1 Introduction
demi11 ("we", "us", "our", or the "Company") operates the online gaming platform accessible at https://demi11.cam (the "Platform"). As a platform serving users across Indonesia, we are committed to safeguarding the personal information of every registered user and visitor.
This Privacy Policy describes in full how demi11 collects, stores, processes, shares, and protects personal data in connection with the use of the Platform and all associated services — including casino games, sports betting markets, and lottery products such as togel (Indonesia's traditional numbers lottery). It also outlines the rights you hold with respect to your personal data.
By registering an account or continuing to use the Platform, you acknowledge that you have read and understood this Privacy Policy and you consent to the data practices described herein. If you do not agree with any part of this Policy, please discontinue use of the Platform and contact our support team to close your account.
This Privacy Policy should be read in conjunction with our Terms & Conditions, which govern your use of the Platform as a whole.
2 Data We Collect
demi11 collects personal data in several categories depending on how you interact with the Platform. The following table summarizes the categories of data we may hold about you:
| Category | Examples |
|---|---|
| Identity Data | Full legal name, date of birth, gender, Indonesian National Identity Card (KTP) number, passport number (where applicable). |
| Contact Data | Email address, mobile phone number, city of residence (e.g., Jakarta, Surabaya, Bandung, Bali). |
| Financial Data | Bank account details (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon), e-wallet identifiers (OVO, DANA, GoPay), deposit and withdrawal history, account balance records — all in Indonesian Rupiah (IDR). |
| KYC / Verification Data | Scanned or photographed copies of government-issued identity documents, selfie photographs submitted for biometric verification. |
| Usage Data | Login timestamps, session durations, games played, bet amounts, wager history, bonus activity, device type, operating system, browser type. |
| Technical Data | IP address, geolocation data (country/city level), device identifiers, referring URLs, pages visited within the Platform. |
| Communications Data | Records of live chat conversations, support ticket history, email correspondence with the demi11 support team. |
| Responsible Gaming Data | Deposit limits you have set, self-exclusion requests, session time limits, and any problem gambling self-assessments submitted via the Platform. |
We do not collect or store full payment card numbers (PAN), CVV codes, or PIN numbers. Payment processing is handled by certified third-party payment gateways that comply with applicable security standards.
3 How We Collect Data
3.1 Directly From You
The majority of your personal data is collected directly from you during the following interactions:
- Completing the account registration form;
- Submitting KYC verification documents;
- Making a deposit or requesting a withdrawal;
- Contacting customer support via live chat or email;
- Opting in to promotional offers or bonus programs;
- Setting responsible gaming limits or submitting a self-exclusion request.
3.2 Automatically Through Platform Use
When you access and use the Platform, certain technical and usage data is collected automatically through server logs, session tracking systems, and analytics tools. This includes your IP address, device type, browser version, pages visited, games launched, and session activity. This data is collected to ensure platform stability, detect fraud, and improve user experience.
3.3 Through Cookies and Similar Technologies
demi11 uses cookies and similar tracking technologies to enhance platform performance and personalize your experience. Please refer to Section 9 (Cookies & Tracking) for a detailed explanation of the types of cookies used and how to manage your preferences.
3.4 From Third Parties
In limited circumstances, demi11 may receive personal data about you from third-party sources, including:
- Payment processors and banking partners, for the purpose of verifying transaction authenticity;
- Identity verification service providers used to cross-check KYC documents;
- Fraud prevention and anti-money laundering (AML) screening services;
- Publicly available sources, where permitted by applicable law, for the purpose of verifying identity or detecting prohibited conduct.
4 Purpose of Use
demi11 processes your personal data only for the following defined purposes. We do not use your data for any purpose incompatible with the purposes listed below:
- Account Management: Creating, maintaining, and administering your user account on the Platform;
- Identity Verification (KYC): Verifying your identity and age (minimum 21 years) to comply with responsible gaming standards and prevent fraud;
- Transaction Processing: Processing deposits and withdrawal requests via your registered Indonesian bank accounts and e-wallets;
- Customer Support: Responding to support inquiries, resolving disputes, and communicating account-related information;
- Security and Fraud Prevention: Detecting, investigating, and preventing fraudulent activity, money laundering, unauthorized access, and other prohibited conduct;
- Responsible Gaming Compliance: Administering deposit limits, self-exclusion requests, and other responsible gaming tools you activate;
- Platform Improvement: Analyzing usage patterns to improve game offerings, interface design, and overall platform performance;
- Marketing and Promotions: Sending you relevant promotional offers and bonuses, subject to your communication preferences — you may opt out at any time by contacting support;
- Legal Compliance: Meeting our obligations under applicable international anti-money laundering (AML) and counter-terrorism financing (CTF) frameworks.
