1 Introduction
Welcome to the cmibet Privacy Policy. This document explains how cmibet ("we", "us", "our") collects, uses, discloses, stores, and protects the personal information of individuals ("you", "your", "Member", "User") who access or use our online betting platform accessible at https://cmibet.cam (the "Platform").
cmibet operates as an internationally licensed online gambling service provider catering primarily to Indonesian players. We are committed to handling your personal data responsibly, transparently, and in compliance with applicable international data protection regulations, including principles derived from the General Data Protection Regulation (GDPR) and other globally recognized privacy frameworks.
By registering an account, depositing funds, placing bets, or otherwise using any part of our Services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, processing, and use of your personal data as described herein. If you do not agree with any part of this Privacy Policy, you must immediately cease using the Platform and contact us to arrange closure of your account.
2 Data Controller
For the purposes of applicable data protection laws, cmibet acts as the data controller with respect to the personal information collected through the Platform. This means that cmibet determines the purposes and means of processing your personal data.
As the data controller, cmibet is responsible for ensuring that all data processing activities comply with the principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, and confidentiality.
Contact details for privacy-related inquiries are provided in Clause 15 of this Privacy Policy.
3 Data We Collect
cmibet collects the following categories of personal data from Users:
3.1 Identity Information
- Full legal name (as it appears on your Indonesian National Identity Card / KTP Nasional)
- Date of birth
- Nationality and country of residence
- Gender
- Copy of identity document (Indonesian National ID / KTP) uploaded during KYC (Know Your Customer) verification
- Selfie photograph (used to verify identity against submitted ID document)
3.2 Contact Information
- Email address
- Mobile phone number (including country code)
- Residential address (if provided for verification purposes)
3.3 Financial Information
- Bank account details (bank name such as BCA, BRI, BNI, Mandiri; account number; account holder name) for deposit and withdrawal processing
- E-wallet account identifiers (OVO, DANA, GoPay, ShopeePay) where applicable
- Transaction history including deposit amounts, withdrawal amounts, bet placements, winnings, and bonus credits
- Payment method preferences
3.4 Account & Usage Data
- Username and encrypted password
- Login and session information (date, time, duration)
- Betting history (games played, sports bets placed, outcomes, stakes, winnings)
- Bonus claims and wagering progress
- Responsible gaming settings (deposit limits, self-exclusion status, session limits)
- Customer support interactions (chat transcripts, email correspondence, support tickets)
3.5 Technical & Device Data
- IP address
- Device identifiers (device type, operating system, browser type and version)
- Geolocation data (country-level or region-level, derived from IP address)
- Cookie identifiers and similar tracking technologies (see Clause 11)
- Browsing behavior on the Platform (pages visited, time spent, referral source)
4 How We Collect Data
cmibet collects your personal data through the following methods:
- Direct Provision: When you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, or update your account settings, you provide information directly to cmibet.
- Automated Collection: As you navigate and interact with the Platform, we automatically collect technical and usage data via cookies, web beacons, and similar tracking technologies embedded in the Platform's code.
- Third-Party Sources: We may receive data from third-party service providers such as payment processors (e.g., BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay), KYC verification services, and fraud prevention platforms to verify your identity, process transactions, and ensure platform security.
- Public Sources: In limited circumstances, we may supplement your information with publicly available data sources to fulfill our legal and regulatory obligations, such as screening against sanctions lists or verifying identity claims.
5 How We Use Your Data
cmibet processes your personal data for the following purposes:
- Account Management: To create, maintain, and manage your Member account, including authentication, password reset, and account recovery processes.
- Service Delivery: To provide access to our betting and gaming services, process bets, calculate and credit winnings, issue bonuses, and facilitate all core platform functionalities.
- Payment Processing: To process deposits and withdrawals via BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, and ShopeePay, reconcile transactions, and maintain accurate financial records.
- KYC & Verification: To verify your identity, age (21+ requirement), and address in compliance with anti-money-laundering (AML) regulations and responsible gaming obligations. This includes reviewing submitted documents and conducting enhanced due diligence where necessary.
- Fraud Prevention & Security: To detect, investigate, and prevent fraud, money laundering, collusion, bonus abuse, multiple account creation, unauthorized access, and other prohibited conduct described in our Terms & Conditions.
- Customer Support: To respond to your inquiries, resolve disputes, investigate complaints, and provide technical assistance via live chat, email, and WhatsApp.
- Responsible Gaming: To enforce our responsible gaming framework, including monitoring for signs of problem gambling, implementing deposit and loss limits, processing self-exclusion requests, and providing access to support resources.
- Regulatory Compliance: To comply with legal obligations under our international gaming license, including record-keeping, reporting to regulatory authorities, and cooperation with law enforcement investigations.
- Marketing & Promotions (with consent): To send you promotional offers, bonus notifications, newsletters, and updates about new games or features via email or SMS, where you have provided explicit consent. You may opt out at any time via account settings or unsubscribe links.
