Privacy Policy

1. Introduction

web777 ("the Company", "we", "us", "our") takes the privacy of every player and visitor seriously. This Policy describes our practices regarding the collection, use, disclosure, storage, and protection of personal information obtained through the Platform. We recognize that our players — predominantly based in Indonesia, with users across Jakarta, Surabaya, Medan, Bandung, Bali, and other major cities — trust us with sensitive personal and financial data. That trust is something we do not take lightly.

We operate in accordance with internationally recognized data protection principles, including purpose limitation, data minimization, storage limitation, integrity, and confidentiality. We collect only the data we genuinely need to provide you with a secure, personalized, and legally compliant gaming experience. We do not sell your data. We do not rent your data. We do not share it with third parties except as explicitly described in this Policy.

If you have any questions about how your data is handled at any point, our Data Protection team is available via live chat or at the email address listed in Section 16 of this Policy.

2. Definitions

The following definitions apply throughout this Policy:

• "Personal Data" — Any information that identifies or could reasonably identify a specific individual, including name, identification number, contact details, financial records, and device identifiers.
• "Processing" — Any operation performed on personal data, including collection, storage, use, disclosure, alteration, retrieval, or deletion.
• "Data Subject" — The individual to whom the personal data relates — in this context, the registered player or Platform visitor.
• "Data Controller" — web777, which determines the purposes and means of processing personal data collected through the Platform.
• "Data Processor" — A third party that processes personal data on behalf of web777, subject to contractual data protection obligations.
• "Cookies" — Small text files placed on your device by the Platform to store session information, preferences, and analytical data.
• "KYC" — Know Your Customer; the identity and document verification process required for regulatory compliance and fraud prevention.
• "AML" — Anti-Money Laundering; regulatory framework and procedures to prevent the Platform from being used to launder funds derived from illegal activity.

3. Data We Collect

web777 collects personal data across three primary categories: data you provide directly, data generated through your use of the Platform, and data obtained from third-party sources for verification and fraud prevention purposes.

3.1 Data You Provide Directly

• Full legal name (as appears on government-issued identification)
• Date of birth (to verify you are 21 years of age or older)
• Indonesian National Identity Card number (NIK — Nomor Induk Kependudukan)
• Email address and Indonesian mobile phone number
• Registered bank account details (BCA, BRI, BNI, Mandiri, and others) or e-wallet details (OVO, DANA, GoPay, ShopeePay, LinkAja)
• Home address (for KYC and identity verification)
• Identity documents uploaded for KYC: KTP (Kartu Tanda Penduduk), selfie photographs, proof of address
• Communication records from live chat, email correspondence, and support tickets

3.2 Data Generated Through Platform Use

• Login timestamps, session duration, and device information
• IP address and approximate geographic location
• Browser type, operating system, and device identifiers
• Game activity logs: games played, bet amounts, wager history, wins and losses
• Deposit and withdrawal transaction records, including amounts, timestamps, and payment methods used
• Bonus activation records and wagering requirement progress
• Responsible gaming tool usage: deposit limits set, self-exclusion requests, session time limits
• Cookie and tracking data as described in Section 11

3.3 Data from Third-Party Sources

• Identity verification responses from KYC service providers
• Fraud risk scores and AML screening results from compliance service providers
• Payment confirmation data from banks and e-wallet processors
• Device fingerprint data from fraud detection systems

4. How We Collect Data

Personal data is collected through the following channels:

4.1 Direct Submission

When you complete the registration form, submit KYC documents, make a deposit or withdrawal request, contact customer support, or participate in any promotion that requires personal information, you are providing data directly to web777.

4.2 Automated Technical Collection

Our Platform automatically collects technical and behavioral data each time you access or use the service. This includes server logs, session data, device information, and usage patterns — all collected through standard web technologies including cookies, web beacons, and server-side analytics.

4.3 Third-Party Verification Services

To fulfill our KYC and AML obligations, we may share limited identity data with licensed third-party verification providers, who in turn provide confirmation of identity status and fraud risk assessments. These providers are contractually bound to process your da ta solely for verification purposes on our behalf.

