Privacy Policy — spg77

spg77 ("we", "us", "our", "the Company") operates the online gaming platform at spg77.lat, serving players primarily in Indonesia. We are committed to handling your personal data with the highest standards of confidentiality, integrity, and transparency. This Privacy Policy describes in detail the categories of personal data we collect, the purposes for which we process it, the legal bases we rely upon, and the rights you hold as a data subject.

This Policy should be read alongside our Terms & Conditions and our Responsible Gaming policy, which together form the full contractual and regulatory framework governing your relationship with spg77. In the event of any conflict between this Privacy Policy and the Terms & Conditions on a matter of data protection, this Privacy Policy shall take precedence.

We review and update this Privacy Policy periodically to reflect changes in our data practices, applicable law, and regulatory guidance. The version currently published at spg77.lat/privacy-policy is always the most current and supersedes all prior versions.

For the purposes of applicable data protection law, spg77 is the data controller responsible for the personal data you provide when using the Platform. As data controller, we determine the purposes and means by which your personal data is processed and are accountable for ensuring that processing activities comply with applicable privacy and data protection obligations.

Where we engage third-party processors to handle data on our behalf — for example, payment gateway providers processing transactions via BCA, BRI, BNI, Mandiri, or GoPay — we do so under binding contractual agreements that require those processors to maintain equivalent standards of data protection and to use your data solely for the purposes we specify. We do not permit sub-processors to use your data for their own independent purposes.

If you have any queries about our role as data controller, or wish to exercise any of your data-subject rights described in Clause 9, please contact us using the details provided in Clause 14.

We collect and process the following categories of personal data in connection with your use of the spg77 Platform. The specific data points collected will vary depending on the services you use and the stage of your relationship with us (e.g., visitor, registered Member, or verified Member).

spg77 collects personal data through several distinct channels depending on the nature of your interaction with the Platform:

• Directly from you: When you complete the registration form, update your account profile, submit KYC documents, make a deposit or withdrawal request, enter a promotion, contact our support team, or respond to a survey, you provide data directly to us. We only request information that is necessary for the stated purpose.
• Automatically through technology: When you visit spg77.lat, our servers automatically log technical data including your IP address, browser type, and session timestamps. We also use cookies and similar tracking technologies (described in Clause 10) to collect usage and behavioural data as you navigate the Platform.
• From third-party payment processors: When you initiate a deposit or withdrawal via a local Indonesian bank (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI) or an e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja), our payment processing partners confirm transaction details — including transaction reference numbers and transfer amounts in IDR — which are linked to your account record.
• From identity verification service providers: If we engage a third-party KYC provider to assist with identity document verification, that provider will share a verification result (pass, fail, or refer) with us alongside the document data you submitted. We do not receive raw biometric scores or underlying model outputs beyond the verification result.
• From responsible gaming and fraud monitoring tools: Our platform employs automated monitoring systems that analyse patterns in account behaviour — such as unusually rapid wagering activity, multiple accounts sharing an IP address, or sudden changes in deposit frequency — to identify potential fraud, money laundering, or problem gambling. The outputs of this monitoring constitute derived data about your account.
• From publicly available sources: In limited circumstances — for example, where we need to verify a claim or investigate a suspected breach of our Terms — we may consult publicly available information such as public social media profiles, court records, or watchlist databases. We will process such data only to the extent strictly necessary for the purpose of the investigation.

We process your personal data only where we have a valid legal basis to do so. The following table summarises the primary purposes for which we process personal data and the corresponding legal basis:

Where we rely on legitimate interests as our legal basis, we carry out a balancing test to ensure our interests do not override your fundamental rights and freedoms. You may request details of the specific legitimate interest assessment applicable to any processing activity by contacting us at the address in Clause 14.

spg77 does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We will never share your data with advertising networks, data brokers, or marketers without your explicit consent. The categories of third parties with whom we do share data — and the basis for doing so — are set out below:

• Payment Service Providers: We share the minimum necessary financial data with Indonesian bank payment gateways and e-wallet operators (including BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja) to process your transactions. These providers act as data processors under our instructions and are contractually bound to protect your data.
• Identity Verification Providers: Where a third-party KYC platform is used to verify your identity documents, we share the document data you submit with that provider for the sole purpose of verification. The provider returns a verification result and is prohibited from retaining or using your documents for any other purpose.
• Game Content Providers: Certified game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft operate game engines integrated into our Platform. When you play a game, session data (including your bet amounts and outcomes) is transmitted to the relevant studio's servers for the purpose of running the game and generating results. These studios are licensed and regulated and are contractually required to protect player data.
• Customer Support Platform: Our live chat and customer support tools may be hosted or supported by a third-party software provider. Support agents access your account data only to the extent necessary to resolve your query. Chat transcripts are retained as described in Clause 8.
• Fraud Prevention and Compliance Services: We may share account or transaction data with fraud detection vendors, anti-money-laundering screening services, or watchlist providers as necessary to comply with our legal obligations and protect the Platform from abuse.
• Legal Authorities: We will disclose personal data to courts, regulators, law enforcement agencies, or other governmental authorities where we are legally compelled to do so by court order, regulatory directive, or applicable law. Where permitted, we will notify you of such disclosure.
• Business Transfers: In the event of a merger, acquisition, restructuring, or sale of all or substantially all of spg77's assets, your personal data may be transferred to the successor entity. We will notify you via your registered email address and provide you an opportunity to delete your account before any such transfer takes effect.

spg77 is operated by a company incorporated outside Indonesia, and certain processors and sub-processors involved in Platform operations — including game studio server infrastructure, cloud hosting providers, and our licensing authority's compliance systems — may be based in jurisdictions other than Indonesia.

When we transfer your personal data outside of Indonesia to such service providers, we take steps to ensure that appropriate safeguards are in place. These safeguards may include binding contractual clauses based on internationally recognised model contract terms, certification of the recipient under a recognised privacy framework, or confirmation that the destination jurisdiction provides an adequate level of data protection under applicable law.

For transfers to game studios and payment processors with global operations, we rely on standard contractual clauses incorporated into our data processing agreements. These clauses impose obligations on the recipient that are equivalent to those applicable under the laws of jurisdictions with robust data protection regimes.

We retain your personal data only for as long as necessary to fulfil the purpose for which it was collected, or for as long as required or permitted by applicable law. The following retention principles apply across our data categories:

• Account and Identity Data: Retained for the duration of your active membership plus a minimum period of five (5) years following account closure, to comply with anti-money-laundering, record-keeping, and dispute resolution requirements.
• Financial Transaction Records (deposits, withdrawals in IDR): Retained for a minimum of five (5) years from the date of the transaction, or longer if required by applicable financial crime legislation or regulatory audit requirements.
• KYC Verification Documents (KTP, passport, bank statement): Retained for the duration of account membership and for five (5) years post-closure. Original document images are stored in encrypted form with access limited to authorised compliance personnel.
• Game Session Logs and Wagering History: Retained for a minimum of three (3) years to support dispute resolution, regulatory audits, and responsible gaming monitoring.
• Customer Support Communications (live chat, email, WhatsApp): Retained for two (2) years from the date of the last interaction in the conversation thread, after which transcripts are anonymised or deleted.
• Marketing Preference Records: Retained for the duration of your membership plus one (1) year, to evidence your consent history and honour opt-out requests. Opt-out records are retained for five (5) years to ensure we do not inadvertently re-contact you following a withdrawal of consent.
• Technical and Usage Logs (IP addresses, session data): Retained for up to twelve (12) months in identifiable form for security and fraud-prevention purposes, then aggregated or anonymised. Anonymised aggregate data may be retained indefinitely for statistical and product improvement purposes.

At the end of the applicable retention period, personal data will be securely deleted or irreversibly anonymised in accordance with our internal data lifecycle management procedures. Where data cannot be immediately deleted due to technical constraints — for example, data held in encrypted backup archives — it will be isolated from active processing and deleted at the next scheduled purge cycle.

