Privacy Policy

itemkj ("we", "us", "our") is the operator of the online betting and gaming platform accessible at https://itemkj.cam. We are committed to protecting the privacy, security, and confidentiality of the personal data entrusted to us by our Members and website visitors, with particular sensitivity to the expectations of our primary user base — English-preference Indonesian players located in Jakarta, Surabaya, Bandung, Medan, Bali, Yogyakarta, and across the Indonesian archipelago.

This Privacy Policy has been prepared in accordance with internationally recognised data protection principles, including those reflected in the General Data Protection Regulation (GDPR) framework, which itemkj applies voluntarily as a benchmark for responsible data stewardship, irrespective of jurisdictional mandate. Where Indonesian law imposes data localisation or notification requirements that are more stringent, itemkj endeavours to meet those standards to the extent reasonably practicable for an internationally licensed offshore operator.

We collect only the data that is necessary for the legitimate operation of our Platform, the fulfilment of our regulatory obligations (including KYC and Anti-Money Laundering requirements), and the delivery of a safe, personalised betting experience. We do not collect data speculatively, and we do not sell, lease, or trade your personal information to third parties for their independent commercial purposes.

For the purposes of this Privacy Policy, the following terms carry the meanings assigned below:

• "Personal Data" means any information that identifies or could reasonably be used to identify a natural person, directly or indirectly, including name, date of birth, national identity number, email address, mobile phone number, bank account details, IP address, device identifiers, and location data.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, organisation, adaptation, retrieval, use, disclosure by transmission, dissemination, or deletion.
• "Data Controller" means itemkj in its capacity as the entity that determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Processor" means any third-party service provider that processes Personal Data on itemkj's behalf under a documented data processing agreement.
• "Member" means any individual who has completed account registration on the Platform and whose Personal Data is therefore subject to this Policy.
• "Sensitive Data" means Personal Data revealing racial or ethnic origin, political opinions, religious beliefs, health information, or financial account credentials. itemkj collects Sensitive Data only to the extent strictly required for KYC, fraud prevention, or responsible gaming purposes.
• "Cookie" means a small text file placed on a Member's device by the Platform for the purposes described in Clause 8 of this Policy.

itemkj collects the following categories of Personal Data from Members and Platform visitors:

itemkj collects Personal Data through the following channels:

• Direct Collection: Data you provide actively when completing the registration form, submitting KYC documents, requesting a deposit or withdrawal, contacting customer support, or updating your account profile.
• Automated Collection: Technical and Usage Data collected automatically through server logs, cookies, web beacons, and session tracking technologies each time you visit or interact with the Platform. This collection is passive and does not require any action on your part beyond accessing the Platform.
• Third-Party Sources: In limited circumstances, itemkj may receive Personal Data from third-party sources, including: (a) identity verification providers engaged to perform KYC checks; (b) fraud detection and device fingerprinting services; (c) payment processors who confirm transaction status and account ownership; and (d) publicly available databases used for AML screening (e.g., sanctions lists, politically exposed persons registries).

All data received from third-party sources is handled in accordance with this Privacy Policy and the contractual obligations itemkj has with those third-party providers. itemkj does not purchase raw Personal Data from data brokers or marketing list providers.

itemkj processes your Personal Data for the following specific purposes:

• Account Management: To create, maintain, and administer your Member account, including processing login credentials, managing account settings, and delivering in-Platform communications.
• Service Delivery: To provide the core betting and gaming services available on the Platform, including processing wagers, settling bets, administering bonuses, and calculating account balances.
• Payment Processing: To facilitate deposits and withdrawals via local Indonesian payment methods (BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, Sho peePay, LinkAja), verify payment account ownership, and maintain accurate financial records.
• Identity Verification (KYC): To verify your identity and age (21+) in compliance with our international gaming licence conditions and AML/CTF obligations. KYC processing is mandatory and cannot be declined by Members who wish to make withdrawals.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, multiple-account abuse, bonus exploitation, money laundering, and other prohibited conduct as defined in our Terms & Conditions.
• Regulatory Compliance: To fulfil our obligations under Applicable Law, including AML screening, sanctions compliance, and the retention of transaction records for the minimum statutory period.
• Responsible Gaming: To monitor account activity for signs of problem gambling behaviour, to implement Member-requested deposit limits, cooling-off periods, and self-exclusion requests, and to deliver responsible gaming communications where warranted.
• Customer Support: To respond to enquiries, resolve disputes, manage complaints, and improve the quality of our support services through internal training and quality review.
• Platform Improvement: To analyse aggregated usage patterns, identify technical issues, optimise Platform performance, and develop new features based on Member behaviour data.
• Marketing Communications: To send promotional offers, bonus notifications, and seasonal campaign communications (e.g., Idul Fitri promotions, Ramadhan special offers, Independence Day bonuses) to Members who have opted in to receive such communications. Marketing processing is strictly opt-in and may be withdrawn at any time through your account settings.

