Privacy Policy — pay77

pay77 ("we", "us", "our") operates the online sports betting and casino platform accessible at pay77.asia ("the Platform"). As the data controller for all personal data collected through the Platform, pay77 is committed to processing that data lawfully, fairly, and transparently.

This Privacy Policy applies to all individuals who visit pay77.asia, whether or not they register as Members. It governs all personal data collected through the website, our mobile-optimised interface, customer support interactions, and any other touchpoint between you and the pay77 brand.

This policy is to be read alongside our Terms & Conditions and our Responsible Gaming policy, both of which form part of the overall agreement between pay77 and its Members. Where any conflict exists between this Privacy Policy and the Terms & Conditions on a matter specifically concerning personal data, this Privacy Policy shall prevail.

pay77's services are directed exclusively at adults aged 21 and over who are residents of Indonesia. If you are outside Indonesia or under 21 years of age, you must not register or provide any personal data to pay77.

pay77 collects personal data through several channels. The categories of data collected, and the contexts in which they arise, are set out below.

3.1 Registration Data

When you create a pay77 account, we collect the information you provide in the registration form:

• Full legal name
• Date of birth (used to verify the 21+ age requirement)
• Indonesian mobile phone number
• Email address
• Residential address (city, province)
• Chosen username and encrypted password

3.2 KYC and Identity Verification Data

To comply with international AML and counter-terrorism financing (CTF) obligations, pay77 may request the following sensitive data at account opening, prior to a first withdrawal, or when unusual account activity is detected:

• National Identity Card (KTP) number and a scan or photo of the document
• Passport number and a scan or photo, where applicable
• A selfie or liveness check image for facial match verification
• Proof of address (utility bill, bank statement, or equivalent document issued within the last 3 months)

3.3 Financial Data

When you make a deposit or withdrawal, we collect transaction data including:

• Bank name and account number (e.g., BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI)
• E-wallet identifier (OVO, DANA, GoPay, ShopeePay, LinkAja)
• Transaction amounts (in IDR) and timestamps
• Transaction reference numbers issued by the payment service provider

We do not collect or store full card numbers. Any card-based payment data is tokenised and handled exclusively by our certified payment service providers.

3.4 Betting and Gaming Activity Data

• Bets placed, odds accepted, markets selected, and wager amounts
• Game sessions, game titles played, duration, and outcomes
• Bonus activations, wagering progress, and promotional engagement
• Account balance history and transaction log

3.5 Technical and Device Data

When you visit pay77.asia, our servers and analytics tools automatically collect:

• IP address and approximate geolocation (country and city level)
• Device type, operating system, and browser version
• Session duration, pages visited, and click-path data
• Referral source (the URL or campaign that brought you to pay77.asia)

3.6 Customer Support Data

When you contact pay77 via live chat, email ([email protected]), or WhatsApp (+62 811 7700 777), we retain the content of those communications, including any documents or screenshots you share, for the purpose of resolving your query and maintaining a service history.

pay77 processes personal data only where a valid legal basis exists. The primary bases we rely upon are:

pay77 uses the personal data it collects for the following specific purposes:

• Account Management: Creating and maintaining your Member account, authenticating your identity at login, and enabling account self-service features such as deposit limits, session reminders, and self-exclusion tools.
• Payment Processing: Facilitating deposits from and withdrawals to your registered bank accounts and e-wallets (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, BSI, OVO, DANA, GoPay, ShopeePay, LinkAja) in Indonesian Rupiah (IDR).
• KYC and AML Compliance: Verifying your age (21+), identity, and source of funds in accordance with international anti-money-laundering and counter-terrorism financing obligations.
• Fraud Prevention and Platform Integrity: Detecting multi-accounting, bonus abuse, collusion, match-fixing involvement, and other forms of fraudulent activity that harm the platform and its Members.
• Customer Support: Responding to your queries, resolving disputes, and maintaining a complete service history for each Member.
• Responsible Gaming: Monitoring betting patterns that may indicate problem gambling behaviour and proactively communicating responsible gaming resources to at-risk Members.
• Personalisation: Tailoring bonus offers, game recommendations, and promotional content to your activity profile — for example, presenting sports promotions relevant to BRI Liga 1 fixtures or Champions League matchdays based on your betting history.
• Platform Analytics: Analysing aggregated, anonymised usage data to improve the pay77 platform experience, identify technical issues, and develop new features.
• Legal Compliance: Retaining records as required by applicable law and providing data to regulatory or law enforcement authorities where legally compelled to do so.

