Privacy Policy — ggmon Platform

ggmon ("the Company", "we", "us", or "our") is committed to protecting the privacy of every individual who accesses or uses the ggmon platform at https://ggmon.cam ("the Platform"). This Privacy Policy describes how the Company collects, uses, stores, discloses, and safeguards personal data in connection with the provision of online betting and gaming services to players located primarily in Indonesia.

This Privacy Policy forms part of and should be read alongside the ggmon Terms & Conditions and Responsible Gaming Policy. By registering an account, making a deposit, or otherwise using the Platform, you acknowledge that you have read this Privacy Policy and consent to the data practices described herein.

We process personal data in accordance with internationally recognized data protection principles, including purpose limitation, data minimization, storage limitation, and security. Our licensing obligations also impose specific data-handling requirements, which we follow rigorously.

The Company collects the following categories of personal data in the course of operating the Platform:

3.1 Registration & Identity Data

• Full legal name (as it appears on your official identity document)
• Date of birth (used to verify compliance with the 21+ age requirement)
• Indonesian national identity card number (KTP / Kartu Tanda Penduduk) or passport number
• Residential address (city, province — e.g., Jakarta, Surabaya, Bandung, Bali, Yogyakarta)
• Email address
• Mobile phone number
• Username and encrypted account password

3.2 Financial & Payment Data

• Bank account name and account number (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata)
• E-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja account numbers/phone numbers)
• Transaction history: deposit amounts, withdrawal amounts, dates, and processing references (in IDR / Rp)
• Source-of-funds documentation (for large-value transactions, as required by AML obligations)

3.3 KYC Verification Documents

• Scanned or photographed copies of identity documents
• Proof-of-address documents (utility bills, official bank statements)
• Selfie or liveness-check images (where required by our KYC provider)

3.4 Betting & Gaming Activity Data

• Bet placement records: event, market, odds, stake, settlement outcome
• Game session logs: game title, session start/end times, wagered amounts, results
• Bonus and promotion usage history
• Responsible gaming tool settings (deposit limits, session limits, self-exclusion status)

3.5 Technical & Device Data

• IP address and approximate geolocation (city/region level)
• Device type, operating system, and browser version
• Session timestamps, page navigation paths, and feature interaction logs
• Cookie identifiers and similar tracking technology data (see Clause 10)

3.6 Communications Data

• Contents of support tickets, live chat transcripts, and email correspondence with ggmon support staff
• Responses to voluntary surveys or promotional opt-in forms

The Company collects personal data through the following means:

• Directly from you — when you complete the registration form, submit KYC documents, initiate a deposit or withdrawal, contact our support team, or participate in a promotion.
• Automatically — through cookies, web beacons, and server log files as you navigate the Platform. Technical data such as IP addresses and device identifiers are collected automatically whenever you access the Platform.
• From third-party service providers — including KYC verification partners, payment processors (e.g., bank transfer gateways, e-wallet providers), and fraud-detection services, which may share data with us as part of identity verification or transaction authorization workflows.
• From game studios — game providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may share session-level data with us for dispute resolution and audit purposes.

The Company processes your personal data for the following purposes:

The Company relies on the following legal bases for processing your personal data:

• Contractual Necessity: Processing is required to perform our obligations under the Terms & Conditions — including account management, payment processing, bet settlement, and customer support.
• Legal Obligation: Processing is necessary to comply with applicable laws and our licensing conditions — including KYC, AML verification, age-verification, and record-keeping requirements.
• Legitimate Interests: Processing is necessary for the Company's legitimate interests — including fraud prevention, Platform security, responsible gaming monitoring, and service improvement — provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: Where we send direct marketing communications or use non-essential cookies, we rely on your freely given, specific, and informed consent. You may withdraw consent at any time without affecting the lawfulness of any prior processing.

The Company does not sell, rent, or license your personal data to unaffiliated third parties for their own commercial purposes. We may share your personal data in the following limited circumstances:

• KYC & Identity Verification Providers: We share identity documents and personal details with third-party KYC service providers to verify your identity and age in accordance with our licensing obligations.
• Payment Processors: We share necessary financial data with Indonesian bank transfer gateways and e-wallet platforms (including those facilitating OVO, DANA, GoPay, ShopeePay, and LinkAja transactions) to process deposits and withdrawals.
• Game Studios & Platform Providers: We share session identifiers and stake/result data with game providers (including Pragmatic Play, Evolution Gaming, Spribe, and Pocket Games Soft) as required to operate their games on the Platform and resolve disputes.
• Fraud Prevention & Security Services: We share device identifiers, IP addresses, and behavioral signals with fraud-detection providers to protect the integrity of the Platform and its Members.
• Regulatory & Law Enforcement Authorities: We may disclose personal data to licensing authorities, law enforcement agencies, or courts when legally required to do so or when we reasonably believe disclosure is necessary to protect the rights, property, or safety of the Company, its Members, or others.
• Corporate Transactions: In the event of a merger, acquisition, or sale of substantially all of the Company's assets, personal data held by the Company may be transferred to the successor entity, subject to equivalent privacy protections.

