Privacy Policy — koi789

1 Definitions

In this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, date of birth, national identity number, contact details, financial information, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, transmission, deletion, or destruction.
• "Platform" means the koi789 website at https://koi789.cam and all associated interfaces and services.
• "Player" / "You" means any individual who accesses, browses, registers on, or uses the Platform.
• "Company" / "We" / "Us" means the entity operating koi789 under its international gaming license.
• "Third-Party Processor" means any external entity engaged by the Company to process Personal Data on its behalf, such as payment processors, KYC verification providers, and IT infrastructure suppliers.
• "Consent" means a freely given, specific, informed, and unambiguous indication of the Player's agreement to the processing of their Personal Data for a stated purpose.

2 Data Controller

2.1 koi789 acts as the data controller in respect of Personal Data collected through the Platform. As data controller, the Company determines the purposes and means of processing your Personal Data and is responsible for ensuring that processing is carried out lawfully, fairly, and transparently.

2.2 Where Personal Data is shared with Third-Party Processors, those processors act as data processors under written data-processing agreements that bind them to process data only on the Company's documented instructions and to implement appropriate security measures.

2.3 For all data protection enquiries, requests, or complaints, you may contact the koi789 data protection team at: [email protected] (plain text — not a clickable link). We aim to acknowledge all data-related correspondence within two (2) business days.

3 Data We Collect

3.1 koi789 collects Personal Data through several channels. The categories of data we collect are described below:

3.1 Registration Data

When you create an Account, we collect your full legal name, date of birth, email address, phone number, and residential address in Indonesia. This information is required to create and administer your Account and cannot be omitted.

3.2 Identity Verification (KYC) Data

To comply with our anti-money-laundering and player-protection obligations, we collect copies of government-issued photo identification (such as your Kartu Tanda Penduduk / KTP, passport, or SIM), proof of address documents, and evidence of payment method ownership. This data is processed by our KYC verification partner under a strict data-processing agreement.

3.3 Financial & Transaction Data

We record all deposit and withdrawal transactions on your Account, including the amount in Indonesian Rupiah (IDR / Rp), the payment method used (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, OVO, DANA, GoPay, ShopeePay, or LinkAja), transaction timestamps, and reference numbers. Full payment card or bank account numbers are never stored on our servers — only masked identifiers are retained.

3.4 Betting & Gaming Activity Data

We record your wagering history, game selections, bet amounts, and outcomes across all products on the Platform — including sportsbook markets, live dealer tables, slot titles, and togel (Indonesia's traditional numbers lottery) draws. This data is used to administer your Account, detect problem gambling indicators, and comply with regulatory reporting obligations.

3.5 Technical & Device Data

We automatically collect certain technical information when you access the Platform, including your IP address, browser type and version, operating system, device type, referring URL, pages viewed, session duration, and time-zone setting. This data is used for security monitoring, fraud detection, and Platform performance optimization.

3.6 Communications Data

We retain records of all communications between you and our customer support team, whether conducted by email, live chat, or other messaging channels. These records are kept for quality assurance, dispute resolution, and regulatory compliance purposes.

3.7 Marketing Preference Data

Where you have opted in to receive promotional communications, we record your marketing consent status, preferred communication channel (email, SMS), and language preference (English or Bahasa Indonesia).

4 Purpose & Legal Basis for Processing

4.1 The table below sets out the purposes for which koi789 processes your Personal Data and the legal basis relied upon for each purpose:

4.2 Where processing is based on your consent (for example, marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal. To withdraw consent, update your preferences in Account Settings or contact support at [email protected].

5 Data Sharing

5.1 koi789 does not sell, rent, or trade your Personal Data to any third party for their own commercial purposes. We share your data only in the circumstances described below:

5.1 Payment Service Providers

To process deposits and withdrawals via BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, OVO, DANA, GoPay, ShopeePay, and LinkAja, we share the minimum necessary financial and identity data with the relevant payment service provider. These providers are subject to their own data protection obligations under Indonesian financial services regulation.