- Platform Improvement: To analyze usage patterns, conduct A/B testing, improve user experience, optimize performance, and develop new features based on aggregated and anonymized data.
- Legal Defense: To establish, exercise, or defend legal claims, enforce our Terms & Conditions, and protect the rights, property, and safety of cmibet, our Members, and the general public.
6 Legal Basis for Processing
Under applicable data protection laws, cmibet relies on the following legal bases to process your personal data:
- Contractual Necessity: Processing is necessary to perform our contract with you (the Terms & Conditions). This includes account creation, payment processing, service delivery, and customer support.
- Legal Obligation: Processing is necessary to comply with legal and regulatory obligations, including KYC/AML requirements, age verification (21+ enforcement), licensing conditions, tax reporting, and cooperation with law enforcement.
- Legitimate Interests: Processing is necessary for legitimate interests pursued by cmibet or a third party, provided those interests are not overridden by your fundamental rights. Legitimate interests include fraud prevention, platform security, network integrity, business analytics, and direct marketing to existing customers (subject to opt-out).
- Consent: Where processing is based on consent (e.g., marketing communications beyond transactional messages, optional data collection for surveys or feedback), you have the right to withdraw consent at any time via account settings or by contacting our support team. Withdrawal of consent does not affect the lawfulness of processing prior to withdrawal.
7 Data Sharing & Disclosure
cmibet does not sell your personal data to third parties for marketing purposes. However, we may share your data with the following categories of recipients in limited circumstances:
- Payment Service Providers: Banks (BCA, BRI, BNI, Mandiri) and e-wallet platforms (OVO, DANA, GoPay, ShopeePay) receive the minimum data necessary to process your deposits and withdrawals, including account holder name, account number, and transaction amounts.
- KYC & Verification Partners: Third-party identity verification services receive copies of your ID documents and personal details to conduct automated and manual identity checks, age verification, and address confirmation on our behalf.
- Game Providers: Licensed game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive limited data (username, bet amounts, game session identifiers) necessary to deliver live dealer games and slot games through their platforms.
- Fraud Prevention & Security Services: Specialized third-party platforms receive IP addresses, device identifiers, and behavioral data to detect fraudulent activity, bot usage, and security threats in real time.
- Cloud Hosting & IT Infrastructure Providers: Data is stored on secure cloud servers operated by trusted infrastructure providers. These providers process data solely on our instructions and under strict confidentiality and security obligations.
- Regulatory Authorities: We may disclose data to gaming regulators, tax authorities, and law enforcement agencies where legally required or where necessary to comply with a court order, subpoena, or regulatory investigation.
- Legal & Professional Advisors: Lawyers, accountants, auditors, and compliance consultants may access your data on a need-to-know basis to provide professional services to cmibet.
- Corporate Transactions: In the event of a merger, acquisition, or sale of all or part of cmibet's business, your personal data may be transferred to the acquiring entity, subject to the same privacy protections described in this Privacy Policy.
All third-party recipients are contractually obligated to handle your data securely, use it only for the specified purposes, and comply with applicable data protection laws.
8 Data Security Measures
cmibet employs industry-standard technical and organizational measures to protect your personal data from unauthorized access, loss, misuse, alteration, or destruction:
- Encryption: All data transmitted between your device and our servers is protected using 256-bit SSL/TLS encryption. Sensitive data at rest (passwords, payment details) is encrypted using strong cryptographic algorithms.
- Access Controls: Access to personal data is restricted to authorized cmibet personnel and third-party service providers who require access to perform their job functions. Access is granted on a least-privilege basis and is regularly reviewed.
- Authentication: User accounts are protected by strong password requirements (minimum 8 characters, mixed case, numbers). We encourage Members to enable two-factor authentication (2FA) where available.
- Monitoring & Logging: Our systems continuously monitor for suspicious activity, unauthorized access attempts, and security anomalies. Security logs are retained and regularly audited.
- Regular Audits: cmibet conducts periodic internal and external security audits, vulnerability assessments, and penetration testing to identify and remediate potential weaknesses.
- Incident Response: In the event of a data breach that poses a risk to your rights and freedoms, cmibet will notify affected Members and relevant regulatory authorities without undue delay, in accordance with applicable data breach notification requirements.
While we implement robust security measures, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your login credentials and for notifying us immediately if you suspect unauthorized access to your account.
9 Data Retention
cmibet retains your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law:
- Active Accounts: Data associated with active Member accounts is retained for the duration of the account's existence and for a period of time thereafter as required by our licensing obligations and applicable regulations.
- Closed Accounts: Following voluntary account closure or administrative suspension, we retain core identity, financial, and transaction data for a minimum of 5 years (or longer if required by specific regulations) to comply with AML record-keeping requirements, tax obligations, and dispute resolution needs.
