Privacy Policy — pop77

pop77 ("we", "us", "our") operates the online betting and casino platform accessible at https://pop77.cam (the "Platform"). We are committed to safeguarding the privacy and personal data of all individuals who interact with the Platform, including registered account holders, prospective players, and general visitors.

This Privacy Policy sets out the basis on which we collect, use, store, share, and otherwise process personal data in connection with the Platform and our business operations. It has been drafted in accordance with internationally recognised data protection principles and is intended to be transparent, accessible, and easy to understand.

This policy applies specifically in the context of Indonesian players and residents. pop77 serves the Indonesian market and processes data in accordance with applicable international data protection standards. Where Indonesian law or regulation imposes specific requirements, we comply with those requirements in addition to the general principles stated here.

This Privacy Policy should be read alongside pop77's Terms & Conditions, which govern your use of the Platform more broadly.

The following definitions apply throughout this Privacy Policy:

• "Personal Data" means any information relating to an identified or identifiable natural person — i.e., information that can be used, directly or indirectly, to identify you.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, and deletion.
• "Data Controller" means pop77, the entity that determines the purposes and means of processing your Personal Data.
• "Data Processor" means a third party that processes Personal Data on behalf of pop77 under a contractual arrangement — for example, our payment gateway partners or cloud hosting provider.
• "KYC" means Know Your Customer — the identity verification process required before you may withdraw funds from your pop77 account.
• "Cookies" means small text files stored on your device by your browser when you visit the Platform.
• "You" / "Player" means any natural person who accesses or uses the Platform, whether registered or not.
• "IDR" means Indonesian Rupiah, the currency in which pop77 accounts are denominated.

pop77 collects the following categories of Personal Data in the course of providing our services:

We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data except where expressly required for identity verification purposes (e.g., a photograph embedded in a government-issued ID document submitted for KYC).

pop77 collects Personal Data through the following channels:

• Direct Submission: Data you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting our support team, or responding to a promotion.
• Automated Technologies: Data collected automatically when you access the Platform, including via cookies, web beacons, server logs, and similar tracking technologies. This includes your IP address, device identifiers, and session behaviour.
• Payment Processors: Confirmation data returned by our payment gateway partners (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja) when a transaction is initiated or completed. We do not receive or store full bank account credentials — only the masked identifiers required to process and reconcile transactions.
• Identity Verification Partners: During enhanced KYC checks, we may use a third-party identity verification service that compares your submitted documents against authoritative databases. That service returns a verification result to pop77; we do not receive raw data from external databases.
• Third-Party Analytics: Anonymised, aggregated usage data from analytics tools we use to understand how players interact with the Platform. This data cannot be used to identify you individually.

pop77 processes your Personal Data only where we have a valid legal basis to do so. The primary legal bases on which we rely are as follows:

• Contractual Necessity: Processing that is necessary to open and operate your account, accept and settle bets, process deposits and withdrawals in IDR, and provide customer support. Without this processing, we cannot deliver our services to you.
• Legal Obligation: Processing required to comply with applicable anti-money-laundering (AML) regulations, counter-terrorism-financing (CTF) obligations, KYC verification requirements, and responses to lawful requests from regulatory or law enforcement authorities.
• Legitimate Interests: Processing conducted in pursuit of pop77's legitimate business interests where those interests are not overridden by your privacy rights — including fraud detection, platform security, abuse prevention, responsible gaming monitoring, and internal analytics to improve our services.
• Consent: Where we send you optional marketing communications (e.g., promotional emails about new bonuses or seasonal offers), we do so on the basis of your freely given consent. You may withdraw this consent at any time by updating your notification preferences in your account dashboard or by contacting our support team.

pop77 does not make automated decisions that produce significant legal effects solely based on profiling, except where explicitly required by our fraud-prevention obligations. In any such case, you have the right to request human review of the decision.

pop77 does not sell your Personal Data. We share your data only in the following limited circumstances:

• Payment Service Providers: We share the minimum necessary financial and identity data with our local payment partners — including banks (BCA, BRI, BNI, Mandiri, CIMB Niaga) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) — solely to process your deposit and withdrawal transactions.
• Identity Verification Services: During KYC, we may transmit your identity documents to a third-party verification provider. That provider is bound by strict data processing agreements and may not use your data for any purpose other than returning a verification result to pop77.
• Technology Infrastructure Providers: Our hosting, cloud storage, and security infrastructure partners may process your data on pop77's behalf. All such providers are engaged under data processing agreements that restrict their use of your data to the services they provide to pop77.
• Game Content Providers: Third-party game studios — such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft — receive anonymised session identifiers to deliver game content and track RNG outcomes. They do not receive your name, contact details, or financial data.
• Regulatory & Law Enforcement Authorities: We will disclose Personal Data to government agencies, regulators, or law enforcement bodies when required to do so by law, court order, or regulatory direction, or where we believe disclosure is necessary to protect the rights, safety, or property of pop77 or others.
• Business Transfers: In the event of a merger, acquisition, restructuring, or sale of all or part of pop77's business, your Personal Data may be transferred to the acquiring entity. You will be notified by email if your data becomes subject to a materially different privacy policy as a result of such a transaction.

pop77 retains your Personal Data for no longer than is necessary to fulfil the purpose for which it was collected, subject to any overriding legal or regulatory retention obligations. Our standard retention periods are as follows:

After the applicable retention period expires, Personal Data is securely deleted or anonymised so that it can no longer be linked to any identifiable individual. Anonymised aggregate data may be retained indefinitely for analytical purposes.

pop77 implements a comprehensive set of technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, alteration, or disclosure. Our security framework includes:

• Encryption in Transit: All data transmitted between your device and pop77's servers is encrypted using TLS 1.2 or higher (256-bit encryption). Our platform is served exclusively over HTTPS.
• Encryption at Rest: Sensitive Personal Data — including identity documents and financial records — is encrypted at rest using AES-256 encryption in our database infrastructure.
• Access Controls: Access to Personal Data is restricted on a strict need-to-know basis. All pop77 staff with access to Personal Data are subject to confidentiality obligations, and access rights are reviewed regularly.
• Two-Factor Authentication: Pop77 supports two-factor authentication (2FA) for player accounts. We strongly recommend enabling 2FA in your account security settings to protect against unauthorised login attempts.
• Penetration Testing and Audits: Our platform undergoes regular independent security audits and penetration testing to identify and remediate potential vulnerabilities before they can be exploited.
• Incident Response: In the event of a data breach that poses a risk to your rights and freedoms, pop77 will notify affected Players as promptly as practicable and take all reasonable steps to contain and remediate the breach.

While we employ robust security measures, no system can guarantee absolute security. You also have a role in keeping your account secure — please use a strong, unique password, enable 2FA, and never share your login credentials with anyone.

pop77 uses cookies and similar technologies to ensure the Platform functions correctly and to understand how players use it. The types of cookies we use are:

• Strictly Necessary Cookies: These are essential for the Platform to operate. They maintain your login session, remember your security settings, and ensure pages load correctly. These cookies cannot be disabled without breaking core Platform functionality.
• Functional Cookies: These remember your preferences — such as language settings and responsible gaming tool configurations — so you do not have to re-enter them on every visit.
• Analytics Cookies: We use anonymised analytics tools to understand aggregate traffic patterns, page performance, and feature usage. The data generated is not linked to any individual Player and is used solely to improve the Platform experience.

pop77 does not use third-party advertising cookies, retargeting pixels, or social media tracking scripts. You will not be profiled across other websites based on your pop77 activity.

You can manage or delete cookies at any time through your browser settings. Please note that disabling strictly necessary cookies may prevent certain parts of the Platform from functioning as intended. For instructions on managing cookies in your specific browser, refer to your browser's help documentation.

