Privacy Policy — gas1m

This Privacy Policy ("Policy") is issued by gas1m ("the Platform", "we", "us", "our"), the operator of the online betting service available at https://gas1m.cam. It applies to all personal data processed in connection with your use of the gas1m platform, whether you are a registered account holder, a visitor to our website, or a contact of our customer support team.

This Policy should be read alongside the gas1m Terms & Conditions and Responsible Gaming Policy. By registering for or using the gas1m platform, you acknowledge that you have read and understood this Policy.

Scope & Data Controller

This Policy covers the personal data of all individuals who interact with gas1m, including registered platform users (Account holders), prospective users who begin but do not complete registration, visitors who browse the gas1m website without registering, and individuals who contact gas1m's customer support team.

gas1m is the data controller responsible for the personal data described in this Policy. This means gas1m determines the purposes and means by which your personal data is processed. Where gas1m engages third-party processors to handle data on its behalf, gas1m remains responsible for ensuring those processors meet the standards described in this Policy.

gas1m's primary market is Indonesia, and this Policy acknowledges the data protection framework applicable to Indonesian users, including the Personal Data Protection Law (Undang-Undang Perlindungan Data Pribadi — UU PDP) that came into force in 2022, as well as internationally recognized data protection principles.

Personal Data We Collect

gas1m collects the following categories of personal data in the course of operating the platform and serving registered users:

How We Collect Your Data

gas1m collects personal data through the following channels:

3.1 Direct Collection

Data you provide directly when you register your Account, complete KYC verification, make a deposit or withdrawal request, contact customer support, respond to a survey or promotion, or update your account profile settings.

3.2 Automated Collection

Data generated automatically when you use the platform — including IP addresses, device identifiers, session logs, and betting activity — is collected by gas1m's platform infrastructure, analytics systems, and fraud-detection tools. This collection occurs whether or not you are logged in to your Account.

3.3 Third-Party Collection

Data received from third parties where this is necessary and permitted:

• KYC verification providers: Identity verification results and document validation outcomes.
• Payment processors and Indonesian banks: Transaction confirmation data, payment method ownership verification.
• Fraud prevention services: Risk scores and device reputation data.
• Analytics platforms: Aggregated, anonymized usage statistics that help gas1m improve platform performance.

Purposes & Legal Basis for Processing

gas1m processes your personal data only where a valid legal basis exists. The primary purposes and corresponding bases are set out below:

• Account registration and management — necessary for the performance of the contract between you and gas1m.
• Processing deposits, bets, and withdrawals — necessary for the performance of the contract; also required for regulatory compliance.
• KYC identity and age verification (21+) — legal obligation under applicable gaming licensing and anti-money laundering requirements.
• Fraud detection and prevention — legitimate interest of gas1m and its users in maintaining a secure, fair platform.
• Responsible gaming monitoring — legal obligation and legitimate interest; enables gas1m to identify users who may be exhibiting problem gambling behaviour and to apply protective measures.
• Customer support — necessary for the performance of the contract and legitimate interest in delivering quality service.
• Platform security and technical maintenance — legitimate interest in maintaining platform integrity and availability.
• Regulatory and legal compliance — legal obligation, including reporting obligations to gas1m's licensing authority.
• Personalised marketing and promotions — based on your consent only, where you have opted in to receive promotional communications from gas1m.
• Analytics and product improvement — legitimate interest, using aggregated and/or anonymized data to improve the platform experience for all users.

Data Sharing & Third Parties

gas1m does not sell your personal data. We share personal data with third parties only in the following limited circumstances:

5.1 Service Providers and Processors

Third parties engaged by gas1m to provide specific services necessary to operate the platform, including KYC and identity verification providers, payment processing partners (including BCA, BRI, BNI, Mandiri, and e-wallet operators such as OVO and DANA), cloud hosting and infrastructure providers, fraud detection and cybersecurity services, and customer support platform providers. All service providers are bound by data processing agreements that require them to process your data only as instructed by gas1m and to maintain appropriate security standards.