5 Legal Basis for Processing
demi11 processes your personal data on the following legal bases:
| Legal Basis | Application |
|---|---|
| Contractual Necessity | Processing required to fulfill our obligations under the Terms & Conditions you accepted at registration — including account management, payment processing, and KYC verification. |
| Legitimate Interests | Fraud detection, platform security monitoring, abuse prevention, and analytics for platform improvement — where our interests do not override your fundamental privacy rights. |
| Legal Obligation | Compliance with international AML and CTF obligations, including document retention requirements and transaction reporting thresholds. |
| Consent | Direct marketing communications and optional analytics cookies — you may withdraw consent at any time without affecting prior processing. |
6 Data Sharing
6.1 We Do Not Sell Your Data
demi11 does not sell, rent, or trade your personal data to any third party for commercial purposes. Your data is shared externally only in the limited circumstances described below, and always subject to strict confidentiality obligations.
6.2 Permitted Third-Party Recipients
Your personal data may be disclosed to the following categories of third parties, strictly on a need-to-know basis:
- Payment Processors: Indonesian bank gateway partners (including BCA, BRI, BNI, Mandiri integrations) and e-wallet providers (OVO, DANA, GoPay) receive the minimum financial data necessary to process your transactions;
- KYC and Identity Verification Providers: Third-party services that assist in verifying the authenticity of your identity documents;
- Fraud and AML Screening Services: Providers that screen transactions and user profiles against sanctions lists and fraud databases;
- Game Content Providers: Studios such as Pragmatic Play, Evolution Gaming, Microgaming, and Spribe receive anonymized session data — they do not receive your name, bank details, or identity documents;
- IT Infrastructure Providers: Cloud hosting, content delivery network (CDN), and cybersecurity service providers that maintain the Platform's technical infrastructure;
- Legal and Regulatory Authorities: We will disclose personal data if required to do so by a lawful order from a competent authority or court of jurisdiction.
6.3 Business Transfers
In the event of a merger, acquisition, restructuring, or sale of all or part of the Company's assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such change via the email address registered to your account prior to the transfer taking effect, and you will retain all rights described in Section 10 of this Policy.
7 Data Retention
demi11 retains your personal data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention periods apply:
| Data Category | Retention Period |
|---|---|
| Account and Identity Data | For the duration of your account, plus 5 years following account closure. |
| Financial Transaction Records | 7 years from the date of each transaction, in accordance with standard AML record-keeping obligations. |
| KYC Documents | 5 years following account closure or the completion of the relevant verification process, whichever is later. |
| Customer Support Records | 3 years from the date of the last interaction, for quality assurance and dispute resolution purposes. |
| Usage and Technical Logs | 13 months from the date of collection, after which logs are anonymized or deleted. |
| Marketing Preferences | Until you withdraw consent or close your account, whichever is earlier. |
Where personal data is no longer required, it is securely deleted or irreversibly anonymized so that it can no longer be linked to any individual.
8 Data Security
demi11 implements a multi-layered security architecture to protect your personal data against unauthorized access, disclosure, alteration, and destruction. Our security measures include:
- SSL/TLS Encryption: All data transmitted between your device and the Platform is encrypted using industry-standard SSL/TLS protocols;
- Encryption at Rest: Sensitive data stored on our servers — including identity documents and financial records — is encrypted using AES-256 encryption;
- Access Controls: Access to personal data is restricted on a strict need-to-know basis; all internal access is logged and audited;
- Two-Factor Authentication (2FA): Available for user accounts and mandatory for all administrative access to internal systems;
- Penetration Testing: Regular third-party security assessments are conducted to identify and remediate vulnerabilities;
- Incident Response Plan: A documented data breach response plan is in place; in the event of a breach affecting your personal data, you will be notified without undue delay.
While demi11 takes all reasonable precautions to secure your data, no digital transmission or storage system is entirely immune to risk. You are responsible for maintaining the confidentiality of your own account credentials. Please notify us immediately at [email protected] if you suspect any unauthorized use of your account.
9 Cookies & Tracking
9.1 What Are Cookies?
Cookies are small text files placed on your device when you visit a website. They allow the website to recognize your device across sessions and store certain preferences or session state. demi11 uses cookies and similar technologies (including local storage and session storage) to operate the Platform efficiently and improve your experience.
