Privacy Policy — bumi4

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "bumi4," "we," "us," or "our" refers to the operator of the bumi4 online gaming and sportsbook platform accessible at bumi4.cam, including all associated services, subdomains, and mobile interfaces.
• "You," "Member," or "User" refers to any individual who visits, registers on, or uses the bumi4 Platform or its Services.
• "Personal Data" means any information that identifies or could reasonably be used to identify a living natural person, either on its own or in combination with other data.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, deletion, or any combination thereof.
• "Data Controller" refers to bumi4, as the entity that determines the purposes and means of processing your Personal Data.
• "Data Processor" refers to a third-party service provider that processes Personal Data on behalf of and under the instruction of bumi4.
• "KYC" (Know Your Customer) refers to the identity and document verification process required before a Member may withdraw funds or access higher-tier account features.
• "Cookies" refers to small text files placed on your device by the Platform to facilitate session management, preference storage, and analytics.
• "Services" means all products and features offered on the Platform, including but not limited to live casino, sportsbook, slots, live roulette, and specialty card games.

bumi4 collects only the Personal Data that is necessary to provide, maintain, and improve the Services, fulfil our legal and regulatory obligations, and protect the integrity of the Platform. The categories of data we collect are as follows:

Registration & Account Data

• Full legal name (as it appears on a government-issued identification document).
• Date of birth (used to verify the 21+ age eligibility requirement).
• Email address and mobile telephone number (used for account access, verification OTPs, and communications).
• Username and encrypted password hash.
• City and country of residence within Indonesia.

Identity Verification (KYC) Data

• Government-issued identification documents: National Identity Card (KTP), passport, or driver's licence — including the document number, expiry date, and the photograph contained within the document.
• A selfie or live facial capture submitted for biometric liveness verification, where required.
• Proof of ownership of the nominated payment method (e.g., a bank statement or screenshot of the e-wallet account dashboard showing the account holder's name).

Financial & Transaction Data

• Deposit and withdrawal transaction records, including amount, timestamp, payment method used (e.g., BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, LinkAja), and transaction reference numbers.
• Account balance history and bonus credit /debit records.
• Payment method identifiers (masked bank account numbers or masked e-wallet identifiers — bumi4 does not store full, unmasked bank account numbers beyond the period required to process the transaction).

Gaming & Betting Activity Data

• Bet history, game session logs, wagering amounts, win/loss records, and bonus utilisation records.
• Game preferences, favourite categories, and session duration data.
• Responsible gaming tool usage (deposit limit settings, session time reminders, self-exclusion requests).

Technical & Device Data

• IP address, geolocation data (country and city level, derived from IP), device type, operating system, and browser type/version.
• Session tokens, login timestamps, and logout timestamps.
• Cookie identifiers and analytics event data (see Section 9 — Cookies & Tracking).

Communications Data

• The content of live chat conversations, email correspondence, and WhatsApp messages exchanged with bumi4 Customer Support.
• Feedback, complaints, and dispute records.

bumi4 collects Personal Data through the following methods:

• Directly from you: When you register an Account, complete the KYC verification process, make a deposit or withdrawal, contact Customer Support, or participate in a promotion.
• Automatically through the Platform: When you browse or interact with the bumi4 website or mobile interface, our systems automatically collect technical and device data via server logs, cookies, and similar tracking technologies.
• From third-party verification partners: When you submit KYC documents, our authorised identity verification partner processes the documents and returns a verification status to bumi4. The partner may independently retain a record as required by their own regulatory obligations.
• From payment processors: When you initiate a deposit or withdrawal, the relevant bank, e-wallet provider (OVO, DANA, GoPay, ShopeePay, LinkAja), or payment gateway transmits transaction confirmation data to bumi4.
• From fraud-prevention and AML screening services: bumi4 may receive risk-scoring or watchlist-match data from third-party compliance services as part of its anti-money-laundering (AML) and counter-terrorist financing (CTF) obligations.

bumi4 uses your Personal Data for the following purposes:

bumi4 does not use your Personal Data for automated decision-making that produces legal or similarly significant effects without human review, except in cases of fraud detection where automated systems may trigger an account hold that is subsequently reviewed by a human compliance officer within 24 hours.

bumi4 processes your Personal Data on the following legal bases, depending on the specific processing activity:

• Contract performance: Processing necessary to fulfil our obligations under the Member Agreement — including account management, payment processing, and service delivery — is carried out on the basis that it is necessary for the performance of the contract between you and bumi4.
• Legal obligation: Processing required to comply with applicable anti-money laundering legislation, identity verification requirements, record-keeping mandates, and lawful requests from regulatory or law enforcement authorities is carried out on the basis of legal obligation.
• Legitimate interests: Processing for fraud prevention, platform security, abuse detection, and aggregated analytics is carried out on the basis of bumi4's legitimate interests in operating a secure, fair, and commercially viable platform — provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for direct marketing communications (promotional emails, SMS, WhatsApp messages regarding bonuses and new game releases) is carried out on the basis of your explicit opt-in consent, which you may withdraw at any time via Account Settings or by contacting Customer Support.

