Privacy Policy

1. Introduction and Scope

koi365 ("we," "us," or "our") is committed to protecting the privacy and personal data of every individual who accesses or uses the koi365 online gaming platform at https://koi365.cam (the "Platform"). This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, and the rights available to you as a data subject.

This Policy applies to all registered members, prospective members, and visitors of the Platform, including residents of Jakarta, Surabaya, Bandung, Medan, Semarang, Makassar, Palembang, Bali, Yogyakarta, and all other cities and provinces throughout Indonesia. It covers data collected through the website, mobile-optimised interfaces, live-chat sessions, email correspondence, and any other channel through which you interact with koi365.

By registering an account, depositing funds, or otherwise using our services, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree with this Policy in whole or in part, you must discontinue use of our Platform.

2. Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" — any information relating to an identified or identifiable natural person, including name, identification number, location data, or any factor specific to the physical, cultural, or social identity of that person.
• "Processing" — any operation performed on Personal Data, whether or not by automated means, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" — the entity that determines the purposes and means of processing Personal Data. For this Policy, the Data Controller is koi365.
• "Data Processor" — a natural or legal person that processes Personal Data on behalf of the Data Controller under a written agreement.
• "User" or "You" — any natural person who accesses the Platform, whether or not registered as a member.
• "KYC" — Know Your Customer; the identity-verification procedures required before withdrawals are processed, in line with international anti-money-laundering standards.
• "Cookies" — small text files placed on your device by the Platform or authorised third-party services to store session and preference information.

3. Personal Data We Collect

The categories of Personal Data koi365 collects depend on your interaction with the Platform. The table below summarises what we collect and why each category is necessary.

We do not intentionally collect sensitive categories of personal data (such as health information, racial or ethnic origin, or religious beliefs) unless expressly required for responsible-gaming self-exclusion requests, in which case we process such data only to the extent necessary and with appropriate safeguards.

4. How We Collect Your Data

4.1 Information You Provide Directly

The majority of Personal Data we hold is provided directly by you during account registration, identity verification, payment transactions, promotional claim forms, live-chat sessions, email correspondence, and completion of surveys or feedback requests. You are responsible for ensuring that all information you provide is accurate, current, and complete.

4.2 Automated Collection

When you access the Platform, our servers automatically record certain Technical and Usage Data. This includes your IP address, browser type, referring URL, pages visited, time spent on each page, and actions taken (such as clicking on a game or claiming a bonus). This data is collected through server logs, cookies, pixel tags, and analytics tools.

4.3 Third-Party Sources

We may receive Personal Data about you from third-party identity-verification services (for KYC processing), payment service providers such as BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, OVO, DANA, GoPay, ShopeePay, and LinkAja (for transaction confirmation), fraud-prevention databases, and publicly available sources where permitted by applicable law.

5. Purposes and Legal Bases for Processing

koi365 processes Personal Data only where a valid legal basis exists. The principal bases we rely upon are:

• Contractual Necessity: Processing required to create and maintain your account, process deposits and withdrawals, deliver gaming services, and manage your VIP or loyalty programme participation.
• Legitimate Interests: Processing necessary for fraud prevention, platform security, analytics, service improvement, and responsible-gaming monitoring, provided such interests are not overridden by your fundamental rights.
• Legal Obligation: Processing required to comply with anti-money-laundering (AML) regulations, counter-terrorism financing (CTF) requirements, age verification obligations, and lawful requests from competent authorities.
• Consent: Processing for direct-marketing communications, personalised promotions, and non-essential cookies, where you have provided freely given, specific, informed, and unambiguous consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

6. Disclosure and Sharing of Data

koi365 does not sell, rent, or trade Personal Data to any third party for their own independent marketing purposes. We share Personal Data only in the following limited circumstances:

6.1 Service Providers

We engage carefully vetted Data Processors — including payment gateway operators, cloud hosting providers, KYC verification platforms, customer-support software vendors, and analytics providers — solely to assist in delivering our services. Each processor is bound by a written data-processing agreement requiring equivalent data-protection standards to those described in this Policy.

6.2 Legal and Regulatory Authorities

We will disclose Personal Data to law enforcement, regulators, or other governmental bodies where we are legally compelled to do so, where disclosure is necessary to protect the rights, property, or safety of koi365, our members, or the public, or where required to investigate suspected fraud or criminal activity.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets involving koi365, Personal Data may be transferred to the successor entity. We will provide reasonable notice of any such transfer and ensure the receiving entity is bound by data-protection obligations at least as stringent as those in this Policy.

6.4 Aggregated and Anonymised Data

We may share aggregated, anonymised statistical information — from which no individual can be identified — with business partners, industry analysts, or the public for research and reporting purposes.

7. Cookies and Tracking Technologies

koi365 uses cookies and similar tracking technologies to provide a functional, personalised, and secure gaming experience. The types of cookies we deploy include:

• Strictly Necessary Cookies: Essential for Platform operation, session management, authentication, and security. These cannot be disabled without impairing core functionality.
• Performance and Analytics Cookies: Enable us to understand how Users interact with the Platform, identify popular features, and measure the effectiveness of improvements. Data is aggregated and anonymised where possible.
• Functional Cookies: Store your preferences such as language settings, display options, and last-visited game categories to enhance your experience.
• Marketing Cookies: Used (with your prior consent) to deliver relevant promotional communications and measure campaign effectiveness. These are not placed without your explicit opt-in.

You can manage or delete cookies through your browser settings at any time. Note that disabling certain cookies may affect Platform functionality.