As a data subject, you hold meaningful rights over your personal data. spg77 is committed to honouring these rights promptly and without unnecessary bureaucratic barriers. The rights available to you include:

• Right of Access: You may request a copy of the personal data we hold about you, along with information about how it is processed, where it is stored, and with whom it has been shared. We will provide this information within 30 days of receiving a valid request.
• Right to Rectification: If you believe that personal data we hold is inaccurate or incomplete, you may request that we correct or complete it. For straightforward corrections such as updating your phone number or email address, you may do this directly through your account settings. For identity data, please contact support.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose for which it was collected, or where you withdraw consent and no other legal basis applies. Note that this right is subject to overriding legal obligations: we are required to retain transaction and KYC records for regulatory purposes as described in Clause 8, and erasure requests that conflict with these obligations will be partially fulfilled (non-regulated data deleted; regulated data retained and isolated).
• Right to Restriction of Processing: In certain circumstances — for example, while the accuracy of data is being contested — you may request that we restrict active processing of your data to storage only.
• Right to Data Portability: Where processing is based on your consent or the performance of a contract, and is carried out by automated means, you may request a machine-readable copy of the personal data you provided to us, for the purpose of transferring it to another service provider.
• Right to Object: You may object at any time to processing of your personal data based on our legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, or unless the processing is necessary for the establishment, exercise, or defence of legal claims.
• Right to Withdraw Consent: Where processing is based solely on your consent (for example, receiving promotional communications about bonus offers and seasonal promotions), you may withdraw that consent at any time via your account settings or by contacting our support team. Withdrawal of consent does not affect the lawfulness of any processing carried out prior to withdrawal.
• Right to Lodge a Complaint: If you are not satisfied with how spg77 has handled your personal data, you have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction. We would appreciate the opportunity to address your concerns directly first — please contact us via the channels in Clause 14 before escalating to a regulatory authority.

To exercise any of the above rights, please contact our support team via live chat or by email at [email protected] (plain text — not a clickable link). We may need to verify your identity before fulfilling a data-subject rights request to ensure we do not disclose personal data to an unauthorised person. We will not charge a fee for standard requests; however, we reserve the right to charge a reasonable administrative fee for requests that are manifestly unfounded, excessive, or repetitive.

spg77.lat uses cookies and similar technologies — including session tokens, local storage, and pixel tags — to provide a functional, personalised, and secure Platform experience. The categories of cookies we use are as follows:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function and cannot be disabled. They include session authentication tokens that keep you logged in, security cookies that protect against cross-site request forgery (CSRF), and cookies that remember your language and currency preferences. Without these cookies, core Platform features including account login, deposits, and game play cannot operate.
• Performance and Analytics Cookies: These cookies collect anonymised data about how Members use the Platform — which pages are visited most frequently, how long users spend in game lobbies, and where users encounter errors. This data helps us improve the Platform. We do not link analytics data to your personal identity.
• Functionality Cookies: These cookies remember your Platform preferences — for example, your preferred deposit method (BCA, OVO, etc.), your game lobby filters, and your notification settings — so you do not have to reconfigure them on each visit.
• Security and Fraud Prevention Cookies: These cookies support our fraud detection and responsible gaming monitoring systems. They allow us to detect anomalous behaviour patterns — such as rapid switching between multiple accounts from the same device — and flag them for review.

