ipo77 Privacy Policy

The following definitions apply throughout this Privacy Policy and all related ipo77 data-governance documents:

• "Personal Data" means any information relating to an identified or identifiable natural person — that is, any data that can be used, alone or in combination with other data, to identify you directly or indirectly.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, or deletion.
• "Controller" means ipo77, acting as the entity that determines the purposes and means of Processing your Personal Data.
• "Processor" means any third-party service provider that Processes Personal Data on behalf of ipo77, subject to our instructions and contractual obligations.
• "Member" / "You" means any registered user of the ipo77 Platform.
• "Platform" means the ipo77 website at ipo77.cam and all associated Services.
• "KYC Data" means identity and address verification documents submitted by a Member as part of the Know Your Customer process described in ipo77's Terms & Conditions.
• "Cookies" means small text files placed on your device by the Platform to enable functional, analytical, and preference-related features.

ipo77 collects Personal Data through several distinct channels. The categories of data collected, and the context in which each is gathered, are described below:

2.1 Registration Data

When you create an ipo77 Account, we collect your full legal name, date of birth, residential address (including city — such as Jakarta, Surabaya, Bandung, Medan, or Bali), email address, and phone number. This data is required to create and administer your Account.

2.2 Identity Verification (KYC) Data

Before processing your first withdrawal, we collect KYC documents including a copy of your government-issued identification (such as an Indonesian National Identity Card — KTP, or passport), proof of residential address, and proof of payment method ownership. These documents are processed securely and retained in accordance with Clause 7 of this Policy.

2.3 Financial Transaction Data

We record all deposit and withdrawal transactions, including amounts in Indonesian Rupiah (IDR), timestamps, payment method references, and processing status. This data covers transactions via BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, BSI, OVO, DANA, GoPay, ShopeePay, and LinkAja.

2.4 Betting & Gaming Activity Data

We record all wagers placed, game sessions, bet outcomes, and bonus interactions on the Platform. This includes activity across all product categories — football betting (BRI Liga 1, EPL, Champions Lea gue, La Liga, Serie A, Bundesliga), live casino, *togel* (Indonesia's traditional numbers lottery) markets, and slot titles.

2.5 Technical & Device Data

When you access ipo77, our servers automatically collect certain technical information, including your IP address, browser type and version, operating system, device identifiers, referring URL, pages visited, and session duration. This data is used for security monitoring, fraud prevention, and platform performance optimisation.

2.6 Communications Data

If you contact ipo77 via live chat, email, or any other support channel, we retain records of those communications — including timestamps, the content of messages, and any supporting documents you provide — for quality assurance, dispute resolution, and regulatory compliance purposes.

ipo77 uses the Personal Data described in Clause 2 for the following specific purposes:

ipo77 does not use your Personal Data for automated decision-making that produces significant legal effects on you without human oversight. Where automated tools are used in fraud detection, flagged cases are reviewed by a qualified human analyst before any account action is taken.

ipo77 Processes your Personal Data on one or more of the following legal grounds, depending on the specific purpose for which the data is used:

• Contractual Necessity: Processing required to perform the contract between you and ipo77 — specifically, to operate your Account, process transactions, and deliver the Services you have requested. Without this Processing, ipo77 cannot provide its Services to you.
• Legal Obligation: Processing necessary to comply with applicable legal or regulatory requirements, including anti-money laundering (AML) obligations, know-your-customer (KYC) requirements, and fraud reporting duties imposed by the regulatory frameworks under which ipo77 operates internationally.
• Legitimate Interests: Processing carried out to further ipo77's legitimate business interests, where those interests are not overridden by your privacy rights. This includes fraud prevention, platform security, responsible gaming monitoring, and improving the quality of the Services we provide.
• Consent: For marketing communications and the use of non-essential cookies, ipo77 relies on your freely given, specific, and informed consent. You may withdraw consent at any time without affecting the lawfulness of Processing carried out prior to withdrawal.

ipo77 does not sell or rent your Personal Data to any third party. We may, however, share your data with the following categories of recipients in the circumstances described:

• Payment Service Providers: We share transaction data with the relevant payment processor (such as BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, or LinkAja) solely to facilitate the processing of deposits and withdrawals requested by you. These providers operate under their own privacy and data security frameworks.
• Identity Verification Partners: KYC Data may be shared with third-party identity verification service providers engaged by ipo77 to conduct document authentication checks. All such providers are contractually bound to process data only for the stated verification purpose.
• Game Content Providers: Certain technical session data may be shared with certified game studios — including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft — to the extent required to deliver and authenticate gameplay sessions.
• IT Infrastructure & Security Providers: We engage cloud hosting, content delivery, and cybersecurity service providers to maintain and protect the Platform. These providers act as data Processors under binding agreements that restrict their use of data to operational purposes only.
• Legal & Regulatory Authorities: ipo77 may disclose Personal Data to law enforcement agencies, regulatory bodies, or courts where required to do so by law, court order, or to protect the rights and safety of ipo77, its Members, or the public.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of ipo77's business, Member data may be transferred to the relevant successor entity. Members will be notified of any such transfer and the privacy terms applicable to their data going forward.

