Privacy Policy

1. Introduction

koi200 ("the Company," "we," "us," or "our") operates the online gaming platform accessible at https://koi200.cam and is the data controller responsible for the personal data of all registered Users and visitors to the Platform. We are deeply committed to maintaining the privacy, integrity, and security of the personal information entrusted to us by our players across Indonesia — from Jakarta and Surabaya to Bandung, Bali, Medan, and beyond.

This Privacy Policy is designed to be clear, comprehensive, and accessible. We have structured it to answer the most important questions any User might have about their personal data: what we collect, why we collect it, who we share it with, how long we keep it, and how you can exercise control over it. We encourage all Users to read this document in full before using the koi200 Platform.

This Policy should be read alongside our Terms & Conditions, which govern the overall legal relationship between you and koi200, and our Responsible Gaming policy, which outlines our commitment to safe and fair gaming practices.

2. Definitions

Throughout this Privacy Policy, the following terms carry the meanings defined below:

• "Personal Data" means any information that directly or indirectly identifies a living individual, including name, national identity number (NIK), email address, phone number, IP address, device identifiers, and financial account details.
• "Processing" means any operation performed on Personal Data, including collection, storage, organization, retrieval, disclosure, use, transfer, deletion, or destruction.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data — in this context, koi200.
• "Data Processor" means any third party that processes Personal Data on behalf of koi200 under a data processing agreement (e.g., payment providers, cloud hosting partners).
• "User" / "You" means any individual who visits, registers on, or uses the koi200 Platform in any capacity.
• "KYC" means Know Your Customer — the identity and age verification process mandated for all players before withdrawals are processed.
• "Cookies" means small text files placed on your device by the Platform to enable functionality, analytics, and session management.
• "Sensitive Data" means a subset of Personal Data that carries elevated privacy risk, including identity document numbers (NIK), financial account details, and device biometric identifiers.

3. Data We Collect

koi200 collects the following categories of personal data, depending on the nature of your interaction with the Platform:

3.1 Registration & Account Data

• Full legal name as it appears on your Indonesian National Identity Card (KTP)
• Date of birth (used for mandatory 21+ age verification)
• Indonesian National Identity Number (NIK)
• Valid email address and active Indonesian mobile phone number
• Username, password (stored in hashed, non-reversible form), and security questions
• Residential address as stated on your KTP or supporting address document

3.2 Financial & Transaction Data

• Bank account details (account number, account holder name, bank name) for deposit and withdrawal processing via BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata, or other supported institutions
• E-wallet identifiers for OVO, DANA, GoPay, ShopeePay, and LinkAja transactions
• Full transaction history: deposit amounts, withdrawal amounts, dates, payment method used, and transaction reference numb ers, and processing status
• Bonus claim history, wagering activity records, and promotional participation logs

3.3 Identity Verification (KYC) Data

• Scanned or photographed copies of your KTP (Indonesian National Identity Card)
• Selfie photographs submitted for facial verification purposes
• Proof of address documentation (utility bills, bank statements dated within 3 months)
• Any additional documents requested during enhanced due diligence reviews

3.4 Technical & Usage Data

• IP address, approximate geolocation (city/region level), and internet service provider details
• Device type, operating system, browser type and version, screen resolution, and language settings
• Session timestamps, pages visited, features used, game sessions played, bet amounts, and game outcomes
• Referral source (e.g., search engine, referral link) and campaign attribution identifiers
• Cookie identifiers and local storage data as described in Section 10 of this Policy

3.5 Communications Data

• Records of all communications between you and koi200 customer support, including live chat transcripts, email correspondence, and any documents shared during support interactions
• Survey responses, feedback submissions, and voluntary information provided in any other communication with the Company

4. How We Collect Data

koi200 collects personal data through the following channels and methods:

• Directly from you: When you complete the registration form, submit KYC documents, make a deposit or withdrawal request, contact customer support, or interact with any feature on the Platform that requires you to provide information.
• Automatically via the Platform: Through server logs, cookies, session tracking technologies, and analytics tools that capture technical and behavioral data as you browse and use the Platform. These operate in accordance with our Cookies policy in Section 10.
• From payment providers: When you initiate a financial transaction, our integrated payment partners (including Indonesian banks and e-wallet providers) transmit transaction confirmation data to koi200 to credit or debit your Account accordingly.
• From identity verification partners: Where automated KYC verification tools are used, these partners may cross-reference the identity documents you submit against relevant databases and return a verification result to koi200.
• From fraud prevention and AML screening services: Third-party risk management services may provide supplementary data points to assist koi200 in identifying unusual account activity or potential financial crime.