Managing Cookies: You can manage or disable non-essential cookies through your browser settings. Most modern browsers allow you to block third-party cookies, clear your cookie history, or receive a warning before a cookie is stored. Please note that disabling strictly necessary cookies will impair or prevent your ability to use the Platform. Instructions for managing cookies in common browsers are available via the browser's own help documentation.

spg77 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our security framework includes:

• Encryption in Transit: All data transmitted between your browser or device and spg77.lat is protected by TLS 1.2 or higher (256-bit SSL), ensuring that your login credentials, financial data, and personal information cannot be intercepted in transit.
• Encryption at Rest: Sensitive data — including KYC documents, payment details, and account passwords — is stored in encrypted form using industry-standard encryption algorithms. Passwords are hashed with a modern cryptographic hashing function and are never stored in plain text, ensuring that even in the unlikely event of a data breach, your password cannot be recovered.
• Access Controls: Access to personal data within spg77's systems is restricted to employees and contractors who require it to perform their job functions. We enforce role-based access control (RBAC), and all access to sensitive data is logged and auditable. KYC documents are accessible only to members of our compliance team.
• Two-Factor Authentication: spg77 offers two-factor authentication (2FA) for Member accounts and enforces it for administrative access to internal systems. We strongly recommend that all Members enable 2FA in their account security settings.
• Penetration Testing and Security Audits: Our Platform undergoes regular security assessments, including third-party penetration testing, to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: In the event of a personal data breach that poses a risk to your rights and freedoms, spg77 will notify affected Members and the relevant supervisory authority within the timeframes required by applicable law. Our incident response team is available around the clock to contain and investigate any potential breach event.

While we apply robust technical and organisational measures, no online platform can guarantee absolute security. You play an important role in keeping your account safe: use a strong, unique password; do not share your login credentials with anyone; and log out of your account when using a shared device. If you suspect your account has been compromised, contact our support team immediately via live chat.

spg77 is strictly an adult platform. Access to and use of the Platform — including registering an account, placing wagers, or participating in any game or promotion — is prohibited for any person under the age of 21. We do not knowingly collect personal data from individuals under the age of 21.

Our registration process requires a date of birth, and our KYC verification process requires a government-issued identity document that confirms the Member's age. Where age verification indicates a Member is under 21, the account will be immediately suspended, all associated funds will be frozen pending investigation, and the matter may be reported to the relevant authority where legally required.

If you are a parent or guardian and believe that a minor has accessed the Platform using falsified identity information, please contact our support team immediately via live chat. We will investigate the matter promptly, close the account, and arrange return of any real-money deposits made under the minor's account, net of any applicable investigation costs.

spg77 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, Platform features, applicable law, or regulatory requirements. When we make material changes — for example, introducing a new category of data collection, adding a new third-party processor, or changing our retention periods — we will notify active Members via an in-account dashboard notification and, where appropriate, by email to the registered address.

Non-material changes (such as correcting typographical errors, clarifying existing language without changing substantive meaning, or updating contact details) may be made without advance notice, though the "Last Updated" date at the top of this Policy will always reflect the date of the most recent revision.

The version of this Privacy Policy published at spg77.lat/privacy-policy at any given time is the version currently in force and supersedes all prior versions. Your continued use of the Platform after the effective date of a revised Privacy Policy constitutes your acknowledgement of the updated terms. If you do not agree with a revised Policy, you should cease using the Platform and contact support to request account closure.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way spg77 processes your personal data, please reach out to us through one of the following channels. We are committed to responding to all privacy-related enquiries promptly, transparently, and in plain language:

• Live Chat: Available 24/7 inside your spg77 account dashboard — the fastest and most direct channel for any account-specific or privacy-related queries. Our agents are native Indonesian speakers and fully briefed on data-subject rights procedures.
• Email: [email protected] — please use the subject line "Privacy Enquiry" or "Data Subject Request" so our compliance team can prioritise your message appropriately. This is a plain text address — do not click; copy and paste into your email client.
• WhatsApp Support: Available 07:00–23:00 WIB (Western Indonesia Time, UTC+7). The WhatsApp number is displayed inside your account dashboard after login to protect against unsolicited contact.

We aim to acknowledge all privacy-related correspondence within 2 business days and to resolve standard data-subject rights requests within 30 calendar days of identity verification. For complex or volume requests, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason before the initial 30-day period expires.

For formal written correspondence regarding data protection matters, please direct your communication via email to [email protected] with the subject line "Data Protection — Formal Notice". We will acknowledge receipt and assign a reference number to your case.