At d200m, the privacy and security of your personal data is a foundational commitment, not an afterthought. This Privacy Policy explains precisely what information we collect from players across Indonesia, why we collect it, how it is stored and protected, and the rights you hold over your own data. We encourage you to read this document carefully before registering an account or using any d200m service.
Our Commitment to You
These summary cards highlight the six key principles that underpin how d200m handles your data. They do not replace the full policy below.
Every data exchange between your device and the d200m platform is protected by 256-bit TLS/SSL encryption — the same standard used by major financial institutions and international banks such as BCA and Mandiri.
d200m does not sell, rent, or trade your personal information to third-party marketers under any circumstances. Your data is used exclusively for the purposes set out in this Privacy Policy.
We collect only the personal data that is strictly necessary to operate your account, process transactions, verify your identity, and comply with our legal obligations. We do not engage in bulk or speculative data harvesting.
You have the right to access, correct, export, and request deletion of your personal data at any time. Submit a data rights request to our support team and we will respond within 5 business days.
d200m uses strictly necessary cookies to maintain your session and a limited set of analytics cookies to improve platform performance. We do not use cross-site advertising trackers or fingerprinting technologies.
Personal data is retained only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. Account data is deleted or anonymized within 90 days of confirmed account closure.
d200m ("we", "us", "our") operates the online gaming platform accessible at d200m.asia, offering sportsbook betting, live casino tables, slot games, Bandar Q, and Bola Tangkas to adult players primarily located across Indonesia — including Jakarta, Surabaya, Bandung, Medan, Bali, Yogyakarta, Semarang, and other regions of the archipelago.
We are committed to handling your personal information with transparency, integrity, and care. This Privacy Policy sets out in plain terms: what personal data d200m collects from you, the lawful bases on which we process that data, with whom it may be shared, how long it is retained, the technical and organisational measures used to protect it, and the rights available to you in relation to your own data.
This Privacy Policy applies to all visitors, registered members, and former members of the d200m platform, and to all personal data submitted to us through our website, mobile interface, live chat, email correspondence, and any other channel through which you interact with d200m. It should be read alongside our Terms & Conditions and Responsible Gaming page, which together constitute the full agreement governing your relationship with d200m.
Plain-Language Commitment: We have written this policy to be as clear and readable as possible while maintaining the legal accuracy required for a formal data-processing disclosure. Where legal terminology is unavoidable, we have added plain-English explanations in parentheses.
2.1 Identity. For the purposes of applicable data protection law, the data controller responsible for your personal information is the entity that operates the d200m platform at d200m.asia. The data controller determines why and how your personal data is processed.
2.2 Contact for Data Matters. All data protection enquiries, subject access requests, objection notices, and data deletion requests should be directed to our dedicated data team at with the subject line "Data Privacy Request". Our team will acknowledge your request within 24 hours (WIB) and provide a substantive response within 5 business days.
2.3 Scope of Control. d200m acts as the data controller for all personal data submitted through the registration form, KYC verification process, deposit and withdrawal flow, customer support interactions, and responsible gaming tools. In relation to data processed by third-party game providers (such as Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, and Spribe) within their own gaming environments, those providers may act as independent data controllers subject to their own privacy policies.
3.1 Registration Data. When you create a d200m account, we collect: your full legal name as it appears on your government-issued identity document; date of birth; residential address in Indonesia (including city and province); a valid email address; and a mobile phone number for account security purposes.
3.2 Identity Verification (KYC) Data. To comply with our anti-money laundering obligations and to verify that you are 21 years of age or older, we collect: a scanned or photographed copy of your Indonesian National Identity Card (KTP) or passport; in some cases, a selfie taken while holding your identity document; and proof of your registered payment method (e.g., a screenshot of your BCA, BRI, BNI, or Mandiri account in your name).
3.3 Financial Transaction Data. When you make deposits or request withdrawals, we collect: the payment method used (bank transfer via virtual account, e-wallet such as OVO, DANA, GoPay, ShopeePay, or LinkAja, or QRIS payment); transaction reference numbers; the amount in Indonesian Rupiah (IDR); and timestamp information. We do not store full bank account credentials or e-wallet PIN codes on our servers.
3.4 Gameplay and Activity Data. We collect records of your gaming activity on the d200m platform, including: games played, bet amounts, win/loss history, session duration, and any self-imposed responsible gaming limits you have activated. This data is used for account management, dispute resolution, responsible gaming monitoring, and platform optimisation.
3.5 Technical and Device Data. When you access d200m, we automatically collect certain technical data including: your IP address; device type and operating system; browser type and version; referring URL; pages visited and time spent; and session identifiers. This data is collected via server logs and analytics tools and is used for fraud prevention, security monitoring, and service improvement.