ipo77 uses cookies and similar tracking technologies to enable core Platform functionality, enhance the user experience, and gather aggregated analytical insights. The categories of cookies used on ipo77.cam are as follows:

You may manage your cookie preferences at any time through your browser settings. Note that disabling strictly necessary cookies may prevent certain parts of the Platform from functioning correctly. ipo77 does not use third-party advertising trackers that report your behaviour on other websites back to external ad networks.

ipo77 retains Personal Data only for as long as is necessary for the purpose for which it was collected, or as required by applicable law. The following retention schedules apply:

• Account & Registration Data: Retained for the duration of your active Account plus a period of five (5) years following account closure, to satisfy potential legal, regulatory, and dispute-resolution obligations.
• KYC Documents: Retained for a minimum of five (5) years from the date of submission, consistent with internationally recognized anti-money laundering record-keeping standards. Copies of KYC documents are securely deleted at the end of the retention period.
• Financial Transaction Records: Retained for five (5) years from the date of each transaction, in line with standard financial record-keeping practice.
• Betting & Gaming Activity Data: Retained for three (3) years from the date of each session or wager, to support dispute resolution, bonus auditing, and responsible gaming review.
• Customer Support Communications: Retained for two (2) years from the date of the final communication in a support thread, unless the matter is subject to ongoing legal proceedings.
• Technical & Device Data: Aggregated and anonymised after ninety (90) days from collection. Raw log data containing identifiable IP addresses is retained for no longer than twelve (12) months.

Upon the expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised using industry-standard methods. You may request early deletion of your data subject to the conditions described in Clause 8.

As a Member of ipo77, you hold the following rights in relation to the Personal Data we Process about you. To exercise any of these rights, contact our support team via live chat at ipo77.cam or by email at [email protected] (plain text — not a clickable link):

• Right of Access: You may request a copy of the Personal Data ipo77 holds about you. We will provide this in a structured, commonly used format within 30 days of a verified request.
• Right to Rectification: If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request that we correct it promptly. For account details such as your registered name or address, you can initiate corrections directly through your account settings or by contacting support.
• Right to Erasure: You may request the deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where the data has been unlawfully Processed. Note that erasure requests cannot be fulfilled where retention is required by applicable law — for example, financial records subject to regulatory retention obligations.
• Right to Restriction: In certain circumstances, you may request that we restrict the Processing of your data — for example, while the accuracy of data is being contested, or while a legitimate interests objection is being assessed.
• Right to Data Portability: Where Processing is based on your consent or contractual necessity, you may request that we provide your data in a machine-readable format so that it can be transferred to another service provider of your choice.
• Right to Object: You may object to Processing based on ipo77's legitimate interests at any time. You have an unconditional right to object to the Processing of your data for direct marketing purposes.
• Right to Withdraw Consent: Where Processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of Processing carried out before the withdrawal.

ipo77 implements a comprehensive set of technical and organisational security measures to protect your Personal Data against unauthorised access, loss, destruction, or disclosure. Our security framework includes:

• 256-Bit SSL/TLS Encryption: All data in transit between your device and ipo77's servers is encrypted using industry-standard Transport Layer Security (TLS) protocols. Our SSL certificate is maintained and renewed proactively to ensure continuous coverage.
• Encrypted Data at Rest: Sensitive Personal Data — including KYC documents, financial records, and authentication credentials — is stored using strong encryption algorithms. Passwords are hashed using industry-standard one-way hashing functions; ipo77 staff cannot view your password in plain text.
• Access Management: Internal access to Member Personal Data is restricted to authorised staff members with a demonstrable operational need. All access events are logged and subject to regular audit review.
• Two-Factor Authentication (2FA): ipo77 supports and strongly encourages the use of two-factor authentication for Member accounts to provide an additional layer of protection against unauthorised access.
• Continuous Threat Monitoring: Our security operations team monitors the Platform continuously for anomalous activity, intrusion attempts, and data integrity issues. Automated alerting systems are in place to detect and respond to security events in real time.
• Incident Response: In the event of a data security breach that is likely to result in a risk to your rights and freedoms, ipo77 will notify affected Members without undue delay and take immediate remediation steps to contain the breach and prevent recurrence.

ipo77 is committed to keeping this Privacy Policy current and accurate. We review this document regularly and update it when our data practices change, when new Services are introduced, or when applicable legal or regulatory requirements evolve.

When material changes are made to this Policy, we will:

• Update the "Last Updated" date displayed at the top of this page;
• Notify registered Members via email to the address on their Account; and
• Display a prominent notice on the Platform for at least seven (7) days prior to the amended Policy taking effect.

Continued use of the ipo77 Platform following the effective date of any Privacy Policy update constitutes your acceptance of the revised terms. If you do not agree to the updated Policy, you should cease using the Platform and may contact support to request Account closure.

For all privacy-related inquiries — including data rights requests, questions about specific data practices, or concerns about how your information is being handled — please contact our dedicated privacy team through the following channel:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24 hours a day, 7 days a week at ipo77.cam, with bilingual support agents covering WIB (UTC+7), WITA (UTC+8), and WIT (UTC+9) time zones.