5. Purpose of Processing

We use the personal data we collect strictly for the purposes described below. We do not process your data for any purpose that is incompatible with those originally stated at the time of collection.

6. Legal Basis for Processing

koi200 processes your personal data on the following legal grounds, consistent with applicable data protection principles:

• Contractual necessity: The majority of data processing activities are necessary for koi200 to fulfill its contractual obligations to you under the Terms & Conditions — including operating your Account, processing transactions, and delivering gaming services.
• Legal obligation: Certain processing activities — most notably KYC identity verification, transaction record-keeping, and AML screening — are required by applicable laws and international regulatory standards to which koi200 adheres.
• Legitimate interests: koi200 processes some data on the basis of its legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and service improvement — provided those interests are not overridden by your privacy rights.
• Consent: Where we wish to send you marketing communications, promotional offers, or use non-essential cookies, we will request your explicit consent. You may withdraw that consent at any time by contacting us or updating your Account communication preferences.

7. Data Sharing & Third Parties

koi200 does not sell, rent, or trade your personal data to any third party. We share data only in the specific, controlled circumstances described below, and only to the extent strictly necessary for each purpose:

• Payment processors and banking partners: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, and others) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the transaction data necessary to execute deposits and withdrawals from your Account. These entities process your data as independent data controllers under their own privacy policies.
• KYC and identity verification providers: Specialist third-party identity verification services receive your KYC documents solely for the purpose of verifying your identity and age, and are contractually bound to use that data for no other purpose.
• Game content providers: Software studios (including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, and Spribe) may receive anonymized or pseudonymized session data necessary to deliver and log game outcomes. These providers do not receive your full identity data.
• Cloud hosting and infrastructure providers: koi200 uses internationally reputable cloud infrastructure providers to host Platform data. These partners operate as data processors under binding agreements that restrict their use of your data to infrastructure services only.
• Fraud prevention and AML services: Specialist risk and compliance partners may receive transaction data and behavioral signals to assist in identifying potential fraud, money laundering, or match-fixing activity.
• Legal and regulatory authorities: Where required by law, court order, or the directive of a competent regulatory authority, koi200 may disclose your personal data to the relevant body. We will notify you of such disclosure where we are legally permitted to do so.
• Business succession: In the event of a merger, acquisition, or sale of koi200 or its assets, your personal data may be transferred to the acquiring entity, subject to an equivalent or higher standard of data protection.

8. Data Retention

koi200 retains personal data only for as long as is necessary to fulfill the purpose for which it was collected, to comply with applicable legal and regulatory obligations, or to resolve disputes and enforce our agreements. The following general retention periods apply:

• Active Account data: Retained for the full duration of your Account membership and for a minimum of 5 years following Account closure, to satisfy AML record-keeping obligations and to defend against any potential legal claims.
• KYC documents: Retained for a minimum of 5 years from the date of verification, in compliance with international anti-money laundering standards.
• Financial transaction records: Retained for a minimum of 7 years to satisfy financial record-keeping requirements applicable to the koi200 licensing jurisdiction.
• Customer support communications: Retained for 3 years from the date of the last interaction, to facilitate complaint resolution and quality assurance review.
• Technical and usage data (logs): Retained for 12 months in identifiable form, then anonymized or deleted. Aggregated, anonymized analytics data may be retained indefinitely for platform improvement purposes.
• Marketing consent records: Retained for the duration of the consent and for 3 years after withdrawal of consent, to demonstrate compliance with consent obligations.

Upon expiry of the applicable retention period, personal data will be securely deleted or irreversibly anonymized using industry-standard data destruction methods.

9. Data Security

koi200 implements a comprehensive, layered security architecture designed to protect your personal data against unauthorized access, disclosure, alteration, or destruction. Our security measures include, but are not limited to:

• Transport Layer Security (TLS/SSL): All data transmitted between your browser or app and the koi200 Platform is encrypted using 256-bit TLS encryption, ensuring that information in transit cannot be intercepted by third parties.
• Data encryption at rest: Sensitive data stored on koi200 servers — including financial account details, KYC documents, and identity records — is encrypted at rest using AES-256 encryption standards.
• Access controls: Access to personal data is restricted on a strict need-to-know basis. koi200 staff access rights are governed by role-based access control (RBAC) policies, and all access events are logged and audited.
• Password security: Account passwords are stored using one-way cryptographic hashing. koi200 does not store your password in any readable form, and our support staff cannot retrieve your password — only reset it through a verified process.
• Two-factor authentication (2FA): Players are strongly encouraged to enable 2FA on their koi200 Account as an additional layer of protection against unauthorized access.
• Penetration testing and vulnerability assessments: koi200 conducts regular third-party security audits and penetration tests to identify and remediate potential vulnerabilities in our systems before they can be exploited.
• Incident response: In the event of a data security incident that may affect your rights, koi200 will notify affected Users within a reasonable timeframe in accordance with applicable notification requirements.