3.6 Communications Data. When you contact our support team via live chat, email, or WhatsApp, we retain a record of those communications — including the content of your messages — for quality assurance, training, dispute resolution, and compliance purposes. Calls or chats may be recorded, and you will be notified when this is the case.
| Data Category | Examples | Collected At |
|---|---|---|
| Registration Data | Full name, email, DOB, mobile number, address | Account sign-up |
| KYC / Identity Data | KTP / passport scan, selfie, payment proof | Verification request |
| Financial Data | Bank/e-wallet used, transaction amount (IDR), reference no. | Deposit / withdrawal |
| Gameplay Data | Bets placed, game history, session logs, RG limits | Ongoing platform use |
| Technical Data | IP address, device OS, browser, session ID | Every site visit |
| Communications Data | Live chat transcripts, support emails, WA messages | Customer support interactions |
d200m processes your personal data only for the specific, documented purposes set out below. We do not repurpose your data for any use that is incompatible with the original reason for collection without first informing you and, where required, obtaining your consent.
Every processing activity carried out by d200m rests on one or more of the following lawful bases. Where we rely on legitimate interests, we have conducted a balancing assessment and determined that our interests are not overridden by your rights and freedoms.
6.1 Third-Party Service Providers. d200m shares your personal data with a limited set of trusted third-party service providers who process data on our behalf and under our instruction, including:
All service providers are contractually bound to process your data solely on d200m's instructions, to maintain appropriate security standards, and to delete or return data upon termination of their engagement.
6.2 Regulatory and Legal Disclosures. d200m may disclose your personal data to competent authorities, law enforcement agencies, courts, or regulators where required to do so by applicable law, by a valid court order, or in connection with an investigation into suspected illegal activity. We will notify you of any such disclosure where we are legally permitted to do so.
6.3 Business Transfers. In the event of a merger, acquisition, or sale of substantially all of d200m's assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified in advance of any such transfer and of any change to the applicable privacy policy.
6.4 No Sale of Data. d200m does not sell, rent, license, or otherwise commercially exploit your personal data to third-party advertisers, data brokers, or any other commercial entity. This commitment applies unconditionally and without exception.
7.1 Cross-Border Processing. Because d200m operates through international technology infrastructure and works with globally distributed game providers and cloud services, your personal data may be transferred to and processed in countries outside Indonesia. These countries may have data protection laws that differ from those in force in Indonesia.
7.2 Safeguards. Where personal data is transferred internationally, d200m ensures that appropriate safeguards are in place to protect that data to a standard equivalent to or higher than the protections described in this Privacy Policy. These safeguards include: data processing agreements with contractual clauses requiring the recipient to maintain appropriate data security standards; technical controls such as encryption in transit and at rest; and access controls limiting data access to authorised personnel only.
7.3 Your Acknowledgement. By registering an account with d200m, you acknowledge that your personal data may be transferred internationally in the manner described above, and that d200m has implemented the safeguards described to protect your information during such transfers.
8.1 Active Accounts. While your d200m account is active, we retain all data categories described in Section 3 for the duration of the account relationship. This is necessary to provide uninterrupted service, maintain transaction records, and support dispute resolution.
8.2 Closed Accounts. Following account closure — whether initiated by you or by d200m — personal data is retained for a period of five (5) years from the date of closure. This retention period reflects our obligations under applicable anti-money laundering record-keeping requirements, which typically mandate a minimum five-year retention period for customer due diligence and transaction records.
8.3 KYC Documents. Identity verification documents (KTP / passport scans, selfies, payment proofs) are retained for the same five-year period post-account closure. After this period, documents are securely deleted or permanently anonymised.
8.4 Marketing Data. If you have consented to receive marketing communications, your contact details and marketing preferences are retained until you withdraw consent. Upon withdrawal of consent, marketing data is deleted within 30 days, subject to the retention obligations described in clauses 8.2 and 8.3 for overlapping data categories.
8.5 Technical Logs. Server logs and technical session data are retained for a maximum of 12 months from the date of collection, after which they are automatically purged or anonymised for aggregate analytical use.
Right to Erasure: You may request early deletion of your personal data at any time (see Section 11). Where data must be retained to meet a legal obligation, we will restrict its use to that purpose only and inform you of the applicable retention period.
9.1 Technical Controls. d200m implements industry-standard technical security controls to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These controls include:
9.2 Organisational Controls. In addition to technical measures, d200m maintains organisational security practices including: mandatory data privacy training for all staff who handle player data; a documented incident response plan for data breaches; confidentiality obligations in all staff and contractor contracts; and regular internal audits of data processing activities.
9.3 Breach Notification. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, d200m will notify affected players without undue delay and will take immediate steps to contain and remediate the breach. We will also notify the relevant supervisory authority where required by applicable law.
