Privacy Policy

bom89 ("we", "us", "our") operates the online betting and gaming platform accessible at bom89.asia. As a platform serving players across Indonesia, bom89 is committed to protecting the personal information of every Member and visitor who interacts with our Services.

This Privacy Policy applies to all personal data collected through the bom89 website, mobile-optimised interface, and any related communications (including email and live chat). It explains what data we collect, why we collect it, how it is used, and the rights you hold over your personal information.

By registering an account or using any bom89 Service, you confirm that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree to this Privacy Policy, you must not use the bom89 platform.

This Privacy Policy should be read in conjunction with bom89's Terms & Conditions and Responsible Gaming policy, which together govern the full scope of your relationship with bom89.

bom89 collects personal data that is necessary to provide, operate, and improve our Services, comply with legal obligations, and prevent fraud. The categories of data we may collect include:

bom89 collects personal data through the following channels:

1. Direct Interactions: Data you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting our support team, or responding to a survey or promotion.
2. Automated Technologies: Technical and usage data collected automatically as you navigate the bom89 platform, via cookies, server logs, and similar tracking technologies (see Section 6 — Cookies & Tracking).
3. Payment Processors: Transaction confirmation data received from Indonesian payment providers (BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, LinkAja) when you initiate a deposit or withdrawal.
4. Identity Verification Partners: Identity and age verification data returned by third-party KYC service providers who cross-reference your submitted documents against authoritative Indonesian population databases.
5. Fraud Prevention Services: Risk signals shared by anti-fraud and anti-money-laundering (AML) screening partners to help us identify and prevent financial crime on the platform.
6. Public Sources: In limited circumstances, bom89 may supplement account data with information from publicly available Indonesian government registers or credit reference databases, strictly for the purpose of verifying account holder identity and eligibility.

bom89 processes your personal data only for clearly defined, lawful purposes. The table below summarises our primary processing activities and the legal basis for each:

bom89 will not use your personal data for purposes that are incompatible with those set out above without first obtaining your explicit consent or being required to do so by law.

bom89 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share personal data only in the following limited and controlled circumstances:

1. Payment Service Providers: We share necessary financial data with Indonesian payment processors (BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, LinkAja) solely to process your deposit and withdrawal transactions. These providers are bound by their own data protection obligations and are prohibited from using your data for any other purpose.
2. KYC and Identity Verification Partners: We share identity documents and personal details with regulated third-party KYC providers to verify your age (21+), identity, and Indonesian residency. These partners process data only on our instruction and under strict confidentiality agreements.
3. Game Content Providers: When you play a game powered by a third-party studio (such as Pragmatic Play, Evolution Gaming, Pocket Games Soft, NetEnt, Microgaming, or Spribe), limited technical session data (game round ID, stake, result) is shared with the respective studio solely for the purpose of game operation, audit, and fairness verification. These providers do not receive your full identity or contact data.
4. Fraud and AML Screening Services: We share risk-relevant data points (IP address, transaction patterns, device fingerprint) with specialised anti-fraud and anti-money-laundering service providers to detect and prevent financial crime.
5. Legal and Regulatory Authorities: bom89 may disclose personal data to law enforcement agencies, regulatory bodies, or courts where required to do so by applicable law, court order, or regulatory demand. bom89 will notify affected Members where legally permitted to do so prior to any such disclosure.
6. Corporate Transactions: In the event of a merger, acquisition, or sale of all or part of bom89's business, your personal data may be transferred to the acquiring entity, subject to equivalent privacy protections. You will be notified of any such transfer in advance.

bom89 uses cookies and similar tracking technologies to operate and improve the platform. A cookie is a small text file stored on your device when you visit a website. The categories of cookies we use are as follows:

You may manage cookie preferences through your browser settings. Most modern browsers allow you to refuse or delete cookies. Please note that disabling strictly necessary cookies will impair the functionality of the bom89 platform and may prevent you from logging into your Account or placing bets.

bom89 does not use third-party advertising cookies or share cookie data with external ad networks or social media platforms for targeted advertising purposes.

bom89 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. Our standard retention periods are as follows:

1. Active Account Data: Retained for the full duration of your active membership with bom89, plus a minimum of 5 years following account closure, to meet anti-money-laundering record-keeping obligations.
2. KYC and Identity Documents: Retained for a minimum of 5 years from the date of submission or account closure, whichever is later, in compliance with internationally recognised AML standards.
3. Transaction Records: All financial transaction records (deposits, withdrawals, bet stakes, winnings in IDR) are retained for a minimum of 5 years from the date of each transaction.
4. Support Communications: Live chat transcripts and email correspondence with our support team are retained for 2 years from the date of the interaction, for quality assurance and dispute resolution purposes.
5. Marketing Preferences: Records of your promotional consent and opt-out history are retained indefinitely to ensure we honour your communication preferences correctly.
6. Self-Exclusion Records: Records of any self-exclusion request are retained indefinitely to prevent re-registration during an active exclusion period and to facilitate reinstatement requests after a permanent exclusion, where applicable.
7. Technical Logs: Server access logs and security event logs are retained for 12 months and then securely deleted or anonymised.

