Privacy Policy

The following terms are used throughout this Privacy Policy with the meanings assigned below:

• "Personal Data" — any information that identifies or could reasonably identify a living individual, either alone or in combination with other data. Examples include full name, email address, IP address, date of birth, and bank account details.
• "Processing" — any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, deletion, or any combination thereof.
• "Data Controller" — the entity that determines the purposes and means of processing Personal Data. For users of the pro77 Platform, pro77 is the Data Controller.
• "Data Processor" — a third-party entity that processes Personal Data on behalf of pro77, under documented instructions and appropriate data protection agreements.
• "Member" / "User" / "you" — any individual who has registered an account on the pro77 Platform or who accesses the Platform without registration.
• "Cookies" — small text files placed on your device by the Platform to facilitate session management, analytics, and personalization.
• "KYC Data" — identity verification documents submitted in connection with the know-your-customer process described in the pro77 Terms and Conditions.

Pro77 operates as the Data Controller for all Personal Data collected through the pro77 Platform. The Platform is owned and operated by pro77's internationally licensed operating entity. For all privacy-related inquiries, requests, and complaints, please contact our designated Data Protection Officer (DPO) using the contact details provided in Section 16 of this policy.

Pro77 processes Personal Data in accordance with its international operating license obligations and in a manner consistent with internationally recognized data protection principles, including purpose limitation, data minimization, storage limitation, integrity, and confidentiality.

Pro77 collects only the Personal Data that is necessary for the purposes described in this policy. The categories of Personal Data we collect are summarized in the table below:

Pro77 collects Personal Data through the following channels and mechanisms:

• Direct Submission: Data you actively provide when registering an account, completing a deposit or withdrawal form, submitting KYC documents, contacting support, or opting into a promotional offer.
• Automated Technical Collection: Data collected automatically when you access the Platform, including IP address, browser fingerprint, device identifiers, cookie data, and session activity logs. This collection occurs regardless of whether you are logged in.
• Payment Providers: When you make a deposit or request a withdrawal via a local bank (BCA, BRI, BNI, Mandiri, CIMB Niaga) or e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja), the payment provider confirms transaction status and, where required for fraud prevention, shares limited transaction metadata with pro77.
• Identity Verification Partners: Where pro77 uses a third-party identity verification service to cross-check KYC documents, that service may return a verification result and confidence score to pro77. Raw document images are not retained by the verification partner beyond their own stated retention periods.
• Third-Party Analytics Tools: Pro77 uses privacy-respecting analytics tools to understand aggregate usage patterns. These tools are configured to anonymize IP addresses and do not build individual user profiles for advertising purposes.
• Affiliate and Referral Partners: If you arrive at pro77 via an affiliate link, the affiliate partner may share a referral code or click identifier with pro77 for the purpose of crediting the referral. Pro77 does not receive your personal data from affiliate partners beyond this identifier.

Pro77 processes your Personal Data only where a valid legal basis exists. The legal bases on which we rely are:

• Contractual Necessity: Processing that is necessary to perform the contract between you and pro77 — i.e., the Terms and Conditions you accepted at registration. This covers account creation, deposit processing, bet settlement, withdrawal execution, and customer support delivery.
• Legal Obligation: Processing required to comply with applicable legal and regulatory obligations, including anti-money laundering (AML) laws, know-your-customer (KYC) requirements, fraud prevention obligations, and data retention mandates imposed by our operating license.
• Legitimate Interests: Processing necessary for pro77's legitimate business interests, provided those interests are not overridden by your rights and freedoms. Examples include fraud detection, platform security monitoring, abuse prevention, and aggregate analytics for product improvement.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent. This applies primarily to direct marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing, by contacting support at [email protected] or adjusting your account notification preferences.

The Personal Data pro77 collects is used for the following specific purposes:

• Account Management: Creating and maintaining your Member account, authenticating your identity at login, processing password resets, and delivering account-related notifications.
• Payment Processing: Facilitating IDR deposits via BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, and LinkAja; verifying payment ownership; processing withdrawal requests to your registered account.
• Regulatory Compliance: Conducting KYC checks, performing AML transaction monitoring, maintaining mandatory records for our international operating license, and responding to lawful information requests from competent authorities.
• Fraud and Security: Detecting and investigating suspicious account activity, unauthorized access attempts, multi-accounting, bonus abuse, and payment fraud. Automated risk-scoring systems may flag accounts for manual review based on behavioral signals.
• Customer Support: Responding to your inquiries, resolving disputes, processing complaints, and providing Indonesian-speaking agent support 24/7.
• Responsible Gaming: Monitoring usage patterns to identify signs of problematic gambling behavior; delivering self-imposed limit reminders, reality checks, and cooling-off notifications; processing self-exclusion requests.
• Platform Personalization: Tailoring the game lobby, promotional offers, and content recommendations to your stated preferences and betting history, where you have not opted out of personalization.
• Marketing Communications: Sending promotional emails, SMS notifications, and in-platform messages about bonuses, new game launches, and seasonal promotions — only where you have provided explicit consent and have not subsequently opted out.
• Product Development and Analytics: Analyzing aggregated, anonymized usage data to improve platform performance, identify high-demand features, and guide investment in new product categories.

Pro77 does not sell, rent, or trade your Personal Data to third parties for their own commercial purposes. Personal Data is shared with external parties only in the following limited circumstances:

• Payment Processors: Local bank networks (BCA, BRI, BNI, Mandiri, CIMB Niaga) and e-wallet platforms (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the minimum transaction data necessary to process your deposits and withdrawals. These entities are independently regulated financial institutions operating under their own privacy frameworks.
• Identity Verification Providers: Third-party KYC service providers receive KYC document images and personal identity data solely for the purpose of identity verification. These providers are bound by data processing agreements that restrict secondary use of your data.
• Game Content Providers: When you play a game from a third-party studio (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Pocket Games Soft, or Spribe), a pseudonymous player identifier and session token — but not your full personal identity — is transmitted to that studio's game server to facilitate gameplay. Game studios do not receive your full name, contact details, or financial data.
• Cloud Infrastructure and Hosting Providers: Pro77's platform is hosted on secure third-party cloud infrastructure. Infrastructure providers may have logical access to encrypted data as part of normal hosting operations and are bound by data processing agreements.
• Analytics Service Providers: Anonymized, aggregated platform usage data is processed by analytics tools. No individually identifiable data is shared with analytics providers.
• Legal and Regulatory Authorities: Pro77 will disclose Personal Data to law enforcement agencies, financial regulators, or other competent authorities when required to do so by law, court order, or our operating license obligations. Where legally permissible, we will notify you of such a disclosure.
• Business Transfers: In the event of a merger, acquisition, or sale of pro77's business assets, your Personal Data may be transferred to the acquiring entity as part of that transaction, subject to equivalent privacy protections being maintained.

Pro77 uses cookies and similar tracking technologies to operate the Platform effectively, maintain your authenticated session, and understand how Members interact with the site. The categories of cookies used are as follows:

You can manage cookie preferences through your browser settings at any time. Note that disabling strictly necessary cookies will prevent you from logging into the Platform. Pro77 does not use third-party advertising cookies or cross-site behavioral tracking cookies.

Pro77 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply:

• Active Account Data: Retained for the lifetime of your active pro77 account, plus a minimum of 5 years following account closure — in accordance with AML and KYC record-keeping requirements under our international operating license.
• KYC Documents: Retained for a minimum of 5 years from the date of submission, or 5 years from account closure — whichever is later. Retained in encrypted form, accessible only to authorized compliance personnel.
• Financial Transaction Records: Retained for a minimum of 5 years from the date of each transaction, in line with AML regulatory obligations.
• Customer Support Communications: Retained for 3 years from the date of the last interaction, for quality assurance and dispute resolution purposes.
• Technical and Log Data: Server access logs and security event logs are retained for 12 months. Aggregated, anonymized analytics data may be retained indefinitely.
• Marketing Consent Records: Records of your marketing consent and any subsequent opt-out are retained for the duration of your account plus 3 years, to demonstrate compliance with consent obligations.

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymized. Physical KYC document copies (if any) are destroyed using certified secure shredding processes.

