Privacy Policy
rrr77 — How We Handle Your Data

In this Privacy Policy, the following terms have the meanings set out below unless the context requires otherwise:

2.1 rrr77 collects the following categories of Personal Data in the course of providing its platform and services:

2.2 rrr77 does not collect or process special categories of sensitive Personal Data such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data beyond what is strictly required for identity verification (facial image on KTP and selfie verification).

rrr77 collects Personal Data through the following methods:

• Direct submission: Information you provide when creating an account, completing KYC verification, initiating deposits or withdrawals, setting responsible gaming limits, or contacting our support team.
• Automated technical collection: Data automatically generated when you access or use the rrr77 platform, including server logs recording your IP address, browser characteristics, device identifiers, and session activity.
• Cookies and similar technologies: First-party cookies and session tokens placed on your device to maintain login state, remember preferences, and support platform analytics. See Section 7 for full details.
• Payment processors: Transaction confirmation data, payment status updates, and fraud screening results returned by our payment processing partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, OVO, DANA, GoPay, ShopeePay) when you initiate a financial transaction.
• KYC and identity verification services: Document authenticity checks and database screening results returned by third-party KYC service providers engaged by rrr77 to verify member identity and screen against sanctions and watchlists.
• Fraud detection tools: Risk scores and device reputation data from fraud prevention services used to protect the platform from unauthorized access and financial crime.

rrr77 processes your Personal Data strictly for the following defined purposes:

rrr77 processes your Personal Data on one or more of the following lawful bases:

• Contractual necessity: Processing required to fulfill our obligations under the rrr77 Terms & Conditions — including account creation, payment processing, and game delivery — is necessary to provide you with the services you have requested.
• Legal obligation: Processing required to comply with applicable laws, licensing conditions, AML regulations, and regulatory instructions from competent authorities.
• Legitimate interests: Processing conducted to protect the security and integrity of the rrr77 platform, prevent fraud, improve our services, and communicate important operational updates — where these interests are not overridden by your fundamental rights and freedoms.
• Consent: Where we rely on your consent as the legal basis for processing (e.g., for non-essential marketing communications or non-essential cookies), you may withdraw that consent at any time by contacting support or updating your account communication preferences. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

6.1 rrr77 does not sell, rent, or trade your Personal Data. We share your data with third parties only in the following defined circumstances:

• Payment service providers: Your financial account details and transaction information are shared with the relevant Indonesian bank (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP) or e-wallet operator (OVO, DANA, GoPay, ShopeePay) to process your requested deposit or withdrawal. These providers act as independent data controllers for their own services and are governed by their own privacy policies.
• KYC and identity verification providers: Your identity documents and personal details are shared with certified third-party KYC verification services to authenticate your identity and screen against applicable watchlists. These providers are contractually bound to process your data only for the purpose of fulfilling rrr77's verification requests.
• Fraud prevention and risk management services: Technical and behavioral data (device fingerprint, IP address, usage patterns) may be shared with fraud detection platforms to identify and prevent unauthorized access and financial crime.
• Cloud infrastructure and hosting providers: rrr77's platform data is stored on servers managed by enterprise cloud infrastructure providers. These providers are engaged under data processing agreements and may not use Member data for any purpose other than providing hosting services to rrr77.
• Regulatory and law enforcement authorities: rrr77 may be required by applicable law, court order, or regulatory instruction to disclose Member data to competent authorities. Such disclosures are made only to the extent legally required.
• Professional advisors: Legal counsel, auditors, and compliance consultants who require access to Member data to provide professional services to rrr77 are bound by confidentiality obligations.

6.2 All third-party Data Processors engaged by rrr77 are required to implement appropriate technical and organizational security measures and are contractually prohibited from processing Member data for their own commercial purposes.

7.1 Types of Cookies Used. rrr77 uses the following categories of cookies on the platform:

• Strictly necessary cookies: Essential to the operation of the platform — they maintain your login session, remember your language preference, and enable core security functions. These cookies cannot be disabled without preventing you from using the platform.
• Functional cookies: Remember your account preferences (e.g., preferred betting view, odds format) to provide a personalized experience on return visits.
• Analytics cookies: Collect aggregated, anonymized data about how Members use the platform — pages visited, time spent, features used — to help rrr77 identify usability improvements and technical issues.
• Security cookies: Used to detect and prevent fraudulent login attempts, session hijacking, and other security threats.

7.2 Managing Cookies. You may configure your browser to block or delete cookies at any time through your browser settings. Be aware that blocking strictly necessary cookies will impair your ability to use the rrr77 platform, as session authentication requires these cookies to function.

7.3 No Third-Party Advertising Cookies. rrr77 does not place third-party advertising cookies or allow advertising networks to place tracking cookies on the rrr77 platform. We do not use behavioral advertising targeting.

7.4 Local Storage. In addition to cookies, rrr77 may use browser local storage to preserve session state and performance preferences. Local storage data is managed through the same principles as cookies and can be cleared through your browser settings.

