igm27 Privacy Policy

igm27 ("we", "us", "our") is committed to protecting the privacy of every individual who uses the igm27 platform. This Privacy Policy sets out a transparent account of how igm27 collects, uses, stores, shares, and protects personal data in connection with the operation of Indonesia's trusted online betting platform.

igm27 operates as an international online betting and gaming service, primarily serving players located across Indonesia, including Jakarta, Surabaya, Medan, Bandung, Bali, Yogyakarta, Semarang, and beyond. Our platform offers sportsbook betting, live casino, togel (Indonesia's traditional numbers lottery), slot games, and esports wagering, all denominated in Indonesian Rupiah (IDR).

This Privacy Policy should be read alongside the igm27 Terms & Conditions and Responsible Gaming Policy. Together these documents form the complete framework governing your relationship with igm27 as a registered member. If there is any conflict between this Privacy Policy and the Terms & Conditions on a data-related matter, this Privacy Policy takes precedence.

igm27 acts as the data controller in respect of all personal data collected through the igm27 platform. This means igm27 is responsible for deciding the purposes and means of processing your personal data and for ensuring that processing is carried out lawfully, fairly, and transparently.

For the purposes of this Privacy Policy, the following terms have the meanings set out below:

• "Personal Data" — Any information relating to an identified or identifiable natural person. An identifiable person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to that person.
• "Processing" — Any operation or set of operations performed on personal data, whether by automated means or otherwise, including collection, recording, organisation, structuring, storage, adaptation, retrieval, use, disclosure, transmission, restriction, erasure, or destruction.
• "Data Controller" — The entity that determines the purposes and means of processing personal data. igm27 is the data controller for all personal data collected through the igm27 platform.
• "Data Processor" — A third party that processes personal data on behalf of igm27, under igm27's instructions and subject to contractual data-processing obligations.
• "Member" — Any natural person who has registered a verified account on the igm27 platform and accepted the igm27 Terms & Conditions.
• "Sensitive Data" — A subset of personal data that warrants additional protection, including financial account details, government-issued identity document numbers, and data used for identity verification (KYC) purposes.
• "Cookie" — A small text file placed on your device by a website to store information about your session, preferences, or browsing behaviour.

igm27 collects the following categories of personal data in connection with the operation of the platform. We collect only the data that is necessary for the stated purposes and do not collect data in excess of what is required.

igm27 collects personal data through the following channels and mechanisms:

• Direct submission: Data you provide actively when registering an igm27 account, completing the KYC verification process, making a deposit or withdrawal, completing a responsible gaming form, or contacting igm27 customer support via live chat or email.
• Automated collection: Technical and usage data collected automatically as you interact with the igm27 platform, including IP address logging, device fingerprinting, session tracking, and cookie-based behavioural data. This collection occurs whenever you access any part of the igm27 platform.
• Payment processors: Transaction confirmation data received from igm27's payment processing partners when you deposit or withdraw funds via Indonesian bank transfer or e-wallet. igm27 receives confirmation of transaction status and the account details associated with the payment, but does not receive or store full card numbers or e-wallet security credentials.
• Identity verification providers: Results of identity and document verification checks conducted by igm27's third-party KYC service providers, including document authenticity scores and age verification outcomes.
• Risk and fraud screening services: Risk scores, fraud flags, and related data signals returned by igm27's fraud prevention and anti-money-laundering screening partners in connection with account activity and payment processing.

igm27 processes personal data only where a valid lawful basis exists. The following lawful bases apply to igm27's data processing activities:

• Contractual necessity: Processing that is necessary for the performance of the igm27 Member agreement, including account registration, payment processing, bet settlement, and withdrawal handling. Without this processing, igm27 cannot deliver the Services you have contracted for.
• Legal obligation: Processing required to comply with igm27's legal and regulatory obligations, including anti-money-laundering (AML) compliance, Know Your Customer (KYC) verification, age verification, and response to lawful requests from competent authorities.
• Legitimate interests: Processing necessary for igm27's legitimate business interests, where those interests are not overridden by your fundamental rights and freedoms. This includes fraud prevention, platform security, duplicate account detection, responsible gaming monitoring, and product improvement analytics.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent. Consent is used as the basis for sending you direct marketing communications via email or SMS. You may withdraw consent for marketing communications at any time by contacting igm27 customer support.

igm27 uses the personal data we collect for the following specific purposes:

• Account management: Creating, maintaining, and administering your igm27 member account, including processing login sessions, updating account information, managing wallet balances in IDR, and handling account closure requests.
• Identity and age verification: Verifying that you are a real person, that your identity matches the account details you have provided, and that you are at least 21 years of age as required by igm27's eligibility policy.
• Payment processing: Facilitating deposits via BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OCBC NISP, OVO, DANA, GoPay, ShopeePay, and LinkAja, and processing withdrawal requests to verified Member payment accounts.
• Responsible gaming: Monitoring Member betting patterns to identify indicators of problem gambling behaviour, enforcing self-imposed deposit limits and time-out periods, and proactively reaching out to Members whose activity triggers responsible gaming alerts.
• Fraud prevention and security: Detecting, investigating, and preventing fraudulent transactions, money laundering, duplicate accounts, bonus abuse, use of prohibited automation tools, and other forms of platform misuse.
• Customer support: Responding to Member enquiries, resolving disputes, processing complaints, and maintaining records of support interactions for quality assurance and training purposes.
• Product and platform improvement: Analysing aggregated and anonymised usage data to improve the igm27 platform, optimise the user experience, develop new features, and assess the performance of existing products.
• Marketing communications: Sending you promotional offers, bonus notifications, and product updates via email or SMS, where you have consented to receive such communications. You may withdraw consent at any time.
• Legal compliance: Meeting igm27's obligations under applicable laws and regulations, including retaining financial records for the legally required retention periods and responding to lawful requests from competent authorities.

igm27 does not sell, rent, or trade your personal data. We share personal data only with the following categories of third parties, and only to the extent necessary for the stated purpose:

• Payment processors: Indonesian banking partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OCBC NISP) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the minimum transaction data required to execute deposits and withdrawals. These providers operate under their own privacy policies and are independently regulated financial entities.
• Identity verification providers: Specialist KYC and age-verification service providers receive identity documents and biometric data solely for the purpose of verifying Member identity and age. These providers are bound by contractual data-processing obligations that restrict further use of the data.
• Fraud and AML screening providers: Risk management and anti-money-laundering screening services receive transactional and behavioural data for the purpose of generating risk scores and fraud flags to protect the platform and its Members.
• Game content providers: Game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive a session token and anonymised usage data to deliver their game content within the igm27 platform. These providers do not receive your full personal profile or financial data.
• Customer support tools: Live chat and support ticketing platform providers may process communications data on igm27's behalf under data-processing agreements that restrict use of the data to the provision of the support service.
• Legal and regulatory authorities: igm27 may disclose personal data to competent regulatory authorities, law enforcement agencies, or courts where required to do so by applicable law, a valid court order, or a lawful regulatory request. igm27 will notify affected Members of such disclosures where legally permitted to do so.

igm27 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

Following the expiry of the applicable retention period, igm27 will securely delete or irreversibly anonymise the relevant personal data. Where data has been anonymised, it may be retained indefinitely for statistical and analytical purposes, as it no longer constitutes personal data.

igm27 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• Transport encryption: All data transmitted between your device and the igm27 platform is encrypted using 256-bit SSL/TLS protocols. The igm27 platform enforces HTTPS on all connections and does not accept unencrypted HTTP connections.
• At-rest encryption: Sensitive personal data, including KYC documents and financial account details, is encrypted at rest on igm27's servers using AES-256 encryption.
• Access controls: Access to Member personal data by igm27 staff is restricted on a strict need-to-know basis. Role-based access controls ensure that only authorised personnel can access specific categories of data relevant to their job function.
• Multi-factor authentication: igm27's internal administrative systems require multi-factor authentication for all staff access. Members are encouraged to enable two-factor authentication (2FA) on their igm27 accounts for additional protection.
• Intrusion detection and monitoring: igm27 operates continuous network monitoring and intrusion detection systems. Unusual access patterns and potential security incidents trigger automated alerts for immediate review by the igm27 security team.
• Regular security audits: igm27 conducts regular independent security assessments, including penetration testing and vulnerability scanning, to identify and remediate security weaknesses before they can be exploited.
• Data breach response: In the event of a data breach that poses a risk to Member rights and freedoms, igm27 will notify affected Members without undue delay and will take immediate steps to contain the breach and minimise its impact.

igm27 uses cookies and similar tracking technologies to operate and improve the platform. The following types of cookies are used on the igm27 platform:

• Strictly necessary cookies: Essential for the basic operation of the igm27 platform. These cookies manage your login session, maintain your wallet state, and ensure the security of your connection. The platform cannot function without these cookies, and they cannot be disabled.
• Functional cookies: Enable enhanced features and personalisation, such as remembering your preferred language settings, your most recently used payment method, and your display preferences. Disabling these cookies may reduce platform functionality.
• Analytics cookies: Used to collect anonymised and aggregated data about how Members use the igm27 platform, including which pages are visited most frequently and where users encounter difficulties. This data is used solely to improve the platform and is not shared with third-party advertising networks.
• Security and fraud-prevention cookies: Support igm27's fraud detection systems by tracking device fingerprint data, session behaviour patterns, and other signals used to identify suspicious activity and prevent unauthorised account access.

