At cm888, your privacy is not an afterthought — it is foundational to the trust we build with every player across Indonesia. This Privacy Policy explains exactly what personal data we collect, why we collect it, how we protect it, and what rights you hold over it.
cm888 ("we", "us", "our") is committed to protecting the personal data of every individual who accesses or uses the cm888 online casino and sportsbook platform available at https://cm888.my (the "Platform"). This Privacy Policy ("Policy") describes in detail the categories of personal data we collect, the purposes for which we process that data, the parties with whom we may share it, the security measures we employ to protect it, and the rights you hold as a data subject.
This Policy applies to all users of the Platform ("you", "your"), including registered account holders and unregistered visitors browsing the site. It covers data collected through the Platform itself, through any related customer support channels (live chat and email), and through technical tracking technologies such as cookies and server logs.
This Policy should be read alongside our Terms & Conditions and our Responsible Gaming policy, both of which form part of the overall agreement between you and cm888. By registering an account or continuing to use the Platform, you acknowledge that you have read and understood this Policy.
If you are under 21 years of age, you are not permitted to use the cm888 Platform, and cm888 does not knowingly collect personal data from individuals below this age. If you believe we have inadvertently collected data from a minor, please contact us immediately at [email protected] so that we can take prompt corrective action.
We collect personal data in the following categories. The specific data points collected from you will depend on the nature and extent of your interaction with the Platform.
When you create an account on cm888, we collect the information you provide during the registration process, including your chosen username, email address, date of birth, and any optional profile details you elect to add. This data is necessary to establish and maintain your account.
Before processing any withdrawal request, we are required to verify your identity. KYC data may include: a copy of your Indonesian National Identity Card (KTP) or passport; a recent bank statement or utility bill as proof of address; and, in some circumstances, a selfie photograph taken alongside your identity document. This data is collected to prevent fraud, underage gambling, and money laundering.
We record details of every deposit and withdrawal you make on the Platform, including the transaction amount in Indonesian Rupiah (IDR / Rp), the payment method used (such as BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, or LinkAja), the timestamp of the transaction, and the reference number assigned by your payment provider. We do not store full bank account numbers or complete e-wallet credentials; only the masked identifiers necessary for reconciliation purposes are retained.
We maintain records of your betting and gaming activity on the Platform, including game sessions played, wager amounts, outcomes, bonus usage, and account balance movements. This data supports account management, dispute resolution, responsible gaming monitoring, and regulatory compliance.
We automatically collect certain technical data when you access the Platform, including your IP address, browser type and version, operating system, device type and model, screen resolution, referring URL, pages visited, time spent on each page, and session duration. This data is used for security monitoring, fraud detection, and Platform performance optimisation.
If you contact our support team via live chat or email, we retain records of those communications, including the content of messages, the timestamp of each exchange, the support agent assigned, and the resolution outcome. This data is used to manage your enquiry and to improve service quality.
cm888 will never ask for your account password, full bank account number, or complete credit/debit card details via any communication channel including live chat, email, or phone. If you receive such a request, treat it as fraudulent and report it to [email protected] immediately.
| Data Category | Examples | Collected From |
|---|---|---|
| Identity Data | Username, email, date of birth | Registration form |
| KYC Data | KTP copy, passport, proof of address, selfie | KYC submission portal |
| Financial Data | Transaction amounts, payment channel, timestamps | Deposit/withdrawal actions |
| Gaming Activity | Game sessions, wager history, bonus usage | Platform activity |
| Technical Data | IP address, device type, browser, session data | Automated server logs |
| Communications | Live chat transcripts, email messages | Support interactions |
cm888 collects personal data through the following channels and mechanisms:
We process your personal data only for the purposes described below. We do not use your data in ways that are incompatible with the purpose for which it was originally collected without first obtaining your consent.
Your identity and registration data is used to create, manage, and maintain your account on the Platform, to authenticate your identity on login, to communicate account-related notices to you, and to process your requests for account updates or closure.
Your financial and gaming activity data is used to process deposits and withdrawals accurately, to settle bets and game rounds, to credit bonuses and promotional rewards to your account, and to display your current balance and transaction history within your account dashboard.
KYC data, transaction data, and gaming activity records are retained and, where legally required, disclosed to regulatory authorities to comply with international anti-money laundering (AML) obligations, counter-terrorist financing (CTF) requirements, and the know-your-customer rules of the jurisdiction under which cm888 operates.
Technical and device data, combined with transaction patterns and account behaviour, is analysed to detect and prevent unauthorised account access, bonus abuse, collusion, money laundering, and other fraudulent activities that could harm our players or the integrity of the Platform.