10. Cookies & Tracking Technologies

koi200 uses cookies and similar tracking technologies to enable core Platform functionality, improve your experience, and analyze Platform usage. A cookie is a small text file stored on your device by your browser when you visit the Platform. We use the following categories of cookies:

• Strictly necessary cookies: These cookies are essential for the Platform to function. They enable session management, authentication, security checks, and basic navigation. These cookies cannot be disabled without disrupting core Platform functionality and do not require your consent.
• Functional cookies: These cookies remember your preferences — such as language settings, preferred payment method, and last-visited game category — to personalize your experience on return visits.
• Analytics cookies: We use aggregated, anonymized analytics data to understand how Users interact with the Platform — which pages are most visited, where users encounter difficulty, and how they navigate between sections. This helps us continually improve koi200. Analytics cookies require your consent.
• Session cookies: Temporary cookies that expire when you close your browser, used to maintain your login state and gaming session continuity during a single visit.
• Persistent cookies: Cookies that remain on your device for a defined period (typically 30–365 days), used to recognize returning Users and maintain certain Account preferences between sessions.

You may manage or disable cookies through your browser settings at any time. Please note that disabling strictly necessary cookies will impair the functionality of the koi200 Platform and may prevent you from accessing certain features, including Account login and financial transactions.

11. Your Data Rights

As a User of koi200, you hold the following rights over your personal data. These rights may be exercised at any time by submitting a written request to [email protected] with the subject line "Data Rights Request" along with your Account username and registered email address for verification purposes:

We will respond to all verifiable data rights requests within 30 calendar days of receipt. Where a request is complex or we receive a high volume of requests, we may extend this period by a further 30 days, with notification to you. We do not charge a fee for handling data rights requests unless a request is manifestly unfounded, repetitive, or excessive.

12. Children's Privacy

koi200 is strictly an adults-only platform. Access to all koi200 services is limited to individuals who are at least 21 years of age. We do not knowingly collect, process, or store personal data from any individual under the age of 21.

Our mandatory KYC verification process is specifically designed to confirm that all registered Users meet the 21+ age requirement before withdrawal privileges are activated. Any Account that is found, at any point, to belong to an individual under 21 years of age will be immediately closed, all gaming activity will be voided, and any remaining balance will be handled in accordance with our Terms & Conditions.

If you are a parent or guardian and you believe your child may have registered on the koi200 Platform without authorization, please contact us immediately at [email protected]. We will investigate the matter promptly, close the Account, and delete all associated data to the extent permitted by law.

13. International Data Transfers

koi200 operates globally and, in delivering its services to Indonesian players, may transfer personal data to servers and service providers located outside of Indonesia. Such transfers may occur in connection with cloud hosting infrastructure, third-party KYC verification services, or game content delivery networks.

Where personal data is transferred internationally, koi200 takes all reasonable steps to ensure that an equivalent level of data protection is maintained, including through the use of contractual data processing agreements, standard contractual clauses, or transfers to jurisdictions recognized as providing an adequate level of data protection.

By using the koi200 Platform and providing your personal data, you acknowledge and consent to the international transfer of your data in accordance with the safeguards described in this Policy.

14. Changes to This Privacy Policy

koi200 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we provide. All changes will be published on this page with an updated effective date displayed at the top of the document.

For material changes — those that significantly affect the way we process your personal data or that reduce your rights under this Policy — we will provide at least 14 calendar days' advance notice via email to the address registered on your Account and/or through a prominent notification on the Platform.

Your continued use of the koi200 Platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with any material change, you must cease using the Platform and may request Account closure by contacting our support team before the change takes effect.

We recommend that all Users review this Privacy Policy periodically to stay informed about how koi200 protects and manages their personal data.

15. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way koi200 handles your personal data, please do not hesitate to reach out to our Data Privacy team. We are committed to addressing all privacy-related inquiries promptly and transparently.

When submitting a data rights request, please include your registered Account username and the email address associated with your koi200 Account so that we can verify your identity before actioning your request. koi200 will never ask you to provide your Account password in any communication.