bumi4 does not sell, rent, or trade your Personal Data to any third party for commercial purposes. Data is shared only in the circumstances described below:

• Identity verification partners: KYC documents and biometric data are transmitted to our authorised verification partner exclusively for the purpose of completing identity checks. The partner operates under a strict data processing agreement and is prohibited from using the data for any other purpose.
• Payment processors and banks: Transaction data is shared with the relevant Indonesian bank (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, BSI) or e-wallet provider (OVO, DANA, GoPay, ShopeePay, LinkAja) to the extent necessary to process your requested deposit or withdrawal.
• Game software providers: Limited session and account-tier data may be shared with licensed game studios (e.g., Pragmatic Play, Evolution Gaming, Microgaming, Spribe, Pocket Games Soft) to facilitate game delivery, audit trail maintenance, and jackpot verification. These providers are contractually bound to data confidentiality obligations.
• Fraud prevention and AML screening services: Transaction and identity data may be cross-referenced against watchlists maintained by licensed compliance data providers to satisfy our AML/CTF obligations.
• Regulatory and law enforcement authorities: bumi4 will disclose Personal Data to competent authorities when required to do so by law, court order, or a lawful request from a regulatory body with jurisdiction over the Platform's operations. We will notify the affected Member of such a disclosure where we are legally permitted to do so.
• Corporate transactions: In the event of a merger, acquisition, asset sale, or restructuring involving bumi4, your Personal Data may be transferred to the successor entity, provided that the successor agrees to be bound by data protection obligations no less protective than those set out in this Privacy Policy.

bumi4 is an internationally operated platform. Some of our Data Processors — including game software providers, cloud infrastructure partners, and identity verification services — are located or operate data centres in jurisdictions outside Indonesia. As a result, your Personal Data may be transferred to, stored in, or processed in countries other than Indonesia.

Wherever Personal Data is transferred internationally, bumi4 ensures that appropriate safeguards are in place, including:

• Contractual obligations imposed on the receiving entity through data processing agreements that require data protection standards equivalent to those applied by bumi4.
• Use of reputable cloud infrastructure providers that maintain internationally recognised security certifications (ISO 27001, SOC 2 Type II, or equivalent).
• Encryption of Personal Data both in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent), regardless of where it is stored.

By using the bumi4 Platform, you acknowledge and consent to the transfer of your Personal Data to jurisdictions outside Indonesia as described in this section, subject at all times to the safeguards described above.

bumi4 retains Personal Data only for as long as it is necessary for the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised. Where anonymisation is applied, the resulting dataset no longer constitutes Personal Data and may be retained indefinitely for aggregated analytics purposes.

bumi4 uses cookies and similar tracking technologies (local storage, session storage, pixel tags) to operate core Platform functionality, improve user experience, and gather aggregated analytics data. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication tokens, CSRF protection tokens, and load-balancing cookies. These cookies cannot be disabled without breaking core Platform functionality. No consent is required for strictly necessary cookies.
• Functional Cookies: Remember your preferences — such as your preferred language display, remembered username, and notification settings. These cookies improve convenience but are not essential to the Platform's operation.
• Analytics Cookies: Collect anonymised data on how Members navigate the Platform — which pages are visited most frequently, how long sessions last, and which game categories generate the most engagement. This data is used solely to improve Platform design and performance. Analytics cookies are set only with your consent.
• Security & Fraud-Detection Cookies: Assist in detecting and preventing fraudulent activity, including account takeover attempts and unusual betting patterns. These may be treated as strictly necessary due to their security function.

bumi4 does not use third-party advertising cookies or permit external advertisers to place tracking cookies on the Platform. All cookies used are first-party or are placed by Data Processors operating under contractual data processing agreements with bumi4.

As a Member of bumi4, you hold the following rights with respect to your Personal Data. To exercise any of these rights, please contact our Data Protection Officer (see Section 15).