The Company retains personal data only for as long as necessary to fulfill the purposes for which it was collected, and in any event for no shorter than the minimum retention periods imposed by our licensing conditions and applicable law.

When personal data is no longer required for any legitimate purpose and the applicable retention period has expired, the Company will securely delete or anonymize it in a manner that prevents reconstruction.

The Company implements a multi-layered security framework to protect your personal data against unauthorized access, accidental loss, alteration, or disclosure. Our key security measures include:

• 256-Bit SSL/TLS Encryption: All data transmitted between your browser and the Platform is encrypted using industry-standard TLS protocols, preventing interception by third parties.
• Encrypted Data Storage: Sensitive data fields — including identity document numbers, financial account identifiers, and passwords — are stored in encrypted form using strong cryptographic algorithms. Passwords are hashed and salted; they are never stored in plaintext.
• Access Controls: Access to personal data is strictly limited to authorized Company personnel and processors who have a documented need to access the data for a specified legitimate purpose. All access is subject to role-based permissions and audit logging.
• Two-Factor Authentication (2FA): Members are encouraged to enable 2FA on their accounts. Internal system access by Company employees requires mandatory 2FA.
• Regular Security Audits: The Platform undergoes periodic penetration testing and security audits conducted by qualified independent security professionals.
• Incident Response Protocol: The Company maintains a documented data breach response procedure. In the event of a data breach that poses a high risk to affected individuals, the Company will notify affected Members without undue delay and will take immediate steps to contain and remediate the breach.

The Platform uses cookies and similar tracking technologies to deliver, maintain, and improve our services. A cookie is a small text file placed on your device by the Platform's server when you visit the site. Cookies do not contain executable code and cannot access other data on your device.

You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will prevent you from logging in or using the Platform's core features. Disabling analytics cookies will not affect Platform functionality.

Subject to applicable law and our legitimate interests as a licensed operator, you have the following rights with respect to your personal data held by ggmon:

To exercise any of the above rights, please submit a written request to [email protected]. We will acknowledge your request within 5 business days and provide a substantive response within 30 calendar days. Where a request is complex or numerous, we may extend this period by a further 60 days, in which case we will notify you of the extension and the reasons for it.

We may require you to verify your identity before processing certain requests in order to protect against unauthorized access to another person's data.

The Platform is strictly restricted to adults aged 21 years and over. The Company does not knowingly collect personal data from any person under the age of 21. Our registration process includes automated age-screening checks, and all accounts are subject to mandatory KYC age verification prior to the first withdrawal or upon reaching specified deposit thresholds.

If we become aware that personal data has been collected from a person under the age of 21 — whether through our own checks or through information brought to our attention — we will immediately close the account, delete all associated personal data to the extent permitted by our legal obligations, and return any deposited funds to the payment source.

The Company is operated by an internationally registered entity, and some of our data processors and service providers may be located in jurisdictions outside Indonesia. Where personal data is transferred to a third country, the Company ensures that appropriate safeguards are in place to maintain an equivalent level of data protection, including:

• Entering into standard contractual clauses or equivalent data transfer agreements with recipient organizations;
• Transferring data only to jurisdictions that the Company's licensing authority recognizes as providing adequate data protection standards;
• Conducting data transfer impact assessments where required by our licensing conditions.

By using the Platform, you acknowledge that your personal data may be processed in jurisdictions outside Indonesia. In all cases, the Company requires that any overseas processor provides contractual guarantees of data security equivalent to the standards described in this Privacy Policy.

The Platform may integrate with or rely upon third-party services in order to deliver certain features. These include game studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft), payment gateways, and analytics tools. Each of these third-party providers operates under its own privacy policy and data handling practices.

The Company is not responsible for the data practices of third-party providers beyond the contractual data processing agreements we have in place with them. Where a third-party provider processes your personal data as a data controller in its own right (rather than as a processor on our behalf), its own privacy policy will govern that processing. We encourage you to review the privacy policies of any third-party providers whose services you interact with directly.

The Platform does not contain links to external third-party websites beyond the operational integrations described above. We do not endorse any third-party website and accept no responsibility for the privacy practices of any external site.

The Company reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or licensing requirements. When we make material changes, we will update the "Effective date" at the top of this page. Where changes are significant, we will make reasonable efforts to notify active Members via their registered email address prior to the changes taking effect.

Your continued use of the Platform following the publication of an updated Privacy Policy constitutes your acknowledgment of the updated terms. If you do not agree with any material change to this Privacy Policy, you may close your account by contacting our support team.

If you have any questions, concerns, or complaints about this Privacy Policy or the way the Company handles your personal data, please contact us through the following channel:

• Email: [email protected]
• Support Hours: 24 hours a day, 7 days a week (including Indonesian public holidays)
• Languages: English and Bahasa Indonesia
• Response Time: Acknowledgment within 5 business days; substantive response within 30 calendar days (WIB, UTC+7)

We take privacy complaints seriously and will investigate all credible reports promptly and impartially. If you are not satisfied with our response to your complaint, you may escalate the matter to the relevant licensing authority or data protection supervisory body in the jurisdiction where you are located.