Privacy Policy — 77raja Platform

This Privacy Policy describes how 77raja ("we", "us", "our", "the Platform") collects, uses, stores, and protects personal information provided by or collected from users ("you", "your") of the 77raja website accessible at https://77raja.cam and all associated services.

77raja operates an online betting and gaming platform built specifically for the Indonesian market. Our primary user base consists of adult residents of Indonesia aged 21 and over. In operating this platform, we necessarily collect personal data to deliver our services, verify user identity, process financial transactions, comply with legal obligations, and maintain the security and integrity of the platform.

This policy is written in English and governs data processing activities across all markets in which 77raja operates. Where local data protection laws impose additional requirements on how we handle your data, we comply with those requirements in addition to the baseline standards set out here.

77raja is the data controller responsible for the personal data collected through this platform. As data controller, 77raja determines the purposes for which and the means by which your personal data is processed.

Where we engage third-party service providers to process data on our behalf — such as payment processors, identity verification services, or cloud infrastructure providers — those parties act as data processors under our instruction and are bound by data processing agreements that require them to apply security and confidentiality standards equivalent to our own.

The categories of personal data 77raja collects are described in the table below. We collect only what is necessary for the identified purposes.

Special categories: 77raja does not intentionally collect special category personal data (such as health, religious, or political data) and requests that users do not submit such information through any platform channel.

We collect personal data through the following means:

• Direct submission: Information you actively provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting support, or updating your profile settings.
• Automated collection: Technical data automatically gathered when you access the platform, including IP address, device identifiers, browser information, and session activity logs. This data is collected through server logs and, where applicable, cookies and similar technologies.
• Third-party sources: Identity verification and fraud-prevention services may supplement the information you provide with data from external databases to verify your identity and assess risk. Payment processing partners transmit transaction confirmation data to us when you complete a deposit or withdrawal.
• Support interactions: Correspondence you initiate via live chat, email, or WhatsApp (where applicable) is logged and retained as communications data.

77raja processes personal data for the following purposes, each supported by the identified legal basis:

77raja does not sell, lease, or trade your personal information to third parties for their independent commercial use. We share personal data only in the following controlled circumstances:

• Payment processors: To facilitate IDR deposits and withdrawals through BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI, OVO, DANA, GoPay, ShopeePay, and LinkAja, we share the minimum necessary transaction and identity data with the relevant payment gateway or banking partner.
• Identity verification providers: Third-party KYC service providers may receive your identity documents and biographical data to perform automated or manual verification checks. These providers are contractually prohibited from using your data for any purpose other than providing verification services to 77raja.
• Cloud infrastructure and hosting: 77raja uses third-party cloud service providers for data storage and platform hosting. These providers operate under data processing agreements and do not have independent access to your data for any purpose.
• Fraud and risk management: Shared databases used by the online gaming industry to identify fraudulent account patterns, bonus abuse, or money laundering may receive limited identifiers to perform cross-platform risk checks.
• Legal and regulatory obligations: We will disclose personal data to law enforcement, regulatory authorities, or courts when required to do so by applicable law, a valid legal order, or where we believe disclosure is necessary to prevent imminent harm or financial crime.
• Business transfers: In the event of a merger, acquisition, or sale of assets, personal data held by 77raja may be transferred to the successor entity, subject to that entity maintaining equivalent privacy protections. Users will be notified of any material change in data controller identity.

77raja operates internationally. Your personal data may be transferred to, and processed in, countries outside Indonesia where 77raja's servers, service providers, or affiliated entities are located. Where such transfers occur, 77raja takes steps to ensure that an adequate level of data protection is applied, including:

• Executing data processing agreements with contractual obligations equivalent to applicable data protection standards.
• Assessing the legal frameworks of recipient countries and applying additional technical or contractual safeguards where necessary.
• Restricting access to transferred data to personnel and systems that genuinely require it to perform their designated function.

By using 77raja, you acknowledge and consent to your personal data being processed outside Indonesia under the conditions described in this section.

We retain personal data for as long as your account is active and for as long as necessary to fulfil the purposes for which it was collected, unless a longer retention period is required by law.