pay77 does not sell, rent, or trade your personal data to third-party marketers under any circumstances. We share personal data only in the limited situations described below:

6.1 Authorised Data Processors

pay77 engages third-party companies to perform specific processing functions on our behalf. All such processors are bound by written data-processing agreements that restrict their use of your data to the specific service they provide. Categories of authorised processors include:

• Payment Service Providers: Indonesian and international payment gateways that facilitate deposit and withdrawal transactions via local banks and e-wallets.
• KYC and Identity Verification Partners: Third-party providers that conduct document authenticity checks and liveness verification as part of our AML programme.
• Game Content Providers: Studio partners such as Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Pocket Games Soft, and Spribe receive session and wagering data necessary to deliver their respective games. These providers do not receive your full identity data.
• Customer Support Technology Providers: Live chat and helpdesk platforms that facilitate communication between Members and the pay77 support team.
• Cloud Infrastructure and Security Providers: Hosting, CDN, and cybersecurity services that underpin the technical operation of pay77.asia.

6.2 Legal and Regulatory Disclosures

pay77 may disclose personal data to government authorities, law enforcement bodies, financial intelligence units, or courts where required by applicable law, a valid court order, or a lawful request by a regulatory authority. In each case, pay77 will disclose only the minimum data necessary to satisfy the legal requirement and, where permitted by law, will notify the affected Member of the disclosure.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of substantially all of pay77's assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified via your registered email address before any such transfer takes effect, and the acquiring entity will be required to honour this Privacy Policy or provide you with a materially equivalent level of protection.

pay77.asia uses cookies and similar tracking technologies to operate the platform, remember your preferences, detect fraud, and analyse site performance. The categories of cookies in use are as follows:

You can manage cookie preferences through your browser settings. Clearing all cookies from pay77.asia will log you out of any active session and reset your stored preferences. Strictly necessary cookies cannot be disabled without materially impairing the platform's core functionality.

pay77 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is either securely deleted or irreversibly anonymised so that it can no longer be linked to an individual. Where deletion is not technically feasible for a specific data set (e.g., encrypted backup archives), that data will be isolated from active processing and deleted as soon as it becomes technically practicable.

pay77 implements industry-standard technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. Our key security controls include:

• Encryption in Transit: All data exchanged between your browser or app and pay77's servers is encrypted using TLS 1.3 and 256-bit SSL. The padlock icon and "https://" prefix in your browser confirm this protection is active on every page of pay77.asia.
• Encryption at Rest: Sensitive personal data — including KYC document images, financial account identifiers, and password hashes — is encrypted at rest using AES-256 encryption on pay77's cloud infrastructure.
• Access Controls: Personal data is accessible only to pay77 personnel and authorised processors who have a documented need to access it in order to perform their role. Access is governed by role-based access control (RBAC) and is subject to regular audit.
• Password Security: Member passwords are never stored in plain text. pay77 uses a salted cryptographic hashing algorithm for all password storage. We strongly recommend Members use a unique, complex password and enable any available two-factor authentication (2FA) feature.
• Intrusion Detection: pay77 operates 24/7 network monitoring and intrusion detection systems. Anomalous access patterns trigger automatic alerts and, where appropriate, temporary account locks pending review.
• Penetration Testing: pay77's platform undergoes regular third-party security assessments and penetration testing to identify and remediate vulnerabilities before they can be exploited.
• Data Breach Response: In the event of a confirmed personal data breach that creates a risk to your rights and freedoms, pay77 will notify affected Members within 72 hours of becoming aware of the breach, providing a clear description of what happened, what data was involved, and what steps have been taken to address it.