5.2 KYC & Identity Verification Providers

Your KYC documentation is processed by a specialist identity verification provider engaged by the Company under a binding data-processing agreement. The provider is permitted to use your data only for the purpose of verifying your identity on our behalf and is prohibited from retaining it beyond the period necessary to complete verification.

5.3 Fraud Prevention & Security Partners

We share limited technical and transactional data with fraud-detection and cybersecurity partners to identify suspicious activity, prevent account takeovers, and maintain the integrity of the Platform. These partners process data as data processors under our instructions.

5.4 Regulatory Authorities & Law Enforcement

We may disclose Personal Data to relevant regulatory authorities, law enforcement agencies, or courts where we are legally required to do so — for example, in response to a valid court order, anti-money-laundering reporting obligation, or regulatory audit. In such cases, we disclose only the minimum data required to comply with the legal obligation.

5.5 Corporate Transactions

In the event of a merger, acquisition, restructuring, or sale of all or part of the Company's assets, Player data may be transferred to the acquiring entity as part of that transaction, subject to the acquiring entity assuming the same data protection obligations set out in this Policy.

6 International Data Transfers

6.1 As koi789 operates with an internationally licensed platform and engages global technology and payment partners, your Personal Data may be transferred to and processed in countries outside Indonesia. Such countries may have data protection laws that differ from those applicable in Indonesia.

6.2 Where such transfers occur, the Company implements appropriate safeguards to ensure your data receives an equivalent level of protection, including contractual clauses with the receiving entity that impose data protection obligations consistent with this Policy.

6.3 By registering an Account and accepting this Privacy Policy, you acknowledge and consent to the international transfer of your Personal Data as described in this clause.

7 Data Retention

7.1 koi789 retains your Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our standard retention periods are:

• Account and Registration Data: Retained for the duration of your Account and for a minimum of five (5) years after Account closure, to satisfy anti-money-laundering and gaming regulatory requirements.
• KYC Documentation: Retained for a minimum of five (5) years after Account closure or the date of the last transaction, whichever is later.
• Transaction Records: Retained for a minimum of five (5) years from the date of each transaction in compliance with financial record-keeping obligations.
• Customer Support Communications: Retained for three (3) years from the date of the interaction, unless the communication relates to an ongoing dispute or regulatory matter, in which case retention continues until final resolution.
• Technical & Device Data: Retained in identifiable form for up to twelve (12) months, after which it is anonymized or deleted.
• Marketing Preference Data: Retained until you withdraw consent or close your Account, plus a reasonable period thereafter to demonstrate compliance with opt-out requests.

7.2 Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymized in accordance with our internal data destruction procedures.

8 Your Rights

8.1 Subject to applicable law, you have the following rights in respect of your Personal Data held by koi789:

8.2 To exercise any of the above rights, please contact us at [email protected]. We will respond to all valid requests within thirty (30) calendar days. In complex cases, this period may be extended by a further two months, in which case we will notify you of the extension and the reasons for it within the initial 30-day window.

8.3 We may need to verify your identity before processing a data rights request to ensure that Personal Data is not disclosed to, or acted upon at the request of, an unauthorized person.

8.4 Please note that certain rights are subject to limitations. For example, the right to erasure does not apply where retention is required to comply with a legal obligation (such as anti-money-laundering record-keeping) or to establish, exercise, or defend a legal claim.

9 Cookies & Tracking Technologies

9.1 koi789 uses cookies and similar tracking technologies (including pixels and local storage) to operate the Platform, maintain your logged-in session, remember your preferences, detect fraud, and analyze Platform usage. The categories of cookies we use are:

• Strictly Necessary Cookies: Required for core Platform functionality such as session management, security tokens, and load balancing. These cannot be disabled without breaking the Platform.
• Functional Cookies: Store your preferences such as language selection (English / Bahasa Indonesia), display settings, and time-zone (defaulting to WIB, UTC+7 for Indonesia). Disabling these may affect your experience.
• Analytics Cookies: Collect anonymized data about how Players navigate the Platform to help us identify performance issues and improve the user experience. No personally identifiable information is included in analytics reports.
• Security & Fraud Detection Cookies: Used by our fraud-prevention systems to identify suspicious patterns and protect accounts from unauthorized access.

