bumi88 Privacy Policy

1. Definitions

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

• "bumi88," "we," "us," or "our" — refers to the operator of the bumi88 online gaming platform accessible at https://bumi88.cam, including all affiliated entities, officers, employees, and authorized agents.
• "Personal Data" — any information that identifies, or could reasonably be used to identify, a living individual directly or indirectly, including name, national ID number, email address, IP address, device identifiers, and financial account details.
• "Processing" — any operation performed on Personal Data, whether automated or manual, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Subject" or "you" — any individual whose Personal Data is processed under this Policy, including registered players, prospective users, and website visitors.
• "Third Party" — any natural or legal person other than bumi88 and the Data Subject who processes Personal Data on our behalf or to whom Personal Data is disclosed.
• "Cookies" — small text files placed on your device by the bumi88 platform to store session information, preferences, and anonymized usage analytics.
• "KYC" (Know Your Customer) — the identity verification process bumi88 carries out to confirm a player's identity, age, and source of funds in accordance with anti-money laundering and responsible gaming obligations.

2. Information We Collect

bumi88 collects only the Personal Data that is necessary and proportionate to operate a safe, compliant, and high-quality online gaming service for players across Indonesia. The categories of data we collect are set out below.

2.1 Registration and Identity Data

When you open a bumi88 account we collect: full legal name, date of birth, gender, nationality, residential address, city (e.g., Jakarta, Surabaya, Bandung, Medan), province, and postal code. For residents of Indonesia we also collect your National Identification Number (NIK / Nomor KTP) as required for KYC compliance. This data is used to verify your identity, confirm you meet our 21+ age requirement, and prevent duplicate or fraudulent accounts.

2.2 Contact Data

We collect your email address, mobile phone number, and — where provided — your WhatsApp contact details. These are used for account communications, transaction confirmations, promotional messages (where you have opted in), and customer support.

2.3 Financial and Payment Data

To process deposits and withdrawals in Indonesian Rupiah (IDR), we collect the bank account names and numbers associated with Indonesian bank accounts (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Danamon, OCBC NISP, Bank Permata, and BSI) and e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja). We do not store full bank account credentials or personal internet banking passwords. All payment data is handled in accordance with PCI-DSS standards.

2.4 KYC Verification Documents

As part of our mandatory identity verification process, we collect copies or photographs of government-issued identification documents (KTP, passport, or driver's license), proof of address documents, and selfie photographs taken during the liveness-check stage of verification. These documents are stored securely and processed solely for KYC and anti-money laundering (AML) compliance purposes.

2.5 Transaction and Gaming Activity Data

We record all deposits, withdrawals, bonus claims, wagers, game results, and account balance movements. This data enables us to settle bets accurately, detect fraud, fulfill audit obligations, and personalize your gaming experience. For sports bets this includes your selections, stakes, odds accepted, and settlement outcomes across markets including football (BRI Liga 1, EPL, Champions League, FIFA World Cup, AFF Cup), and other sports and gaming categories.

2.6 Technical and Device Data

When you access bumi88 we automatically collect: IP address, browser type and version, operating system, device model, screen resolution, time zone, referring URL, pages visited, session duration, and clickstream data. This information is used for security monitoring, fraud detection, platform optimization, and regional access controls.

2.7 Communications Data

We retain records of all communications between you and bumi88, including live chat transcripts, email correspondence, and WhatsApp messages. These records are maintained for dispute resolution, quality assurance, staff training, and compliance documentation.

3. How We Collect Data

bumi88 collects Personal Data through the following channels:

• Direct submission: Information you provide during registration, account verification, deposit/withdrawal requests, or support interactions.
• Automated collection: Technical data gathered automatically when you browse or use the platform, including through cookies, web beacons, and server-side logs.
• Third-party sources: Identity verification agencies, fraud prevention databases, payment processors, and analytics partners may provide supplementary data to validate your identity and protect your account.
• Publicly available sources: We may cross-reference data against publicly available databases to verify identity details, detect inconsistencies, or assess fraud risk.

4. How We Use Your Information

Your Personal Data is used exclusively for the purposes set out in this Policy. bumi88 does not sell, rent, or otherwise commercialize your Personal Data to unaffiliated third parties. Our primary uses are as follows:

5. Legal Basis for Processing

bumi88 processes your Personal Data only where we have a valid legal basis to do so. Depending on the specific processing activity, the applicable legal basis is one of the following:

• Contract performance: Processing necessary to perform the contract we have with you — for example, verifying your account, processing deposits, settling bets, and paying out winnings.
• Legal obligation: Processing required to comply with applicable law, including KYC/AML requirements, age verification mandates, record-keeping obligations, and responses to lawful regulatory or law-enforcement requests.
• Legitimate interests: Processing necessary for our legitimate business interests where those interests are not overridden by your rights — including fraud prevention, network security, and platform quality improvement.
• Consent: Processing based on your explicit, freely given consent — specifically for marketing communications. You may withdraw consent at any time by contacting support or using the unsubscribe mechanism in any promotional message.