• Right of Access: You may request a copy of all Personal Data bumi4 holds about you. We will provide this in a structured, machine-readable format (CSV or JSON) within 30 calendar days of a verified request.
• Right to Rectification: You may request correction of any inaccurate or incomplete Personal Data. Updates to core account details (name, date of birth) that require KYC re-verification will be processed once supporting documentation is received.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data. This right is subject to legal retention obligations — bumi4 cannot erase data it is required to retain under AML/CTF legislation or financial record-keeping requirements. Where erasure is not possible in full, bumi4 will delete all data that is not subject to a mandatory retention obligation and will inform you of any data that must be retained and the reason.
• Right to Restrict Processing: You may request that bumi4 restrict the processing of your Personal Data in certain circumstances — for example, while the accuracy of the data is being contested, or while a complaint is under review.
• Right to Data Portability: Where processing is carried out on the basis of your consent or contract performance, and is carried out by automated means, you may request that your Personal Data be transferred directly to another service provider where technically feasible.
• Right to Object: You may object to the processing of your Personal Data where that processing is based on bumi4's legitimate interests. bumi4 will cease that processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of prior processing.

bumi4 implements a comprehensive, layered security framework designed to protect your Personal Data against unauthorised access, disclosure, alteration, and destruction. Key security measures include:

• Transport encryption: All data transmitted between your device and the bumi4 Platform is encrypted using TLS 1.2 or higher. The Platform enforces HTTPS across all pages and subdomains.
• Data-at-rest encryption: Personal Data stored in bumi4's databases is encrypted using AES-256 encryption. Password data is stored exclusively as salted bcrypt hashes — plaintext passwords are never stored.
• Access controls: Access to Personal Data within bumi4's internal systems is restricted on a strict need-to-know basis. All staff with access to Member data are subject to background checks, confidentiality obligations, and role-based access control (RBAC) policies.
• Two-factor authentication (2FA): All internal systems that store or process Member Personal Data require 2FA for staff access. Members are also encouraged to enable SMS OTP 2FA on their Accounts.
• Penetration testing and vulnerability management: bumi4 commissions independent penetration tests of its infrastructure on a regular basis and operates a continuous vulnerability management programme to identify and remediate security weaknesses promptly.
• Incident response: bumi4 maintains a documented security incident response plan. In the event of a data breach that is likely to result in a risk to your rights and freedoms, bumi4 will notify affected Members without undue delay and within the timeframe required by applicable regulations.

While bumi4 applies industry-standard security measures, no system can guarantee absolute security. You are responsible for maintaining the confidentiality of your own Account credentials and for notifying bumi4 immediately if you suspect unauthorised access to your Account.

The bumi4 Platform is strictly restricted to adults aged 21 years and over. bumi4 does not knowingly collect, store, or process Personal Data from individuals under the age of 21. Age verification is a mandatory step in the registration and KYC process, and all Members must confirm that they are at least 21 years of age before completing Account registration.

If bumi4 discovers that an Account has been registered by an individual under the age of 21, the Account will be immediately suspended, any funds held in the Account will be subject to a compliance review, and all Personal Data associated with the Account will be deleted as soon as the mandatory review process permits. If you believe a minor has registered an Account on bumi4, please contact Customer Support immediately.

The bumi4 Platform may reference or display the names and logos of third-party payment providers, game studios, and sports organisations for informational and contextual purposes. bumi4 does not operate external links to third-party websites from within its core Platform pages.

If you navigate to any external website — whether through a search engine, an advertisement on a third-party platform, or any other channel outside of bumi4's direct control — the privacy practices of that external website are governed by its own privacy policy, not by this document. bumi4 accepts no responsibility for the data practices of third-party websites or services.

bumi4 reviews and updates this Privacy Policy periodically to reflect changes in our data processing practices, applicable law, regulatory guidance, or Platform features. All updates are published on this page with a revised Effective Date displayed at the top of the document.

Where a proposed update constitutes a material change to how we process your Personal Data — meaning it introduces a new processing purpose, a new category of data, or a new third-party sharing arrangement that was not previously disclosed — bumi4 will notify registered Members via email to their registered address at least 14 calendar days before the change takes effect.

For non-material updates — such as clarifications of existing language, corrections of typographical errors, or updates to contact details — the revised policy will be published immediately without advance notice. The Effective Date will be updated to reflect the revision.

Your continued use of the Platform after the Effective Date of any update constitutes your acknowledgement of the revised Privacy Policy. If you object to any change, you should cease using the Platform and may request Account closure in accordance with the Terms & Conditions.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or wish to raise a privacy concern, please contact bumi4's Data Protection Officer (DPO) through any of the following channels:

• Email (DPO): [email protected] — include "Privacy Request" or "Data Rights Request" in the subject line so your message is routed directly to the DPO team.
• Live Chat: Available 24 hours a day, 7 days a week on the bumi4 Platform. Request to speak with the Data Protection team.
• WhatsApp: +62 811 0000 4444 — available 08:00–24:00 WIB daily.

bumi4 will acknowledge all privacy-related requests within 5 business days (WIB) and provide a full substantive response within 30 calendar days. For complex requests, this period may be extended by up to 30 additional calendar days; you will be notified of any extension before the original deadline.

For general account and transaction support inquiries unrelated to data rights, please use the standard Customer Support channels described in the FAQ or Terms & Conditions.