9.2 You can manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will prevent you from logging in or using core Platform features.

9.3 koi789 does not use third-party advertising cookies or behavioral targeting cookies. No Player data is shared with advertising networks.

10 Security Measures

10.1 The Company implements a layered set of technical and organizational security measures to protect your Personal Data against unauthorized access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit TLS encryption for all data in transit between your device and our servers;
• AES-256 encryption for sensitive data stored at rest, including payment method details and KYC documents;
• Multi-factor authentication options for Player accounts;
• Regular penetration testing and vulnerability assessments conducted by independent third-party security firms;
• Role-based access controls ensuring that only authorized personnel can access Personal Data, strictly limited to what is necessary for their role;
• 24/7 automated security monitoring with real-time alerting for anomalous activity patterns;
• Strict vendor due-diligence processes applied before engaging any Third-Party Processor with access to Personal Data.

10.2 In the event of a Personal Data breach that poses a risk to Players' rights and freedoms, the Company will notify affected Players and the relevant supervisory authority within the timeframes required by applicable law, and will take all reasonable steps to contain and remediate the breach.

10.3 While the Company takes all reasonable steps to protect your data, no system is entirely immune from risk. You are responsible for maintaining the security of your own Account credentials. If you suspect unauthorized access to your Account, contact support immediately at [email protected].

11 Minors

11.1 The Platform is strictly intended for adults aged 21 and over. koi789 does not knowingly collect or process Personal Data belonging to individuals under the age of 21.

11.2 If we become aware that Personal Data has been submitted by or collected from a person under 21, we will immediately close the associated Account, delete the data, and return any deposits at our discretion following investigation.

11.3 If you are a parent or guardian and believe that a minor has registered on the Platform, please contact us immediately at [email protected] so that we can take prompt action.

12 Third-Party Links

12.1 The Platform may contain references to third-party services such as payment providers and game studios. This Privacy Policy applies solely to data processed by koi789. Where you interact directly with a third-party service (for example, completing a bank transfer through BCA internet banking), that third party's own privacy policy governs the processing of your data by that entity.

12.2 koi789 has no control over and accepts no responsibility for the privacy practices of third-party services. We encourage you to review the privacy policies of any third-party service you use in connection with your koi789 Account.

13 Amendments to This Policy

13.1 koi789 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or our data processing practices. Material changes will be communicated to registered Players via the email address on file with a minimum of seven (7) calendar days' advance notice.

13.2 The current version of this Privacy Policy, identified by the effective date displayed at the top of this page, supersedes all prior versions. We recommend that you review this page periodically to stay informed of any updates.

13.3 Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. If you do not agree to the revised terms, you must close your Account before the effective date of the change.

14 Contact & Complaints

14.1 For any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data by koi789, please contact our data protection team using the details below:

• Email: [email protected] (plain text — not a clickable link)
• Response Target: Within 2 business days for general privacy enquiries; within 30 calendar days for formal data rights requests
• Languages: English and Bahasa Indonesia
• Hours: 24 hours a day, 7 days a week, including Indonesian public holidays

14.2 If you are not satisfied with our response to a privacy complaint, you have the right to escalate the matter to the relevant data protection supervisory authority in your jurisdiction. In Indonesia, matters relating to electronic data protection may be directed to the Kementerian Komunikasi dan Digital (Ministry of Communication and Digital Affairs) or other competent authority as applicable under current Indonesian law.

14.3 We take all privacy complaints seriously and commit to investigating each one thoroughly and responding with a full written outcome within the applicable regulatory timeframe.