6. Sharing and Disclosure of Personal Data

bumi88 does not sell or lease your Personal Data. We share data only in the circumstances described below and only with parties bound by appropriate confidentiality and data-processing obligations:

6.1 Service Providers and Processors

We engage trusted third-party service providers to support our operations. These include: payment gateway operators and Indonesian banking partners (BCA, BRI, BNI, Mandiri, and e-wallet providers); identity verification and KYC platform providers; cloud hosting and content delivery network (CDN) providers; cybersecurity and fraud detection vendors; game software providers (including Pragmatic Play, Evolution Gaming, PG Soft, and others); and customer communications platforms. All processors are contractually bound to process your data only on our instructions and to maintain equivalent security standards.

6.2 Regulatory and Law Enforcement Authorities

We will disclose Personal Data to competent regulatory bodies, law enforcement agencies, courts, or other government authorities when required by applicable law, a valid court order, or a lawful regulatory demand. We will notify you of such disclosure to the extent permitted by law.

6.3 Corporate Transactions

In the event of a merger, acquisition, restructuring, or sale of our business assets, Personal Data may be transferred to the acquiring entity as part of that transaction, subject to equivalent privacy protections. We will inform you of any such change and your options at the time.

6.4 Safety and Fraud Prevention

Where we believe disclosure is necessary to prevent serious harm, investigate fraud, enforce our Terms & Conditions, or protect the rights and safety of our players, staff, or third parties, we may share relevant data with appropriate parties.

7. Cookies and Tracking Technologies

The bumi88 platform uses cookies and similar tracking technologies to provide a functional, personalized, and secure gaming experience. The categories of cookies we deploy are as follows:

• Strictly necessary cookies: Essential for the operation of the platform, including session management, login state, and security tokens. These cannot be disabled without impairing core functionality.
• Functional cookies: Remember your preferences such as language, currency display, and notification settings to personalize your experience across sessions.
• Analytics cookies: Collect anonymized or aggregated data about how visitors interact with our platform — pages viewed, session duration, navigation paths — to help us improve usability and performance. We use industry-standard analytics tools with data anonymization enabled.
• Security and anti-fraud cookies: Identify suspicious activity patterns and help us detect unauthorized access attempts, bot activity, and collusion.

You can manage cookie preferences through your browser settings. Note that disabling certain cookies may affect the functionality of the bumi88 platform. We do not use third-party advertising or retargeting cookies.

8. Data Retention

bumi88 retains your Personal Data only for as long as necessary to fulfill the purposes for which it was collected and to comply with our legal, regulatory, and contractual obligations. Our general retention guidelines are:

• Active account data: Retained for the lifetime of your account plus five years following account closure, to satisfy AML record-keeping requirements and resolve any potential disputes.
• KYC documents: Retained for a minimum of five years from the date of verification or account closure, whichever is later, in accordance with applicable anti-money laundering regulations.
• Transaction records: Retained for a minimum of seven years from the transaction date for financial audit and regulatory compliance purposes.
• Customer communications: Live chat transcripts and email correspondence retained for three years for dispute resolution and quality assurance purposes.
• Technical and device logs: Retained for 12 months, after which they are anonymized or deleted unless required for an ongoing security investigation.
• Marketing consent records: Retained until you withdraw consent and for three years thereafter to demonstrate compliance with consent obligations.

When Personal Data is no longer required, it is securely deleted or anonymized so that it can no longer be linked to an identifiable individual. Anonymized data may be retained indefinitely for aggregate analytics and research purposes.