Pro77 implements a multi-layered security architecture designed to protect your Personal Data against unauthorized access, disclosure, alteration, and destruction. Key security measures include:

• Transport Layer Security (TLS 1.3): All data in transit between your browser and pro77's servers is encrypted using TLS 1.3, the current industry gold standard for transport encryption. Connections using deprecated protocols (TLS 1.0, TLS 1.1, SSL) are rejected.
• 256-Bit AES Encryption at Rest: Personal Data and KYC documents stored on pro77's servers are encrypted at rest using AES-256. Encryption keys are managed separately from the encrypted data and rotated on a regular schedule.
• Access Controls: Access to Personal Data is restricted to pro77 personnel whose role requires it. All internal access is logged, role-based, and subject to periodic access review. Privileged access to production systems requires multi-factor authentication.
• Penetration Testing: Pro77's platform undergoes regular penetration testing by independent cybersecurity professionals. Critical vulnerabilities identified during testing are remediated within defined SLA windows before being publicly disclosed.
• Intrusion Detection and Monitoring: Automated systems monitor platform traffic and server activity 24/7 for anomalous patterns indicative of unauthorized access or data exfiltration attempts.
• Incident Response Plan: Pro77 maintains a documented data breach incident response plan. In the event of a confirmed breach affecting your Personal Data, pro77 will notify affected Members and relevant authorities within the timeframes required by applicable law.

As a data subject, you hold the following rights with respect to your Personal Data held by pro77. These rights are subject to applicable legal limitations and our regulatory obligations (for example, we cannot delete transaction records that we are legally required to retain).

To exercise any of the above rights, please submit a written request to [email protected] with the subject line "Data Rights Request — [Right Type]" and include your pro77 username and a brief description of your request. Pro77 will acknowledge your request within 5 business days and aim to fulfill it within 30 calendar days, subject to identity verification and applicable legal constraints.

The pro77 Platform is strictly restricted to individuals aged 21 and over. Pro77 does not knowingly collect Personal Data from individuals under the age of 21. If pro77 discovers that Personal Data has been collected from an individual who is under 21, that account will be immediately suspended, all associated data will be securely deleted (to the extent not required for fraud investigation purposes), and any funds held in the account will be processed in accordance with our underage gambling policy.

If you are a parent or guardian and you believe that a minor in your care has registered a pro77 account, please contact us immediately at [email protected]. We will investigate and act on verified reports within 2 business days. Adults only — 21+ strictly enforced on all pro77 products.

Pro77 operates internationally, and your Personal Data may be processed in countries outside Indonesia. Where Personal Data is transferred to a country that does not provide an equivalent level of data protection to your home jurisdiction, pro77 implements appropriate safeguards to ensure your data remains protected, including:

• Standard Contractual Clauses (SCCs): Legally binding contractual terms between pro77 and the receiving entity that require the recipient to protect your data to a standard equivalent to that applied within Indonesia or the EU, as applicable.
• Data Processing Agreements: All third-party Data Processors that handle your Personal Data on pro77's behalf are required to sign a Data Processing Agreement that sets out their obligations regarding data security, confidentiality, and use limitations.
• Adequacy Assessments: Before transferring data to a new jurisdiction, pro77's compliance team conducts a transfer impact assessment to evaluate the legal environment in the destination country and determine whether additional safeguards are required.

By using the pro77 Platform, you acknowledge that your Personal Data may be transferred to and processed in countries outside Indonesia where privacy laws may differ. Pro77 takes all reasonable steps to ensure that such transfers are conducted securely and lawfully.

The pro77 Platform does not contain links to external third-party websites for general browsing purposes. All navigation within the Platform leads to internal pro77 pages. However, certain integrated services — such as third-party game studios' game clients rendered within the Platform — operate under the respective studio's own privacy framework with respect to anonymized in-game session data.

Pro77 is not responsible for the privacy practices of third-party game studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Pocket Games Soft, Spribe, or others) with respect to data they collect independently through their game clients. We recommend reviewing the privacy policy of any third-party service provider whose products you use directly. Pro77's Data Controller obligations extend only to data processed under pro77's direct control.

Pro77 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, changes to applicable law or regulatory requirements, or the introduction of new platform features that involve the collection of new categories of Personal Data.

• The "Last Updated" date at the top of this page will be revised whenever a substantive change is made.
• Where amendments are material — for example, where we introduce a new processing purpose or share data with a new category of third party — pro77 will notify registered Members by email at least 14 days before the change takes effect.
• For minor amendments (such as clarifications of existing language that do not change the substance of our commitments), the updated policy will be posted without advance individual notification.
• Your continued use of the Platform after the effective date of any amendment constitutes your acknowledgment of the updated policy. If you do not accept the revised terms, you must close your account before the effective date.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to raise a privacy concern or complaint, please contact pro77's Data Protection Officer through the following channel:

Pro77 is committed to resolving all privacy concerns fairly and transparently. If you are dissatisfied with the outcome of a privacy inquiry, you may escalate the matter by marking your follow-up email with the subject line "Privacy Escalation — [Your pro77 Username]".