4.4 Payment Processors

When you make a deposit via BCA, BRI, BNI, Mandiri, CIMB Niaga, or any supported e-wallet such as OVO, DANA, or GoPay, the relevant financial institution confirms transaction details to web777. We do not store full card numbers or complete bank account credentials on our own servers; payment data is handled by PCI-DSS compliant processors.

5. Purpose of Processing

web777 processes your personal data only for specific, legitimate, and clearly defined purposes. We do not use your data for any purpose that is incompatible with the reasons for which it was originally collected. The primary purposes for which we process personal data are:

• Account Creation and Management: To register your account, verify your identity, maintain your profile, and provide you with access to the Platform's full range of services.
• Payment Processing: To facilitate deposits and withdrawals via local Indonesian banks (BCA, BRI, BNI, Mandiri, and others) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja), and to maintain accurate transaction records.
• KYC and AML Compliance: To verify that you meet the eligibility requirements (21 years of age or older), confirm the legitimacy of your payment methods, and detect and prevent money laundering, fraud, and other financial crimes.
• Gaming Services Delivery: To deliver casino games, sports betting markets, lottery and togel (Indonesia's traditional numbers lottery) products, live dealer experiences, and all other Platform features.
• Customer Support: To respond to your inquiries, resolve disputes, process complaints, and deliver 24/7 Indonesian-speaking support.
• Responsible Gaming: To monitor gameplay patterns for signs of problematic behavior, implement deposit limits and self-exclusion requests, and proactively reach out to at-risk players.
• Security and Fraud Prevention: To detect unauthorized account access, prevent multi-accounting, identify bonus abuse, and protect the integrity of the Platform for all users.
• Legal and Regulatory Obligations: To fulfill any legal obligations imposed on web777 by applicable international gaming regulations, financial compliance requirements, or court orders.
• Platform Improvement: To analyze aggregated, anonymized usage data to improve game selection, user interface design, payment processing speed, and overall service quality.
• Promotional Communications: To send you relevant bonus offers, promotional updates, and personalized gaming recommendations — subject to your communication preferences and opt-out rights.

6. Legal Basis for Processing

web777 processes your personal data on one or more of the following legal grounds, consistent with internationally recognized data protection frameworks:

6.1 Contractual Necessity

The majority of data processing activities are necessary to fulfill our contractual obligations to you under the Terms & Conditions. This includes account registration, payment processing, game delivery, and customer support. Without processing this data, we cannot provide the services you have agreed to receive.

6.2 Legal Obligation

Certain processing activities — particularly KYC identity verification, AML transaction monitoring, and the retention of financial records — are required by applicable international gaming regulations and financial compliance standards. We are legally obligated to conduct these activities regardless of individual consent.

6.3 Legitimate Interests

We process certain categories of data on the basis of legitimate business interests, specifically fraud detection, Platform security, prevention of multi-accounting and bonus abuse, and anonymized analytics for service improvement. Where we rely on legitimate interests, we ensure that our interests do not override your fundamental privacy rights.

6.4 Consent

For non-essential processing activities — such as sending promotional emails, personalized marketing communications, and optional analytics cookies — we rely on your explicit consent. You may withdraw consent for marketing communications at any time by contacting our support team. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

7. Data Sharing & Disclosure

web777 does not sell, rent, or trade your personal data to any third party for their independent commercial use. We share your data only in the limited circumstances described below, and only with parties that are contractually bound to protect it:

7.1 Service Providers and Data Processors

We engage carefully selected third-party service providers who process data strictly on our behalf and under our instructions. These include identity verification and KYC providers, payment gateway operators, fraud detection and AML screening services, cloud hosting and infrastructure providers, customer support platform vendors, and email delivery services. Each provider is subject to a data processing agreement that prohibits unauthorized use of your data.

7.2 Game Software Providers

To deliver casino and sports betting content, the Platform integrates software from providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft. These providers may receive limited technical data (such as session tokens or anonymized player IDs) to facilitate game delivery. They do not receive your full personal profile.

