Privacy Policy — hmd29

Introduction

hmd29 operates https://hmd29.cam (the "Platform") as an international online betting and casino service directed at users in Indonesia and other permitted markets. As the data controller responsible for personal data processed through the Platform, hmd29 takes its obligations under applicable data-protection law seriously.

This Privacy Policy sets out a transparent account of our data practices in plain, professional language. We have deliberately avoided legalese where possible. Where technical or legal terms are unavoidable, they are explained in Section 2 (Definitions) below. If after reading this Policy you have questions that are not addressed here, please contact us using the details in Section 16.

This Policy should be read alongside our Terms & Conditions, which form the primary contractual agreement governing your use of hmd29. In the event of any conflict between this Policy and the Terms & Conditions on a data-privacy matter, this Policy shall prevail.

Definitions

The following terms are used throughout this Privacy Policy with the meanings defined below:

• "Personal Data" — any information relating to an identified or identifiable natural person (a data subject). This includes names, identification numbers, location data, online identifiers, and any other information specific to a person's physical, economic, or online identity.
• "Processing" — any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, storage, use, disclosure, or deletion.
• "Data Controller" — the entity that determines the purposes and means of processing Personal Data. hmd29 is the Data Controller for all data processed through the Platform.
• "Data Processor" — a third party that processes Personal Data on behalf of and under instruction from the Data Controller.
• "User" or "you" — any individual who accesses, registers on, or uses the Platform.
• "KYC" — Know Your Customer, the identity-verification procedure required to confirm a User's identity and age prior to withdrawal or at hmd29's compliance team's discretion.
• "Cookies" — small text files placed on a User's device by the Platform to facilitate functionality, analytics, and personalisation.
• "IDR" / "Rp" — Indonesian Rupiah, the primary transactional currency used on the Platform.

Data We Collect

hmd29 collects only the data that is necessary for the purposes described in Section 5. The categories of Personal Data we process are as follows:

3.1 Identity & Contact Data

• Full legal name (as it appears on your KTP or equivalent government-issued ID);
• Date of birth;
• Residential address (city, province, postal code, Indonesia);
• Email address;
• Mobile phone number.

3.2 Identity Verification (KYC) Data

• Photograph or scan of your KTP (Kartu Tanda Penduduk) or equivalent photo ID;
• Selfie photograph taken during the verification process;
• Proof of payment method ownership (e.g., screenshot of your BCA, BRI, BNI, or Mandiri account showing your name and account number).

3.3 Financial & Transaction Data

• Deposit amounts, dates, and originating payment method (bank or e-wallet);
• Withdrawal requests, amounts, and destination payment method;
• Wagering history — bet amounts, odds accepted, outcomes, and timestamps;
• Bonus claims, wagering-requirement progress, and promotional participation records.

3.4 Technical & Device Data

• IP address at the time of registration and each subsequent login;
• Device type, operating system, and browser version;
• Unique device identifiers;
• Session duration and navigation patterns within the Platform.

3.5 Communications Data

• Records of live-chat conversations with our support team;
• Email correspondence sent to or received from [email protected];
• Feedback, complaints, and dispute records.

3.6 Responsible Gaming Data

• Self-set deposit limits, loss limits, and session-time reminders;
• Cooling-off and self-exclusion requests, including duration and effective dates;
• Responsible gaming self-assessment responses where voluntarily submitted.

How Data is Collected

hmd29 collects Personal Data through the following channels and mechanisms:

Purposes of Processing

hmd29 processes your Personal Data for the following specific, documented purposes. We do not use your data for any purpose incompatible with those listed here without first obtaining your explicit consent or identifying a new lawful basis.

Legal Basis for Processing

hmd29 processes Personal Data on one or more of the following legal bases, depending on the specific processing activity:

6.1 Contract Performance

Most processing is necessary to perform the contract between you and hmd29 — that is, to provide the betting and gaming services you have signed up for, including registering your Account, accepting bets, processing payments, and delivering customer support.

6.2 Legal Obligation

Certain processing — particularly KYC verification and AML transaction monitoring — is required by our international gaming licence and applicable financial-crime-prevention regulations. We cannot operate the Platform lawfully without conducting these checks.

6.3 Legitimate Interests

hmd29 processes some data on the basis of its legitimate interests as a regulated gaming operator, including: fraud detection, network security, abuse prevention, and anonymised platform analytics used to improve service quality. Where we rely on this basis, we have assessed that our interests are not overridden by your rights.

6.4 Consent

Where processing is not required for contract performance or legal obligation — for example, sending you promotional email communications about new games or seasonal offers — we rely on your freely given, specific consent. You may withdraw consent at any time by contacting [email protected] or updating your Account communications preferences. Withdrawal of consent does not affect the lawfulness of processing conducted prior to withdrawal.

Data Sharing

hmd29 does not sell, rent, or trade your Personal Data to any third party for their own marketing or commercial purposes. We share data only in the following circumstances:

7.1 Service Providers (Data Processors)

We engage carefully vetted third-party processors to support platform operations, including:

• Payment gateways — to facilitate deposits and withdrawals via BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, and LinkAja;
• KYC verification providers — automated identity-document checking services that process KTP scans and selfie images;
• Cloud infrastructure providers — servers, databases, and content-delivery networks on which the Platform operates;
• Fraud and AML screening vendors — services that screen transactions and account behaviour against financial-crime indicators;
• Customer support software — tools used to manage live-chat and email correspondence.

