data that it is legally required to retain for anti-money laundering or financial record-keeping purposes.
• Right to Restrict Processing. You may request that c200m restrict the processing of your personal data in specific circumstances, such as while the accuracy of your data is being contested or while an objection to processing is being assessed.
• Right to Data Portability. You have the right to receive a structured, machine-readable copy of the personal data you have provided to c200m, and to have that data transmitted to another data controller where technically feasible.
• Right to Object. You have the right to object to the processing of your personal data where c200m relies on legitimate interests as the legal basis. You also have an unconditional right to object to the processing of your data for direct marketing purposes at any time.
• Right to Withdraw Consent. Where c200m processes your data on the basis of your consent (such as for promotional communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

c200m will not charge a fee for handling data rights requests unless they are manifestly unfounded or excessive. Where a request cannot be fulfilled — for example, because it conflicts with a legal retention obligation — c200m will explain the reason clearly in its response.

The c200m Platform is strictly intended for adults aged 21 and over. c200m does not knowingly collect personal data from any individual under the age of 21. Age verification is conducted as part of the standard KYC process on all c200m accounts.

If c200m becomes aware that personal data has been collected from a person under the age of 21 without verifiable parental or guardian consent, c200m will take immediate steps to delete that data, permanently close the associated account, and return any funds to the depositing payment method after satisfactory verification of ownership.

If you believe that a minor is using the c200m Platform, please contact our support team immediately at [email protected]. For guidance on parental control tools that can restrict access to online gambling platforms, please visit our Responsible Gaming page.

The c200m Platform integrates services provided by third-party technology partners to deliver the full range of gaming and payment functionality. These include game content providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft, as well as payment technology providers, KYC verification services, and cloud infrastructure providers.

Each third-party provider operates under its own privacy and data security policies, in addition to the contractual obligations it owes to c200m as a Data Processor. c200m conducts due diligence on all third-party providers before engagement and requires contractual confirmation of appropriate data protection standards.

The c200m Platform does not contain links to external third-party websites for general browsing purposes. c200m accepts no responsibility for the privacy practices or content of any external website that a Member may independently choose to visit.

c200m reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, our data processing practices, or the services we provide. When material changes are made, c200m will notify active Members via a prominent notice on the Platform and, where appropriate, by email to the address registered on your account. The "Last Updated" date at the top of this document will be revised to reflect each update.

Your continued use of the c200m Platform following the publication of a revised Privacy Policy constitutes your acknowledgement of the changes. If you do not agree with any material change to this Policy, you must cease using the Platform and may contact support to request account closure and the return of any Real Money Funds balance.

We encourage you to review this Privacy Policy periodically to stay informed about how c200m is protecting your information. All previous versions of this Policy are retained internally and are available on request.

If you have any questions, concerns, or complaints regarding this Privacy Policy or c200m's handling of your personal data, please contact us through the following channels:

• Email: [email protected] — please mark your subject line "Privacy Request" or "Data Complaint" for priority routing to our data protection team.
• Live Chat: Available 24/7 directly from the Platform via the chat widget in your Member dashboard. Indonesian-speaking agents are available at all hours.
• Response Time: c200m will acknowledge all privacy-related queries within 24 hours (WIB business hours) and will aim to resolve or formally respond to substantive requests within 30 calendar days.

If you are not satisfied with c200m's response to a privacy complaint, you have the right to escalate the matter through the applicable dispute resolution process outlined in c200m's Terms & Conditions. c200m is committed to resolving all privacy concerns fairly and transparently.