fan77 Privacy Policy

fan77 does not sell, rent, or trade your personal data. We share data only in the following limited and controlled circumstances:

• KYC and identity verification providers: Licensed third-party services that verify identity documents and screen against sanctions and PEP (politically exposed persons) lists. These providers process data only on our behalf and under strict contractual data protection obligations.
• Payment processors: Banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, BSI) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the minimum financial data necessary to execute your requested transactions. Each of these entities is independently subject to Bank Indonesia and OJK data protection requirements.
• Game content providers: Studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive anonymised or pseudonymised session identifiers to facilitate game delivery. They do not receive your full identity data.
• Fraud prevention and security networks: Shared fraud intelligence platforms that help identify patterns of suspicious activity across the online gaming industry. Data shared in this context is pseudonymised wherever technically feasible.
• Legal authorities: Where required by a valid court order, regulatory demand, or other lawful obligation, fan77 will disclose the minimum personal data necessary to comply. We will notify affected Members of such disclosures wherever legally permitted to do so.
• Group entities: fan77's affiliated entities may access your data for internal compliance, risk management, or consolidated reporting purposes, subject to the same data protection standards set out in this Policy.

All third parties with whom fan77 shares personal data are required to handle that data in accordance with applicable data protection standards. fan77 does not permit its data processors to use your personal data for their own independent commercial purposes.

fan77 uses cookies and similar tracking technologies to operate the platform, remember your preferences, maintain your login session, and collect analytics data. The types of cookies we use are as follows:

You can manage or delete cookies at any time through your browser settings. Note that disabling strictly necessary cookies will impair your ability to use the fan77 platform. For detailed guidance on managing cookies in your specific browser, consult your browser's help documentation.

fan77 retains your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our standard retention periods are as follows:

• Active account data: Retained for the duration of your account's active status plus a minimum of five years following account closure, to satisfy AML record-keeping requirements.
• Transaction records: Financial transaction records are retained for a minimum of five years from the date of the transaction, in accordance with standard financial compliance requirements.
• KYC documents: Identity verification documents are retained for the period your account remains active and for five years after account closure. Copies are destroyed securely upon the expiry of this retention period.
• Support communications: Customer support records are retained for three years from the date of the last interaction, to facilitate dispute resolution and service quality monitoring.
• Analytics data: Anonymised and aggregated usage analytics may be retained indefinitely for platform improvement purposes, as they cannot be used to identify individual Members.
• Marketing preferences: Records of your consent to or opt-out from marketing communications are retained for the lifetime of your account and for two years after closure.

Where personal data is no longer required and no legal obligation mandates its retention, fan77 securely deletes or irreversibly anonymises that data.

fan77 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our principal security controls include:

• 256-bit TLS encryption: All data transmitted between your browser and the fan77 platform is encrypted using Transport Layer Security (TLS 1.2 or higher). This applies to all page interactions, login requests, and financial transactions.
• Password hashing: Member passwords are never stored in plain text. We apply industry-standard one-way hashing algorithms with per-user salts, ensuring that even in the event of a database breach, your password cannot be recovered.
• Two-factor authentication (2FA): SMS-based 2FA is available to all Members and is strongly recommended. This adds a second layer of verification beyond your password.
• Access controls: fan77 staff access to Member personal data is restricted on a strict need-to-know basis. Access is logged, monitored, and subject to regular internal audit.
• Intrusion detection: Our platform employs automated intrusion detection and prevention systems (IDS/IPS) that monitor for anomalous traffic patterns and potential attack vectors in real time.
• Regular security assessments: fan77 conducts periodic vulnerability assessments and penetration tests conducted by qualified independent security professionals.

While fan77 takes every reasonable precaution to protect your data, no online platform can guarantee absolute security. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, fan77 will notify affected Members without undue delay and take immediate remedial action.

As a fan77 Member, you hold the following rights with respect to your personal data. To exercise any of these rights, contact our Data Protection Officer at [email protected] with the subject line "Privacy Rights Request". We will respond within 30 calendar days.

The fan77 platform is strictly intended for adults aged 21 and above. fan77 does not knowingly collect personal data from individuals under the age of 21. If you are under 21, you must not use fan77 or submit any personal information to us.

If fan77 discovers or is notified that a Member is under 21 years of age, we will immediately suspend the account, delete all associated personal data to the extent permitted by our legal retention obligations, void any Bonus Funds, and return any demonstrable real-money deposits after deducting applicable costs in accordance with our Terms & Conditions.

Parents or guardians who believe that a minor may have created a fan77 account should contact us immediately at [email protected]. We take all such reports seriously and will act without delay.

The fan77 platform may from time to time reference or display content from third-party services, including live sports data feed providers and game studio interfaces. fan77 does not control the privacy practices of these third parties and is not responsible for their privacy policies or data handling practices.

We encourage you to review the privacy policies of any third-party service you interact with independently. fan77's Privacy Policy applies solely to data collected directly through the fan77 platform and its immediate service integrations as described in this document.

fan77 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the Services we offer. When material changes are made, we will notify registered Members via email to their registered address and display a prominent notice on the fan77 platform at least seven (7) days before the revised Policy takes effect.

The "Last updated" date at the top of this page always reflects the most recent revision. We recommend reviewing this Policy periodically. Your continued use of fan77 after the effective date of any revision constitutes your acceptance of the updated Privacy Policy.

For any privacy-related enquiries, requests to exercise your data rights, or concerns about how fan77 handles your personal data, please contact our Data Protection Officer:

• Email: [email protected] — subject line: "Privacy — DPO Enquiry"
• Live Chat: Available 24/7 within your fan77 Account dashboard.
• Response Commitment: All privacy rights requests will receive an acknowledgement within 48 hours and a full response within 30 calendar days.

If you are not satisfied with our response to a privacy complaint, you have the right to escalate your concern to the relevant data protection supervisory authority in your jurisdiction.