When the applicable retention period has expired, bom89 will securely delete or irreversibly anonymise your personal data in accordance with our internal data destruction procedures.

bom89 implements industry-standard technical and organisational measures to protect your personal data against unauthorised access, accidental loss, disclosure, alteration, or destruction. Our security framework includes:

1. 256-bit SSL/TLS Encryption: All data transmitted between your device and the bom89 platform is encrypted in transit using 256-bit SSL/TLS protocols. Look for the padlock icon in your browser's address bar as confirmation.
2. Encryption at Rest: Sensitive data fields — including passwords, KTP numbers, and bank account identifiers — are encrypted at rest using AES-256 encryption within our secure data stores.
3. Password Hashing: Account passwords are never stored in plain text. They are hashed using a strong one-way cryptographic algorithm (bcrypt) with a unique salt per account.
4. Two-Factor Authentication (2FA): bom89 offers optional 2FA for all Member Accounts via one-time passcode (OTP) sent to your registered Indonesian mobile number. We strongly recommend enabling 2FA to add an additional layer of protection to your Account.
5. Access Controls: Access to personal data within bom89's internal systems is restricted on a strict need-to-know basis. All staff with data access undergo security training and are bound by confidentiality obligations.
6. Penetration Testing and Security Audits: bom89 conducts regular third-party penetration tests and internal security reviews to identify and remediate vulnerabilities before they can be exploited.
7. Automated Fraud Monitoring: Real-time automated systems monitor all account activity for anomalous behaviour, suspicious login patterns, and unusual transaction volumes, flagging potential incidents for immediate human review.

While bom89 takes all reasonable steps to safeguard your data, no internet transmission or electronic storage system is entirely risk-free. You are responsible for maintaining the secrecy of your Account credentials and should contact our support team immediately at [email protected] if you suspect any unauthorised access to your Account.

As a bom89 Member, you hold the following rights with respect to your personal data. You may exercise any of these rights at any time by contacting our support team at [email protected]:

1. Right of Access: You have the right to request a copy of the personal data we hold about you, together with information about how that data is being processed.
2. Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data held in your bom89 Account. For name or date-of-birth corrections, KYC documentation will be required.
3. Right to Erasure ("Right to be Forgotten"): You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected. Please note that this right is subject to overriding legal obligations — in particular, bom89 is required to retain financial and identity records for a minimum of 5 years under applicable AML standards, and erasure requests cannot override these obligations.
4. Right to Restriction of Processing: You may request that bom89 suspend processing of your personal data in certain circumstances — for example, while the accuracy of the data is contested or while an objection to processing is under review.
5. Right to Data Portability: You may request a structured, machine-readable copy of the personal data you provided to bom89 during registration and account use, for the purpose of transferring it to another service provider.
6. Right to Object: You have the right to object to processing of your personal data where that processing is based on bom89's legitimate interests. You also have the absolute right to opt out of direct marketing communications at any time, without providing a reason.
7. Right to Withdraw Consent: Where bom89 processes your data on the basis of your consent (e.g., for marketing communications), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

bom89 will respond to all rights requests within 30 days of receipt. Where a request is complex or numerous, this period may be extended by a further 60 days, in which case we will notify you of the extension and the reason for it within the initial 30-day window.

We will not charge a fee for handling rights requests unless they are manifestly unfounded, repetitive, or excessive, in which case a reasonable administrative fee may apply.

bom89's Services are strictly restricted to adults aged 21 years and over. We do not knowingly collect personal data from any individual under the age of 21.

During account registration, all applicants are required to confirm that they are at least 21 years of age and are residents of Indonesia. bom89 applies automated age-check controls at the point of registration and conducts KYC identity verification — including review of the applicant's KTP, passport, or driver's licence — to confirm age eligibility before full account access is granted.

If bom89 discovers or is notified that personal data has been collected from a person under 21 years of age, we will immediately:

1. Suspend the relevant Account;
2. Void any bets placed and withhold any associated winnings;
3. Return any net deposits to the payment source used, following verification;
4. Permanently delete the personal data of the underage individual from our systems; and
5. Report the incident to the relevant authorities where required by applicable law.

The bom89 platform may contain references to third-party payment providers, game studios, and service partners. bom89 does not operate or control any third-party websites or services and is not responsible for the privacy practices or content of such third parties.

When you interact directly with a third-party payment gateway or a licensed game studio's interface, that third party's own privacy policy governs the collection and use of any data you provide to them. We encourage you to review the privacy policies of any third-party services you access in connection with your use of bom89.

This Privacy Policy applies exclusively to personal data processed by bom89 in connection with the bom89 platform. It does not extend to any data collected by third parties operating independently of bom89's instruction.

bom89 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, operational requirements, or applicable law. The effective date at the top of this document will always reflect the date of the most recent revision.

Where a material change is made to this Privacy Policy — such as a new category of data being collected, a new sharing arrangement being established, or a change to the legal basis for a key processing activity — bom89 will notify active Members via email or an in-platform notice at least 14 days prior to the change taking effect.

For non-material updates (such as corrections to wording, clarifications of existing practices, or administrative changes), the revised Privacy Policy will be published on this page without advance individual notification.

Your continued use of the bom89 platform following the effective date of any amendment to this Privacy Policy constitutes your acknowledgement of the updated terms. If you do not accept the changes, you must discontinue use of the platform and may request account closure in accordance with our Terms & Conditions.

If you have any questions, concerns, or requests regarding this Privacy Policy or the way bom89 processes your personal data, please contact our Data Support team using the details below:

For data erasure or portability requests, please also attach a copy of your KTP or other accepted identity document so that we can verify your identity before actioning the request. bom89 cannot process data rights requests from unverified individuals.