Privacy Policy

1 Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings assigned below:

• "Personal Data" — Any information relating to an identified or identifiable natural person ("data subject"), including but not limited to name, identification number, location data, online identifier, or factors specific to the physical, economic, or social identity of that person.
• "Processing" — Any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, storage, adaptation, retrieval, use, disclosure, or erasure.
• "Data Controller" — The entity that determines the purposes and means of processing Personal Data. For all data processed through the km77 platform, the Data Controller is km77.
• "Data Processor" — A third-party entity that processes Personal Data on behalf of km77 under a written data-processing agreement.
• "Consent" — Any freely given, specific, informed, and unambiguous indication of your agreement to the processing of your Personal Data for a stated purpose.
• "Cookie" — A small text file placed on your device by the km77 platform for the purposes of session management, analytics, or personalisation.
• "Platform" — The km77 website at https://km77.cam, including all subdomains, APIs, and associated digital interfaces through which our services are delivered.

2 Scope & Controller

This Privacy Policy applies to all Personal Data collected by km77 in connection with your use of the Platform, regardless of the device or method of access used. It covers data collected directly from you at registration or during your use of our services, as well as data collected automatically through cookies and similar technologies.

km77 acts as the Data Controller in respect of all Personal Data processed under this policy. Our designated data protection contact can be reached at [email protected]. We will acknowledge all data-related enquiries within five (5) business days.

This policy does not apply to third-party websites or services that may be referenced on the Platform. km77 is not responsible for the privacy practices of any third party, and we encourage you to review the privacy policies of any external service you interact with.

3 Data We Collect

km77 collects Personal Data through three principal channels:

3.1 Data You Provide Directly

When you register an account, complete identity verification, make a deposit or withdrawal, contact our support team, or participate in a promotion, you may provide us with:

• Identity information: full legal name, date of birth, nationality, and government-issued identification number (e.g., Indonesian KTP or passport number).
• Contact information: email address, mobile telephone number, and residential address (including city — for example, Jakarta, Surabaya, Bandung, Bali, or Medan).
• Financial information: bank account details for BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, or Bank Danamon; e-wallet identifiers for OVO, DANA, GoPay, ShopeePay, or LinkAja; and cryptocurrency wallet addresses for BTC, ETH, or USDT transactions.
• KYC documents: scanned copies of identity cards, passports, utility bills, and bank statements submitted to satisfy our verification requirements.
• Communications: the content of any messages, emails, or live-chat conversations you have with our support team.

3.2 Data Collected Automatically

When you access and use the Platform, our systems automatically record certain technical information, including:

• Internet Protocol (IP) address and approximate geographic location derived from it.
• Device identifiers, browser type and version, operating system, and screen resolution.
• Session data: login and logout timestamps (recorded in WIB, UTC+7), pages visited, navigation paths, and features accessed.
• Gameplay data: game sessions initiated, wagers placed, outcomes, and bonus interactions.

3.3 Data Received from Third Parties

In limited circumstances we may receive Personal Data about you from third parties, including:

• KYC and identity verification service providers, who confirm the authenticity of identity documents submitted during account registration.
• Payment processors and banking partners, who provide transaction confirmation and fraud-risk signals.
• Responsible-gambling organisations and self-exclusion registries, which notify us when a registered player has requested exclusion from gambling services.

4 Lawful Basis for Processing

km77 processes your Personal Data only where a recognised lawful basis exists. The primary bases we rely upon are:

• Contractual necessity: Processing required to open and manage your account, process deposits and withdrawals, settle bets, and provide customer support.
• Legal obligation: Processing required to comply with applicable anti-money-laundering (AML), counter-terrorism-financing (CTF), and Know Your Customer (KYC) regulations, as well as financial record-keeping requirements.
• Legitimate interests: Processing undertaken to detect and prevent fraud, protect the security of the Platform, improve our products and services, and enforce our Terms & Conditions — provided such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing of your data for direct marketing communications, where you have explicitly opted in to receive such communications. You may withdraw consent at any time by contacting [email protected] or using the unsubscribe mechanism in any marketing email.

