Privacy Policy

The following definitions apply throughout this Policy:

• "Personal Data" means any information that identifies or could reasonably be used to identify a natural person, including name, date of birth, national identity number, email address, phone number, IP address, device identifiers, and financial account details.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, transfer, or deletion.
• "Data Controller" means j20m, the entity that determines the purposes and means of processing your Personal Data.
• "Data Processor" means a third party that processes Personal Data on j20m's behalf, subject to j20m's written instructions.
• "Player" means any natural person who has registered a j20m account.
• "KYC" means the Know Your Customer identity verification process required under j20m's AML and fraud prevention obligations.
• "Cookie" means a small text file placed on your device by j20m's web server for the purpose of session management, preference storage, or analytics.

j20m collects the following categories of Personal Data depending on your interaction with the Platform:

2.1 Registration Data

• Full legal name as it appears on your government-issued ID
• Date of birth (to verify the 21+ age requirement)
• Residential address in Indonesia (city, province, postal code)
• Email address and phone number
• Username and encrypted password

2.2 KYC Verification Data

• Copies of government-issued photo ID (KTP, passport, or SIM)
• Proof of residential address documents
• Payment method verification documents (bank account or e-wallet screenshots)
• Selfie or liveness-check images where enhanced verification is required

2.3 Financial Transaction Data

• Deposit and withdrawal amounts, dates, and methods
• Bank account numbers, e-wallet IDs (OVO, DANA, GoPay, ShopeePay, LinkAja), and BCA / BRI / BNI / Mandiri account references associated with your account
• Wagering history, game session logs, and balance records

2.4 Technical & Usage Data

• IP address and approximate geographic location
• Browser type, operating system, and device identifiers
• Session timestamps, pages visited, and features used
• Referring URL and search terms where applicable

2.5 Communications Data

• Records of live chat conversations and email correspondence with j20m support
• Feedback, complaint, and dispute records

j20m collects Personal Data through the following means:

• Directly from you: when you complete registration forms, submit KYC documents, make deposits or withdrawals, contact support, or respond to surveys.
• Automatically: through server logs, cookies, pixel tags, and similar technologies that record your interactions with the Platform each time you visit.
• From third-party service providers: including KYC verification bureaus, payment processors, fraud detection services, and game data providers — where such data is necessary for the Platform's operation and your account's security.
• From publicly available sources: in limited circumstances, j20m may verify registration data against publicly available records for AML screening purposes.

j20m processes your Personal Data for the following purposes, each supported by a defined legal basis:

• Account management and service delivery — necessary for the performance of the contract between you and j20m.
• Identity verification (KYC) — necessary for compliance with our legal obligations under applicable anti-money-laundering and counter-terrorism financing standards.
• Payment processing — necessary for the performance of your deposit and withdrawal instructions and for fraud prevention.
• Responsible gaming monitoring — necessary for compliance with our legal obligations and to protect the vital interests of Players who may be at risk of gambling-related harm.
• Customer support — necessary for the performance of our contractual obligations to you and for our legitimate interest in resolving disputes efficiently.
• Platform security and fraud detection — based on j20m's legitimate interest in maintaining the integrity of the Platform and protecting all Players from fraud and abuse.
• Analytics and platform improvement — based on j20m's legitimate interest in understanding how the Platform is used so that it can be improved. Technical and usage data used for this purpose is aggregated and anonymised where practicable.
• Marketing communications — based on your consent, where you have opted in to receive promotional emails or notifications from j20m. You may withdraw this consent at any time by contacting support or using the unsubscribe link in any marketing email.
• Legal and regulatory compliance — necessary to comply with applicable laws, court orders, and the directions of regulatory or law enforcement authorities.

j20m does not sell your Personal Data. We share it only in the following strictly defined circumstances:

• Payment processors and banking partners: BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, OVO, DANA, GoPay, ShopeePay, and LinkAja receive the minimum transaction data necessary to process your deposits and withdrawals. Each partner is subject to its own regulatory obligations and data protection standards.
• KYC and identity verification providers: j20m uses regulated third-party bureaus to verify the identity documents you submit during the KYC process. These providers process your data solely for verification purposes and are bound by confidentiality agreements.
• Game content providers: Licensed studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive session identifiers and wagering data necessary to deliver their games and calculate outcomes. They do not receive your full personal profile.
• Fraud detection and security services: j20m uses specialist third-party tools to detect account compromise, bonus abuse, and money-laundering patterns. These tools process technical and behavioural data under strict data processing agreements.
• Regulatory and law enforcement authorities: j20m will disclose Personal Data to government bodies, regulators, or law enforcement agencies when required to do so by law, court order, or a valid regulatory direction. Where legally permissible, j20m will notify affected Players of such disclosures.
• Corporate transactions: In the event of a merger, acquisition, or sale of all or part of j20m's business, Player data may be transferred to the acquiring entity, provided that the receiving party agrees to protect it under terms no less protective than this Policy.

