Privacy Policy

1. Information We Collect

1.1 Information You Provide Directly

When you register for an account on ym200, we collect the following personal information:

• Account Registration Data: Full legal name, date of birth, email address, mobile phone number, residential address, nationality, and preferred currency (Indonesian Rupiah / IDR).
• Identity Verification Documents (KYC): Government-issued photo ID (Indonesian National Identity Card / Kartu Tanda Penduduk (KTP), passport, or driver's license), proof of residential address (utility bill, bank statement from BCA / BRI / BNI / Mandiri), and selfie photograph for identity confirmation.
• Financial Information: Bank account details, e-wallet account information (OVO, DANA, GoPay, ShopeePay, LinkAja), and transaction history including deposits, withdrawals, bets placed, and winnings paid.
• Communication Records: Any correspondence you send to ym200 via email, live chat, WhatsApp, or in-app messaging, including support tickets, complaints, and feedback.
• Marketing Preferences: Your opt-in or opt-out choices regarding promotional emails, SMS notifications, and push notifications.

1.2 Information We Collect Automatically

When you access or use the ym200 platform, we automatically collect certain technical and usage information:

• Device Information: IP address, device type (mobile, tablet, desktop), operating system, browser type and version, screen resolution, and unique device identifiers.
• Usage Data: Pages viewed, time spent on each page, click patterns, navigation paths, referral sources (how you arrived at ym200), date and time of access, session duration, and interaction with games, bets, and promotions.
• Location Data: Approximate geographic location derived from your IP address to ensure compliance with jurisdictional restrictions and to provide localized content (e.g., Indonesian Rupiah pricing, WIB time zone display).
• Cookies and Tracking Technologies: We use cookies, web beacons, and similar technologies to recognize your device, remember your preferences, analyze site traffic, and improve user experience. See Section 7 (Cookies) for more details.

1.3 Information from Third Parties

In certain circumstances, we may receive information about you from third-party sources:

• Payment Processors: When you deposit or withdraw funds, our payment partners (banks, e-wallet providers) may share transaction status, verification results, and fraud detection signals with ym200.
• Game Providers: Studios such as Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, and Ezugi provide us with game outcome data, wagering statistics, and RTP (Return to Player) metrics for your gameplay sessions.
• Fraud Prevention Services: We work with specialized fraud detection and anti-money-laundering (AML) service providers who may provide risk scores, watchlist matches, or verification results based on publicly available data and industry databases.

2. How We Use Your Information

ym200 collects and processes your personal information for the following lawful purposes:

2.1 Account Management and Service Delivery

• To create, maintain, and manage your ym200 account.
• To process deposits, withdrawals, and other financial transactions.
• To enable you to place bets on sports events, casino games, togel draws, and other gambling products offered on the platform.
• To provide customer support via live chat, email, WhatsApp, and in-app messaging.
• To send transactional notifications such as deposit confirmations, withdrawal receipts, bet settlement updates, and account security alerts.

2.2 Legal and Regulatory Compliance

• To verify your identity and age (minimum 21 years) as required by international gaming regulations and Indonesian legal standards.
• To comply with Know Your Customer (KYC) and Anti-Money Laundering (AML) obligations, including screening against sanctions lists and monitoring for suspicious activity.
• To respond to legal process, court orders, or government requests for information.
• To enforce our Terms and Conditions, detect and prevent fraud, cheating, collusion, bonus abuse, and other prohibited activities.

2.3 Platform Improvement and Analytics

• To analyze user behavior, preferences, and gameplay patterns to improve the ym200 platform's design, functionality, and game selection.
• To conduct A/B testing, usability studies, and performance optimization.
• To generate aggregated, anonymized statistics about platform usage, popular games, betting trends, and user demographics for internal business intelligence.

2.4 Marketing and Promotional Communications

• To send promotional emails, SMS messages, and push notifications about bonuses, special offers, tournaments, and new game launches — only if you have opted in to receive such communications.
• To personalize marketing content based on your gameplay preferences, betting history, and engagement patterns (e.g., showing togel promotions to users who frequently play togel).
• To conduct surveys, request feedback, and invite you to participate in loyalty or VIP programs.

You can opt out of marketing communications at any time by adjusting your account notification settings or clicking the "unsubscribe" link in any promotional email. Transactional and account security notifications cannot be opted out of as they are essential to the operation of your account.

2.5 Security and Fraud Prevention

• To monitor for unauthorized access, account takeover attempts, and suspicious login activity.
• To detect and prevent fraudulent transactions, multi-accounting, arbitrage betting, and other forms of abuse.
• To maintain audit logs and records as required by our operating license and regulatory authorities.

