b200m Privacy Policy

For the purposes of this Privacy Policy, the following terms carry the meanings set out below wherever they appear in this document:

b200m acts as the data controller for all Personal Data collected through the Platform. As controller, b200m determines the purposes for which your data is collected and the means by which it is processed. All data-processing activities carried out on behalf of b200m by third-party service providers (Processors) are governed by written data-processing agreements that impose obligations consistent with applicable data protection standards.

For any privacy-related enquiries, data subject requests, or concerns regarding the processing of your Personal Data, you may contact b200m's data protection contact point at:

b200m collects Personal Data through several channels: directly from you during registration and account use, automatically through your interaction with the Platform, and from third-party service providers (such as payment processors and identity verification agencies). The categories of data we collect are:

A — Registration & Account Data

• Full legal name (as it appears on your Indonesian national identity card / KTP or passport).
• Date of birth (used to verify that you meet the 21+ age requirement).
• Email address and Indonesian mobile phone number.
• City of residence within Indonesia (e.g., Jakarta, Surabaya, Bandung, Bali, Medan, Yogyakarta).
• Username and hashed password (passwords are never stored in plain text).

B — Identity & KYC Documents

• Scanned copies or photographs of government-issued identity documents (KTP or passport).
• Proof of bank account or e-wallet ownership (e.g., screenshot of BCA, BRI, BNI, Mandiri, OVO, GoPay, DANA, ShopeePay, or LinkAja account details).
• Proof of address documents (utility bills, bank statements, or official correspondence issued within the past three months).
• Facial verification images, where required by our identity verification service provider.

C — Financial & Transaction Data

• Deposit and withdrawal amounts (denominated in IDR / Rp), timestamps, and payment method references.
• Bank account numbers and e-wallet identifiers used for deposits and withdrawals.
• Transaction history, including details of all bets placed, games played, and bonus credits received.

D — Device & Technical Data

• IP address and approximate geographic location derived from IP data.
• Device type, operating system, and browser type and version.
• Session timestamps, page view logs, and click-path data.
• Cookie identifiers and similar tracking technologies (see Section 06).

E — Communications Data

• Content and metadata of messages exchanged with b200m support via live chat or email to [email protected].
• Records of any complaints, disputes, or responsible gaming requests submitted to b200m.

b200m processes your Personal Data only for specific, documented purposes. The table below maps each processing purpose to the data categories involved:

b200m does not use your Personal Data for automated decision-making that produces significant legal effects on you, except where such processing is required by our licensing obligations or anti-fraud systems. Where automated decisions affect your account (for example, an automated fraud flag), you have the right to request human review of that decision by contacting [email protected].

Each processing activity carried out by b200m rests on one of the following legal bases:

• Contractual necessity: Processing required to perform our contract with you — including account management, payment processing, KYC verification, and the delivery of betting and gaming services. Without this processing, b200m cannot provide its services to you.
• Legal obligation: Processing required to comply with applicable laws and our international gaming license obligations — including anti-money-laundering record keeping, regulatory reporting, and responding to lawful data requests from authorities.
• Legitimate interests: Processing necessary for b200m's legitimate business interests, where those interests are not overridden by your rights — including fraud prevention, platform security, responsible gaming monitoring, and anonymized analytics to improve our product.
• Consent: Processing based on your freely given, specific, and informed consent — including sending you promotional emails and personalizing marketing communications. You may withdraw consent at any time by updating your communication preferences in Account Settings or by contacting support.

b200m uses cookies and similar tracking technologies to ensure the Platform functions correctly, to remember your preferences, and to understand how players interact with our games and pages. We use the following categories of cookies:

b200m does not use third-party advertising or cross-site tracking cookies. You may manage cookie preferences through your browser settings at any time. Disabling strictly necessary cookies will impair your ability to log in and use the Platform.

b200m shares your Personal Data only in the limited circumstances described below. All third-party recipients are contractually bound to process your data solely for the specified purpose and to maintain appropriate security standards:

• Payment processors: Your bank account details and transaction amounts are shared with the relevant Indonesian bank (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) or e-wallet provider (OVO, GoPay, DANA, ShopeePay, LinkAja) as required to process deposits and withdrawals in IDR.
• Identity verification providers: KYC documents are processed by b200m's contracted identity verification service to confirm your name, age, and document authenticity. This provider operates under a strict data-processing agreement and is prohibited from using your documents for any other purpose.
• Game studios: When you play a game powered by a third-party studio (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Pocket Games Soft), your username, game session token, and balance are shared with that studio solely to enable gameplay. Studios do not receive your full name, address, or KYC documents.
• Licensing authority: b200m's gaming license regulator may require access to account records, transaction histories, and KYC data as part of compliance audits or investigations. b200m complies with all lawful regulatory data requests.
• Law enforcement: b200m will disclose Personal Data to law enforcement agencies or courts where required by a lawful order, warrant, or legal obligation. b200m will notify the affected Player of such disclosure where legally permitted to do so.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of b200m's business, your Personal Data may be transferred to the acquiring entity, subject to equivalent privacy protections. Affected Players will be notified before any such transfer takes effect.

b200m operates under an international gaming license, and some of the third-party service providers it engages — including game studios and technical infrastructure providers — may process data outside of Indonesia. Where such cross-border transfers occur, b200m ensures appropriate safeguards are in place, which may include:

• Standard contractual clauses approved by recognized international data protection authorities, incorporated into agreements with relevant Processors.
• Processing by recipients located in jurisdictions that our licensing authority considers to provide an adequate level of data protection.
• Binding corporate rules where the recipient is part of the same corporate group as b200m.