8.1 rrr77 retains your Personal Data only for as long as necessary to fulfill the purpose for which it was collected, or as required by applicable legal, regulatory, or licensing obligations. The following general retention periods apply:

• Active account data: Retained for the lifetime of your rrr77 account and for a period of five (5) years following permanent account closure.
• Transaction and financial records: Retained for a minimum of five (5) years following each transaction, in compliance with applicable AML record-keeping requirements.
• KYC documents: Retained for five (5) years following account closure or the date of the last transaction, whichever is later.
• Support communications: Retained for three (3) years from the date of the last interaction, for quality assurance and dispute resolution purposes.
• Marketing consent records: Retained for the duration of your membership and for two (2) years following account closure, to demonstrate the lawfulness of any marketing communications sent.
• Technical and usage logs: Retained for up to twelve (12) months from generation, after which they are aggregated and anonymized.

8.2 Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymized using industry-standard data destruction methods.

9.1 Technical Safeguards. rrr77 implements the following technical security measures to protect your Personal Data:

• 256-bit SSL/TLS encryption for all data in transit between your device and rrr77 servers.
• Encryption-at-rest for all databases containing Personal Data and financial records.
• Multi-factor authentication (MFA) options for Member account access.
• Automated intrusion detection and prevention systems monitoring for unauthorized access attempts.
• Regular penetration testing and vulnerability assessments conducted by independent security specialists.
• Strict role-based access controls limiting rrr77 staff access to Personal Data to only those with a documented operational need.

9.2 Organizational Safeguards. rrr77 maintains the following organizational security practices:

• All staff with access to Personal Data are subject to confidentiality agreements and receive regular data protection training.
• A documented data breach response procedure is maintained and tested periodically. In the event of a data breach affecting your Personal Data, rrr77 will notify affected Members and relevant authorities in accordance with applicable legal requirements.
• Third-party Data Processors are subject to due diligence assessments before engagement and are required to maintain equivalent security standards to rrr77 under binding contractual terms.

9.3 Your Responsibility. The security of your rrr77 account also depends on the strength and confidentiality of your password. rrr77 strongly recommends using a unique, complex password that is not reused on any other service. Never share your login credentials with any other person. rrr77 staff will never ask for your password.

As an rrr77 Member, you hold the following rights with respect to your Personal Data. To exercise any of these rights, submit a written request to [email protected]. rrr77 will respond within thirty (30) calendar days of receiving a valid, verifiable request.

11.1 The rrr77 platform is strictly intended for adults aged 21 years and older. rrr77 does not knowingly collect, process, or store Personal Data belonging to individuals under the age of 21.

11.2 Our mandatory KYC identity verification process — which requires submission of a government-issued photo ID — serves as the primary mechanism for preventing minors from registering. Any account found during routine checks or investigation to belong to a person under 21 years of age will be closed immediately, all associated data will be retained only as required by legal obligation, and the matter may be referred to appropriate authorities.

11.3 If you are a parent or guardian and have reason to believe that a minor under your supervision has registered an account on rrr77 or submitted Personal Data to the platform, please contact us immediately at [email protected] with the subject line "UNDERAGE ACCOUNT" and we will investigate and take appropriate action without delay.

12.1 rrr77's platform infrastructure and some of its third-party service providers are located outside Indonesia. As a result, your Personal Data may be transferred to and processed in countries other than your country of residence. Where such transfers occur, rrr77 ensures that appropriate safeguards are in place to protect your data, including:

• Transfers only to countries or jurisdictions recognized as providing an adequate level of data protection;
• Use of binding contractual clauses that require receiving parties to protect your Personal Data to standards equivalent to those applied by rrr77; or
• Other lawful transfer mechanisms as recognized by applicable data protection law.

12.2 By using the rrr77 platform and submitting your Personal Data, you acknowledge that your data may be transferred internationally under the safeguards described above. If you have questions about the safeguards applicable to a specific international transfer, contact [email protected].

13.1 rrr77 reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, platform functionality, or our data processing practices. The effective date at the top of this document indicates when the current version came into force.

13.2 Where a material change is made to this Privacy Policy, rrr77 will notify registered Members by email to their registered address and/or by displaying a prominent notice on the platform, at least seven (7) calendar days before the updated policy takes effect — except where a shorter notice period is required for urgent legal or security reasons.

13.3 Continued use of the rrr77 platform after the effective date of any updated Privacy Policy constitutes your acknowledgment of the changes. If you do not agree with any changes, you must cease using the platform and may request account closure before the updated policy takes effect.

13.4 Previous versions of this Privacy Policy are available upon request by contacting [email protected].

For all privacy-related inquiries, data rights requests, or concerns regarding rrr77's handling of your Personal Data, please contact us using the details below. All privacy correspondence is handled by our dedicated compliance team.

This Privacy Policy was last reviewed and updated on January 1, 2026. The current version supersedes all previous versions of the rrr77 Privacy Policy. We encourage all Members to review this page periodically to remain informed about how their Personal Data is being handled.