idr77 Privacy Policy

1. Definitions

In this Privacy Policy, the following terms carry the meanings set out below:

• "idr77" / "we" / "us" / "our" — the idr77 online gambling platform, operated by its international licence holder and accessible at idr77.bio.
• "User" / "you" / "your" — any natural person who accesses, registers on, or uses the idr77 platform.
• "Personal Data" — any information relating to an identified or identifiable natural person, including but not limited to name, email address, date of birth, phone number, payment details, device identifiers, and IP address.
• "Processing" — any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.
• "KYC" (Know Your Customer) — the identity and payment-method verification process carried out to confirm a User's identity, age, and ownership of registered payment methods.
• "Cookies" — small text files placed on a User's device by the idr77 platform to facilitate session management, fraud detection, and usage analytics.

2. Data Controller

2.1  idr77, operating through its internationally licensed parent entity, acts as the data controller for all Personal Data collected through the idr77 platform at idr77.bio.

2.2  As data controller, idr77 determines the purposes and means by which Personal Data is processed. idr77 is responsible for ensuring that all processing carried out under its direction complies with the applicable data protection principles set out in this Privacy Policy.

2.3  For all privacy-related enquiries, data access requests, or complaints, Users may contact idr77 via the support contact details provided in Section 14 of this policy.

3. Data We Collect

3.1  idr77 collects Personal Data through several channels, including the account registration form, KYC verification submissions, payment processing, platform activity, and customer support interactions. The categories of data collected are set out in the table below.

3.2  idr77 does not intentionally collect sensitive personal data categories such as racial or ethnic origin, religious beliefs, political opinions, or health data beyond what is strictly necessary for responsible-gaming monitoring purposes. Where responsible-gaming monitoring results in the collection of data that could be considered sensitive, that data is processed solely for player-protection purposes and is never shared with third parties for commercial ends.

4. Legal Basis for Processing

4.1  idr77 processes Personal Data on the following legal bases:

• Contractual necessity: Processing required to fulfil the account registration agreement, including identity verification, payment processing, and account management;
• Legitimate interests: Processing necessary to prevent fraud, detect money laundering, maintain platform security, and improve the platform through aggregate usage analytics — provided those interests are not overridden by the User's rights;
• Legal obligation: Processing required to comply with applicable international regulatory requirements, including anti-money-laundering (AML) obligations and KYC mandates;
• Consent: Processing for direct marketing communications, where consent has been explicitly provided at the time of registration or through account settings. Consent may be withdrawn at any time.

5. How We Use Your Data

5.1  idr77 uses Personal Data for the following purposes:

• Creating, maintaining, and managing your idr77 Account;
• Verifying your identity and age as part of KY C verification;
• Processing deposits and withdrawals via local Indonesian payment methods including BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, and ShopeePay;
• Detecting, investigating, and preventing fraudulent transactions, money laundering, and other prohibited conduct;
• Monitoring betting patterns for responsible-gaming purposes and applying player-protection measures where necessary;
• Providing customer support and responding to enquiries and complaints;
• Sending transactional communications such as deposit confirmations, withdrawal notifications, and account security alerts;
• Sending promotional communications and personalised offers where you have provided consent to receive them;
• Improving platform functionality, game performance, and user experience through aggregate and anonymised analytics;
• Complying with applicable legal and regulatory obligations.

5.2  idr77 does not use automated decision-making or profiling that produces legal or similarly significant effects on Users, except in the context of fraud detection systems that may trigger an account review flag requiring human assessment before any adverse action is taken.

6. Data Sharing & Disclosure

6.1  idr77 does not sell, rent, or trade Personal Data to any third party for commercial or marketing purposes. Personal Data may be shared with the following categories of recipients only where necessary and proportionate:

• Payment processors and banking partners: including BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, and ShopeePay, for the sole purpose of processing financial transactions on your behalf;
• KYC and identity verification service providers: third-party vendors engaged to assist with document verification and fraud screening, operating under strict data processing agreements;
• Game content providers: licensed studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive anonymised session data for game performance and fair-play auditing purposes;
• Customer support platform providers: technology vendors operating the live chat and ticketing infrastructure used to deliver support services;
• Law enforcement and regulatory authorities: where disclosure is required by applicable law, court order, or regulatory mandate, idr77 will comply and may do so without prior notice to the User.

6.2  All third-party service providers engaged by idr77 are required to process Personal Data strictly in accordance with idr77's instructions and to maintain appropriate technical and organisational security measures. idr77 does not permit service providers to use shared data for their own commercial purposes.

7. Cookies & Tracking Technologies

7.1  idr77 uses cookies and similar technologies — including local storage objects and session tokens — to deliver, secure, and improve the platform. The categories of cookies used are as follows:

• Strictly necessary cookies: Required for core platform functionality, including maintaining your login session, securing account pages, and facilitating the cashier. These cannot be disabled without significantly impairing platform use;
• Functional cookies: Used to remember your preferences such as language settings, preferred lobby view, and game history within a session;
• Analytics cookies: Aggregate, anonymised data collected to understand how Users navigate the platform, which game categories attract the most engagement, and where technical errors occur. This data is used exclusively for internal platform improvement;
• Security cookies: Used to detect and prevent fraudulent login attempts, bot activity, and unusual session behaviour.

7.2  idr77 does not use third-party advertising cookies, retargeting pixels, or cross-site tracking scripts that follow your activity beyond the idr77.bio domain.

7.3  Most web browsers allow you to control cookie settings through the browser's preferences. Disabling strictly necessary cookies will impair your ability to log in and use the platform. Disabling analytics or functional cookies will not prevent access but may reduce platform personalisation.