itemkj relies on one or more of the following legal bases when processing your Personal Data:

• Contractual Necessity: Processing required to fulfil our obligations under the Member agreement (our Terms & Conditions), including account administration, bet processing, and payment handling.
• Legal Obligation: Processing necessary to comply with Applicable Law, including KYC verification, AML record-keeping, and regulatory reporting obligations under our international gaming licence.
• Legitimate Interests: Processing carried out in pursuit of itemkj's legitimate business interests, including fraud prevention, platform security, abuse detection, and internal analytics — provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for which itemkj has obtained your explicit prior consent, most notably in respect of direct marketing communications and non-essential cookies. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out prior to withdrawal.

itemkj does not sell, rent, or trade your Personal Data to third parties for their own independent marketing or commercial purposes. We share Personal Data only in the following circumstances and only to the extent strictly necessary:

• KYC & Identity Verification Providers: Licensed third-party verification services that process your identity documents and conduct biometric matching on our behalf to fulfil KYC obligations. These providers act as Data Processors under binding data processing agreements.
• Payment Processors: Financial institutions and payment gateway operators (including those facilitating BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, and LinkAja transactions) that require transaction and account data to process deposits and withdrawals on your behalf.
• Fraud & AML Screening Services: Third-party tools used to screen transactions and account activity against sanctions lists, politically exposed persons (PEP) registries, and known fraud pattern databases. These services receive minimal data (typically name, date of birth, and transaction metadata) and are contractually prohibited from using it for any other purpose.
• Game Content Providers: Studios such as Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft may receive a Member's session token and anonymised usage data for the purpose of game delivery, fairness auditing, and technical support. No personally identifiable information beyond a platform-generated session identifier is shared with game studios.
• Customer Support Platforms: Third-party live chat and helpdesk tools used to deliver 24/7 support. Indonesian-speaking agents interact with you through these platforms; your support conversations are stored and may be reviewed for quality assurance purposes.
• Regulatory & Law Enforcement Authorities: itemkj will disclose Personal Data to competent regulatory bodies, law enforcement agencies, or courts where required to do so by a valid legal order, warrant, or regulatory directive. Where permitted by law, itemkj will notify the affected Member of any such disclosure.
• Corporate Restructuring: In the event of a merger, acquisition, sale of assets, or other corporate restructuring event, your Personal Data may be transferred to the acquiring entity, provided that the acquiring entity commits to maintaining data protection standards at least equivalent to those described in this Policy.

The itemkj Platform uses cookies and similar tracking technologies to deliver a functional, secure, and personalised user experience. The following categories of cookies are in use:

itemkj does not use cookies to serve third-party advertising on external websites. Marketing cookies on the Platform are used exclusively to personalise in-Platform promotional messaging based on your betting preferences and activity history.

Most modern browsers allow you to manage cookie settings, including blocking or deleting cookies. Please note that disabling strictly necessary cookies will prevent the Platform from functioning correctly and may result in your inability to log in or place wagers.

itemkj retains Personal Data for the minimum period necessary to fulfil the purpose for which it was collected, subject to any longer retention period required by Applicable Law or our regulatory obligations. The following retention schedules apply:

• Active Account Data: Retained for the full duration of the Member's active account relationship with itemkj, plus a post-closure period as described below.
• Financial & Transaction Records: Retained for a minimum of 5 years following the date of the relevant transaction, in compliance with standard AML record-keeping requirements applicable to internationally licensed gaming operators.
• KYC Documents (Identity & Verification): Retained for a minimum of 5 years following account closure or the date the document was submitted, whichever is later.
• Customer Support Records: Live chat transcripts and support ticket records retained for 2 years following the closure of the relevant support case.
• Marketing Data: Opt-in records and associated marketing preference data retained for the duration of the Member's account plus 3 years post-closure, to evidence consent in case of complaint.
• Technical & Log Data: Server logs and session data retained for a rolling period of 12 months for security and fraud investigation purposes.
• Closed Account Data: Upon account closure, itemkj anonymises or deletes data that is no longer required to fulfil the above retention obligations. Data subject to mandatory retention periods is archived in a restricted-access environment and is not used for any active processing purpose.

As a Member of the itemkj Platform, you hold the following rights with respect to your Personal Data. To exercise any of these rights, contact our support team at [email protected]. We will acknowledge your request within 5 business days and provide a substantive response within 30 calendar days.