8. Data Retention

We retain Personal Data for as long as your account remains active and for a defined period thereafter, as required by legal obligations or legitimate business purposes. Specific retention periods include:

• Account and transaction records: minimum 5 years following account closure, in line with AML and financial-regulation requirements.
• KYC documentation: 5 years from the date of collection or from the end of the customer relationship, whichever is later.
• Customer support communications: 3 years from the date of each interaction.
• Marketing preference logs: duration of the marketing relationship plus 2 years.
• Technical logs: 12 months on a rolling basis, unless extended for active security investigations.

Once Personal Data is no longer required for its original purpose or any subsequent legitimate purpose, it is securely deleted or irreversibly anonymised.

9. Security Measures

koi365 employs a comprehensive, layered approach to information security designed to protect your Personal Data against unauthorized access, accidental loss, alteration, disclosure, or destruction. Our principal technical and organizational measures include:

• Transport Layer Security (TLS): All data transmitted between your device and our servers is encrypted using industry-standard TLS 1.2 or higher, ensuring that information cannot be intercepted in transit.
• Data Encryption at Rest: Sensitive Personal Data stored on our servers — including financial records and identity documents — is encrypted using AES-256 encryption.
• Access Controls: Access to Personal Data is strictly limited to authorized koi365 personnel and Data Processors who require it to perform their designated functions. Role-based access controls and least-privilege principles are enforced throughout our systems.
• Two-Factor Authentication: Administrative access to systems holding Personal Data requires multi-factor authentication. We also offer two-factor authentication to Users to protect their accounts.
• Intrusion Detection and Monitoring: Our infrastructure is monitored continuously for suspicious activity, unauthorized access attempts, and anomalous transaction patterns using automated detection systems.
• Penetration Testing: We engage independent security specialists to conduct regular penetration tests and vulnerability assessments of our Platform and underlying infrastructure.
• Staff Training: All koi365 personnel who handle Personal Data receive regular data-protection and information-security training. Confidentiality obligations are embedded in employment contracts.
• Incident Response: We maintain a documented data-breach response procedure. In the event of a breach that poses a material risk to your rights and freedoms, we will notify affected Users without undue delay.

10. Your Data Rights

As a data subject, you have meaningful rights over the Personal Data koi365 holds about you. We respect and facilitate the exercise of these rights as set out below:

• Right of Access: You may request a copy of the Personal Data we hold about you, together with information about how it is processed. We will respond within 30 days of a verified request.
• Right to Rectification: If any Personal Data we hold is inaccurate or incomplete, you have the right to request correction. For minor details such as contact information, you can update records directly through your account profile.
• Right to Erasure: You may request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (and no other legal basis applies), or where processing is unlawful. This right is subject to our legal retention obligations.
• Right to Restriction of Processing: You may request that we limit processing of your Personal Data while the accuracy of the data is contested, or while a legitimate-interests objection is being assessed.
• Right to Data Portability: Where processing is based on consent or contractual necessity and carried out by automated means, you may request that we provide your Personal Data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing based on our legitimate interests at any time. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to Withdraw Consent: Where processing relies on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Right Not to Be Subject to Automated Decision-Making: koi365 does not make decisions that produce legal or similarly significant effects on Users solely through automated processing without human review.

To exercise any of the above rights, please contact our Data Protection team at [email protected] with the subject line "Data Rights Request," including your full name, registered email address, and a description of your request. We may need to verify your identity before fulfilling the request. There is no charge for exercising your rights, except where requests are manifestly unfounded or excessive, in which case a reasonable administrative fee may apply.

11. Protection of Minors

koi365 is strictly an adults-only platform. Our services are not directed at, and must not be used by, any person under 21 years of age. We do not knowingly collect Personal Data from individuals under this age threshold. Where we have reason to believe that Personal Data has been submitted by a minor, we will take immediate steps to delete that data and close the associated account.

If you are a parent or guardian and believe that a minor in your care has created a koi365 account or provided Personal Data to us, please contact [email protected] immediately so that we can investigate and take appropriate remedial action.

12. International Data Transfers

koi365 operates globally and may transfer your Personal Data to servers or Data Processors located outside Indonesia. Whenever such transfers occur, we ensure that appropriate safeguards are in place to protect your information to a standard at least equivalent to that required under applicable data-protection principles. Safeguards may include contractual clauses, vendor certification programs, or equivalent data-protection frameworks recognized by relevant authorities.

By using the koi365 Platform, you acknowledge that your Personal Data may be processed in countries outside Indonesia. We take all reasonable steps to ensure that any international transfer is conducted securely and lawfully, and that recipient entities are bound by obligations consistent with this Privacy Policy.

13. Changes to This Policy

koi365 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data-processing practices, applicable law, or Platform features. Material changes — those that meaningfully affect your rights or how we use your Personal Data — will be communicated to registered Users via email notification and a prominent notice on the Platform at least 14 days before the revised Policy takes effect.

We encourage you to review this page periodically to stay informed of any updates. The "Last Reviewed" date at the top of this document indicates when the Policy was most recently assessed. Your continued use of the Platform after the effective date of a revised Policy constitutes acceptance of those changes.

14. Contact and Complaints

If you have questions, concerns, or requests relating to this Privacy Policy or our data-processing practices, please contact our Data Protection team using the details below:

• Email: [email protected] (plain text — not a clickable link)
• Channel: 24/7 Live Chat available on the Platform
• Response Time: We aim to respond to all privacy-related inquiries within 5 business days (WIB, UTC+7).

If you are dissatisfied with our response to your inquiry or believe that we have processed your Personal Data in a manner inconsistent with this Policy or applicable data-protection standards, you have the right to escalate your complaint to the relevant data-protection supervisory authority in your jurisdiction. We will always cooperate fully with any such authority in investigating a complaint.