Gaming activity data is monitored to identify behavioural patterns that may indicate problem gambling, such as rapidly escalating wager sizes, extended uninterrupted sessions, or repeated large loss episodes. Where such patterns are detected, we may proactively reach out to you with responsible gaming information or activate protective limits consistent with our Responsible Gaming policy.
Communications data is used to handle and resolve your enquiries, to follow up on unresolved issues, and to improve the quality and responsiveness of our support team through internal training and process review.
Where you have given explicit consent to receive promotional communications, we may use your email address to send you information about new games, upcoming promotions, seasonal offers tied to Indonesian holidays such as Idul Fitri, Nyepi, or Chinese New Year (Imlek), and personalised bonus offers based on your gaming preferences. You may withdraw your marketing consent at any time by clicking the unsubscribe link in any marketing email or by contacting our support team.
Aggregated and anonymised technical data is used to analyse Platform performance, identify and resolve bugs, optimise page loading speeds, and improve the overall user experience for players across Jakarta, Surabaya, Bandung, Bali, Medan, and all other regions of Indonesia we serve.
cm888 processes your personal data under the following legal bases, consistent with internationally recognised data protection principles:
| Processing Purpose | Legal Basis |
|---|---|
| Account creation and management | Performance of a contract (Terms & Conditions) |
| Processing deposits and withdrawals | Performance of a contract |
| KYC identity verification | Legal obligation (AML/CTF compliance) |
| Fraud prevention and security | Legitimate interests of cm888 and its users |
| Responsible gaming monitoring | Legitimate interests; legal obligation where applicable |
| Sending marketing communications | Your explicit consent |
| Platform analytics and improvement | Legitimate interests (using anonymised data) |
| Regulatory reporting | Legal obligation |
Where we rely on legitimate interests as our legal basis, we have assessed that our interests do not override your fundamental rights and freedoms as a data subject, particularly given the nature of the data involved and the reasonable expectations of users of an online gaming platform.
cm888 does not sell, rent, or trade your personal data to any third party for their own commercial purposes. We share your data only in the limited circumstances described below, and only to the minimum extent necessary for each purpose.
To complete financial transactions, we share the necessary transaction data with your chosen payment provider — such as BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, OVO, DANA, GoPay, ShopeePay, or LinkAja. Each provider operates under its own privacy policy and is independently responsible for the data it processes in connection with the transaction.
We engage regulated third-party KYC service providers to assist with document verification and identity checks. These providers receive only the specific documents and data required to complete the verification task and are contractually prohibited from using that data for any other purpose.
We share technical identifiers (such as hashed device fingerprints and IP reputation scores) with fraud prevention service providers to protect the Platform and its users from fraudulent activity. These providers act as data processors under our instruction and are bound by strict data handling obligations.
Our casino and slot games are delivered by licensed third-party game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft. These providers may receive a session token and anonymised game-round data to operate the game engine correctly. They do not receive your full identity or financial data.
cm888 may disclose personal data to law enforcement agencies, regulatory bodies, or other public authorities where required to do so by applicable law, court order, or regulatory directive — including in connection with the investigation of financial crime, fraud, or other serious offences.
In the event of a merger, acquisition, restructuring, or sale of all or part of cm888's business, your personal data may be transferred to the acquiring entity as part of the transaction. You will be notified of any such transfer and any material change to data handling practices arising from it.
All third parties with whom cm888 shares personal data are required to implement appropriate technical and organisational security measures and are contractually prohibited from using your data for any purpose beyond that for which it was shared.
cm888 uses cookies and similar tracking technologies (such as pixel tags and local storage objects) to operate and improve the Platform. A cookie is a small text file stored on your device when you visit a website. Cookies do not contain executable code and cannot be used to install software on your device.
| Cookie Type | Purpose | Duration |
|---|---|---|
| Strictly Necessary | Enable core Platform functions — login session management, balance display, bet confirmation. Cannot be disabled. | Session |
| Performance | Collect anonymised data on how users navigate the Platform to identify and resolve performance issues. | Up to 13 months |
| Functional | Remember your preferences such as language settings, last game played, and display options. | Up to 12 months |
| Security | Detect and prevent fraudulent login attempts, bot activity, and suspicious session behaviour. | Session to 30 days |
You may configure your browser to refuse all cookies or to alert you when a cookie is being set. However, disabling strictly necessary cookies will prevent you from logging in to your account and using the core features of the Platform. Instructions for managing cookies are available in the help section of all major browsers including Chrome, Firefox, Safari, and Edge.
cm888 does not use third-party advertising cookies or cross-site tracking cookies. We do not participate in behavioural advertising networks or retargeting programmes that track your activity across other websites.
cm888 retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply:
At the end of the applicable retention period, data is securely deleted or anonymised in accordance with our internal data destruction procedures. Anonymised data may be retained indefinitely for statistical and analytical purposes, as it no longer constitutes personal data.
cm888 takes the security of your personal data seriously and implements a layered set of technical and organisational controls designed to prevent unauthorised access, disclosure, alteration, or destruction of your data.