3. How We Share Your Information

ym200 does not sell, rent, or trade your personal information to third parties for their own marketing purposes. However, we may share your data with the following categories of recipients under strict confidentiality and data protection agreements:

3.1 Service Providers and Business Partners

• Payment Processors: Banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) process your deposits and withdrawals and may receive your name, account number, and transaction details.
• Game Providers: Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Ezugi, Spribe, and other studios receive anonymized or pseudonymized data about your gameplay sessions to deliver game content and calculate RTP statistics.
• Cloud Hosting and IT Services: We use third-party cloud infrastructure providers (servers, databases, content delivery networks) to store and process data. All providers are contractually required to implement appropriate security measures.
• Customer Support Platforms: Live chat, email ticketing, and CRM systems used by our support team may store conversation logs and account details.
• Fraud Detection and KYC Services: Specialized vendors perform identity verification, document authentication, AML screening, and risk assessment on our behalf.

3.2 Legal and Regulatory Authorities

We may disclose your personal information to law enforcement agencies, regulators, courts, or government bodies if required to do so by law, court order, subpoena, or legal process, or if we believe in good faith that disclosure is necessary to:

• Comply with legal obligations or respond to lawful requests for information.
• Protect the rights, property, or safety of ym200, our users, or the public.
• Detect, prevent, or investigate fraud, money laundering, terrorist financing, or other illegal activities.

3.3 Business Transfers

In the event that ym200 undergoes a merger, acquisition, sale of assets, or other corporate restructuring, your personal information may be transferred to the successor entity. We will notify you via email and/or a prominent notice on our website before your information is transferred and becomes subject to a different privacy policy.

3.4 With Your Consent

In any circumstances not covered above, we will only share your personal information with third parties if you have given explicit consent to such sharing.

4. Data Security Measures

ym200 takes the security of your personal information extremely seriously. We implement industry-standard technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction:

4.1 Encryption

• Data in Transit: All communications between your device and ym200's servers are encrypted using TLS 1.2 or higher (256-bit SSL encryption), ensuring that data cannot be intercepted by third parties.
• Data at Rest: Personal information stored in our databases is encrypted using AES-256 encryption. Passwords are hashed and salted using bcrypt with a minimum work factor of 12.

4.2 Access Controls

• Access to personal data is restricted to authorized ym200 employees, contractors, and service providers who need the information to perform their job functions. All personnel undergo background checks and sign confidentiality agreements.
• We enforce role-based access controls (RBAC) and the principle of least privilege — users can only access the minimum data necessary for their role.
• Multi-factor authentication (MFA) is required for all internal systems that handle sensitive data.

4.3 Infrastructure Security

• Our servers are hosted in ISO 27001-certified data centers with physical security measures including biometric access controls, 24/7 surveillance, and fire suppression systems.
• We employ firewalls, intrusion detection systems (IDS), and intrusion prevention systems (IPS) to monitor and block malicious traffic.
• Regular security audits, vulnerability assessments, and penetration testing are conducted by independent third-party security firms.

4.4 Data Breach Response

In the unlikely event of a data breach that compromises your personal information, ym200 will:

• Notify affected users via email within 72 hours of becoming aware of the breach.
• Report the breach to relevant regulatory authorities as required by applicable data protection laws.
• Provide clear information about what data was affected, what steps we are taking to mitigate harm, and what actions you should take to protect yourself (e.g., changing your password).

5. Data Retention and Deletion

5.1 How Long We Keep Your Data

ym200 retains your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy and to comply with legal, regulatory, accounting, and reporting obligations. Specific retention periods include:

• Active Accounts: Personal data is retained for the duration of your active account plus an additional period to comply with legal requirements.
• Closed Accounts: After you close your account, we retain core identity data (name, date of birth, KYC documents) and transaction history for a minimum of 7 years to comply with anti-money-laundering regulations and financial recordkeeping requirements.
• Marketing Data: If you opt out of marketing communications, your email address and opt-out preference are retained indefinitely to honor your request and prevent re-subscription.
• Cookies and Logs: Session cookies expire when you close your browser; persistent cookies are deleted after 12 months. Server logs and IP addresses are retained for 90 days for security and fraud detection purposes.

5.2 Right to Deletion

Under applicable data protection laws, you have the right to request deletion of your personal data in certain circumstances:

• The data is no longer necessary for the purposes for which it was collected.
• You withdraw your consent (where consent was the legal basis for processing).
• You object to processing based on legitimate interests and there are no overriding grounds for continued processing.
• The data was unlawfully processed.