9.4 Your Responsibilities. While d200m takes extensive steps to secure your data on our side, the security of your d200m account also depends on the strength and confidentiality of your login credentials. You are responsible for using a strong, unique password for your d200m account, enabling any available MFA options, and not sharing your login details with any third party. d200m will never ask you for your password via email, live chat, or any other channel.
10.1 What Are Cookies. Cookies are small text files placed on your device by a website when you visit it. They allow the website to remember information about your visit — such as your login session, preferred settings, and which pages you have viewed. Cookies can be session-based (deleted when you close your browser) or persistent (retained on your device for a defined period).
10.2 Cookies d200m Uses. The d200m platform uses the following categories of cookies:
10.3 What d200m Does Not Use. d200m does not use third-party advertising cookies, cross-site tracking pixels, behavioural profiling cookies, or device fingerprinting technologies. We do not participate in any advertising network or data exchange programme that would result in your browsing activity on d200m being shared with external advertisers.
10.4 Managing Cookies. You can control and delete cookies through your browser settings. Please note that disabling strictly necessary cookies will prevent you from logging in to your d200m account and using core platform features. Disabling analytics or preference cookies will not affect your ability to play games or process transactions.
As a d200m player, you have the following rights in relation to your personal data. To exercise any of these rights, contact us at with the subject line "Data Rights Request" and your registered username. We will respond within 5 business days.
Identity Verification for Rights Requests: To protect your privacy and prevent unauthorised access to your data, d200m may require you to verify your identity before processing a data rights request. This typically involves confirming your registered email address and account username. We will not charge a fee for reasonable rights requests.
12.1 Strict 21+ Policy. The d200m platform is strictly for adults aged 21 and over. d200m does not knowingly collect personal data from individuals under the age of 21. The registration process includes a date-of-birth field, and accounts where the entered date of birth indicates the registrant is under 21 are blocked from proceeding. All accounts are subject to KYC verification, which includes confirmation of age via a government-issued identity document (KTP or passport).
12.2 Discovery of Underage Accounts. If d200m discovers or is credibly informed that a registered member is under the age of 21, the account will be immediately suspended pending investigation. Any funds deposited by an underage player will be returned to the original payment method after verification, less any amounts that cannot be recovered due to completed transactions. All personal data associated with a confirmed underage account will be permanently deleted within 30 days of the discovery, except where retention is required by applicable law.
12.3 Parental Guidance. Parents and guardians who believe a minor may have accessed d200m are encouraged to contact us immediately at . d200m also recommends the use of parental control software and internet filtering tools to prevent minors from accessing online gaming platforms.
13.1 Right to Update. d200m reserves the right to update or amend this Privacy Policy at any time. Changes may be made to reflect updates in applicable law, changes to our data processing practices, the introduction of new platform features, or feedback from players and regulators.
13.2 Notification of Material Changes. Where a change to this Privacy Policy is material — meaning it significantly affects how we collect, use, or share your personal data — d200m will notify registered members by email to the address on file, by a prominent notice on the d200m platform, or both, at least 14 days before the change takes effect. Continued use of the d200m platform after the effective date of the updated policy constitutes acceptance of the revised terms.
13.3 Version History. The current version of this Privacy Policy is identified by the effective date shown at the top of this document. Earlier versions are available on request by contacting .
13.4 Non-Material Changes. For minor, non-material updates (such as typographical corrections, clarifications of existing practices, or changes to formatting), d200m may update this page without providing advance notice. The "Last Updated" date at the top of this document will always reflect the most recent revision.
If you have any questions, concerns, or requests relating to this Privacy Policy or to d200m's data processing practices, please contact us through any of the following channels:
We aim to acknowledge all privacy-related enquiries within 24 hours (WIB) and to provide a full substantive response within 5 business days. For complex subject access requests or formal erasure requests, we may require up to 30 days from the date of identity verification to fulfil the request, in accordance with applicable law. We will inform you if a longer processing period is necessary.
Formal Privacy Complaints: If you are not satisfied with d200m's response to a privacy concern, you have the right to escalate your complaint to the relevant data protection supervisory authority in your jurisdiction. For players in Indonesia, you may also seek resolution through the relevant consumer protection channels. d200m is committed to engaging constructively with any supervisory authority enquiry.
Your Data Is Safe With Us
Now that you understand how d200m protects your personal data, you are ready to enjoy everything the platform has to offer — from live BRI Liga 1 sportsbook betting and Evolution Gaming live casino tables, to thousands of slots from Pragmatic Play, and classic Indonesian card games including Bandar Q and Bola Tangkas.
Adults only. Gambling involves financial risk. Please play responsibly.