8. Data Security

8.1  idr77 implements a layered security architecture to protect Personal Data against unauthorised access, disclosure, alteration, and destruction. Security measures in place include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and our servers;
• Encryption at rest for all stored Personal Data and KYC documentation;
• Role-based access controls limiting data access to personnel with a documented operational need;
• Multi-factor authentication for all internal administrative access to data systems;
• Regular penetration testing and vulnerability assessments conducted by independent security specialists;
• Automated anomaly detection and intrusion-detection systems monitoring platform infrastructure on a continuous basis.

8.2  While idr77 takes all reasonable and industry-standard precautions to protect Personal Data, no digital platform can guarantee absolute security. Users are encouraged to maintain strong, unique passwords for their idr77 Account and to enable any available two-factor authentication features.

8.3  In the event of a data breach that is reasonably likely to result in a risk to the rights and freedoms of affected Users, idr77 will notify affected individuals promptly and take all necessary remediation steps in accordance with applicable regulatory requirements.

9. Data Retention

9.1  idr77 retains Personal Data for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable international regulatory and anti-money-laundering obligations. The general retention periods applied by idr77 are as follows:

• Active Account data (identity, contact, financial data): retained for the full duration of the Account relationship plus a minimum of five years following Account closure, in accordance with standard AML record-keeping requirements;
• KYC documentation (ID scans, selfie photographs, proof of payment method): retained for a minimum of five years from the date of verification or Account closure, whichever is later;
• Transaction records (deposits, withdrawals, bet history): retained for a minimum of five years from the date of each transaction;
• Customer support records (chat transcripts, email correspondence): retained for three years from the date of the interaction;
• Technical and usage data (IP logs, session data): retained for up to 13 months for fraud detection and security purposes, then deleted or anonymised.

9.2  Once the applicable retention period expires, Personal Data is securely deleted using industry-standard data destruction methods or, where deletion is not technically feasible, permanently anonymised so that it can no longer be attributed to any identifiable individual.

10. Your Rights Over Your Personal Data

10.1  Depending on your location and the applicable data protection framework, you may hold some or all of the following rights in relation to the Personal Data idr77 holds about you:

• Right of Access: Request a copy of the Personal Data idr77 holds about you, including confirmation of how it is being processed.
• Right to Rectification: Request correction of any inaccurate or incomplete Personal Data held in your Account.
• Right to Erasure: Request deletion of Personal Data that is no longer necessary for the purposes for which it was collected, subject to idr77's legal retention obligations.
• Right to Restriction: Request that processing of your Personal Data be restricted in certain circumstances, such as while a data accuracy dispute is being resolved.
• Right to Data Portability: Request a structured, machine-readable copy of Personal Data you have provided to idr77, where processing is carried out by automated means.
• Right to Object: Object to processing of your Personal Data carried out on the basis of legitimate interests, including direct marketing communications.
• Right to Withdraw Consent: Where processing is based on your consent, withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

10.2  To exercise any of the above rights, contact idr77 customer support using the details in Section 14. idr77 will respond to all valid requests within 30 days. Where a request is complex or involves a large volume of data, idr77 may extend this period by a further 60 days with prior notice.

10.3  idr77 will not charge a fee for processing a data rights request unless the request is manifestly unfounded, excessive, or repetitive, in which case a reasonable administrative fee may apply.

11. International Data Transfers

11.1  idr77 operates as an internationally licensed offshore platform. As a result, Personal Data collected from Users in Indonesia may be transferred to, stored in, and processed in countries outside Indonesia, including the jurisdiction in which idr77's parent entity holds its international operating licence.

11.2  Where Personal Data is transferred internationally, idr77 ensures that appropriate safeguards are in place to protect your data to a standard at least equivalent to that provided under this Privacy Policy. Such safeguards may include contractual clauses, data processing agreements with service providers, or reliance on the adequacy frameworks applicable to the receiving jurisdiction.

11.3  By registering an idr77 Account, you acknowledge that your Personal Data may be transferred internationally for the purposes set out in this Privacy Policy.

12. Minors — Under 21 Not Permitted

12.1  The idr77 platform is strictly for adults aged 21 and above. idr77 does not knowingly collect Personal Data from individuals under the age of 21. If idr77 becomes aware that Personal Data has been collected from a person under 21 without appropriate consent, that data will be promptly deleted and the associated Account permanently closed.

12.2  If you are a parent or guardian and believe that a minor has registered an idr77 Account or submitted Personal Data to the platform, please contact customer support immediately using the details in Section 14.

13. Changes to This Privacy Policy

13.1  idr77 reserves the right to update or amend this Privacy Policy at any time. Where a material change is made to the way Personal Data is collected, used, or shared, idr77 will notify registered Users by email to the address on record or by displaying a prominent notice on the platform for a period of not less than 7 days before the amended policy takes effect.

13.2  Your continued use of the idr77 platform following the effective date of any amended Privacy Policy constitutes acceptance of the updated terms. If you do not agree with any changes, you must stop using the platform and contact support to request Account closure.

13.3  The date on which this Privacy Policy was last updated is displayed at the top of this page. We encourage you to review this page periodically to remain informed of our current privacy practices.

14. Contact & Complaints

14.1  For any questions, concerns, or requests relating to this Privacy Policy or the Personal Data idr77 holds about you, please contact the idr77 data support team through any of the following channels:

• Live chat: Available directly from any logged-in Account page, 24 hours a day, 7 days a week;
• Email: [email protected] (plain text — not a clickable link).

14.2  idr77 takes all privacy-related enquiries seriously and aims to acknowledge data rights requests within 72 hours and resolve them within 30 calendar days. Complex requests may take up to 90 days in total, with advance notice provided.

14.3  If you are not satisfied with how idr77 has handled a privacy concern after raising it directly with the support team, you have the right to escalate the matter to the data protection supervisory authority in the jurisdiction in which idr77 holds its international operating licence.