Privacy Policy — atom38

1. Introduction

atom38 ("we", "us", "our") operates the online betting and gaming platform at https://atom38.cam. In the course of providing our services to users primarily located in Indonesia, we collect and process certain personal data. We are committed to handling that data responsibly, lawfully, and transparently.

This Privacy Policy describes: the categories of personal data we collect; the lawful grounds on which we rely to process it; the purposes for which we use it; the parties with whom we may share it; how long we retain it; the security safeguards we apply; and the rights that you, as a data subject, are entitled to exercise.

This Privacy Policy should be read alongside our Terms & Conditions and our Responsible Gaming policy, both of which are incorporated by reference. Where any conflict arises between this Privacy Policy and the Terms & Conditions, the Terms & Conditions shall prevail to the extent required by applicable law.

2. Definitions

In this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, national ID number, email address, phone number, IP address, and financial account details.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, or deletion.
• "Data Controller" means atom38, the entity that determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Processor" means any third party that processes Personal Data on atom38's behalf, under written instruction and a binding data-processing agreement.
• "User" means any natural person who accesses, browses, or registers on the Platform.
• "KYC" means Know Your Customer — the identity-verification process required by anti-money-laundering obligations before a User's first withdrawal is approved.
• "Cookies" means small text files stored by a web browser on a User's device, used to recognise returning visitors and maintain session state.

3. Data We Collect

atom38 collects Personal Data across three broad categories. The table below summarises each category, the specific data points involved, and the primary purpose for collection.

4. How We Collect Data

atom38 collects Personal Data through the following channels:

• Direct submission: When you register an Account, complete the KYC process, make a deposit or withdrawal request, contact customer support, or respond to a promotional offer, you provide data directly to atom38.
• Automated technologies: When you access or use the Platform, our servers automatically collect Technical Data including your IP address, browser fingerprint, and session metadata. Cookies and similar tracking technologies also collect Behavioural Data as described in Section 10.
• Payment processors: When you initiate a deposit or withdrawal, your selected bank (such as BCA, BRI, BNI, or Mandiri) or e-wallet provider (such as OVO, DANA, or GoPay) may transmit confirmation data to atom38 to verify the transaction.
• Identity verification providers: Where atom38 uses a third-party KYC service to verify your identity documents, that provider may share the outcome of the verification check with atom38. We do not receive the raw identity document from the third-party provider; only a pass/fail result and a risk score are shared.
• Fraud prevention partners: atom38 may receive device-reputation scores or IP-risk signals from trusted fraud-prevention services to protect the Platform and its users.

5. Legal Basis for Processing

atom38 processes your Personal Data only where a valid lawful basis exists. The primary bases on which we rely are:

• Contractual necessity: Processing is necessary to perform the contract between you and atom38 — specifically, to register your Account, process deposits and withdrawals, settle bets, and provide customer support.
• Legal obligation: atom38 is required to collect and retain certain data (including KYC documents and transaction records) to comply with anti-money-laundering (AML), counter-terrorist-financing (CTF), and other applicable regulatory obligations.
• Legitimate interests: atom38 processes Technical Data and Behavioural Data to detect and prevent fraud, ensure platform security, improve the user experience, and conduct internal analytics — where those interests are not overridden by your privacy rights.
• Consent: Where atom38 sends optional marketing communications or deploys non-essential cookies, we rely on your explicit, freely given consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

6. How We Use Your Data

atom38 uses the Personal Data we collect for the following purposes:

• To create, maintain, and manage your Account, including verifying your age (21+) and identity as required.
• To process deposits and withdrawals via your chosen Indonesian bank or e-wallet, and to maintain accurate financial records of all transactions in Indonesian Rupiah (IDR / Rp).
• To settle Wagers, apply bonus credits, and administer promotional offers in accordance with the applicable terms.
• To communicate with you regarding Account activity, security alerts, transaction confirmations, and support responses.
• To monitor your gaming activity for responsible gaming purposes, including identifying patterns that may indicate problem gambling behaviour and activating protective measures where appropriate.
• To detect, investigate, and prevent fraudulent transactions, money laundering, account takeover attempts, and other prohibited conduct as defined in the Terms & Conditions.
• To comply with applicable legal and regulatory obligations, including the retention of KYC and transaction records.
• To improve the Platform's performance, reliability, and user experience through internal analytics and product testing.
• To send you personalised promotional offers and marketing communications, where you have given your consent and subject to your right to opt out at any time.

atom38 does not use automated decision-making (including profiling) that produces legal or similarly significant effects on users, without first providing you with appropriate notice and an opportunity to request human review.