5 How We Use Your Data

km77 uses the Personal Data we collect for the following purposes:

• Account administration: Creating and maintaining your player account, verifying your identity at registration and on an ongoing basis, and managing your account preferences.
• Service delivery: Processing deposits and withdrawals via your chosen payment method (local Indonesian bank transfer, e-wallet, or cryptocurrency), settling wagers, and crediting bonuses.
• Fraud prevention and security: Detecting, investigating, and preventing fraudulent transactions, money laundering, multi-accounting, and other prohibited conduct as defined in our Terms & Conditions.
• Legal and regulatory compliance: Meeting our obligations under applicable AML, CTF, and KYC regulations, responding to lawful requests from regulatory authorities, and maintaining financial records for the periods required by law.
• Customer support: Responding to your enquiries, resolving disputes, processing complaints, and providing technical assistance.
• Personalisation: Tailoring your Platform experience — including game recommendations and promotional offers — based on your activity history and stated preferences, where you have not objected to such processing.
• Direct marketing: Sending you information about km77 promotions, bonuses, and new features, subject to your marketing preferences and applicable opt-in requirements. You may opt out at any time.
• Analytics and improvement: Analysing aggregate usage patterns to identify technical issues, optimise Platform performance, and develop new features.
• Responsible gaming: Monitoring gameplay patterns to identify potential indicators of problem gambling and intervening in accordance with our Responsible Gaming obligations.

6 Sharing & Disclosure

km77 does not disclose your Personal Data to third parties except in the following circumstances:

• Service providers and Data Processors: We engage vetted third-party providers to assist with payment processing (including integration with Indonesian banks and e-wallets), KYC verification, fraud detection, cloud hosting, and customer support tooling. Each provider is bound by a written data-processing agreement that restricts their use of your data to the specific service they supply.
• Regulatory and law-enforcement authorities: We will disclose Personal Data where required to do so by applicable law, court order, or the lawful request of a competent regulatory or law-enforcement authority. Where legally permissible, we will notify you of such a request before complying.
• Fraud prevention agencies: Where we have a reasonable suspicion of fraud, money laundering, or other financial crime, we may share relevant data with specialist fraud-prevention agencies and, where appropriate, with other licensed gambling operators via shared industry databases.
• Responsible-gambling organisations: In cases where we identify a player as potentially vulnerable, we may share limited data with accredited responsible-gambling support organisations to facilitate assistance.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of km77's business, Personal Data may be transferred to the acquiring entity, provided that the receiving party agrees to honour the commitments set out in this Privacy Policy.

In all cases, we apply the principle of data minimisation — sharing only the minimum data necessary for the specific purpose of the disclosure.

7 International Transfers

The km77 Platform serves players across Indonesia, including users in Jakarta, Surabaya, Bandung, Bali, Medan, Semarang, and beyond. Our core infrastructure and data-processing operations may involve the transfer of Personal Data to servers or service providers located outside of Indonesia.

Where such international transfers occur, km77 ensures that appropriate safeguards are in place to protect your data, including:

• Contractual clauses that impose data-protection obligations on the receiving party equivalent to those under this policy.
• Use of service providers that maintain internationally recognised security certifications (e.g., ISO 27001).
• Encryption of data both in transit and at rest, regardless of the jurisdiction in which it is stored.

By using the km77 Platform, you acknowledge and consent to the transfer of your Personal Data to jurisdictions outside Indonesia for the purposes described in this policy, subject to the safeguards outlined above.

8 Retention

km77 retains Personal Data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. Our standard retention periods are summarised in the data table above (Section — "What We Collect & Why"). Key retention principles are as follows:

• Account and identity data is retained for a minimum of five (5) years following account closure to satisfy AML and KYC record-keeping obligations.
• Financial transaction records are retained for seven (7) years in accordance with standard financial regulatory requirements.
• Technical and usage data collected via cookies and server logs is retained for no more than thirteen (13) months.
• Customer support communications are retained for three (3) years following the last substantive interaction, to enable resolution of any future disputes.
• Marketing preference data is retained until you withdraw consent or close your account, whichever occurs first.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised so that it can no longer be attributed to an identified individual. Anonymised or aggregated data (from which no individual can be identified) may be retained indefinitely for analytical and statistical purposes.

