umi55 Privacy Policy

This Privacy Policy ("Policy") describes how umi55, operated at umi55.cam ("we", "us", "our", "the Platform"), collects, processes, stores, and protects the personal data of individuals who visit, register on, or otherwise interact with the umi55 online betting and casino platform.

This Policy applies to all members of umi55 globally, with particular reference to members based in Indonesia, including Jakarta, Surabaya, Bandung, Medan, Bali, and other regions across the archipelago. Indonesian players engage with umi55 across a range of products including sports betting on BRI Liga 1 and international leagues, live dealer casino, togel (Indonesia's traditional numbers lottery), and slot games — all of which involve personal data processing activities described in this Policy.

By registering an account with umi55 or continuing to use the platform after this Policy has been communicated to you, you acknowledge that you have read and understood this Policy and consent to the data processing activities described herein. If you do not agree with this Policy, you must not register an account or continue using umi55.

This Policy is incorporated by reference into umi55's Terms & Conditions. Terms not otherwise defined here carry the meanings assigned to them in the Terms & Conditions.

In this Privacy Policy, the following terms have the meanings stated:

• "Personal Data" — any information that identifies or could identify a living individual, directly or in combination with other data. This includes name, email address, IP address, device identifiers, and KTP (Kartu Tanda Penduduk) identity card number.
• "Processing" — any operation performed on personal data, including collection, storage, use, transmission, alteration, and deletion.
• "Data Controller" — umi55, which determines the purposes and means of processing your personal data.
• "Data Processor" — a third party that processes personal data on behalf of umi55, such as payment processors and cloud hosting providers, under binding contractual obligations.
• "Member" / "You" — any individual who has registered a umi55 account or is otherwise interacting with the platform.
• "Sensitive Data" — categories of personal data that warrant heightened protection, including copies of identity documents submitted during KYC verification.
• "Retention Period" — the duration for which umi55 stores personal data before it is securely deleted, as detailed in Section 9.

umi55 collects personal data across several categories, each collected only to the extent necessary for the specific purpose stated:

umi55 collects personal data through the following channels:

• Direct Submission: Data you provide when registering an account, completing KYC verification, making a deposit or withdrawal request, submitting a support inquiry, or opting in to a promotional offer.
• Platform Activity: Data generated automatically as you use umi55 — including game sessions, betting activity, login events, and navigation patterns — recorded in server logs and analytics systems.
• Payment Processors: Confirmation data returned by BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, LinkAja, and other payment partners following transaction authorization. umi55 does not store full bank account numbers or e-wallet login credentials.
• KYC and Identity Verification Partners: Where umi55 uses a third-party identity verification service to cross-check document authenticity, that service returns a verification result and a risk score to umi55. The underlying identity document is stored only by umi55, not by the third-party verification vendor.
• Technical Data from Devices: IP addresses, device fingerprints, and browser metadata collected automatically via cookies and server-side logging for security and fraud prevention purposes.

umi55 processes personal data for the following specific and documented purposes only:

• Account Creation and Management: Registering your account, maintaining your member profile, processing login authentication, and managing account settings including deposit limits and self-exclusion preferences.
• Identity Verification (KYC): Verifying your identity and age (minimum 21 years of age) before processing withdrawal requests, in compliance with our international licensing obligations and anti-money laundering requirements.
• Payment Processing: Receiving and crediting deposits, processing withdrawal requests to your BCA, BRI, BNI, Mandiri, or e-wallet account, and maintaining records of all financial transactions.
• Fraud Prevention and Security: Detecting and preventing fraudulent account activity, bonus abuse, money laundering, and unauthorized access attempts. This includes IP analysis, device fingerprinting, and behavioral pattern monitoring.
• Regulatory Compliance: Meeting record-keeping, reporting, and investigation obligations imposed by our international gaming license and applicable AML frameworks.
• Customer Support: Responding to account queries, resolving disputes, processing KYC submissions, and managing complaint escalations.
• Platform Improvement: Anonymized analysis of aggregate player behavior data to improve game selection, interface design, payment infrastructure, and support quality.
• Marketing Communications: Sending promotional offers, bonus notifications, and seasonal campaign communications to members who have not opted out. You may withdraw marketing consent at any time by contacting support.
• Responsible Gaming: Monitoring account activity to identify patterns potentially indicative of problem gambling and fulfilling our obligations to provide responsible gaming tools and intervention support.

umi55 processes personal data on the following legal bases, depending on the purpose of the processing:

• Contractual Necessity: Processing necessary to perform the contract between umi55 and the member — including account management, payment processing, and game provision — is carried out on the basis of contractual necessity.
• Legal Obligation: Processing required to comply with our licensing authority's requirements, anti-money laundering regulations, and financial record-keeping rules is carried out on the basis of legal obligation.
• Legitimate Interests: Processing for fraud prevention, platform security, and aggregate analytics is carried out on the basis of umi55's legitimate interest in operating a secure and compliant platform, balanced against member privacy rights.
• Consent: Processing for direct marketing communications and non-essential cookies is carried out on the basis of your consent. You may withdraw consent at any time without affecting the lawfulness of processing conducted prior to withdrawal.

umi55 does not sell or rent your personal data. We may disclose personal data to the following categories of third parties, strictly for the purposes described:

• Payment Processors and Banks: BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Danamon, OVO, DANA, GoPay, ShopeePay, and LinkAja receive the minimum data necessary to authorize, process, and settle transactions. These entities operate under their own privacy policies and regulatory frameworks.
• Identity Verification Services: Third-party KYC verification providers receive document images and personal details for the purpose of identity and age verification. These providers are contractually bound to use your data only for verification and to delete documents following completion of the check.
• Cloud Infrastructure Providers: umi55 uses internationally recognized cloud hosting providers to store platform data. These providers act as data processors under contractual data processing agreements and do not access member data for their own purposes.
• Game Content Providers: Providers such as Pragmatic Play, Evolution Gaming, PG Soft, Microgaming, and Spribe receive session data necessary to deliver game content. These providers may maintain their own game-session logs in accordance with their licensing requirements.
• Regulatory and Law Enforcement Authorities: umi55 will disclose personal data to governmental, regulatory, or law enforcement authorities where required by law, by court order, or where umi55 reasonably believes disclosure is necessary to protect the rights, property, or safety of umi55, its members, or the public.
• Corporate Successors: In the event of a merger, acquisition, or sale of substantially all assets of umi55, member personal data may be transferred to the acquiring entity, subject to equivalent privacy protections. Members will be notified of any such transfer.

umi55 is an internationally operated platform. Your personal data may be transferred to and stored on servers located outside Indonesia, including in the jurisdiction where umi55 holds its gaming license and in the locations of our cloud infrastructure providers.

Where personal data is transferred internationally, umi55 ensures that appropriate safeguards are in place, including: standard contractual clauses with data processors; contractual obligations requiring the recipient to maintain data security standards equivalent to those applied by umi55; and selection of cloud providers and processing partners that operate in jurisdictions with recognized data protection frameworks.

By registering an account with umi55, you consent to the international transfer of your personal data as described in this section.

umi55 retains personal data only for as long as necessary to fulfill the purpose for which it was collected, or as required by applicable legal and licensing obligations. The following retention periods apply:

• Active Account Data: Retained for the duration of your membership with umi55 and for a minimum of five (5) years following account closure, in accordance with our international gaming license requirements and AML record-keeping obligations.
• KYC Identity Documents: Retained for a minimum of five (5) years from the date of the member's most recent financial transaction, as required under our anti-money laundering compliance framework.
• Transaction Records: Financial transaction records (deposits, withdrawals, wagers) are retained for a minimum of five (5) years and may be retained for up to seven (7) years where regulatory reporting obligations require it.
• Support Interaction Records: Chat transcripts and email records are retained for two (2) years from the date of the interaction, or for the duration of any unresolved dispute.
• Technical & Device Logs: IP logs and session data used for fraud prevention are retained for 12 months from the date of collection, after which they are anonymized or deleted.
• Marketing Consent Records: Records of your marketing consent are retained for the duration of your membership and for one (1) year following account closure or consent withdrawal.

Upon expiry of the applicable retention period, umi55 will securely delete or irreversibly anonymize your personal data so that it can no longer be attributed to you.

umi55 implements a layered set of technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction:

• Encryption in Transit: All data transmitted between your device and umi55 servers is encrypted using TLS 1.2 or higher (256-bit SSL). This applies to all platform pages, the payment gateway, and the member support interface.
• Encryption at Rest: Sensitive personal data — including KYC documents, bank account details, and contact information — is encrypted at rest on umi55 servers using AES-256 encryption.
• Access Controls: Access to personal data within umi55 is restricted to staff members who require it for their specific role. Role-based access controls, mandatory two-factor authentication for internal systems, and regular access audits are implemented.
• Penetration Testing: umi55 conducts regular third-party penetration tests to identify and remediate security vulnerabilities before they can be exploited.
• Incident Response: umi55 maintains a documented data breach response procedure. In the event of a breach that is likely to result in a high risk to member privacy, affected members will be notified promptly and relevant authorities informed as required.
• Staff Training: All umi55 staff members who handle personal data complete mandatory privacy and data security training on joining and at regular intervals thereafter.

As a umi55 member, you hold the following rights over your personal data. To exercise any of these rights, submit a written request to the email address in Section 15. umi55 will respond within 30 days of receiving a verified request.

umi55 uses cookies — small text files placed on your device — for the following purposes:

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication cookies that keep you logged in, and security cookies that help detect fraud. These cannot be disabled without impairing platform functionality.
• Functional Cookies: Store your platform preferences such as language, odds format, and interface settings so you do not need to re-configure them on each visit.
• Analytics Cookies: Collect anonymized, aggregate data about how members navigate the platform, which pages are visited most, and where users encounter difficulties. This data is used internally to improve the platform and is not shared with third-party advertising networks.

umi55 does not use advertising cookies, cross-site tracking technologies, or cookies that build profiles of your browsing behavior outside the umi55 platform for commercial purposes.

Most browsers allow you to control cookies via browser settings. Disabling strictly necessary cookies will prevent some platform features from functioning correctly. Disabling analytics cookies will not affect your ability to use the platform.

umi55 is strictly an adults-only platform. We do not knowingly collect personal data from individuals under 21 years of age. The minimum age requirement is enforced through KYC identity verification on all accounts prior to withdrawal processing.

If umi55 discovers that personal data has been collected from a person under 21, we will immediately suspend the associated account, void all bets, return any deposited funds to the original payment source, and permanently delete all personal data associated with the account.

If you are a parent or guardian and believe that a minor has registered a umi55 account, please contact us immediately at the email address in Section 15 so we can take prompt remedial action.

umi55 may update this Privacy Policy from time to time to reflect changes in applicable law, our data processing activities, or our organizational structure. When material changes are made, we will notify registered members by email to the address on file at least 14 days before the changes take effect.

The "Last updated" date at the top of this Policy reflects the date of the most recent revision. We encourage members to review this Policy periodically. Your continued use of umi55 following notification of a policy update constitutes acceptance of the revised terms.

If you object to any material change to this Policy, you may close your account before the new policy takes effect and request deletion of your data in accordance with Section 11.

For all privacy-related inquiries — including data access requests, rectification requests, erasure requests, complaints, or questions about this Policy — please contact the umi55 data protection team using the details below.