Privacy Policy — jam37

Throughout this Privacy Policy, the following terms carry the meanings assigned below unless context expressly requires otherwise:

• "Platform" — the jam37 website accessible at jam37.cam, including all sub-pages, mobile-optimized views, and any associated applications.
• "Company" / "we" / "us" / "our" — jam37 and its affiliated operating entities, officers, employees, agents, and licensors.
• "Member" / "you" / "your" — any natural person who has successfully registered an Account on the Platform.
• "Personal Data" — any information that identifies or can reasonably be used to identify a living natural person, directly or in combination with other data in our possession. This includes but is not limited to your name, email address, mobile number, national identity number, IP address, and financial transaction records.
• "Processing" — any operation performed on Personal Data, including collection, recording, organization, storage, adaptation, retrieval, use, disclosure, or deletion.
• "KYC" — Know Your Customer — the identity and age verification process required prior to activating full withdrawal privileges on your Account.
• "Cookies" — small text files placed on your device by the Platform to maintain session state and collect usage analytics.
• "Third-Party Service Providers" — external organizations engaged by jam37 under contractual confidentiality obligations to assist in operating the Platform, including payment processors, fraud detection vendors, and game content providers.
• "Applicable Laws" — all data protection, privacy, anti-money-laundering, and related statutes and regulations applicable to the Company's operations and to your jurisdiction of residence.

jam37 acts as the data controller for all Personal Data collected through the Platform. As data controller, we determine the purposes and means of processing your Personal Data and are responsible for ensuring that processing is carried out lawfully, fairly, and transparently in accordance with Applicable Laws.

Where jam37 engages Third-Party Service Providers to process Personal Data on our behalf, those providers act as data processors bound by written data processing agreements. They are prohibited from using your Personal Data for any purpose beyond the specific services they provide to jam37.

jam37 collects Personal Data through three primary channels: information you provide directly, information generated automatically through your use of the Platform, and information received from trusted third parties as part of our verification and fraud-prevention processes.

A. Information You Provide Directly

• Full legal name, date of birth, and gender (collected at registration).
• Residential address in Indonesia, including province and city (e.g., Jakarta, Surabaya, Bandung, Bali, Medan, Yogyakarta).
• Email address and mobile phone number.
• Indonesian National Identity Card (KTP) number and a scanned copy or photo of the document, submitted during KYC verification.
• Bank account details for the purposes of processing deposits and withdrawals — including account name, account number, and bank name (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, or e-wallet identifiers for OVO, DANA, GoPay, ShopeePay, LinkAja).
• Communications you send to our support team, including live chat transcripts and email correspondence.
• Responsible gaming preferences, limit settings, and self-exclusion elections made through your Account settings.

B. Information Collected Automatically

• IP address, device type, operating system, and browser version at each login event.
• Geolocation data derived from your IP address (country and city level — not GPS-level precision).
• Session duration, pages visited, game sessions initiated, and betting activity logs.
• Cookie identifiers and similar tracking tokens as described in Section 8 of this policy.
• Transaction metadata: deposit amounts (in IDR / Rp), withdrawal requests, timestamps, and payment channel used.

C. Information from Third Parties

• Identity and age verification results from KYC service providers engaged to cross-reference your submitted documents against trusted data registries.
• Fraud risk scores and device fingerprint signals provided by anti-fraud technology partners.
• Payment confirmation data relayed by your bank or e-wallet provider confirming the successful completion of a deposit or withdrawal transaction.

Every processing activity carried out by jam37 rests on one of the following legal bases:

jam37 uses the Personal Data we collect for the following specific purposes:

1. Account Administration: Creating, maintaining, and securing your Member Account; authenticating your identity at each login; communicating material Account notices (password resets, security alerts, KYC status updates).
2. Transaction Processing: Executing deposit instructions received from your nominated Indonesian bank or e-wallet account, and processing withdrawal requests to your verified payment method within the standard processing window of 5–15 minutes for major local banks.
3. Identity Verification: Conducting KYC checks to confirm that you are a natural person, that you are at least 21 years of age, and that the payment instruments registered to your Account are held in your own name — in compliance with anti-money-laundering obligations applicable to internationally licensed gaming operators.
4. Fraud Prevention and Platform Integrity: Detecting, investigating, and preventing fraudulent transactions, multi-account abuse, bonus exploitation, collusion, and any other conduct that violates our Terms & Conditions or constitutes criminal activity.
5. Responsible Gaming: Monitoring your betting behavior for indicators of problematic gambling patterns; delivering reality-check notifications; honoring your elected deposit limits, session time limits, and self-exclusion requests; and proactively engaging with Members who show signs of gambling harm.
6. Promotional Communications: Where you have not opted out, delivering targeted promotional offers via email or in-Platform messaging relevant to your gaming preferences — for example, bonus offers tied to BRI Liga 1 fixtures, Piala AFF (AFF Cup), EPL match weeks, or seasonal promotions around Idul Fitri and Ramadhan.
7. Platform Improvement: Analysing aggregated, anonymized usage data to understand how Members interact with the Platform, identify technical issues, prioritize feature development, and optimize game content offerings.
8. Legal and Regulatory Compliance: Retaining records as required by anti-money-laundering regulations; responding to lawful requests from competent authorities; pursuing or defending legal claims.

jam37 does not sell, rent, or trade your Personal Data. We share your information only in the circumstances described below, and only to the minimum extent necessary for each purpose:

• Payment Processors: Your bank account or e-wallet details are shared with the relevant Indonesian financial institution (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, OVO, DANA, GoPay, ShopeePay, LinkAja) solely to execute the specific transaction you have initiated.
• KYC and Identity Verification Providers: Your identity documents and personal details are shared with our contracted KYC service provider to complete the verification process. This provider operates under a data processing agreement and is prohibited from retaining or using your data for any other purpose.
• Game Content Providers: Certain game studios (including Evolution Gaming, Pragmatic Play, Spribe, and Pocket Games Soft) require a session token and pseudonymous Member ID to initiate a game session. No additional Personal Data beyond what is strictly necessary to launch the game session is shared.
• Fraud Prevention and Security Vendors: Pseudonymized behavioral data and device fingerprint signals are shared with our anti-fraud technology partners to generate risk scores. These partners do not receive your full name, KTP number, or bank account details.
• Legal and Regulatory Authorities: We may disclose your Personal Data to competent law enforcement agencies, regulatory bodies, or courts where we are legally compelled to do so by a valid judicial order, regulatory mandate, or other binding legal instrument. We will notify you of such disclosure where we are legally permitted to do so.
• Corporate Transactions: In the event of a merger, acquisition, or sale of all or substantially all of the Company's assets, your Personal Data may be transferred to the acquiring entity. You will be notified of any such transfer and of any material change in data processing practices that results from it.

jam37 retains your Personal Data for as long as your Account remains active and for a defined period thereafter, in accordance with the following schedule:

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymized. Where deletion is not immediately practicable due to backup storage cycles, the data is quarantined and excluded from active processing until deletion is completed.

jam37 uses cookies and similar technologies — including local storage tokens and session identifiers — to operate the Platform efficiently and to deliver a consistent experience across your sessions. The following categories of cookies are in use:

jam37 does not use third-party advertising cookies, behavioral retargeting cookies, or any cookie that tracks your activity across websites other than jam37.cam. You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair core Platform functionality, including the ability to maintain a logged-in session.

jam37 applies a layered security architecture to protect your Personal Data against unauthorized access, accidental loss, destruction, or disclosure. Our security framework includes the following controls:

• Transport Layer Security (TLS 1.3): All data transmitted between your device and our servers is encrypted using TLS 1.3 or higher. HTTP connections are automatically redirected to HTTPS.
• Password Hashing: Member passwords are stored exclusively as salted cryptographic hashes using bcrypt. Plain-text passwords are never stored or logged.
• Access Controls: Internal access to Personal Data is restricted on a strict need-to-know basis. Staff accounts are governed by role-based access control (RBAC), and all privileged access events are logged and audited.
• Two-Factor Authentication (2FA): Members are strongly encouraged to enable 2FA on their Accounts. 2FA is mandatory for all internal staff accounts with access to Member data.
• Penetration Testing: Independent third-party security firms conduct penetration tests on the Platform infrastructure no less than annually. Critical findings are remediated within 30 days of identification.
• Data Breach Response: In the event of a confirmed data breach that poses a material risk to affected Members, jam37 will notify impacted Members without undue delay and will implement remediation measures immediately.

As a Member of jam37, you hold the following rights with respect to your Personal Data. You may exercise any of these rights by submitting a request to [email protected] or through the Account settings panel:

1. Right of Access: You have the right to request a copy of the Personal Data we hold about you, along with information about how it is processed. We will provide this in a structured, commonly used format within 30 calendar days.
2. Right to Rectification: If any Personal Data we hold is inaccurate or incomplete, you have the right to request that it be corrected. Minor corrections (e.g., email address changes) can be made directly through Account settings. Corrections to identity-related fields (name, date of birth) require supporting KYC documentation.
3. Right to Erasure ("Right to Be Forgotten"): You may request the deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (and no other legal basis applies), or where you object to processing on legitimate interest grounds and we have no overriding legitimate grounds. This right is subject to our legal retention obligations as described in Section 7.
4. Right to Restriction of Processing: In certain circumstances, you may request that we limit our processing of your Personal Data while a dispute about its accuracy or the legitimacy of its processing is resolved.
5. Right to Data Portability: Where processing is based on your consent or on a contract with you, you have the right to receive your Personal Data in a machine-readable format and, where technically feasible, to have it transmitted directly to another controller.
6. Right to Object: You have the right to object at any time to the processing of your Personal Data for direct marketing purposes. Upon receipt of such an objection, we will immediately cease all marketing communications to your registered email address and in-Platform messaging.
7. Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

The Platform is intended exclusively for adults aged 21 years or older. jam37 does not knowingly collect Personal Data from individuals under the age of 21. Age verification is a mandatory step in our registration and KYC process precisely to prevent underage access.

If you are a parent or guardian and you believe that a person under 21 in your care has registered an Account on the Platform, please contact us immediately at [email protected]. We will investigate the matter promptly, close the Account, and delete all associated Personal Data to the extent not required for legal compliance purposes.

jam37 reserves the right to amend this Privacy Policy at any time. All changes will be reflected in a new version of this document published at jam37.cam/privacy-policy, with the effective date updated at the top of the page. Where changes are material — for example, a new category of data collected, a new third-party recipient, or a change to your rights — we will notify you via email to your registered address at least 14 days before the change takes effect.

Your continued use of the Platform after the effective date of any amendment constitutes your acceptance of the updated Privacy Policy. If you do not agree with the amended policy, you must cease using the Platform and may request Account closure in accordance with our Terms & Conditions.

For any questions, concerns, or formal requests relating to this Privacy Policy or the processing of your Personal Data, please reach our Data Protection team through the following channels:

• Live Chat: Available 24/7 directly within the Platform. Average first response under 3 minutes during peak WIB (UTC+7) hours.
• Email: [email protected] — responses within 24 hours for general inquiries; formal data rights requests acknowledged within 5 business days and resolved within 30 calendar days.

Formal written data rights requests sent to our email address will be logged and tracked. You will receive a written acknowledgment with a case reference number within 5 business days of submission. All requests are handled in strict confidence by personnel trained in data protection obligations.