For players based in Indonesia, your primary account data and IDR transaction records are stored on servers that maintain security standards consistent with international best practices for the online gaming industry. If you wish to obtain more information about the specific safeguards applicable to international transfers of your data, please contact [email protected].

b200m retains Personal Data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law and our licensing obligations. The following retention schedule applies:

Upon expiry of the applicable retention period, b200m will securely delete or irreversibly anonymize your Personal Data. Deletion requests submitted before the end of a mandatory retention period will be noted and fulfilled as soon as the retention obligation expires, unless earlier deletion is legally permissible.

b200m implements a layered security framework to protect your Personal Data against unauthorized access, accidental loss, alteration, or disclosure. Our technical and organizational security measures include:

• Transport-layer encryption: All data in transit between your device and b200m's servers is protected using TLS 1.3 with strong cipher suites.
• Encryption at rest: Sensitive data fields — including KYC document stores and financial records — are encrypted at rest using AES-256.
• Password hashing: Account passwords are hashed using a modern, salted cryptographic algorithm (bcrypt). b200m never stores passwords in plain text and cannot retrieve them.
• Access controls: Access to production systems and player data is restricted to authorized b200m personnel on a strict need-to-know basis, enforced through role-based access controls and multi-factor authentication.
• Intrusion detection: b200m employs real-time intrusion detection and anomaly-monitoring systems that alert our security team to unusual access patterns or potential data breaches.
• Third-party security audits: The Platform and its underlying infrastructure are subject to regular independent security assessments as part of our licensing compliance program.

In the event of a data breach that is likely to result in a risk to your rights and freedoms, b200m will notify affected Players without undue delay in accordance with our obligations under applicable data protection law and our licensing authority's requirements.

As a b200m player, you have the following rights in relation to your Personal Data. These rights may be subject to limitations where b200m has overriding legal obligations (for example, AML record-keeping requirements that prevent earlier deletion):

To exercise any of the above rights, submit a written request to [email protected] with the subject line "Data Rights Request — [Your Username]". b200m will acknowledge your request within 5 business days and provide a full response within 30 calendar days. Complex requests or high-volume periods may require an extension of up to an additional 60 days, in which case you will be notified of the delay and the expected resolution date.

b200m's Platform is strictly intended for adults aged 21 years and above. b200m does not knowingly collect Personal Data from individuals under the age of 21 and will not create accounts for minors under any circumstances.

As part of our KYC verification process, every new account undergoes age verification using government-issued identity documentation. Any account found to belong to a player under 21 will be immediately closed, all funds will be returned to the verified source payment method after deducting any winnings, and the relevant records will be retained for regulatory compliance purposes.

If you are a parent or guardian and believe that a minor in your care has accessed or attempted to access b200m's Platform, please contact [email protected] immediately. b200m will investigate and take appropriate action, including the deletion of any Personal Data collected in relation to the minor where legally permissible.

b200m uses certain Personal Data specifically to support responsible gaming outcomes for our players. This processing is carried out in your interest and forms part of our obligations under our international gaming license. Specifically:

• Session monitoring: Session duration and betting frequency data are analyzed to identify patterns consistent with problem gambling behavior. Where such patterns are detected, b200m may proactively contact the Player or apply a temporary account cooling period.
• Deposit limit enforcement: Transaction data is used to enforce the deposit limits you set in your Account Settings. These limits cannot be circumvented by opening additional accounts — our duplicate-account detection systems cross-reference personal and device data across all registered accounts.
• Self-exclusion records: If you self-exclude from b200m, a record of your self-exclusion is retained for the lifetime of the exclusion period (and for five years thereafter) to prevent re-registration during the exclusion window.
• Support interactions: Communications with b200m's support team regarding responsible gaming concerns are flagged and stored in your account record to ensure continuity of care across support interactions.

Full details of the responsible gaming tools available to you — including deposit limits, session time reminders, cool-off periods, and self-exclusion — are described on our Responsible Gaming page. 21+ only. Please gamble responsibly.

b200m reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or licensing requirements. When material changes are made, b200m will:

• Update the "Last Updated" date displayed at the top of this page.
• Send a notification to the registered email address of all active Players at least 7 calendar days before the revised policy takes effect.
• Display a prominent notice on the Platform for a minimum of 14 days following the change.

Your continued use of the Platform after the effective date of any amendment constitutes acceptance of the revised Privacy Policy. If you do not agree with a material change, you may request Account closure before the effective date by contacting [email protected]. Prior versions of this Privacy Policy are available upon request.

For all privacy-related enquiries, data subject requests, or complaints regarding b200m's handling of your Personal Data, please use the contact details below. All privacy communications must be submitted in English and directed to the appropriate channel:

b200m takes privacy complaints seriously. If you are unsatisfied with b200m's response to a privacy complaint, you may escalate the matter to b200m's licensing authority using the contact information provided to you upon request. b200m will cooperate fully with any regulatory investigation into its data-processing practices.