5.2 Regulatory and Legal Disclosure

gas1m may disclose personal data to regulatory bodies, licensing authorities, law enforcement agencies, or courts where required by applicable law or legal process, or where gas1m believes disclosure is necessary to prevent fraud, protect the safety of our users or staff, or enforce our Terms and Conditions.

5.3 Business Transfers

In the event that gas1m undergoes a merger, acquisition, or sale of all or substantially all of its assets, your personal data may be transferred as part of that transaction. You will be notified of any such transfer and your rights in respect of that data prior to any change of controller taking effect.

5.4 No Sale of Data

gas1m will never sell, rent, license, or otherwise commercially exploit your personal data to any third party for their own independent marketing or commercial purposes.

International Data Transfers

gas1m's servers and primary data infrastructure are located in data centres with strong data protection regimes. Where personal data is transferred to or processed in a country outside Indonesia, gas1m ensures that appropriate safeguards are in place to protect that data, such as contractual clauses that impose equivalent data protection standards to those applicable in Indonesia.

In particular, data shared with KYC verification providers and certain cloud infrastructure services may involve processing in jurisdictions outside Indonesia. In all such cases, gas1m has conducted due diligence on the applicable privacy protections and has contractual safeguards in place.

Data Retention Periods

gas1m retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply as a general guide:

• Account registration and identity data: Retained for the duration of your active Account plus a minimum of 5 years after Account closure, to satisfy anti-money laundering and licensing obligations.
• Financial transaction records: Retained for a minimum of 5 years from the date of each transaction, in compliance with financial record-keeping requirements.
• KYC verification documents: Retained for the duration of your Account plus 5 years after closure.
• Betting and game history: Retained for a minimum of 3 years from the date of each session, for dispute resolution and regulatory audit purposes.
• Customer support communications: Retained for 2 years from the date of each interaction.
• Marketing consent records: Retained until you withdraw consent, plus 1 year to evidence the withdrawal.
• Technical and device data (logs): Retained for 12 months on a rolling basis.

After the applicable retention period expires, data is securely deleted or permanently anonymized. Where deletion is not immediately possible due to backup cycles, the data will be isolated from active use until secure deletion can be completed.

Security Measures

gas1m implements a multi-layered security framework to protect your personal data against unauthorized access, alteration, disclosure, or destruction:

• 256-bit SSL/TLS encryption on all data in transit between user devices and gas1m servers.
• AES-256 encryption for sensitive data stored at rest, including financial records and KYC documents.
• Two-factor authentication (2FA) available to all Account holders and mandatory for internal staff accessing user data systems.
• Role-based access controls ensuring that gas1m staff can access only the personal data necessary for their specific job function.
• Regular penetration testing and vulnerability assessments conducted by independent cybersecurity specialists.
• Intrusion detection systems that monitor platform traffic in real time for anomalous access patterns.
• Secure key management with cryptographic keys rotated on a scheduled basis and stored separately from the data they protect.

Cookies & Tracking Technologies

gas1m uses cookies and similar technologies (such as local storage and session tokens) to operate the platform, remember your session, and understand how users interact with our services. The following categories of cookies are in use:

9.1 Strictly Necessary Cookies

These are essential for the platform to function. They manage your login session, maintain your account balance display, and prevent cross-site request forgery. These cookies cannot be disabled without affecting core platform functionality.

9.2 Functional Cookies

These cookies remember your preferences — such as your preferred language, your last-visited page, and your responsible gaming reminder settings — so that you do not have to re-enter them on each visit. They improve your experience without tracking your activity across external websites.

9.3 Analytics Cookies

gas1m uses privacy-respecting analytics tools to collect aggregated, anonymized data about how users navigate the platform — page views, session durations, feature usage rates. This data helps us improve the platform and identify performance issues. No individual users are identified in this analytics data.

9.4 Security Cookies

Cookies used for fraud detection, bot prevention, and device fingerprinting. These are necessary to protect the platform and all users from unauthorized access and fraudulent activity.

