Privacy Policy

1. Definitions

The following definitions apply throughout this Privacy Policy:

• "Personal Data" means any information that identifies or could reasonably be used to identify a living individual, directly or indirectly — including name, national identity number, email address, IP address, and financial account details.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, and deletion.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data — in this case, atm138.
• "Data Processor" means a third party that processes Personal Data on behalf of atm138 under contractual instruction (e.g., payment processors, KYC verification providers).
• "Member" / "You" means any individual who has registered an account on the atm138 platform or whose Personal Data is processed in connection with the platform.
• "Platform" refers to the atm138 website at https://atm138.cam and all associated services.
• "Cookies" means small text files placed on your device by the Platform to enable session management, preference storage, and analytics.

2. Data Controller Identity

The Data Controller responsible for your Personal Data in connection with the atm138 platform is atm138, an internationally licensed online gaming operator. atm138 determines the purposes and means by which your Personal Data is collected and used in the course of providing gaming, payment, and customer support services through the Platform.

All data protection inquiries, subject access requests, and privacy-related complaints should be directed to our designated privacy contact, reachable at the email address provided in Section 15 of this Policy.

3. Personal Data We Collect

atm138 collects Personal Data across several categories. The table below summarizes what we collect and the context in which it arises:

atm138 does not collect special categories of sensitive Personal Data (such as racial origin, religious beliefs, health data, or biometric data) unless specifically required to fulfil a legal obligation, in which case you will be explicitly notified in advance.

4. How We Collect Your Data

atm138 collects Personal Data through the following means:

• Direct submission: Information you provide when completing the registration form, submitting KYC documents, making a deposit or withdrawal request, contacting customer support, or completing any other Platform form.
• Automated collection: Technical data collected automatically when you visit or use the Platform, including via cookies, web beacons, server logs, and similar tracking technologies. See Section 10 for full details on our cookie practices.
• Third-party sources: Identity and fraud-screening data obtained from KYC verification partners and financial crime databases during the account verification process. Payment confirmation data received from Indonesian bank payment gateways and e-wallet providers including OVO, DANA, GoPay, ShopeePay, and LinkAja.
• Publicly available sources: In limited circumstances, atm138 may verify information against publicly available records to fulfil anti-money laundering (AML) obligations.

5. Legal Basis for Processing

atm138 processes your Personal Data only where a valid legal basis exists. The applicable bases are:

• Contractual necessity: Processing required to create and manage your account, process deposits and withdrawals, deliver gaming services, and handle customer support — all of which are necessary to fulfil our contractual obligations to you under the atm138 Terms & Conditions.
• Legal obligation: Processing required to comply with applicable anti-money laundering regulations, know-your-customer requirements, and other legally mandated obligations imposed on internationally licensed gaming operators.
• Legitimate interests: Processing carried out for fraud prevention, security monitoring, platform optimization, and responsible gaming oversight, where such interests are not overridden by your rights and interests.
• Consent: Processing for direct marketing communications and non-essential cookies, where your prior opt-in consent has been obtained. You may withdraw consent at any time by adjusting your account notification preferences or contacting our support team.

6. How We Use Your Personal Data

atm138 uses collected Personal Data for the following specific purposes:

1. Account creation and management: Registering your account, verifying your identity through KYC, maintaining your account profile, and enabling access to Platform services.
2. Transaction processing: Facilitating deposits in IDR via BCA, BRI, BNI, Mandiri, CIMB Niaga, and e-wallets, processing withdrawal requests to your verified bank account, and maintaining transaction records for auditing purposes.
3. Regulatory compliance: Fulfilling anti-money laundering screening obligations, reporting requirements, and responding to lawful requests from regulatory or law enforcement authorities.
4. Fraud and security: Detecting, investigating, and preventing fraudulent activity, bonus abuse, multi-accounting, and unauthorized account access. Monitoring gameplay patterns for indicators of match-fixing or irregular betting activity.
5. Responsible gaming: Monitoring gaming activity to identify patterns consistent with problem gambling. Communicating responsible gaming resources and enforcing self-exclusion or deposit limit requests submitted by members.
6. Customer support: Responding to inquiries, resolving complaints, processing account changes, and conducting quality assurance reviews of support interactions.
7. Marketing communications: Sending promotional offers, bonus notifications, and platform updates where you have opted in. You may opt out at any time from your account settings.
8. Product improvement: Analyzing aggregated, anonymized gaming data to improve Platform performance, user experience, and game content selection.