All processors are bound by data-processing agreements that prohibit them from using your data for any purpose other than delivering the specified service to hmd29.

7.2 Regulatory & Law-Enforcement Authorities

hmd29 will disclose Personal Data to governmental, regulatory, or law-enforcement authorities where required to do so by applicable law, court order, or regulatory directive. We will notify you of such a disclosure where we are legally permitted to do so.

7.3 Business Transfers

In the event of a merger, acquisition, or sale of all or part of hmd29's business assets, Personal Data held by hmd29 may be transferred to the acquiring entity as part of that transaction. We will notify registered Users of any such transfer via the email address on their Account.

International Data Transfers

hmd29 operates internationally and your Personal Data may be processed on servers located outside Indonesia. Where data is transferred across international borders, hmd29 implements appropriate safeguards to ensure the data receives a standard of protection equivalent to that required under applicable data-protection principles, including:

• Standard contractual clauses or equivalent data-transfer mechanisms with processors in recipient countries;
• Transfers only to countries or processors that maintain documented security standards consistent with or exceeding those described in Section 10 of this Policy;
• Contractual prohibitions on onward transfer by processors to sub-processors without hmd29's prior written approval.

For questions about the specific countries in which your data may be processed, please contact us at [email protected].

Data Retention

hmd29 retains Personal Data only for as long as it is necessary to fulfil the purposes for which it was collected, unless a longer retention period is required by law. Our standard retention periods are as follows:

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised so that it can no longer be attributed to an individual. Anonymised, aggregated data may be retained indefinitely for statistical and analytical purposes.

Security Measures

hmd29 implements a layered security architecture to protect Personal Data against unauthorised access, alteration, disclosure, or destruction. Our key technical and organisational measures include:

10.1 Encryption

All data transmitted between your device and the hmd29 Platform is encrypted using TLS 1.3. Personal Data stored on our servers — including KYC documents, financial records, and Account data — is encrypted at rest using AES-256 encryption.

10.2 Access Controls

Access to Personal Data within hmd29 is restricted on a strict need-to-know basis. Staff access is governed by role-based permissions, and access to KYC documents requires additional authentication at the application level. All internal access is logged and audited.

10.3 Two-Factor Authentication

Two-factor authentication (2FA) is available to all Users and strongly recommended. Where hmd29 detects an anomalous login attempt (e.g., a new device or unfamiliar IP address), we apply additional verification steps before granting access.

10.4 Penetration Testing

hmd29 commissions external penetration tests by contracted security firms on a periodic basis. Critical findings are remediated as a priority before the next testing cycle. Test reports are retained as part of our security governance documentation.

10.5 Incident Response

In the event of a data breach that poses a risk to your rights, hmd29 will notify affected Users without undue delay and, where required by applicable law, notify the relevant supervisory authority. Notification will include the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and the measures taken or proposed to address the breach.

Cookies & Tracking Technologies

hmd29 uses cookies and similar tracking technologies to operate and improve the Platform. The following categories of cookies may be set on your device:

hmd29 does not use third-party advertising or behavioural-tracking cookies. You may manage cookie preferences through your browser settings. Disabling essential cookies will impair core Platform functionality, including login and bet placement.

Your Rights as a Data Subject

Subject to applicable law and certain conditions, you hold the following rights in respect of your Personal Data. To exercise any of these rights, contact hmd29 at [email protected] with the subject line "Data Rights Request" and include your registered Account username. We will respond within 30 days.

Minors

The hmd29 Platform is strictly intended for individuals aged 21 years and above. hmd29 does not knowingly collect or process Personal Data relating to individuals under the age of 21. If you believe that a minor has registered on the Platform or submitted Personal Data, please notify us immediately at [email protected]. Upon receiving such notification, hmd29 will promptly close the Account and delete all associated Personal Data, subject only to any data-retention obligations that arise from the detection of an age-violation incident.

All Accounts are subject to mandatory KTP-based age verification before withdrawal is permitted. hmd29's KYC process is designed specifically to prevent underage access, and this remains one of our most rigorously enforced compliance requirements.

Third-Party Services

The Platform may reference or integrate with third-party services, including payment processors such as BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja, and game content providers such as Pragmatic Play, Evolution Gaming, and Spribe. When you interact with a third-party service, that service's own privacy policy governs the data it collects from you directly.

hmd29 is not responsible for the privacy practices of any third-party service. We encourage you to review the privacy notices of any external services with which you interact in connection with your use of hmd29. hmd29 selects its third-party partners carefully and requires contractual data-protection commitments from all processors, but cannot guarantee the practices of independently operated entities.

Policy Amendments

hmd29 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform features. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page;
• Notify registered Users via the email address on their Account at least 7 days before the revised Policy takes effect, where practicable;
• Display a notice on the Platform homepage during the transition period.

Your continued use of the Platform after the effective date of a revised Policy constitutes acceptance of the updated terms. If you do not agree with any amendment, you must cease using the Platform and may request Account closure under the procedure described in the Terms & Conditions.

Contact & Complaints

For any question, concern, or request relating to this Privacy Policy or the processing of your Personal Data, please contact the hmd29 Data Privacy team:

If you are not satisfied with hmd29's response to a privacy complaint, you have the right to escalate your complaint to the supervisory authority responsible for data protection in the jurisdiction applicable to your circumstances. hmd29 will cooperate fully with any such authority in the resolution of a complaint.