You may control cookie settings through your web browser. Most modern browsers allow you to view, block, or delete cookies stored on your device. Please note that blocking strictly necessary cookies will prevent you from logging in to or using the igm27 platform. Browser-level cookie controls do not affect server-side session management or fraud-detection logs.

As an igm27 member whose personal data is processed by igm27, you have the following rights in relation to your personal data. To exercise any of these rights, please contact igm27 at [email protected].

igm27 will respond to all valid data rights requests within 30 days of receipt. Where a request is complex or igm27 receives a high volume of requests, the response period may be extended by a further 60 days, and you will be notified accordingly. igm27 reserves the right to verify your identity before processing a data rights request, to ensure that data is not disclosed to an unauthorised party.

The igm27 platform is strictly restricted to adults who are 21 years of age or older. igm27 does not knowingly collect or process personal data from any person under the age of 21.

• igm27 employs age verification measures at the point of registration and may request identity documents at any time to confirm that a Member meets the minimum age requirement.
• If igm27 becomes aware that personal data has been collected from a person under the age of 21, igm27 will immediately close the account, delete the personal data collected from that individual to the extent permitted by applicable law, and forfeit any wallet balance associated with the account.
• Parents and guardians who believe that a person under the age of 21 in their care has registered an igm27 account are encouraged to contact igm27 customer support at [email protected] immediately. igm27 will investigate and take appropriate action promptly.

The igm27 platform may reference or display content associated with third-party services, including game studios, payment providers, and sports data feeds. This Privacy Policy applies solely to personal data collected and processed by igm27 directly. It does not apply to any third-party websites, platforms, or services that you may access independently.

• igm27 has no control over the privacy practices, data collection activities, or security measures of independent third-party services. igm27 strongly recommends that you review the privacy policies of any third-party service before providing personal data to that service.
• Third-party game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft operate under their own privacy frameworks. Within the igm27 platform, these providers receive only the minimum data necessary to deliver their game content via the igm27 interface.
• Payment providers including BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja are independent financial entities subject to their own regulatory obligations and privacy policies. igm27 is not responsible for the data practices of these providers in connection with services they offer independently of the igm27 platform.
• igm27 is not liable for any loss or damage arising from your use of third-party services linked to or accessible in connection with the igm27 platform.

igm27 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, igm27's data processing practices, or the features and services offered by the igm27 platform.

• When igm27 makes a material change to this Privacy Policy, Members will be notified via the registered email address associated with their igm27 account at least 7 days before the change takes effect, or as soon as practicable where the change is required urgently by law or regulation.
• The updated Privacy Policy will be published on this page at igm27.net/privacy-policy with a revised "Last Updated" date prominently displayed at the top of the document.
• Continued use of the igm27 platform after the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the changes, you should cease using the igm27 platform and may request account closure by contacting igm27 customer support.
• For minor, non-material changes — such as corrections of typographical errors, clarifications of existing practices without substantive change, or updated contact details — igm27 may update this Privacy Policy without individual notification, relying on the publication of the revised document on this page.

If you have any questions, concerns, or requests relating to this Privacy Policy or igm27's data processing practices, please contact the igm27 data protection team through the following channel:

• Live Chat: Available 24 hours a day, 7 days a week, directly from the igm27 platform. Indonesian-speaking agents are available on every shift for Members who prefer to communicate in Bahasa Indonesia.
• Email: [email protected] — Please allow up to two business days for a response to non-urgent email enquiries. For urgent account security matters, live chat is strongly recommended for the fastest resolution.
• Data Rights Requests: To exercise any of the rights listed in Section 11, please email [email protected] with the subject line "Data Rights Request", your registered igm27 username, and a clear description of your request. igm27 will acknowledge receipt within 5 business days.
• Data Breach Reports: If you believe your igm27 account has been compromised or you have identified a security vulnerability on the igm27 platform, please contact igm27 immediately via live chat or email [email protected] with the subject line "Security Report".