Subject to applicable law, you have the following rights in relation to the Personal Data pop77 holds about you:

• Right of Access: You may request a copy of the Personal Data we hold about you. We will provide this within 30 days of a verified request, free of charge for the first request in any 12-month period.
• Right to Rectification: If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request that we correct it. You can update basic account details (email address, contact number, residential address) directly from your account dashboard.
• Right to Erasure: You may request that we delete your Personal Data in circumstances where it is no longer necessary for the purpose for which it was collected, or where you withdraw consent and no other legal basis applies. Note that we may be required to retain certain data for AML, KYC, or legal compliance purposes even following an erasure request.
• Right to Restrict Processing: You may request that we restrict the processing of your Personal Data in certain circumstances — for example, while we are verifying the accuracy of data you have contested.
• Right to Object: You have the right to object to processing based on our legitimate interests where you believe your privacy rights override those interests. You also have an unconditional right to object to processing for direct marketing purposes.
• Right to Data Portability: Where processing is based on your consent or on a contract, and is carried out by automated means, you may request that we provide your Personal Data to you in a structured, commonly used, machine-readable format.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing that occurred before withdrawal.

To exercise any of these rights, please contact our support team at the email address listed in Section 15 of this policy. We will verify your identity before processing any request and will respond within 30 days. If your request is complex or numerous, we may extend this period by a further 30 days with written notice.

pop77's Platform is strictly intended for adults aged 21 and over. We do not knowingly collect or process Personal Data from any person under the age of 21. Age verification is a core component of our registration and KYC processes.

If pop77 discovers that Personal Data has been collected from a person under the age of 21 — whether through a fraudulent registration or any other means — we will immediately suspend the relevant account, delete all associated Personal Data as required by applicable law, and return any funds deposited (subject to fraud review) to the payment method of origin.

If you believe that a minor has registered an account on pop77, please notify us immediately at the contact address in Section 15. We take reports of underage account access extremely seriously and will act on them without delay.

pop77 operates as an internationally licensed platform. As such, your Personal Data may be processed by pop77 or its service providers in countries outside Indonesia. Where Personal Data is transferred to a country that does not provide a level of data protection equivalent to that recognised under your local law, pop77 ensures that appropriate safeguards are in place, including:

• Standard contractual clauses approved by relevant data protection authorities, incorporated into our agreements with overseas service providers.
• Binding corporate rules or equivalent internal data transfer protocols where applicable.
• Transfers to service providers located in jurisdictions that have been recognised as providing an adequate level of data protection.

You may request further information about the specific safeguards applicable to any international transfer of your data by contacting us at the address provided in Section 15.

The pop77 Platform may display content provided by third-party game studios (such as Pragmatic Play, Evolution Gaming, NetEnt, and Microgaming) delivered within embedded game interfaces. These game studios operate under their own privacy and data handling practices with respect to gameplay data they process within their own systems.

The Platform does not contain links to external third-party websites. However, in the event that any reference to an external resource is present on the Platform, pop77 is not responsible for the privacy practices of those external sites. We recommend reviewing the privacy policy of any third-party service you interact with independently of pop77.

pop77 reserves the right to amend this Privacy Policy at any time. Material changes — such as new categories of data collected, new purposes of processing, or significant changes to retention periods or sharing arrangements — will be communicated to registered Players by email to the address on file at least seven (7) days before the change takes effect.

Minor changes (such as clarifications of existing practices, corrections to typographical errors, or restructuring without substantive change) may be made without individual notice, but the updated policy will always reflect the date of the most recent revision at the top of the page.

Your continued use of the Platform after the effective date of any amendment constitutes acceptance of the revised Privacy Policy. If you do not agree with the changes, you should close your account before the effective date and contact our support team to request erasure of your Personal Data in accordance with Section 10.

The current version of this Privacy Policy is always available at https://pop77.cam/privacy-policy.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to raise a privacy concern, please contact pop77's support team using the details below:

We take all privacy enquiries seriously and will acknowledge your communication within two business days. If you are not satisfied with our response to a privacy complaint, you have the right to escalate the matter to the relevant data protection supervisory authority in your jurisdiction or to the data protection authority of the country in which pop77 holds its operating licence.

For questions about your account, transactions, or general platform support, you may also visit our FAQ page, which covers common enquiries about registration, KYC verification, deposits and withdrawals, and security.