9.2 Types of Cookies We Use
| Cookie Type | Purpose | Duration |
|---|---|---|
| Strictly Necessary | Required for core Platform functions — maintaining your login session, securing form submissions, and enabling navigation between pages. | Session |
| Functional | Remembering your language preference, game display settings, and responsible gaming limit configurations. | Up to 12 months |
| Analytics | Collecting anonymized data on page views, session duration, and feature usage to improve Platform performance and content relevance. | Up to 13 months |
| Security | Detecting bot activity, identifying suspicious login patterns, and supporting fraud prevention measures. | Session to 30 days |
9.3 Managing Cookies
Strictly necessary and security cookies cannot be disabled, as they are essential for the Platform to function correctly. For all other cookie categories, you may adjust your preferences through your browser's cookie settings. Please note that disabling functional or analytics cookies may affect certain Platform features. Refer to your browser's help documentation for instructions on managing cookies.
10 Your Rights
As a user of the demi11 Platform, you hold the following rights with respect to your personal data. To exercise any of these rights, please contact our support team using the details in Section 14.
Right of Access
Request a copy of all personal data we hold about you, along with information on how it is being used.
Right to Rectification
Request correction of any inaccurate or incomplete personal data held in your account.
Right to Erasure
Request deletion of your personal data where it is no longer necessary for the purposes it was collected, subject to legal retention obligations.
Right to Restrict Processing
Request that we limit how your data is used while a dispute or correction request is being resolved.
Right to Data Portability
Receive a structured, machine-readable copy of the personal data you provided to us, where technically feasible.
Right to Object
Object to processing carried out on the basis of our legitimate interests, including direct marketing communications.
We will respond to all data rights requests within 30 calendar days of receipt. In complex cases, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it. We will not charge a fee for exercising your rights unless a request is manifestly unfounded or excessive.
11 Minors
The demi11 Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. Registration by minors is prohibited under our Terms & Conditions.
If we become aware that personal data has been collected from a person under the age of 21 without verifiable parental consent, we will take immediate steps to delete that data and close the associated account. If you believe a minor has registered on the Platform, please contact us immediately at [email protected].
12 Cross-Border Data Transfers
demi11 operates through international infrastructure providers. As a result, your personal data may be transferred to and processed in countries outside Indonesia. Where such transfers occur, we ensure that appropriate safeguards are in place to maintain a level of data protection consistent with this Privacy Policy, including:
- Standard contractual clauses or data processing agreements with international service providers;
- Transfers only to jurisdictions that maintain recognized data protection standards;
- Encryption of data in transit to prevent interception during cross-border transfers.
If you would like more information about the specific safeguards applied to any cross-border transfer of your data, please contact our support team.
13 Amendments to This Policy
demi11 may update this Privacy Policy from time to time to reflect changes in our data practices, Platform features, or applicable legal requirements. When material changes are made, we will notify registered users via email or through a prominent notice on the Platform at least 7 days before the revised Policy takes effect.
The "Last Updated" date at the top of this page will always reflect the date of the most recent revision. We encourage you to review this Policy periodically. Your continued use of the Platform following the effective date of any update constitutes your acceptance of the revised Privacy Policy.
14 Contact
If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please reach out to the demi11 privacy team through the following channel:
- Email: [email protected]
- Live Chat: Available 24 hours a day, 7 days a week via the Platform's live chat feature
- Response Time: We aim to acknowledge all privacy-related inquiries within 48 hours and resolve them within 30 calendar days
For data rights requests specifically (access, erasure, rectification, portability), please include your registered email address and a brief description of your request so we can locate your records and respond efficiently.
How We Protect Your Privacy
End-to-End Encryption
Every byte of data transmitted between your device and demi11's servers is protected by SSL/TLS encryption. Your financial and identity information is never exposed in plain text at any point in transit.
No Data Sales
demi11 never sells, rents, or trades your personal data to advertisers or data brokers. Your information is used solely to operate your account and improve your experience on the Platform.
You Control Your Data
Access, correct, export, or request deletion of your personal data at any time. Our support team processes all data rights requests within 30 calendar days, at no charge.
AES-256 Storage Encryption
Sensitive records stored on our servers — including KYC documents, transaction histories, and bank account details — are protected with AES-256 encryption at rest.
Defined Retention Limits
We keep your data only as long as legally required. Financial records are retained for 7 years per AML standards; all other data is deleted or anonymized as soon as it is no longer necessary.
Breach Notification
In the unlikely event of a data breach affecting your personal information, demi11 commits to notifying you without undue delay and providing clear guidance on steps to protect yourself.
Your Privacy, Our Priority
Have questions about how demi11 handles your personal data? Our support team is available around the clock. You can also review our full Terms & Conditions or visit the FAQ for quick answers.
Visit Our FAQ Terms & Conditions Responsible Gaming