7. Data Sharing & Third Parties

atm138 does not sell, rent, or trade your Personal Data to third parties for their own marketing purposes. We share your data only in the following controlled circumstances:

• Payment processors and banking partners: Your financial data is shared with Indonesian banking partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) solely to process your deposit and withdrawal transactions.
• KYC and identity verification providers: Your identity documents and personal details are shared with contracted third-party KYC providers to complete required identity verification checks. These providers are bound by strict data processing agreements and may not use your data for any independent purpose.
• Game software providers: Where technically necessary, limited session and account data may be shared with game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, or Spribe to deliver their game products within the Platform environment.
• Fraud prevention and AML services: Data may be shared with specialist financial crime screening databases to fulfil anti-money laundering obligations and protect the integrity of the Platform.
• Legal and regulatory authorities: atm138 will disclose Personal Data to law enforcement agencies, courts, or regulators where required by applicable law or a valid legal order, or where disclosure is necessary to protect the rights, property, or safety of atm138, its members, or the public.
• Corporate transactions: In the event of a merger, acquisition, or asset sale affecting atm138, Personal Data may be transferred to the successor entity, subject to equivalent privacy protections and advance notice to affected members.

All third parties with whom atm138 shares Personal Data are required to maintain appropriate technical and organizational security measures and to process data only for the specific purposes authorized by atm138.

8. Data Retention

atm138 retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Active account data: Retained for the full duration of your account relationship with atm138, plus an additional period of up to 5 years after account closure to meet regulatory and audit obligations.
• Financial transaction records: Retained for a minimum of 5 years from the date of each transaction, consistent with standard AML record-keeping requirements applicable to international gaming operators.
• KYC documents: Retained for a minimum of 5 years from the date of verification or account closure, whichever is later.
• Customer support records: Retained for 3 years from the date of each support interaction, unless the matter relates to an ongoing dispute or legal claim.
• Marketing data: Retained until you withdraw consent or opt out of all marketing communications, after which it is deleted within 30 days.
• Technical and log data: Retained for up to 12 months for security monitoring and fraud investigation purposes, then deleted or anonymized.

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymized so that it can no longer be associated with any identifiable individual.

9. Data Security

atm138 takes the security of your Personal Data seriously and implements a layered set of technical and organizational safeguards, including:

• TLS/SSL encryption: All data transmitted between your device and our servers is protected using Transport Layer Security (TLS) encryption, ensuring that data cannot be intercepted in transit.
• Encrypted data storage: Sensitive Personal Data stored in our databases — including financial details and identity documents — is encrypted at rest using industry-standard encryption algorithms.
• Access controls: Access to Personal Data is strictly limited to atm138 personnel and contracted Data Processors who have a legitimate operational need to access it. Access is governed by role-based permissions and logged for audit purposes.
• Password hashing: Account passwords are stored as salted cryptographic hashes and are never stored or transmitted in plain text.
• Two-factor authentication: Members are strongly encouraged to enable two-factor authentication (2FA) on their accounts for an additional layer of login security.
• Penetration testing and security audits: atm138 conducts periodic security assessments to identify and remediate vulnerabilities in the Platform infrastructure.
• Incident response: In the event of a Personal Data breach that poses a risk to your rights and interests, atm138 will notify affected members without undue delay and take immediate steps to contain and investigate the incident.

