Privacy Policy — atm42

atm42 ("we", "us", "our") is committed to protecting the personal information of every member who registers and plays on our platform at https://atm42.app. This Privacy Policy ("Policy") sets out, in clear and unambiguous terms, the basis on which we process personal data collected from users in Indonesia and elsewhere.

This Policy applies to all personal data collected via the atm42 website, including registration forms, deposit and withdrawal transactions, customer support interactions, and passive technical data collected during normal browsing sessions. It should be read alongside our Terms & Conditions, which govern the contractual relationship between you and atm42.

If you have questions about anything in this Policy, or wish to exercise any of your data rights, please contact us using the details set out in Clause 15. We will respond to all privacy enquiries within 30 calendar days of receipt.

2.1 Identity. For the purposes of applicable data protection law, the data controller responsible for personal data processed through the atm42 platform is the atm42 operating entity, the details of which are provided in Clause 15 of this Policy.

2.2 Data Protection Officer. atm42 has designated a Data Protection Officer (DPO) who oversees compliance with this Policy and applicable data protection obligations. The DPO can be contacted via the support email address in Clause 15, with the subject line marked "Data Protection Officer".

2.3 Scope. This Policy covers data processing activities performed directly by atm42. Where data is processed by third-party service providers acting on our behalf, those providers are bound by data processing agreements that require them to handle your personal data in a manner consistent with this Policy and applicable law.

atm42 collects the following categories of personal data. We collect only what is genuinely necessary for the purposes described in Clause 5.

3.1 Sensitive Data. atm42 does not intentionally collect special categories of sensitive personal data (such as health data, racial or ethnic origin, religious beliefs, or political opinions). If you voluntarily disclose such information during a support interaction — for example, disclosing a health condition in the context of a responsible gaming request — we will handle it with heightened care and use it solely for the purpose for which it was disclosed.

atm42 collects personal data through the following channels:

• Direct submission: Information you actively provide when registering an account, completing the KYC process, submitting a deposit or withdrawal request, or contacting our support team.
• Automated technical collection: Data gathered passively as you navigate the platform, including IP addresses, session data, and cookie-based identifiers (see Clause 10 for full cookie details).
• Third-party verification services: Identity and document verification data returned by our licensed KYC service providers when you submit identity documents for account verification.
• Payment processors: Transaction confirmation data relayed by Indonesian payment networks (including BCA, BRI, BNI, Mandiri, BSI, OVO, DANA, GoPay, ShopeePay, and LinkAja) when you initiate deposits or withdrawals.
• Game studio providers: Aggregated session and bet data from licensed studio providers (including Evolution Gaming, Pragmatic Play, NetEnt, and Microgaming) that power games on the atm42 platform.

atm42 processes your personal data only where a lawful basis exists. The table below maps each processing purpose to its corresponding legal basis.

5.1 Withdrawing Consent. Where we rely on your consent as the legal basis for processing (e.g., marketing emails), you may withdraw that consent at any time without penalty by updating your notification preferences in Account Settings or by contacting support. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

6.1 We Do Not Sell Your Data. atm42 does not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes. This is an unconditional commitment.

6.2 Trusted Service Providers. atm42 shares personal data with third-party service providers solely to the extent necessary to operate the platform. All such providers are engaged under written data processing agreements that bind them to confidentiality and security standards consistent with this Policy. Current categories of provider include:

• KYC and identity verification services: To validate the identity documents you submit during account verification.
• Payment processors: Indonesian banking partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) and e-wallet platforms (OVO, DANA, GoPay, ShopeePay, LinkAja) to facilitate transactions.
• Game content providers: Licensed studios (Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Pocket Games Soft, Spribe) to deliver game content and record session outcomes.
• Cloud hosting and infrastructure providers: To host the platform on secure, geographically redundant server infrastructure.
• Customer support platform: To manage live chat, email ticketing, and support communications.
• Analytics and fraud-detection tools: To identify anomalous patterns that may indicate fraud, bonus abuse, or money laundering activity.

6.3 Legal Disclosure. atm42 may disclose personal data to law enforcement authorities, regulatory bodies, or courts where required to do so by applicable law, a valid legal process, or to protect the rights, property, or safety of atm42, its members, or the public. We will notify affected members of such disclosures where legally permissible to do so.

6.4 Business Transfers. In the event of a merger, acquisition, asset sale, or restructuring involving atm42, personal data held by atm42 may be transferred to the successor entity. We will notify members of any such transfer and ensure that the receiving entity is bound by privacy obligations no less protective than those set out in this Policy.

7.1 Cross-Border Processing. The atm42 platform serves members primarily located in Indonesia, but our server infrastructure and some third-party service providers operate in other jurisdictions. As a result, your personal data may be transferred to and stored on servers outside Indonesia.

7.2 Safeguards. Where personal data is transferred internationally, atm42 ensures that appropriate safeguards are in place, including: (a) transferring only to jurisdictions that provide an adequate level of data protection; or (b) implementing standard contractual clauses or equivalent data transfer mechanisms that contractually obligate the recipient to protect your data.

