Privacy Policy — 777rp

The following terms, when used in this Privacy Policy, carry the meanings set out below unless context otherwise requires:

777rp collects Personal Data in three primary ways: information you provide directly, information generated automatically by your use of the Platform, and information we receive from third-party verification and payment providers. The categories of data collected are detailed below.

2.1 Information You Provide Directly

• Registration data: Full legal name, date of birth, email address, mobile phone number registered in Indonesia, and a username and password of your choosing.
• KYC documentation: A clear copy of a valid government-issued photo ID (Indonesian KTP or passport), and where required, a photograph of you holding that document (liveness check).
• Payment information: Local bank account details (BCA, BRI, BNI, Mandiri, CIMB Niaga) or e-wallet identifiers (DANA, OVO, GoPay, ShopeePay, LinkAja) used for deposits and withdrawals. 777rp does not store full card or account numbers on its own servers; these are tokenized by our payment processors.
• Communications: Any messages, emails, or support tickets you send to 777rp, including their metadata (date, time, subject line).
• Responsible gaming preferences: Deposit limit settings, session time limits, self-exclusion elections, and cool-off period requests that you configure in your Account settings.

2.2 Data Collected Automatically

• Technical identifiers: IP address, browser type and version, operating system, device type (mobile or desktop), screen resolution, and preferred language settings.
• Session data: Login timestamps (in WIB, UTC+7), session duration, pages visited, click paths, and search queries entered within the Platform.
• Transaction logs: Full records of every deposit, withdrawal, bet placement, and bonus activation, including amounts (in IDR / Rp), timestamps, and outcome data.
• Geolocation: Approximate geographic location derived from your IP address. 777rp does not collect GPS-level location data from your device unless you explicitly grant permission.
• Cookie and tracking data: As described in Section 6.

2.3 Data Received from Third Parties

• Identity verification providers: Confirmation of document authenticity and sanction/PEP (Politically Exposed Person) screening results.
• Payment processors: Transaction status notifications, fraud-scoring signals, and chargeback alerts.
• Fraud prevention services: Device fingerprint risk scores and behavioral anomaly flags.
• Game providers: Game round IDs, session outcomes, and RTP (return-to-player) statistics from studios such as Pragmatic Play, Evolution Gaming, and Spribe, used for dispute resolution and audit purposes.

777rp processes your Personal Data only for purposes that are clearly defined, legitimate, and proportionate to the data collected. The table below maps each processing purpose to the relevant data categories:

777rp does not use your Personal Data for automated decision-making that produces significant legal or similarly significant effects without human oversight. Where automated profiling is used (for example, in responsible gaming risk scoring), a Player may request manual review of any decision that affects their Account by contacting support as described in Section 14.

Every processing activity carried out by 777rp rests on at least one of the following lawful bases:

• Contractual necessity: Processing is necessary to perform the contract between 777rp and you — specifically, the Terms & Conditions you accepted at registration. This basis covers account management, payment processing, and bet settlement.
• Legal obligation: Processing is required to comply with applicable laws and regulations, including anti-money-laundering (AML) requirements, KYC obligations, and instructions from regulatory or law enforcement authorities.
• Legitimate interests: Processing is necessary for 777rp's legitimate business interests — including fraud prevention, platform security, responsible gaming monitoring, and analytics — provided those interests are not overridden by your fundamental rights and freedoms. Where we rely on legitimate interests, a balancing test has been conducted internally.
• Consent: For processing activities that are not covered by the bases above — notably, sending you promotional emails or SMS messages about bonuses, seasonal promotions, and new product launches — we rely on your freely given, specific, and informed consent. You may withdraw consent at any time by updating your communication preferences in your Account settings or by contacting support.

777rp shares Personal Data only in the circumstances described below, and only to the minimum extent necessary for the stated purpose:

• Payment processors: Local bank transfer facilitators and e-wallet partners (DANA, OVO, GoPay, ShopeePay, LinkAja) receive transaction-specific data required to execute and reconcile payments. These processors are contractually bound to handle your data exclusively for payment-processing purposes.
• Identity verification providers: Third-party KYC bureaus receive document images and personal identifiers solely to perform identity confirmation, sanctions screening, and PEP checks. Results are returned to 777rp and the raw documents are not retained by these providers beyond their service agreements.
• Game studios: Providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, and Spribe receive a pseudonymous player token (not your name or contact details) to manage game sessions and provide fair-play audit trails.
• Fraud prevention and security vendors: Device fingerprinting and behavioral-analytics providers receive technical identifiers and session data under strict data-processing agreements.
• Regulatory and law enforcement authorities: 777rp will disclose Personal Data when required to do so by a valid legal order, court order, or instruction from a competent regulatory authority. Where permitted by law, 777rp will endeavor to notify you of such a disclosure in advance.
• Professional advisors: Lawyers, auditors, and compliance consultants may access Personal Data in anonymized or aggregated form as required for their professional engagement with 777rp.
• Business transfers: In the event of a merger, acquisition, or asset sale involving 777rp, Personal Data held by 777rp may be transferred to the successor entity, subject to the same or equivalent privacy protections. Players will be notified of any such transfer at least 30 days in advance.

The 777rp Platform uses cookies and similar tracking technologies to operate core functionality, maintain session security, understand how Players navigate the site, and — with your consent — serve relevant promotional content. The categories of cookies deployed are set out in the table below.

Strictly necessary cookies (session_token, csrf_token) cannot be disabled as they are essential to the secure operation of the Platform. All other cookies may be managed through your Account preferences or your browser's cookie settings. Disabling analytics or preference cookies may limit some non-essential Platform features but will not prevent you from placing bets or managing your Account.

777rp does not deploy third-party advertising networks or cross-site tracking pixels. All analytics data is processed first-party or by contracted processors bound by data-processing agreements.

777rp retains Personal Data only for as long as it is necessary to fulfil the purpose for which it was collected, to comply with applicable legal and regulatory retention requirements, or to resolve disputes and enforce agreements. The primary retention periods are:

• Active Account data: Retained for the duration of your Account's activity plus 5 years after the Account is closed, in compliance with anti-money-laundering record-keeping requirements.
• KYC documents: Retained for 5 years after the date of verification completion or Account closure, whichever is later.
• Transaction records: Retained for 5 years from the date of each transaction, in accordance with financial record-keeping obligations.
• Customer support communications: Retained for 3 years from the date of the last communication in a support thread, for dispute resolution and service-quality purposes.
• Analytics and session data: Retained in anonymized, aggregated form for up to 24 months; raw session logs are deleted after 12 months.
• Marketing consent records: Retained for the duration of your subscription to promotional communications, plus 2 years thereafter as evidence of the consent given.

When Personal Data is no longer required and the applicable retention period has expired, 777rp will delete or irreversibly anonymize it in a secure manner. Anonymized data (from which all direct and indirect identifiers have been removed) is not subject to this policy and may be retained for longer periods for statistical and research purposes.

777rp's Platform serves players across Indonesia, and certain service providers and infrastructure components may be located in jurisdictions outside Indonesia. Where Personal Data is transferred internationally, 777rp ensures that appropriate safeguards are in place to maintain a level of protection consistent with this Privacy Policy, including:

• Contractual clauses binding the recipient to data protection standards equivalent to those applied by 777rp.
• Transfer only to processors and subprocessors whose data-handling practices have been reviewed and approved by 777rp's compliance team.
• Encryption of data in transit using TLS 1.2 or higher at all times.

By using the Platform, you acknowledge that your Personal Data may be transferred to and processed in countries that may not have data protection laws equivalent to those of Indonesia. In all such cases, 777rp contractually ensures that the same level of protection described in this Privacy Policy is maintained.

As a Player whose Personal Data is processed by 777rp, you hold the following rights with respect to your information. To exercise any of these rights, contact us using the details in Section 14. We will respond to all valid requests within 30 calendar days of receipt, and in complex cases we will notify you of any extension within the initial 30-day window.

Please note that certain rights are subject to limitations: for example, the right to erasure cannot override 777rp's obligation to retain transaction records for the statutory 5-year period, and the right to object does not apply to processing that is strictly necessary for the performance of our contract with you.