7. Data Sharing & Disclosure

atom38 does not sell your Personal Data to any third party. We may share your data only in the limited circumstances described below:

7.1 Service Providers (Data Processors)

atom38 engages trusted third-party service providers to assist with specific operational functions, including payment processing (Indonesian banks and e-wallets), identity verification (KYC providers), cloud infrastructure hosting, customer support tools, and fraud-detection platforms. Each provider is bound by a written data-processing agreement that restricts their use of your data to the specified service and prohibits any further disclosure.

7.2 Game Content Providers

Where you play games supplied by third-party studios (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Pocket Games Soft), the game engine is hosted by or connected to that provider's platform. Minimal data (such as your anonymised player ID and stake amount) may be transmitted to the provider solely to enable gameplay. Game providers are contractually prohibited from using this data for any independent marketing or profiling purpose.

7.3 Legal and Regulatory Disclosure

atom38 may disclose Personal Data to government authorities, law enforcement bodies, regulatory agencies, or financial intelligence units where we are required to do so by law, court order, or lawful regulatory demand. Where permitted by law, atom38 will make reasonable efforts to notify you of any such demand before disclosure occurs.

7.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of atom38's business assets, Personal Data held by atom38 may be transferred to the acquiring entity as part of that transaction, subject to equivalent privacy protections. You will be notified of any such transfer and given the opportunity to close your Account if you do not consent to the new entity's data practices.

7.5 Aggregate and Anonymised Data

atom38 may share aggregated, anonymised statistical data with third parties (such as industry analysts or research partners) where that data cannot reasonably be used to identify any individual user.

8. Data Retention

atom38 retains Personal Data only for as long as is necessary to fulfil the purpose for which it was collected, or to comply with applicable legal obligations. The following retention periods apply as a general guide:

On expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised. Where data is anonymised rather than deleted, it may be retained indefinitely for aggregate analytical purposes, as it no longer constitutes Personal Data.

9. Security Measures

atom38 implements a layered set of technical and organisational security measures to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction:

• Encryption in transit: All data exchanged between your browser and the atom38 Platform is encrypted using TLS 1.3 (Transport Layer Security). The Platform's SSL certificate is maintained and renewed before expiry.
• Encryption at rest: Sensitive data fields (including financial account numbers and identity document images) are encrypted at rest using AES-256 encryption.
• Access control: Access to production systems and Personal Data is restricted to authorised personnel on a strict need-to-know basis. All privileged access requires multi-factor authentication.
• Penetration testing: atom38 commissions regular independent security assessments, including penetration testing and vulnerability scanning, to identify and remediate potential weaknesses.
• Incident response: atom38 maintains a documented data-breach response plan. In the event of a breach that poses a risk to your rights and freedoms, we will notify affected users without undue delay.
• Employee training: All staff with access to Personal Data receive mandatory training on data protection obligations and security practices upon onboarding and on an annual basis thereafter.

While atom38 takes every reasonable precaution to protect your data, no internet transmission or electronic storage system can be guaranteed to be entirely secure. You are responsible for maintaining the security of your Account credentials and for notifying atom38 immediately if you suspect any unauthorised access.

10. Cookies & Tracking Technologies

atom38 uses cookies and similar tracking technologies to provide a functional, personalised, and secure experience on the Platform. The categories of cookies we use are described below:

10.1 Strictly Necessary Cookies

These cookies are essential to the Platform's core operation and cannot be disabled. They enable functions such as user authentication (keeping you logged in during a session), session security tokens, load balancing, and fraud-prevention signals. No consent is required for strictly necessary cookies because they are indispensable to the service you have requested.

10.2 Functional Cookies

These cookies remember your preferences (such as language settings, preferred game categories, and notification preferences) so that you do not need to re-enter them on each visit. Disabling these cookies will not prevent you from using the Platform but may reduce convenience.