However, we may refuse deletion requests if we are legally required to retain the data (e.g., for AML compliance, tax reporting, or to defend legal claims). To request deletion, contact our Data Protection Officer at [email protected] (plain text only — type manually into your email client).

6. Your Privacy Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

6.1 Right to Access

You have the right to request a copy of the personal information we hold about you. We will provide this in a structured, commonly used, and machine-readable format (e.g., CSV, JSON) within 30 days of your request.

6.2 Right to Rectification

If any personal information we hold about you is inaccurate or incomplete, you have the right to request correction. You can update most information directly in your account settings, or contact support for assistance.

6.3 Right to Erasure ("Right to be Forgotten")

You may request deletion of your personal data under the conditions outlined in Section 5.2 above.

6.4 Right to Restrict Processing

You can request that we temporarily suspend processing of your personal data in certain situations, such as when you contest the accuracy of the data or object to processing.

6.5 Right to Data Portability

You have the right to receive your personal data in a portable format and to request that we transmit it directly to another service provider where technically feasible.

6.6 Right to Object

You can object to processing of your personal data based on legitimate interests or for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds that override your rights.

6.7 Right to Withdraw Consent

Where processing is based on your consent (e.g., marketing emails, non-essential cookies), you have the right to withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, contact us at [email protected] (plain text — type manually). We may request additional information to verify your identity before fulfilling your request. We will respond within 30 days.

7. Cookies and Tracking Technologies

7.1 What Are Cookies?

Cookies are small text files stored on your device by your web browser when you visit a website. They allow the website to recognize your device on subsequent visits and remember your preferences, login status, and browsing behavior.

7.2 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the platform to function. These enable core features such as secure login, session management, and transaction processing. Cannot be disabled.
• Functional Cookies: Remember your preferences (language, currency, timezone) and provide enhanced features. Disabling these may reduce functionality.
• Analytics Cookies: Collect anonymized data about how users interact with ym200 to help us improve the platform. We use Google Analytics and similar tools.
• Advertising Cookies: Track your activity across websites to deliver personalized ads. We do not currently use advertising cookies on ym200.

7.3 Managing Cookies

You can control and delete cookies through your browser settings. Most browsers allow you to block all cookies, accept only first-party cookies, or receive a prompt before accepting cookies. Note that disabling cookies may affect your ability to use certain features of ym200. Visit your browser's help section for instructions on managing cookies.

8. International Data Transfers

ym200 operates internationally and may transfer your personal data to countries outside Indonesia for processing and storage. Some of these countries may not have data protection laws equivalent to those in Indonesia or the European Union. When we transfer your data internationally, we ensure that:

• The receiving country has been deemed to provide an adequate level of protection by relevant authorities.
• We implement appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission.
• The transfer is necessary for the performance of our contract with you (e.g., processing a withdrawal via an international payment gateway).

By using ym200, you acknowledge and consent to the international transfer of your personal data as described in this Policy.

9. Children's Privacy

ym200 is strictly for adults aged 21 years and older. We do not knowingly collect personal information from individuals under 21. If we become aware that a person under 21 has registered an account or provided personal data, we will immediately delete that account and all associated information. Parents or guardians who believe their child has provided information to ym200 should contact us immediately at [email protected].

10. Contact Information and Complaints

10.1 Data Protection Officer

If you have questions, concerns, or complaints about this Privacy Policy or how ym200 handles your personal data, please contact our Data Protection Officer:

• Email: [email protected] (displayed as plain text — please type this address manually into your email client)
• Subject Line: "Privacy Inquiry" or "Data Protection Request"
• Response Time: We aim to respond to all privacy inquiries within 7 business days.

10.2 Right to Lodge a Complaint

If you are not satisfied with our response to your privacy complaint, you have the right to lodge a complaint with the data protection authority in your jurisdiction. For Indonesian residents, this is the Ministry of Communication and Information Technology (Kementerian Komunikasi dan Informatika / Kominfo). For EU residents, contact your local supervisory authority.

11. Changes to This Privacy Policy

ym200 reserves the right to update or modify this Privacy Policy at any time to reflect changes in our practices, technology, legal requirements, or business operations. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page.
• Notify users via email or a prominent notice on the ym200 platform at least 30 days before the changes take effect.
• Obtain your renewed consent if the changes expand the scope of data collection or sharing in a way that requires consent under applicable law.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information. Continued use of ym200 after changes are posted constitutes acceptance of the updated Policy.