777rp applies a layered, defense-in-depth approach to protecting your Personal Data. The technical and organizational measures in place include, but are not limited to:

• Encryption in transit: All data exchanged between your browser/device and the Platform is encrypted using TLS 1.2 or TLS 1.3. The Platform enforces HTTPS across every page and API endpoint; plain HTTP connections are redirected automatically.
• Encryption at rest: Sensitive fields — including identity document data, payment method identifiers, and KYC records — are encrypted at rest using AES-256 in the Platform's primary database.
• Access controls: Internal access to Personal Data is restricted to staff with a documented operational need. Access is authenticated via multi-factor authentication and is logged for audit purposes. Access rights are reviewed quarterly.
• Payment tokenization: Full bank account numbers and e-wallet identifiers are never stored in plain text on 777rp's servers. Payment data is tokenized at the point of entry by our certified payment processors.
• Intrusion detection: The Platform operates continuous network intrusion detection and web application firewall (WAF) protection, with 24/7 monitoring by the security operations team.
• Penetration testing: External security audits and penetration tests are conducted at least annually by an independent third-party security firm.
• Incident response: 777rp maintains a documented data-breach response plan. In the event of a breach that poses a risk to Players' rights and freedoms, affected Players and relevant authorities will be notified in accordance with applicable legal timelines.

Despite these measures, no internet transmission or electronic storage system is 100% secure. Players are encouraged to use a strong, unique password for their 777rp Account and to enable any available two-factor authentication features.

Age verification is performed during the registration process and is repeated at the KYC verification stage. If 777rp discovers — through KYC review, behavioral monitoring, or any other means — that a registered Account belongs to a person under the age of 21, the following actions will be taken immediately:

• The Account will be suspended and access revoked.
• All Personal Data associated with the Account will be permanently deleted from 777rp's systems within 30 days, except where retention is required by law.
• Any real-money balance in the Account (excluding bonus funds) will be returned to the payment method used for the original deposit, subject to verification.

If you are a parent or guardian and believe that your child has registered on the 777rp Platform, please contact us immediately using the details in Section 14. We will investigate and act upon your report within 48 hours.

The 777rp Platform integrates with a number of third-party services to deliver its full range of features. These integrations are necessary for payment processing, game delivery, identity verification, and platform security. Each third-party integration is governed by a data-processing agreement that requires the third party to handle Personal Data exclusively for the contracted purpose and to apply security standards consistent with those described in Section 10.

Key third-party categories and their data interactions include:

• Payment gateways: Handle encrypted payment credentials for local Indonesian bank transfers and e-wallet transactions (DANA, OVO, GoPay, ShopeePay, LinkAja, BCA, BRI, BNI, Mandiri, CIMB Niaga). These providers operate under their own privacy policies for data they independently collect.
• Game content providers: Studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, and Spribe receive only a pseudonymous session token. No name, email, or contact data is shared with game studios.
• Identity verification platforms: Receive document scans and biometric data solely for KYC purposes. Documents are not used for any other purpose by these providers.
• Analytics platforms: Receive anonymized, aggregated behavioral data (page views, session durations, click funnels) to help 777rp improve the Platform experience. Individual Player identities are never passed to analytics providers.
• Cloud infrastructure providers: Host the Platform's servers and databases in secure, certified data centers. These providers have no business-level access to application data and operate purely as infrastructure vendors.

The Platform may contain links to external websites for informational reference. 777rp is not responsible for the privacy practices of external sites and recommends that you review the privacy policy of any third-party website you visit.

777rp reserves the right to update or amend this Privacy Policy at any time. Changes may be required to reflect updates to the Platform's features, changes in applicable law, or improvements to our data governance practices.

When material changes are made to this Privacy Policy — meaning changes that affect your rights or the way we process your Personal Data in a significant way — 777rp will notify you through one or more of the following channels:

• A prominent notice displayed on the Platform upon your next login.
• An email notification sent to the address registered on your Account.
• An in-Account notification visible in your messages or notification center.

The "Effective Date" at the top of this page will be updated each time the policy is revised. Your continued use of the Platform following notification of material changes constitutes your acceptance of the revised Privacy Policy. If you do not accept the revised terms, you must cease using the Platform and may request Account closure as described in the Terms & Conditions.

For non-material changes — such as typographical corrections, clarifications of existing practices, or updated contact details — 777rp may update this policy without direct individual notification. We encourage you to review this page periodically to stay informed of how we protect your Personal Data.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way 777rp processes your Personal Data, please reach out to our Privacy & Data Protection team. Our team includes Indonesian-speaking support agents available to assist you at all times.

When submitting a data rights request (Section 9), please include the following in your message:

• Your registered Account username or the email address associated with your Account.
• A clear description of the right you wish to exercise (e.g., "I am requesting a copy of all Personal Data held about my Account").
• If requesting erasure or rectification of KYC data, please attach the relevant supporting documentation.

777rp will verify your identity before processing any data rights request to ensure that Personal Data is disclosed or modified only at the instruction of the legitimate Account holder. Verification is typically performed by sending a one-time code to your registered email address.