As a Member or Visitor whose personal data is processed by pay77, you hold the following rights. pay77 is committed to honouring all valid rights requests promptly and without undue restriction:

• Right of Access: You may request a copy of all personal data pay77 holds about you, together with an explanation of the purposes for which it is processed and the categories of third parties with whom it is shared.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data. For basic account details (email address, phone number, city of residence), you may update information directly through the account dashboard.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your personal data. pay77 will fulfil erasure requests where no overriding legal obligation (such as AML record-keeping requirements) requires retention. Where erasure cannot be completed in full, pay77 will inform you which categories of data must be retained and why.
• Right to Restriction of Processing: You may request that pay77 restrict processing of your personal data in circumstances where you contest its accuracy, object to its processing, or where processing is unlawful but you prefer restriction over deletion.
• Right to Data Portability: You may request a structured, machine-readable copy of personal data you have provided to pay77, suitable for transmission to another data controller.
• Right to Object: You may object at any time to processing based on legitimate interests, including profiling for personalisation purposes. You may also withdraw consent for marketing communications at any time via your account settings or by emailing [email protected].
• Rights Relating to Automated Decision-Making: Where pay77 uses automated systems to make decisions that significantly affect you (for example, automated fraud detection resulting in account restriction), you have the right to request human review of that decision.

To exercise any of the above rights, contact the pay77 Data Protection team at [email protected] with the subject line "Data Rights Request". Include your Member ID and registered email address to expedite verification. pay77 will respond to all rights requests within 30 calendar days.

pay77's platform is strictly for adults aged 21 and over. pay77 does not knowingly collect personal data from individuals under the age of 21. If you are under 21, do not access pay77.asia, do not complete the registration form, and do not submit any personal data to pay77 through any channel.

If pay77 becomes aware that personal data has been collected from an individual under the age of 21, that data will be immediately and permanently deleted, the associated account will be closed, and any deposits made will be returned to the source payment method to the extent permitted by applicable AML obligations.

If you are a parent or guardian and you believe your child has provided personal data to pay77 without your consent, please contact us immediately at [email protected]. pay77 will treat such notifications with the highest priority.

pay77.asia does not contain links to external third-party websites in its primary navigation or content areas. However, certain game content delivered by third-party studios (such as Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Pocket Games Soft, and Spribe) is rendered within the pay77 interface via embedded frames or direct integration.

While pay77 selects its game content partners carefully and requires them to maintain appropriate data protection standards, pay77 is not responsible for the privacy practices of third-party studios in respect of any data those studios collect independently through their own systems. We encourage Members to review the privacy notices of any third-party game provider whose content they play.

pay77 operates infrastructure in multiple jurisdictions to ensure platform reliability and performance for Members across Indonesia — including in Jakarta, Surabaya, Medan, Bandung, Bali, Yogyakarta, Semarang, and Makassar. As a result, personal data may be stored on and transferred to servers located outside Indonesia.

Where personal data is transferred to a jurisdiction that does not offer a level of data protection equivalent to that applicable in Indonesia, pay77 implements appropriate safeguards, which may include:

• Standard contractual clauses (SCCs) approved by recognised data protection authorities
• Data-processing agreements with receiving entities that impose obligations equivalent to those set out in this Privacy Policy
• Binding corporate rules where transfers are made within the pay77 corporate group

You may request details of the specific safeguards in place for any international transfer of your personal data by contacting [email protected].

pay77 reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, or our data processing practices. Where a material change is made, pay77 will notify all active Members via the registered email address at least 7 calendar days before the revised policy takes effect.

The "Last updated" date at the top of this document indicates when the most recent revision was made. The version of this Privacy Policy currently published at pay77.asia/privacy-policy supersedes all prior versions. Continued use of the platform after the effective date of any revision constitutes acceptance of the updated policy.

If you do not agree with the revised policy, you must cease using pay77.asia and may request account closure by contacting support. Any personal data collected prior to the revision will continue to be processed under the terms in effect at the time of collection, to the extent required by applicable law.

For all privacy-related queries, rights requests, data breach notifications, or complaints regarding pay77's data processing practices, please contact the pay77 Data Protection team through the following channels:

• Email (Data Rights): [email protected] — use the subject line "Privacy Policy Query" or "Data Rights Request" for fastest routing (response within 30 calendar days)
• Live Chat: Available 24/7 via pay77.asia — select "Account & Privacy" as the query category
• WhatsApp: +62 811 7700 777 — available 24/7; for detailed data requests, email is recommended for a complete written response

pay77 is committed to resolving all privacy-related complaints internally in the first instance. If you are not satisfied with pay77's response to your complaint, you retain the right to escalate the matter to the relevant supervisory authority in your jurisdiction.