9. Security Measures

bumi88 implements a comprehensive set of technical and organizational security measures to protect your Personal Data against unauthorized access, accidental loss, destruction, or disclosure. Our security framework includes:

• 256-bit SSL/TLS encryption: All data transmitted between your device and our servers is encrypted using bank-grade Transport Layer Security (TLS 1.3 or higher), preventing interception by third parties.
• Encryption at rest: Sensitive data stored on our servers — including KYC documents, financial account references, and authentication credentials — is encrypted using AES-256 encryption.
• Access controls: Access to Personal Data is restricted on a strict need-to-know basis. All staff with data access undergo background checks and receive mandatory data protection training. Privileged access is subject to multi-factor authentication and audit logging.
• PCI-DSS compliance: Our payment processing infrastructure meets Payment Card Industry Data Security Standard requirements, ensuring financial data is handled to the highest available industry standard.
• Intrusion detection and monitoring: Our security operations team monitors platform infrastructure 24/7 using automated anomaly detection systems that flag unusual access patterns, brute-force attempts, and potential data exfiltration in real time.
• Regular security audits: We engage independent cybersecurity firms to conduct periodic penetration testing and vulnerability assessments of our platform infrastructure, with findings remediated on a risk-prioritized basis.
• Incident response: We maintain a documented data breach response plan. In the event of a security incident affecting your Personal Data, we will notify you and relevant authorities within the timeframes required by applicable law.

10. Your Rights

As a Data Subject, you hold a number of rights over your Personal Data. bumi88 is committed to honoring these rights in a timely and transparent manner. The rights available to you include:

• Right of access: You may request a copy of all Personal Data we hold about you, together with information about how it is processed. We will respond within 30 days of a verified request.
• Right to rectification: If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request correction. Minor corrections (such as updating a phone number) can be made directly through your account settings; larger corrections (such as legal name changes) require supporting documentation.
• Right to erasure ("right to be forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where processing was unlawful. Please note that certain data must be retained to satisfy legal obligations and cannot be erased on request.
• Right to restriction of processing: In certain circumstances — for example, while the accuracy of your data is being contested — you may request that we temporarily restrict processing of your data.
• Right to data portability: Where processing is based on your consent or contract performance and carried out by automated means, you may request your Personal Data in a structured, machine-readable format for transfer to another service provider.
• Right to object: You have the right to object to processing based on our legitimate interests, including profiling. You may also withdraw consent for marketing communications at any time by contacting our support team or using the unsubscribe link in any promotional email.
• Right not to be subject to automated decision-making: Where we make decisions about your account (such as fraud risk assessment) through solely automated means with significant effects, you have the right to request human review of that decision.

To exercise any of the above rights, please contact our Data Protection team using the details in Section 13 of this Policy. We may request proof of identity before processing your request to prevent unauthorized disclosure of data. We do not charge a fee for legitimate requests; however, we reserve the right to charge a reasonable administrative fee for manifestly unfounded or excessive requests.

11. Minors and Age Verification

The bumi88 platform is strictly intended for adults aged 21 years and over. We do not knowingly collect, process, or store Personal Data belonging to individuals under the age of 21. All registration attempts are subject to automated age screening, and full KYC verification — including submission of a government-issued identification document confirming date of birth — is required before any withdrawals are processed.

If we discover, at any point, that Personal Data has been collected from an individual under 21 years of age, we will immediately suspend the associated account, reverse any transactions where legally permissible, and permanently delete all Personal Data related to that individual. We encourage parents and guardians in Indonesia and elsewhere to use parental control software and to monitor their children's online activity to prevent unauthorized access to gambling platforms.

If you believe a minor has registered on our platform or has accessed it without authorization, please contact our customer support team immediately so we can investigate and take appropriate action without delay.

12. Changes to This Privacy Policy

bumi88 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or platform features. When we make material changes, we will notify registered users via email to the address on file and display a prominent notice on the platform for a period of at least 14 days before the changes take effect.

The "Last Reviewed" date at the top of this Policy is updated each time a revision is made. We encourage you to review this Policy periodically to stay informed about how we protect your Personal Data. Your continued use of the bumi88 platform following the effective date of any revised Policy constitutes your acknowledgment and acceptance of the updated terms.

Archived versions of previous Privacy Policies are available on request by contacting our Data Protection team at the address provided in Section 13 below.

13. Contact and Data Requests

If you have any questions, concerns, or requests relating to this Privacy Policy or the way bumi88 processes your Personal Data, please contact our Data Protection team through the following channels. All data-related requests will be acknowledged within 72 hours and resolved within 30 calendar days of receipt.

• Email: [email protected]
• General inquiries: [email protected]
• Live Chat: Available 24/7 through the chat widget on our platform — select "Data & Privacy" from the topic menu.
• WhatsApp support: +62 812-3456-7890 (available 08:00 – 02:00 WIB, Western Indonesia Time, UTC+7)

When submitting a data request, please include your registered email address, a description of your request, and a copy of a government-issued ID so we can verify your identity before disclosing or modifying any account data. We take data subject requests seriously and treat all communications with strict confidentiality.