7.3 Your Rights Unaffected. An international transfer of your personal data does not affect your rights under this Policy. You retain all rights described in Clause 11 regardless of where your data is processed.

8.1 Retention Principle. atm42 retains personal data for no longer than is necessary for the purposes for which it was collected, subject to any legal or regulatory retention obligations that require longer storage.

8.2 Retention Schedule. The following indicative retention periods apply:

8.3 Deletion. Once the applicable retention period expires, atm42 will securely delete or anonymize your personal data in a manner that prevents reconstruction. Where anonymization is used in place of deletion, the resulting data can no longer be attributed to you and falls outside the scope of this Policy.

atm42 applies a layered security architecture to protect your personal data against unauthorized access, disclosure, alteration, and destruction. Our key technical and organizational measures include:

• 256-bit SSL/TLS encryption on all data in transit between your device and the atm42 platform.
• Encryption at rest for all sensitive personal data, KYC documents, and financial records stored on our servers.
• Role-based access controls ensuring that only authorized atm42 personnel with a documented operational need can access identifiable member data.
• Multi-factor authentication (MFA) for all internal administrative access to systems that hold personal data.
• Penetration testing and vulnerability scanning conducted regularly by independent third-party security firms.
• Incident response plan — in the event of a data breach that is likely to result in a high risk to your rights, atm42 will notify affected members without undue delay and, where required, report to the relevant authority.

10.1 What Are Cookies. Cookies are small text files placed on your device when you visit a website. atm42 uses cookies and similar technologies (local storage, session tokens) to operate the platform, maintain your login session, remember your preferences, and gather anonymized analytics data to improve the user experience.

10.2 Types of Cookies We Use.

10.3 Managing Cookies. You can control non-essential cookies via your browser settings. Please note that disabling strictly necessary cookies will prevent you from logging in and using the atm42 platform. Disabling functional or analytics cookies will not prevent you from playing but may degrade your experience.

Depending on applicable data protection law, you may hold some or all of the following rights in relation to your personal data. atm42 will respond to valid requests within 30 calendar days and will not charge a fee for exercising these rights under normal circumstances.

• Right of Access: You may request a copy of the personal data we hold about you, together with information on how it is being used.
• Right to Rectification: You may ask us to correct inaccurate or incomplete personal data. For straightforward corrections (e.g., contact details), you can often update these directly in Account Settings.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, or where you have withdrawn the consent on which processing was based. This right is subject to our legal retention obligations (see Clause 8).
• Right to Restriction: You may ask us to restrict the processing of your data — for example, while a dispute about accuracy is being resolved — without requiring full deletion.
• Right to Data Portability: Where processing is based on your consent or a contract, and is carried out by automated means, you may request your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You may object at any time to processing based on our legitimate interests, including for direct marketing purposes. We will stop processing unless we can demonstrate compelling grounds that override your interests.
• Rights Related to Automated Decision-Making: atm42 does not make solely automated decisions that produce legal or similarly significant effects on members. Human review is involved in all material account decisions (e.g., account closure, withdrawal holds).

To exercise any of these rights, contact us using the details in Clause 15. We may need to verify your identity before processing your request in order to protect against unauthorized access to another member's data.

12.1 Age Restriction. The atm42 platform is strictly for adults aged 21 and over. We do not knowingly collect or process personal data from individuals under the age of 21. Registration requires confirmation of age, and KYC verification validates date of birth against a government-issued document.

12.2 Discovery of Underage Data. If atm42 discovers that personal data has been collected from a person under the age of 21, we will immediately close the associated account, void any outstanding balance derived from gameplay, and delete the personal data as promptly as legally permissible.

12.3 Parental Notice. If you are a parent or guardian and believe that a minor in your household has registered an account on atm42 without your knowledge, please contact us immediately at the address in Clause 15. We will treat such reports as urgent and act without delay.

The atm42 platform may contain references to third-party services — for example, the game studios whose content we host. atm42 does not control the privacy practices of these third parties and is not responsible for their privacy policies or data handling. We recommend reviewing the privacy policy of any third-party service you interact with directly. This Privacy Policy applies exclusively to data processed by atm42.

14.1 Right to Update. atm42 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or platform functionality. The updated Policy will be published on this page with a revised effective date.

14.2 Material Changes. Where a change is material — meaning it significantly affects how we use your personal data or the rights available to you — atm42 will notify active members via their registered email address at least 14 calendar days before the change takes effect.

14.3 Continued Use. Your continued use of the atm42 platform after the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. If you do not agree to the revised Policy, you should cease using the platform and request account closure in accordance with our Terms & Conditions.

For any privacy-related questions, requests to exercise your data rights, or concerns about how atm42 handles your personal data, please contact us using the details below. In accordance with our site policy, email is displayed as plain text and is not a clickable link.

atm42 takes all privacy requests seriously. Our support team includes Indonesian-speaking agents and English-speaking privacy specialists. You are welcome to write in English. All formal privacy rights requests should include your registered username and email address so we can verify your identity before processing the request.