• Right of Access: You have the right to request a copy of all Personal Data that itemkj holds about you, together with information about how it is being processed and on what legal basis.
• Right to Rectification: You have the right to request the correction of inaccurate or incomplete Personal Data. Some data fields (such as your registered legal name) may require supporting documentation before corrections can be applied.
• Right to Erasure ("Right to Be Forgotten"): You have the right to request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where the data has been unlawfully processed. This right is subject to the mandatory retention obligations described in Clause 9.
• Right to Restriction of Processing: You have the right to request that itemkj restricts its processing of your Personal Data in certain circumstances, for example while a rectification request is being investigated.
• Right to Data Portability: You have the right to receive your Personal Data in a structured, commonly used, machine-readable format (such as CSV or JSON) and to transmit that data to another controller, where technically feasible. This right applies to data processed by automated means on the basis of consent or contract.
• Right to Object: You have the right to object to processing carried out on the basis of legitimate interests, including profiling for marketing purposes. You may opt out of all marketing communications at any time through your account settings without needing to make a formal data rights request.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

itemkj implements a multi-layered security architecture designed to protect your Personal Data against unauthorised access, disclosure, alteration, and destruction. Our current security measures include:

• Encryption in Transit: All data transmitted between your browser or device and the itemkj Platform is protected by TLS 1.3 / 256-bit SSL encryption. Our SSL certificate is maintained with automatic renewal to prevent lapse.
• Encryption at Rest: Sensitive Personal Data — including KYC documents, bank account details, and identity records — is stored using AES-256 encryption in access-controlled data repositories.
• Access Controls: Access to Personal Data within itemkj's internal systems is restricted on a strict need-to-know basis. All staff who interact with Member data are subject to background checks, confidentiality agreements, and regular data-handling training.
• Two-Factor Authentication (2FA): itemkj strongly encourages all Members to enable 2FA on their accounts. 2FA is mandatory for all internal staff accessing Member data systems.
• Penetration Testing: itemkj's Platform undergoes regular third-party penetration testing and vulnerability scanning. Critical vulnerabilities are addressed within defined remediation SLAs.
• Incident Response: In the event of a confirmed Personal Data breach that poses a risk to Member rights, itemkj will notify affected Members without undue delay (and in any event within 72 hours of becoming aware of the breach), describing the nature of the breach, the data affected, and the steps taken to mitigate the impact.

The itemkj Platform is strictly intended for adults aged 21 years and older. itemkj does not knowingly collect, process, or retain Personal Data from any individual under the age of 21. Age verification is a mandatory step in the account registration and KYC process, and itemkj reserves the right to request additional proof of age at any time.

If itemkj becomes aware that it has inadvertently collected Personal Data from a person under the age of 21, it will immediately suspend the relevant account, delete all associated Personal Data to the extent permitted by AML record-keeping obligations, and refund any deposited funds to the payment source. Parents or guardians who believe their child has registered on the Platform are urged to contact itemkj's support team at [email protected] immediately.

The itemkj Platform does not contain links to external third-party websites. In the event that any informational content references a third-party entity (such as a game studio, payment provider, or sports organisation), no hyperlink to that entity's website is provided, and itemkj accepts no responsibility for the data practices of any third-party organisation.

If you independently navigate to a third-party website from information found on the Platform, any data you provide to that third party is governed exclusively by that third party's privacy policy. itemkj has no influence over and accepts no responsibility for third-party data practices.

itemkj reserves the right to update or revise this Privacy Policy at any time. The date of the most recent revision is displayed prominently at the top of this page. Where amendments are material — meaning they substantively affect how we collect, use, or share your Personal Data — itemkj will provide advance notice of at least 14 calendar days by publishing the proposed changes on the Platform and, where practicable, notifying active Members via their registered email address or in-Platform messaging.

Your continued use of the Platform following the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with any material amendment, you may request account closure as described in our Terms & Conditions. itemkj will honour outstanding withdrawal requests from Members who close their accounts due to disagreement with a Privacy Policy amendment, subject to completion of KYC.

Archived versions of previous Privacy Policy iterations are available upon written request to [email protected].

For all privacy-related enquiries, data access requests, rectification requests, erasure requests, or complaints, please contact itemkj's Data Protection team through the following channels:

• Email: [email protected] — please include "Privacy Request" in the subject line for prompt routing to our data protection team.
• Live Chat: Available 24/7 on the Platform. Indonesian-speaking agents are on every shift and can escalate privacy requests to the appropriate internal team.
• Response Commitment: All privacy-related requests will receive an acknowledgement within 5 business days and a full substantive response within 30 calendar days of receipt. Complex requests may require an extension of up to a further 30 days, in which case itemkj will notify you of the extension and the reason for it.

If you are dissatisfied with itemkj's handling of a privacy complaint after following our internal complaints process, you may refer the matter to the data protection supervisory authority in the jurisdiction of itemkj's international gaming licence. itemkj will cooperate fully with any such authority in the investigation of a complaint.