• Active account data: Retained for the duration of your account's existence plus a post-closure period of no less than five (5) years to satisfy financial record-keeping, AML, and audit requirements.
• KYC and identity documents: Retained for a minimum of five (5) years from the date of verification, in line with applicable anti-money laundering regulations.
• Transaction records: Retained for a minimum of five (5) years from each transaction date.
• Support communications: Retained for two (2) years from the date of the last communication in a given thread, unless the subject matter is linked to an ongoing compliance investigation.
• Marketing preferences: Retained until you withdraw your consent or request deletion.
• Anonymised and aggregated analytics: May be retained indefinitely as they no longer constitute personal data.

Once the applicable retention period expires, personal data is securely deleted or anonymised so that it can no longer be associated with any individual.

77raja implements a multi-layered security architecture to protect your personal data against unauthorised access, accidental loss, disclosure, alteration, or destruction:

• Transport encryption: All data transmitted between your device and our platform is encrypted using TLS 1.2 or higher (256-bit SSL). Connections over unencrypted HTTP are automatically redirected to HTTPS.
• Data-at-rest encryption: Sensitive personal data stored in our databases is encrypted using industry-standard algorithms. Encryption keys are managed separately from the encrypted data.
• Access controls: Access to personal data is restricted on a strict need-to-know basis. Internal systems enforce role-based access controls, and all privileged access is logged and audited.
• Two-factor authentication: Available for all user accounts and mandatory for internal administrative access to systems holding personal data.
• Penetration testing: The platform undergoes regular third-party security assessments to identify and remediate vulnerabilities before they can be exploited.
• Incident response: 77raja maintains a documented incident response plan. In the event of a data breach involving personal data, affected users and relevant authorities will be notified promptly in accordance with applicable law.

77raja uses cookies and similar technologies to ensure the platform functions correctly, to remember your preferences, and to analyse platform usage patterns.

• Strictly necessary cookies: Essential for platform operation — session management, authentication, and security tokens. These cannot be disabled without disrupting core functionality.
• Preference cookies: Remember your settings and preferences (such as language and display options) to personalise your experience across sessions.
• Analytics cookies: Collect anonymised data about how users navigate the platform to help us identify areas for improvement. Data is aggregated and not linked to individual identities.
• Marketing cookies: Used to track the effectiveness of our own promotional campaigns. We do not use third-party advertising cookies for cross-site tracking of 77raja users.

You can manage cookie preferences through your browser settings. Disabling strictly necessary cookies will impair your ability to use the platform. Disabling analytics or preference cookies will not prevent you from accessing the platform but may affect your experience.

Depending on your jurisdiction and the applicable data protection framework, you may hold some or all of the following rights in relation to your personal data held by 77raja:

To exercise any of the above rights, submit a written request to [email protected] with the subject line "Data Rights Request". We will acknowledge your request within 48 hours and provide a substantive response within 30 calendar days. We may ask you to verify your identity before fulfilling any data request.

77raja strictly prohibits use of the platform by individuals under the age of 21. We do not knowingly collect personal data from minors. Our registration and KYC processes are designed to identify and exclude underage users.

If we become aware that an account belongs to a person under 21, we will immediately suspend the account, void all associated bets, return any real-money deposits (net of any amounts already withdrawn), and delete all personal data associated with that account in excess of what is required for record-keeping and compliance purposes.

If you believe that a minor has registered on 77raja, please contact us immediately at [email protected]. We will investigate and take action within 24 hours of a credible report.

77raja may update this Privacy Policy periodically to reflect changes in our data practices, applicable law, or the services we offer. The Effective Date at the top of this document will be updated whenever a new version is published.

Where a change is material — for example, a new category of data collection, a change in the purposes for which data is used, or a change in data-sharing arrangements — we will provide advance notice via email or an in-platform notification at least 14 days before the change takes effect. Your continued use of 77raja after the updated Effective Date constitutes acceptance of the revised policy.

We encourage you to review this page periodically to stay informed about how 77raja protects your personal information.

For any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data by 77raja, please contact us through the following channels:

• Email: [email protected] — mark your subject line "Privacy Policy Enquiry" or "Data Rights Request" for prioritised handling.
• Live Chat: Available via the 77raja platform after login. Indonesian-speaking agents available during WIB business hours; English support available 24/7.
• Response times: Data protection enquiries by email will receive an acknowledgement within 48 hours and a substantive response within 30 calendar days. Complex requests may take up to 60 days where permitted by applicable law, with notification sent to you before the initial 30-day period expires.