10. Cookies & Tracking Technologies

atm138 uses cookies and similar tracking technologies to operate the Platform, remember your preferences, maintain your logged-in session, and gather analytics data that helps us understand how the Platform is used. The main categories of cookies we deploy are:

• Strictly necessary cookies: Essential to core Platform functions such as session management, login authentication, and security. These cookies cannot be disabled without impairing the Platform's basic functionality.
• Functional cookies: Used to remember your language preferences, display settings, and region — ensuring a consistent and personalized experience across sessions.
• Analytics cookies: Used to collect aggregated, anonymized data on how members navigate the Platform, which pages are visited most frequently, and where technical errors occur. This data is used solely to improve Platform performance and user experience.
• Marketing cookies: Used, with your prior consent, to deliver promotional offers and track the effectiveness of marketing campaigns. You may opt out of marketing cookies at any time through your account preferences.

You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies may prevent the Platform from functioning correctly. Clearing cookies will log you out of any active session.

11. Your Data Rights

Subject to applicable law, you hold the following rights in relation to your Personal Data held by atm138:

• Right of Access: You may request a copy of the Personal Data atm138 holds about you, along with information about how it is used and with whom it is shared.
• Right to Rectification: You may request correction of any inaccurate or incomplete Personal Data. For basic profile details, you may update information directly through your account settings.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purpose it was collected, where you withdraw consent (for consent-based processing), or where processing is unlawful. This right is subject to overriding legal retention obligations, particularly AML and audit requirements.
• Right to Restriction: You may request that atm138 restrict processing of your Personal Data in certain circumstances — for example, while the accuracy of data is being contested.
• Right to Data Portability: For data processed on the basis of your consent or contract, you may request a machine-readable copy of the data you provided to atm138 for transfer to another controller.
• Right to Object: You may object to processing of your Personal Data for direct marketing at any time, with immediate effect. You may also object to processing based on legitimate interests, subject to atm138 demonstrating compelling grounds.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of the rights listed above, please contact our privacy team using the details in Section 15. We will respond to all valid requests within 30 days of receipt. Where a request is complex or numerous, we may extend this period by a further 60 days, in which case we will notify you of the extension and the reason.

12. Minors

The atm138 Platform is strictly intended for adults aged 21 years and older. atm138 does not knowingly collect or process Personal Data relating to individuals under the age of 21. All registration attempts are subject to age verification, and accounts suspected to belong to minors will be suspended immediately pending investigation.

If you are a parent or guardian and believe that a minor under your care has submitted Personal Data to atm138 without your knowledge, please contact us immediately using the details in Section 15. We will promptly investigate and, where confirmed, delete the relevant Personal Data and close the associated account.

13. International Data Transfers

atm138 operates as an internationally licensed platform, and some of our Data Processors — including game software providers and KYC verification partners — are located outside Indonesia. When Personal Data is transferred internationally, atm138 takes the following steps to ensure adequate protection:

• We enter into binding data processing agreements with all recipient Data Processors that impose contractual obligations equivalent to the protections in this Privacy Policy.
• Where recipients are located in jurisdictions without an adequate data protection framework, we apply standard contractual clauses or equivalent transfer mechanisms to safeguard your data.
• We conduct due diligence on all third-party Data Processors before engaging them, assessing their security practices and data handling procedures.

By using the atm138 Platform, you acknowledge that your Personal Data may be transferred to and processed in countries outside your country of residence. In all cases, atm138 ensures that such transfers are subject to appropriate safeguards consistent with internationally recognized data protection standards.

14. Changes to This Privacy Policy

atm138 may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or Platform functionality. When we make material changes, we will provide advance notice by publishing a prominent notice on the Platform and, where appropriate, sending an email notification to the address registered to your account.

The date of the most recent revision is displayed at the top of this page. We encourage you to review this Privacy Policy periodically. Your continued use of the Platform following the effective date of any revision constitutes your acknowledgment of the updated policy. If you do not agree with a material change, you may close your account by contacting our support team before the change takes effect.

15. Contact Us

For all privacy-related inquiries, data subject access requests, or complaints regarding the handling of your Personal Data, please contact our dedicated privacy team through the following channels:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24/7 through the Platform interface, with Indonesian-speaking agents on standby
• Response Time: Privacy requests are acknowledged within 48 hours and resolved within 30 days

If you are dissatisfied with atm138's response to a privacy complaint, you have the right to escalate the matter to the relevant data protection authority in your jurisdiction or to seek resolution through the dispute resolution process described in the atm138 Terms & Conditions.