Privacy Policy — bmk4d Platform

bmk4d ("we", "us", "our") operates the online betting and gaming platform accessible at https://bmk4d.net (the "Platform"). We are committed to protecting and respecting the privacy of every individual who registers as a member, accesses, or otherwise interacts with the Platform.

This Privacy Policy explains how bmk4d collects, uses, stores, shares, and protects personal data relating to members and visitors. It also sets out your rights with respect to that data and how you may exercise them. This Policy applies to all personal data collected through the Platform, our customer support channels, email communications, and any other means by which you interact with bmk4d.

This Privacy Policy is incorporated by reference into bmk4d's Terms & Conditions. By registering an Account or otherwise using the Platform, you confirm that you have read, understood, and agreed to this Privacy Policy. If you do not agree with any aspect of this Policy, you must not use the Platform.

In this Privacy Policy, the following terms have the meanings set out below:

• "Personal Data" — any information that relates to an identified or identifiable natural person, including name, date of birth, email address, phone number, payment details, device identifiers, and IP addresses.
• "Processing" — any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, and deletion.
• "Data Controller" — bmk4d, as the entity that determines the purposes and means of processing your Personal Data.
• "Data Processor" — any third-party service provider that processes Personal Data on behalf of bmk4d under a formal data processing agreement.
• "Member" — any individual who has registered an Account on the Platform.
• "Account" — a registered member account on the bmk4d Platform, including all associated profile information, transaction history, and preferences.
• "KYC" — Know Your Customer identity verification procedures, including the collection and review of government-issued identity and proof-of-address documents.
• "Cookie" — a small data file placed on your device by the Platform to recognise your browser, maintain session state, and collect usage analytics.
• "IDR" — Indonesian Rupiah, the sole transaction currency on the Platform.

bmk4d collects Personal Data across several categories. We collect only the data that is necessary for the purposes described in this Policy, consistent with the principle of data minimisation.

3.1 Registration & Profile Data

When you create a bmk4d Account, we collect:

• Full legal name (as it appears on your government-issued identity document).
• Date of birth (to verify that you meet the 21+ age requirement).
• Email address and mobile phone number.
• Chosen username and encrypted password.
• Residential address in Indonesia.
• Preferred language (English or Bahasa Indonesia).

3.2 Identity Verification (KYC) Data

To comply with responsible gaming and anti-money-laundering obligations, we may collect:

• Copies of government-issued identity documents: Indonesian National Identity Card (KTP), passport, or driver's licence (SIM).
• Proof of residential address: recent utility bills or bank statements from BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, or OCBC NISP.
• Selfie or live photo for facial verification purposes.
• Proof of payment method ownership (e.g., a screenshot of your OVO, DANA, GoPay, ShopeePay, or LinkAja registered account).

3.3 Financial & Transaction Data

• Deposit and withdrawal amounts in IDR, timestamps, and payment method references (bank account numbers, e-wallet identifiers).
• Betting and gaming activity: wager amounts, game titles played, outcomes, bonus usage, and account balance history.
• Bonus and promotional credit history.

3.4 Technical & Usage Data

• IP address and approximate geographic location.
• Device type, operating system, and browser version.
• Session duration, pages visited, features used, and click-path data.
• Error logs and crash reports generated during Platform use.

3.5 Communications Data

• Records of your communications with bmk4d's customer support team, including email correspondence and live chat transcripts.
• Survey responses and feedback submissions.
• Marketing preference settings and opt-in/opt-out records.

bmk4d collects Personal Data through the following channels:

• Directly from you: Information you provide when registering an Account, completing KYC verification, making deposits or withdrawals, placing wagers, contacting customer support, or responding to surveys.
• Automatically through the Platform: Technical and usage data collected via cookies, server logs, and analytics tools as you navigate the Platform. See Clause 8 for full details on our cookie practices.
• From payment service providers: Transaction confirmation data from BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, OVO, DANA, GoPay, ShopeePay, LinkAja, and QRIS payment networks — specifically transaction references, amounts, and timestamps needed to reconcile deposits and withdrawals on your Account.
• From identity verification services: Verification status and document authenticity confirmation from our third-party KYC providers, used to validate the documents you submit.
• From fraud prevention and security tools: Risk signals and device reputation data from our fraud screening partners, used to protect the integrity of the Platform and your Account.

bmk4d processes your Personal Data for the following specific purposes:

• Account creation and management: To register your Account, verify your identity and age (21+), maintain your profile, and provide you with access to all Platform features.
• Payment processing: To process IDR deposits and withdrawals via your chosen payment method (bank transfer or e-wallet), reconcile transaction records, and prevent payment fraud.
• Gaming services: To facilitate sports betting (including BRI Liga 1, EPL, Champions League, and Timnas Indonesia matches), slots, live casino, togel (Indonesia's traditional numbers lottery), and all other Platform products.
• KYC and AML compliance: To verify member identities, comply with anti-money-laundering obligations, and meet responsible gaming requirements.
• Responsible gaming: To monitor betting patterns for signs of problem gambling, enforce deposit limits and self-exclusion requests, and provide appropriate support resources.
• Customer support: To respond to your enquiries, resolve disputes, process complaints, and deliver an effective after-sales experience.
• Security and fraud prevention: To detect, investigate, and prevent unauthorised Account access, bonus abuse, multi-accounting, and other prohibited conduct described in our Terms & Conditions.
• Platform improvement: To analyse usage patterns, identify technical issues, test new features, and improve the overall performance and user experience of the Platform.
• Marketing communications (where opted in): To send you promotional offers, bonus notifications, and seasonal campaigns — for example, Idul Fitri bonus promotions or Champions League free bet offers — by email or in-platform notification. You may opt out at any time.
• Legal compliance: To retain records as required by applicable law, respond to valid legal requests, and cooperate with regulatory authorities where legally obligated.

bmk4d processes your Personal Data on the following legal bases:

• Contractual necessity: Processing required to perform our contract with you — i.e., to operate your Account, process payments, and deliver gaming services — is carried out on the basis that it is necessary for the performance of that contract.
• Legitimate interests: Processing for fraud prevention, security monitoring, platform analytics, and responsible gaming programme enforcement is carried out on the basis of bmk4d's legitimate interests in operating a safe and fair platform, provided those interests are not overridden by your rights and freedoms.
• Legal obligation: Processing required by applicable law — including KYC verification, AML record-keeping, and responses to valid legal process — is carried out on the basis of compliance with a legal obligation.
• Consent: Where we send you optional marketing communications, we do so on the basis of your affirmative opt-in consent. You may withdraw this consent at any time by updating your marketing preferences in your Account dashboard or by contacting support at [email protected]. Withdrawal of consent does not affect the lawfulness of processing that occurred before the withdrawal.

bmk4d does not sell, rent, or trade your Personal Data. We share Personal Data only in the limited circumstances described below, and only to the extent strictly necessary for the stated purpose.

7.1 Service Providers & Data Processors

We engage carefully selected third-party service providers who process Personal Data on our behalf under binding data processing agreements. Categories of processors include:

• Payment processors: BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OCBC NISP, OVO, DANA, GoPay, ShopeePay, LinkAja, and QRIS network operators — solely for the purpose of processing IDR transactions on your Account.
• KYC and identity verification providers: Third-party document verification platforms used to authenticate identity documents submitted during the KYC process.
• Fraud prevention and security analytics providers: Services that analyse transaction and behavioural data to detect and prevent fraudulent activity.
• Cloud hosting and infrastructure providers: Secure data centre operators that host bmk4d's Platform servers and databases.
• Customer support platform providers: Software tools used to manage email and live chat support interactions.
• Game content studios: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft receive limited session and game-result data necessary to deliver and audit certified game outcomes. No broader profile or financial data is shared beyond what is technically required for game operation.

7.2 Legal & Regulatory Disclosure

bmk4d may disclose Personal Data to law enforcement agencies, regulatory authorities, or other competent bodies where we are legally required to do so, or where disclosure is necessary to protect the rights, property, or safety of bmk4d, our members, or the public.

7.3 Business Transfers

In the event that bmk4d undergoes a merger, acquisition, restructuring, or sale of assets, Personal Data may be transferred to the successor entity as part of that transaction, subject to the same protections as set out in this Privacy Policy. Members will be notified of any such transfer in advance where practicable.

bmk4d uses cookies and similar tracking technologies to operate the Platform, maintain your session, remember your preferences, and gather analytics data that helps us improve the Platform experience.

Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the Platform to function. They maintain your login session, remember your language preference, and enable core security features. These cannot be disabled without breaking core Platform functionality.
• Functional Cookies: Remember your preferences such as game display settings, currency format (IDR), and notification settings to personalise your experience.
• Analytics Cookies: Collect aggregated, anonymised data on how members navigate the Platform — which pages are visited most, where users drop off, and how features are used. This helps bmk4d identify areas for improvement.
• Security Cookies: Assist in fraud detection by recognising trusted devices, flagging unusual login locations, and supporting two-factor authentication workflows.

bmk4d does not use third-party advertising cookies or behavioural targeting cookies that track you across external websites. Our cookies are scoped to bmk4d.net and do not communicate with third-party advertising networks.

You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent you from logging in and using the Platform. For analytics and functional cookies, you may opt out via the cookie preference panel accessible from the Platform footer.

bmk4d retains your Personal Data for as long as is necessary to fulfil the purposes for which it was collected, as set out below:

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in accordance with bmk4d's data destruction procedures. Anonymised, aggregated data (from which no individual can be identified) may be retained indefinitely for statistical and analytical purposes.

bmk4d implements a comprehensive set of technical and organisational measures designed to protect your Personal Data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and bmk4d's servers.
• AES-256 encryption at rest for all sensitive Personal Data stored in bmk4d's databases, including KYC documents and payment method references.
• Multi-factor authentication (MFA) available to all members and mandatory for all bmk4d staff accessing production systems.
• Role-based access controls ensuring that only authorised staff with a documented business need may access specific categories of Personal Data.
• Regular penetration testing and vulnerability assessments conducted by independent security professionals.
• Automated intrusion detection systems monitoring Platform infrastructure for anomalous activity around the clock.
• Secure data centres with physical access controls, redundant power, and geographically distributed backup storage.