All third-party Data Processors engaged by j20m are required to process Personal Data only on j20m's documented instructions, to implement appropriate technical and organisational security measures, and to assist j20m in meeting its obligations to Players under applicable data protection law.

j20m uses cookies and similar tracking technologies to operate the Platform effectively, maintain your session, and understand how the Platform is used. The following cookie categories are in use:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function. They manage your login session, maintain your account state across pages, and protect against cross-site request forgery. These cookies cannot be disabled without breaking core Platform functionality.
• Functional Cookies: These remember your preferences — such as your preferred deposit method or language setting — so you do not need to re-enter them on each visit. Disabling these cookies may reduce your browsing convenience.
• Analytics Cookies: j20m uses aggregated, anonymised analytics to understand traffic patterns, popular features, and error rates. This data is used internally to improve the Platform and is not linked to your personal identity.
• Security Cookies: These help j20m detect and prevent fraudulent login attempts, bot activity, and account takeover by analysing device fingerprinting signals and session behaviour patterns.

Most web browsers allow you to control cookies through their settings. Blocking strictly necessary cookies will impair your ability to use j20m. For guidance on managing cookies in your browser, consult your browser's help documentation.

j20m retains Personal Data for defined periods aligned with the purpose for which it was collected and with applicable legal requirements:

Once a retention period expires, Personal Data is securely deleted or irreversibly anonymised. j20m conducts periodic data audits to ensure compliance with these retention schedules.

j20m implements a layered set of technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure:

• Encryption in transit: All data transmitted between your device and j20m's servers uses 256-bit TLS encryption. HTTP connections are automatically redirected to HTTPS.
• Encryption at rest: Sensitive Personal Data fields — including identity document copies, payment account references, and KYC records — are encrypted at rest using AES-256.
• Access controls: Access to production databases containing Player data is restricted to a small number of authorised personnel. Multi-factor authentication (MFA) is mandatory for all staff with data access. All access events are logged and reviewed.
• Network security: j20m's infrastructure is protected by web application firewalls (WAF), intrusion detection systems (IDS), and DDoS mitigation services.
• Penetration testing: j20m conducts regular third-party penetration tests and vulnerability assessments. Critical findings are remediated within defined SLA windows.
• Incident response: j20m maintains a documented data breach response plan. In the event of a breach that is likely to result in a risk to your rights and freedoms, j20m will notify affected Players without undue delay and take all reasonable steps to mitigate harm.

While j20m takes all reasonable steps to protect your data, no internet transmission is entirely risk-free. You are responsible for maintaining the security of your own device and j20m account credentials.

As a j20m Player, you hold the following rights with respect to your Personal Data. To exercise any of these rights, contact j20m at [email protected] with the subject line "Data Rights Request — [Your Username]". j20m will acknowledge your request within 72 hours and respond substantively within 30 calendar days.

j20m's services are strictly for adults aged 21 years or older. j20m does not knowingly collect or process Personal Data from individuals under the age of 21.

During registration, every prospective Player is required to confirm that they are at least 21 years of age. j20m conducts KYC checks to verify this declaration. Any account discovered to belong to a person under 21 will be immediately closed, all associated Personal Data will be securely deleted to the extent permitted by law, and any balance will be handled in accordance with j20m's Terms & Conditions.

If you are a parent or guardian and believe your child under 21 has registered an account with j20m, please contact us immediately at [email protected]. We will investigate and take appropriate action without delay.

The j20m Platform integrates services provided by regulated and reputable third parties, including game studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft), payment networks (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja), and security and analytics providers.

Each of these third-party integrations may involve the transfer of limited data to those providers as described in Section 5. Each provider operates under its own privacy policy, which governs how it processes any data it receives. j20m is not responsible for the privacy practices of third-party providers beyond the terms of the data processing agreements it holds with them.

j20m does not embed third-party advertising networks or social media tracking pixels on the Platform. Any links to external websites that may appear in support documentation or communications are provided for informational purposes only; j20m has no control over, and accepts no responsibility for, the privacy practices of those external sites.

j20m's servers and some of its third-party service providers may be located outside Indonesia. When Personal Data is transferred internationally, j20m ensures that appropriate safeguards are in place to protect it to a standard equivalent to that required under applicable Indonesian data protection principles.

Safeguards used for international transfers include:

• Binding contractual clauses in data processing agreements with all international Data Processors, requiring them to maintain technical and organisational security measures equivalent to j20m's own standards.
• Transfers only to countries or entities that maintain adequate data protection regimes or are subject to binding corporate rules certified to an internationally recognised standard.
• Encryption of all data in transit and at rest, as described in Section 8, regardless of where it is processed.

j20m reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or our service offerings. When material changes are made, we will notify registered Players by email to their registered address at least 7 calendar days before the updated Policy takes effect. The revised Policy will be published on this page with an updated "Last Updated" date.

Your continued use of the Platform after the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. If you do not accept the changes, you must stop using the Platform and may request account closure and data deletion by contacting support before the amendment's effective date.

We recommend bookmarking this page and reviewing it whenever you receive a policy update notification from j20m.

If you have questions about this Privacy Policy, wish to exercise your data rights, or want to raise a concern about how j20m handles your Personal Data, please contact our Data Protection team using the details below:

• Email: [email protected] — use the subject line "Privacy Enquiry" or "Data Rights Request — [Your Username]"
• Live Chat: Available 24/7 via the Platform. Our Indonesian-speaking support agents can handle privacy enquiries in Bahasa Indonesia or English across all time zones — WIB, WITA, and WIT.

j20m will acknowledge all privacy-related enquiries within 72 hours and provide a substantive response within 30 calendar days. Complex requests involving large volumes of data may require additional time, in which case j20m will notify you of the extended timeline and the reason for it.

If you are not satisfied with j20m's response to a privacy complaint, you have the right to escalate your complaint to the relevant data protection authority or regulatory body in your jurisdiction.