9 Cookies & Tracking Technologies

km77 uses cookies and similar tracking technologies to deliver, secure, and improve the Platform. The main categories of cookies we deploy are described below:

Most web browsers are configured by default to accept cookies. You may adjust your browser settings to refuse or delete cookies at any time; however, doing so may impair your ability to log in to or use certain features of the Platform. km77 does not honour Do Not Track (DNT) browser signals at this time, as there is no universally accepted standard for their interpretation.

10 Your Data Rights

Subject to applicable law and certain limited exceptions, you have the following rights in relation to the Personal Data km77 holds about you:

To exercise any of the above rights, please contact our data protection team at [email protected] with the subject line "Data Rights Request". We will verify your identity before processing the request and will respond within 30 calendar days. Where a request is complex or we receive a high volume of requests, we may extend this period by a further 60 days, notifying you within the initial 30-day window.

Please note that certain rights are subject to exceptions — for example, we cannot erase data that we are legally required to retain for AML or KYC compliance purposes, and we cannot restrict processing that is strictly necessary to deliver contractual services you have requested.

11 Security Measures

km77 implements a layered security architecture to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure. Our principal security controls include:

• Encryption in transit: All data exchanged between your device and the Platform is encrypted using TLS 1.2 or higher.
• Encryption at rest: Sensitive data fields — including identity document data, financial account details, and password hashes — are encrypted at rest using AES-256.
• Access controls: Access to Personal Data within km77's internal systems is restricted on a strict need-to-know basis. All staff with data access undergo background screening and receive annual data-protection training.
• Two-factor authentication: km77 staff accounts with access to player data require multi-factor authentication. Players are strongly encouraged to enable two-factor authentication on their own accounts.
• Intrusion detection and monitoring: Our infrastructure is monitored around the clock for anomalous access patterns and potential security incidents.
• Penetration testing: We commission independent security audits and penetration tests on a regular basis to identify and remediate vulnerabilities before they can be exploited.

12 Children & Minors

The km77 Platform is strictly intended for adults aged 21 and over. We do not knowingly collect Personal Data from any person under the age of 21. Our registration flow includes an age-declaration step, and we conduct age-verification checks as part of our KYC process.

If we become aware that Personal Data has been collected from a person under the age of 21 without appropriate parental or guardian consent, we will take immediate steps to delete that data and close the associated account. If you are a parent or guardian and believe that your child has registered an account on km77, please contact us immediately at [email protected] so that we can investigate and take appropriate action.

13 Policy Amendments

km77 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data-processing practices, applicable law, or regulatory guidance. Where changes are material — for example, where we introduce a new category of data processing or a new type of third-party disclosure — we will notify registered players by email and by a prominent notice on the Platform at least seven (7) days before the changes take effect.

The "Last Updated" date at the top of this page will always reflect the date on which the most recent version of this policy was published. We encourage you to review this page periodically. Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised policy. If you do not agree with the amended policy, you should cease using the Platform and close your account in accordance with the Account Termination clause of our Terms & Conditions.

Archived versions of this Privacy Policy are available upon written request to [email protected].

14 Contact & Complaints

For any questions, concerns, or requests relating to this Privacy Policy or the way km77 handles your Personal Data, please contact our data protection team through the following channel:

If you are dissatisfied with km77's response to a privacy-related complaint, you have the right to escalate the matter to the relevant data-protection supervisory authority in your jurisdiction. We will provide you with the contact details of the applicable authority upon request.

For responsible-gaming enquiries specifically, please include the words "Responsible Gaming Request" in your email subject line to ensure your message is routed to our dedicated player-welfare team as a priority. Full details of our player-protection tools — including deposit limits, session caps, and self-exclusion — are available on our Responsible Gaming page.