Notwithstanding these measures, no method of electronic transmission or storage is completely secure. In the event of a data breach that is likely to result in a risk to your rights and freedoms, bmk4d will notify you without undue delay via the email address registered on your Account, providing details of the nature of the breach, the data affected, and the steps we are taking to address it.

You are equally responsible for the security of your Account. We strongly recommend enabling two-factor authentication (2FA) from your Account security settings and never sharing your login credentials with any other person.

As a bmk4d member, you hold the following rights with respect to your Personal Data. To exercise any of these rights, please contact our Data Protection team at [email protected] with the subject line "Data Rights Request — [Your Right]". We will respond within 30 days of receiving a valid, verifiable request.

bmk4d will verify your identity before processing any data rights request to ensure we do not disclose or delete data in response to a fraudulent request. We will not charge a fee for standard requests. For requests that are manifestly unfounded or excessive in frequency, a reasonable administrative fee may apply.

The bmk4d Platform is strictly intended for adults aged 21 and above. We do not knowingly collect Personal Data from individuals under the age of 21 under any circumstances. The 21+ age requirement is enforced at the point of registration and through our ongoing KYC verification programme.

If bmk4d becomes aware that Personal Data has been collected from an individual who is under 21 years of age, we will immediately suspend that Account, delete all associated Personal Data, and report the matter to our responsible gaming compliance team for review.

If you are a parent or legal guardian and believe that a minor in your care may have accessed or registered on the Platform, please contact us immediately at [email protected] with the subject line "Underage Account Report". We will investigate and take appropriate action within 24 hours of receiving your report.

bmk4d's primary data processing infrastructure is hosted in secure data centres with strong data protection standards. However, some of our third-party service providers — including certain KYC verification platforms, fraud prevention analytics tools, and cloud infrastructure providers — may be based in or operate servers in countries outside Indonesia.

Where Personal Data is transferred internationally, bmk4d ensures that appropriate safeguards are in place to protect that data to a standard at least equivalent to the protections described in this Privacy Policy. These safeguards include:

• Standard contractual data processing clauses requiring the recipient to apply equivalent data protection standards.
• Restricting international transfers to processors located in jurisdictions with recognised adequate data protection frameworks.
• Implementing encryption and access controls that apply regardless of where data is physically stored.

By using the Platform and submitting your Personal Data, you acknowledge that your data may be transferred internationally as described in this clause, subject to the safeguards detailed above.

The bmk4d Platform may display content from or references to third-party services such as game studio providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe), sports data providers, and payment networks. While these third parties are integrated into the Platform experience, they operate under their own privacy policies.

bmk4d is not responsible for the privacy practices or data handling of third-party services that operate independently outside the bmk4d Platform environment. We recommend reviewing the privacy policies of any third-party services you interact with directly.

Within the Platform itself, all data flows to and from third-party game studios and payment processors are governed by the data processing agreements described in Clause 7, which require those processors to handle your data exclusively for the purposes of delivering their contracted service.

bmk4d reviews this Privacy Policy regularly and reserves the right to update or amend it at any time to reflect changes in our data processing practices, applicable legal requirements, or Platform features. The current version of this Policy is always available at bmk4d.net/privacy-policy and is identified by the Effective Date and version number displayed at the top of this page.

Where an update to this Policy involves a material change to how your Personal Data is processed — for example, a new category of data being collected or a new category of third-party processor being engaged — bmk4d will notify active members by email to the address registered on their Account at least 14 days before the change takes effect.

Minor updates — such as corrections of typographical errors, clarifications that do not alter the substance of the Policy, or updates to contact details — may be made immediately without prior notice. Your continued use of the Platform following any update constitutes acceptance of the revised Privacy Policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way bmk4d processes your Personal Data, please contact our Data Protection team using the details below. We are committed to addressing all privacy-related enquiries promptly and transparently.

• Email: [email protected] — please use the subject line "Privacy Enquiry" for general questions, or "Data Rights Request — [Right Type]" when exercising a specific data right.
• Response Time: We aim to acknowledge all privacy-related communications within 24 hours (WIB, UTC+7) and to provide a substantive response within 30 calendar days of receiving a valid, verifiable request.
• Support Languages: Our Data Protection team handles enquiries in both English and Bahasa Indonesia. Members across Jakarta, Surabaya, Bandung, Bali, Medan, Yogyakarta, Semarang, Makassar, and all other parts of Indonesia are welcome to reach out.
• Responsible Gaming & Data: If your enquiry relates to self-exclusion records, responsible gaming data, or the deletion of a self-exclusion history, please mark your subject line "Responsible Gaming — Data Request" for priority handling by our dedicated responsible gaming team.