10.3 Analytical Cookies

With your consent, atom38 uses analytical cookies to understand how users interact with the Platform — which pages are visited most frequently, where users drop off, and how performance can be improved. This data is collected in aggregate and is not linked to identifiable individuals.

10.4 Managing Cookies

You can control cookies through your browser settings. Most modern browsers allow you to block all cookies, delete existing cookies, or receive a notification before a cookie is set. Please note that blocking strictly necessary cookies may impair your ability to log in and use the Platform. atom38 does not currently respond to browser "Do Not Track" signals because no uniform standard exists for that mechanism.

11. Your Rights

Subject to applicable law, you have the following rights in relation to the Personal Data atom38 holds about you. To exercise any of these rights, please contact us using the details in Section 16. atom38 will respond to all verified requests within 30 days. Where a request is particularly complex, we may extend the response period by a further 30 days, in which case we will notify you of the extension and the reason for it.

To exercise any of the above rights, email us at [email protected] with the subject line "Data Rights Request" and include your registered Account email address and a description of your request. We may need to verify your identity before processing the request.

12. Minors & Age Verification

The atom38 Platform is strictly restricted to individuals who are at least 21 years of age. atom38 does not knowingly collect Personal Data from individuals under the age of 21. Age verification is a mandatory step in the Account registration process: all users are required to submit a government-issued photo ID (KTP) confirming their date of birth before their Account becomes fully active.

If atom38 discovers or has reasonable cause to believe that a User is under 21 years of age, we will immediately suspend the Account, void all associated Wagers, and initiate a review of the Account in accordance with the Terms & Conditions. Any Personal Data collected from an underage user will be deleted as promptly as legal obligations permit.

13. International Data Transfers

atom38's primary user base is located in Indonesia. To operate the Platform, we may store or process Personal Data on servers or with service providers located outside Indonesia, including in jurisdictions that may not provide a level of data protection equivalent to Indonesian law.

Where such transfers occur, atom38 takes appropriate safeguards to ensure your data remains adequately protected, including: contractual clauses that obligate the recipient to protect your data to a standard comparable to this policy; selection of service providers in jurisdictions recognised as providing adequate data protection; and technical measures such as encryption that protect data during transfer regardless of the jurisdiction of the receiving server.

By using the Platform and submitting Personal Data to atom38, you acknowledge that your data may be transferred and processed in jurisdictions outside Indonesia, subject to the safeguards described above.

14. Third-Party Services

The Platform may contain functionality powered by third-party services, including game engines from providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft; payment gateways connected to Indonesian banks (BCA, BRI, BNI, Mandiri) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja); and analytical or fraud-prevention tools.

Each third-party service provider operates under its own privacy policy and data practices. atom38 is not responsible for the privacy practices of third-party providers beyond the contractual obligations we impose on them as Data Processors. We encourage you to review the privacy policies of any third-party services with which you interact independently of atom38.

atom38 does not embed social media tracking pixels, third-party advertising networks, or behavioural retargeting scripts on the Platform that would allow unrelated companies to collect your Personal Data without your knowledge.

15. Policy Amendments

atom38 reviews this Privacy Policy periodically and reserves the right to update or amend it at any time. Material changes — defined as changes that affect the type of data collected, the purposes for which it is used, or the parties with whom it is shared — will be communicated to registered Users by email and by a prominent notice on the Platform at least 14 days before the changes take effect.

Minor or administrative changes (such as corrections to contact details or clarifications that do not alter the substance of the policy) may be made without prior notice, and the "Last Updated" date at the top of this page will be revised accordingly. Your continued use of the Platform after the effective date of any amended Privacy Policy constitutes your acceptance of the revised terms. If you do not accept the amended policy, you may close your Account as described in the Terms & Conditions.

16. Contact & Complaints

If you have any questions, concerns, or requests relating to this Privacy Policy or the way atom38 processes your Personal Data, please contact our Data Protection team:

Please include "Privacy Policy Enquiry" or "Data Rights Request" in the subject line of your email, along with your registered Account email address so we can verify your identity and locate the relevant records.

If you are not satisfied with atom38's response to your privacy concern, you have the right to raise a complaint with the relevant data protection authority in your jurisdiction. atom38 will cooperate fully with any such investigation.

For further information about your Account, please also review our Terms & Conditions, our Responsible Gaming policy, and our FAQ page, where many common privacy-related questions are addressed.