- Marketing Data: If you have consented to receive marketing communications, we retain your contact preferences and communication history until you withdraw consent or for a reasonable period of inactivity (typically 3 years), after which your data is anonymized or deleted.
- Technical & Usage Logs: Server logs, IP address records, and session data are typically retained for 12-24 months for security monitoring and fraud detection purposes, after which they are anonymized or deleted.
- Legal Hold: Where data is subject to legal proceedings, regulatory investigation, or an unresolved dispute, retention periods may be extended until the matter is fully resolved.
After the applicable retention period expires, personal data is securely deleted or anonymized such that it can no longer be associated with an identifiable individual.
10 Your Privacy Rights
Subject to applicable law, you have the following rights with respect to your personal data:
- Right of Access: You have the right to request a copy of the personal data we hold about you. This includes the right to receive information about the categories of data processed, the purposes of processing, and the recipients with whom your data has been shared.
- Right of Rectification: You have the right to request correction of inaccurate or incomplete personal data. You can update most account information directly via your account dashboard.
- Right of Erasure ("Right to be Forgotten"): You may request deletion of your personal data in certain circumstances, such as where data is no longer necessary for the purposes for which it was collected, or where you withdraw consent. Note that this right is not absolute — we may be required to retain certain data to comply with legal obligations.
- Right to Restriction of Processing: You may request that we temporarily restrict processing of your data in certain situations, such as where you contest the accuracy of the data or object to processing based on legitimate interests.
- Right to Data Portability: Where processing is based on consent or contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller.
- Right to Object: You have the right to object to processing based on legitimate interests or for direct marketing purposes. Where you object to direct marketing, we will cease processing your data for that purpose immediately.
- Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
- Right to Lodge a Complaint: If you believe that cmibet has processed your personal data in violation of applicable data protection laws, you have the right to lodge a complaint with a supervisory authority in your jurisdiction.
To exercise any of these rights, please contact our Data Protection Officer via the details provided in Clause 15. We will respond to your request within 30 days (or such other period as required by applicable law).
11 Cookies & Tracking Technologies
cmibet uses cookies and similar tracking technologies to enhance your experience on the Platform, analyze usage patterns, and deliver targeted content. A cookie is a small text file stored on your device that allows us to recognize you on subsequent visits.
Types of Cookies We Use:
- Essential Cookies: Required for the Platform to function properly. These cookies enable core features such as login authentication, session management, and security protections. They cannot be disabled.
- Performance Cookies: Collect anonymous information about how visitors use the Platform, such as pages visited, time spent, and navigation paths. This data is aggregated and used to improve platform performance.
- Functional Cookies: Remember your preferences and settings (language preference, display options) to provide a more personalized experience on return visits.
- Targeting/Advertising Cookies: Track your browsing behavior across the Platform to deliver relevant promotional offers and measure the effectiveness of marketing campaigns. These cookies are set only with your consent.
You can manage cookie preferences via your browser settings. Note that blocking or deleting certain cookies may impair the functionality of the Platform and prevent you from accessing certain features. Most modern browsers provide options to accept, reject, or delete cookies on a per-site or global basis.
12 International Data Transfers
cmibet operates internationally and may transfer your personal data to servers and service providers located outside Indonesia, including to jurisdictions that may not provide the same level of data protection as your home country.
Where data is transferred internationally, cmibet ensures appropriate safeguards are in place, such as:
- Standard Contractual Clauses (SCCs) approved by relevant data protection authorities
- Adequacy decisions recognizing that the destination country provides an adequate level of protection
- Binding Corporate Rules or other legally recognized transfer mechanisms
By using the Platform, you acknowledge and consent to the transfer of your personal data as described in this Privacy Policy.
13 Children's Privacy
cmibet is committed to protecting the privacy of minors. The Platform is not intended for use by individuals under the age of 21 years. We do not knowingly collect personal data from individuals under 21.
All Members are required to complete KYC verification proving they are at least 21 years of age. If we become aware that a Member is under 21, we will immediately suspend the account, void any bets or winnings, refund deposited funds (where appropriate), and permanently delete all associated personal data.
If you believe that a minor has gained unauthorized access to the Platform or that we have inadvertently collected data from a minor, please contact us immediately at the details provided in Clause 15.
14 Changes to This Privacy Policy
cmibet reserves the right to modify, update, or replace this Privacy Policy at any time to reflect changes in our practices, legal requirements, or operational needs. The date of the most recent revision is displayed at the top of this document.
Where material changes are made to this Privacy Policy that affect how we process your personal data, we will notify you via email or prominent in-platform notification at least 7 days before the revised policy takes effect. For non-material updates (e.g., clarifications, formatting changes, updated contact details), changes may take effect immediately upon publication.
Continued use of the Platform after the revised Privacy Policy takes effect constitutes your acceptance of the updated terms. If you do not accept the revised Privacy Policy, you must cease using the Platform and contact us to arrange closure of your account.