While cm888 employs industry-standard security measures, no digital system is completely immune to risk. You play an important role in protecting your own data by keeping your account credentials secure, logging out of the Platform when using shared devices, and contacting support immediately if you suspect unauthorised access to your account.
As a user of the cm888 Platform, you hold the following rights with respect to the personal data we hold about you. To exercise any of these rights, please contact us via live chat or at [email protected]. We will respond to all verifiable requests within 30 calendar days.
Please note that certain rights — particularly erasure and restriction — are subject to legal retention obligations described in Section 8. Where we are required by law to retain specific data (e.g., KYC documents and transaction records under AML rules), we will inform you of the basis for retaining that data even following an erasure request.
The cm888 Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect, process, or retain personal data from individuals under the age of 21. Our registration process requires users to confirm their date of birth, and our KYC verification process includes age verification as a mandatory step before any withdrawal is processed.
If a parent or guardian believes that their child has created an account on the cm888 Platform or submitted personal data without authorisation, we ask that they contact us immediately at [email protected]. Upon verification of the report, we will close the relevant account and securely delete all associated personal data without delay.
cm888 supports responsible gaming and recognises that protecting young people from exposure to online gambling is a shared societal responsibility. We strongly encourage parents and guardians to use parental control software to restrict access to online gambling sites on shared devices.
The cm888 Platform may contain links to third-party websites in the context of payment processing redirects or game provider integrations. cm888 is not responsible for the privacy practices of any third-party website or service. Once you leave the cm888 Platform and navigate to a third-party site, this Privacy Policy no longer applies. We encourage you to review the privacy policy of any external site you visit.
cm888 does not endorse or make any representation about the privacy practices of third-party payment providers, game studios, or any other external services. Your interactions with those parties are governed solely by their own terms and privacy policies.
cm888 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law, or improvements to the Platform. When we make a material change to this Policy, we will post a prominent notice on the Platform homepage and, where technically feasible, send a notification to your registered email address at least seven (7) days before the change takes effect.
The "Effective Date" at the top of this page will always reflect the date of the most recent revision. We encourage you to review this Policy periodically. Your continued use of the Platform after the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not agree with any change, please discontinue use of the Platform and contact support to initiate account closure.
Archived versions of prior Privacy Policies are available on request by contacting [email protected]. This practice ensures full transparency about the historical handling of your personal data.
If you have any questions, concerns, or requests regarding this Privacy Policy or the way cm888 handles your personal data, please contact us through the following channels:
When submitting a data subject request by email, please include your registered username and a brief description of the right you wish to exercise. We may ask you to provide proof of identity before processing your request to ensure we do not disclose data to an unauthorised third party.
This Privacy Policy was last reviewed and updated on 1 January 2026. cm888 is committed to handling your personal data with the care, transparency, and respect you deserve as a valued player across Indonesia.
Six core principles guide every data decision we make at cm888 — because trust is the foundation of a great gaming experience.
All data transmitted between your device and the cm888 Platform is protected with 256-bit TLS encryption — the same standard used by leading international banks including BCA and Mandiri. Your credentials and financial details are never exposed in transit.
Personal data is accessible only to authorised cm888 personnel on a strict need-to-know basis. Role-based permissions and multi-factor authentication ensure that no single employee can access your full data profile without independent authorisation.
cm888 does not sell, rent, or trade your personal data to any third party for commercial gain — ever. Data sharing is limited strictly to service delivery partners (payment processors, KYC providers) under binding contractual obligations.
You have the right to access, correct, delete, restrict, and port your data at any time. Submit a request via live chat or email and our Data Protection team will respond within 30 calendar days, consistent with internationally recognised data protection standards.
We retain your data only as long as legally required or operationally necessary — never indefinitely. Once the applicable retention window closes, data is securely deleted or anonymised using industry-standard destruction procedures.
In the unlikely event of a data breach that poses a material risk to your rights, cm888 will notify affected users promptly and without undue delay. Our incident response team operates around the clock across WIB, WITA, and WIT time zones.
Now that you know exactly how cm888 safeguards your data, step into Indonesia's most trusted online casino and sportsbook. From BRI Liga 1 betting to Pragmatic Play slots and live dealer tables — it's all waiting for you.
Adults Only (21+) | Play Responsibly | SSL Secured | Provably Fair Games