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will impair your ability to use the gas1m platform. Disabling analytics or functional cookies will not affect your ability to place bets or make transactions.

Your Data Rights

Under applicable data protection law, including Indonesia's Personal Data Protection Law (UU PDP), you hold the following rights in respect of your personal data held by gas1m. To exercise any of these rights, contact our support team with the subject line "Data Rights Request":

gas1m will respond to all data rights requests within 30 calendar days of receipt. For complex requests, we may extend this period by a further 30 days and will notify you of the extension within the initial 30-day window. There is no charge for submitting a data rights request in most circumstances.

Minors — Persons Under 21

The gas1m platform is strictly for adults aged 21 years and over. gas1m does not knowingly collect personal data from any person under the age of 21. If you believe that a minor has accessed the gas1m platform or that we have inadvertently collected data from a person under 21, please contact us immediately at [email protected] (plain text). We will take immediate steps to verify the situation and, where confirmed, to delete the relevant data and close any associated Account.

Account holders are responsible for ensuring that their login credentials are not accessible to persons under the age of 21 in their household. gas1m accepts no liability for underage access resulting from a registered Account holder's failure to maintain the security of their credentials.

Third-Party Links & Services

The gas1m platform may, in certain contexts, reference third-party services such as the underlying data providers for togel (lottery) draw results or sports data feed providers for live match statistics. gas1m is not responsible for the privacy practices of any third-party websites or services that you access independently of the gas1m platform.

This Policy applies solely to data processed by gas1m in connection with your use of the gas1m platform at https://gas1m.cam. It does not apply to any external websites, payment institution portals (such as your BCA or OVO app), or any other services you access separately.

Marketing Communications

gas1m will send you promotional communications — including bonus offers, seasonal promotions (such as Idul Fitri and Indonesian Independence Day campaigns), and VIP programme updates — only where you have given your explicit consent to receive them at the time of registration or in your Account settings.

You may withdraw your marketing consent at any time by:

• Updating your communication preferences within your gas1m Account settings panel.
• Clicking the "unsubscribe" link in any promotional email from gas1m.
• Contacting our support team with the subject line "Unsubscribe from Marketing".

Withdrawing marketing consent will not affect your receipt of transactional communications that are necessary for the operation of your Account — such as deposit confirmations, withdrawal notifications, KYC status updates, and security alerts. These operational communications are not marketing and cannot be opted out of while your Account remains active.

Changes to This Privacy Policy

gas1m may revise this Privacy Policy from time to time to reflect changes in applicable law, our data processing practices, or the services we offer. The date of the most recent revision is always shown at the top of this page.

Where changes are material — meaning they substantively affect your rights, the data we collect, or the purposes for which we use it — gas1m will notify you by email to your registered address and/or a prominent notice on the platform at least 14 days before the revised Policy takes effect. For non-material corrections (such as clarifications of existing provisions or updated contact details), we will update the Policy without separate advance notice.

Your continued use of the gas1m platform after a revised Policy takes effect constitutes your acceptance of the changes. If you do not agree with a revised Policy, you must cease using the platform and may request Account closure under the process described in the gas1m Terms & Conditions.

Contact & Data Protection Officer

For all privacy-related queries, data rights requests, or concerns about how gas1m handles your personal data, please contact us through the following channels:

• Email (Privacy and Data Rights): [email protected] with subject line "Privacy Enquiry" or "Data Rights Request" (plain text — not a clickable link)
• Live Chat: Available 24/7 via the in-app support widget
• FAQ: gas1m Frequently Asked Questions

gas1m has designated a Data Protection Officer (DPO) responsible for overseeing compliance with this Policy and applicable data protection law. The DPO can be reached via the email address above, clearly marked for the attention of the Data Protection Officer.

gas1m aims to resolve all privacy queries and data rights requests within 30 calendar days. Where a matter requires escalation or extended investigation, we will keep you informed of progress at regular intervals.