7.3 Financial Institutions

Your name and relevant account details are shared with banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI, Bank Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) solely for the purpose of processing deposits and withdrawals initiated by you. This sharing is a necessary element of delivering the payment service you have requested.

7.4 Legal and Regulatory Disclosure

We may disclose personal data to law enforcement agencies, regulatory bodies, courts, or other government authorities where required by applicable law, court order, or regulatory directive. In such cases, we will disclose only the minimum data required to satisfy the legal obligation, and we will notify you of any such disclosure where we are legally permitted to do so.

7.5 Business Transfers

In the event that web777 undergoes a corporate restructuring, merger, acquisition, or sale of substantially all of its assets, your personal data may be transferred to the acquiring entity. Any such transfer will be subject to the same data protection commitments set out in this Policy, and you will be notified of any material change in the data controller's identity with a minimum of 30 days' prior notice.

8. International Data Transfers

As an internationally operated Platform, some of the service providers and infrastructure partners that process data on our behalf are located outside of Indonesia. When personal data is transferred internationally, web777 ensures that appropriate safeguards are in place to maintain the same standard of protection that applies within the Platform itself.

Safeguards we employ for international transfers include: standard contractual clauses incorporated into data processing agreements with all international processors; selection of providers that maintain internationally recognized security certifications (such as ISO 27001 and SOC 2); and technical measures including end-to-end encryption during data transit. We do not transfer your data to jurisdictions that do not offer an adequate level of data protection without implementing these contractual safeguards.

9. Data Retention

web777 retains personal data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention periods apply:

• Active account data: Retained for the full duration of your account's active status plus a minimum of 5 years following account closure, in line with standard financial records retention requirements.
• KYC and identity documents: Retained for a minimum of 5 years from the date of the last transaction associated with your account, consistent with AML regulatory requirements.
• Transaction records: Retained for a minimum of 5 years, covering all deposit, withdrawal, and wagering records.
• Customer support communications: Retained for 3 years from the date of the last communication, to support dispute resolution and service quality assurance.
• Marketing consent records: Retained for 3 years from the date of the most recent consent action (opt-in or opt-out).
• Cookie and analytics data: Session cookies expire at the end of each browsing session; persistent analytics cookies are retained for a maximum of 12 months.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in a manner that prevents re-identification. Where data is anonymized rather than deleted, the resulting anonymized dataset is no longer considered personal data and may be retained indefinitely for analytical purposes.

10. Data Security

web777 implements a multi-layered security framework designed to protect your personal data against unauthorized access, disclosure, alteration, and destruction. Our security measures include, but are not limited to:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and our servers is encrypted using industry-standard SSL/TLS protocols, preventing interception during transit.
• At-Rest Encryption: Sensitive data stored in our databases — including identity documents and financial records — is encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data within our organization is strictly limited to personnel who require it to perform their specific job functions. Role-based access controls and multi-factor authentication are enforced for all staff accessing production systems.
• Intrusion Detection: Our infrastructure is monitored 24/7 by automated intrusion detection systems that flag and respond to anomalous access patterns in real time.
• Regular Security Audits: We conduct regular internal and external security audits, penetration testing, and vulnerability assessments to identify and remediate weaknesses before they can be exploited.
• Data Breach Response: In the event of a confirmed personal data breach that poses a risk to your rights, we will notify affected players within 72 hours of discovery and take immediate remedial action.

11. Cookies & Tracking Technologies

web777 uses cookies and similar tracking technologies to operate the Platform effectively, improve your experience, and analyze usage patterns. Below is a clear description of the categories of cookies we use:

11.1 Strictly Necessary Cookies

These cookies are essential for the Platform to function. They maintain your login session, store your language and currency preferences, and enable core security functions such as CSRF protection. You cannot opt out of these cookies without disabling your ability to use the Platform.

11.2 Performance and Analytics Cookies

We use analytics cookies to understand how players interact with the Platform — which games are most popular, where users encounter difficulties, and how navigation flows can be improved. Analytics data is aggregated and anonymized; it does not identify individual players. You may opt out of analytics cookies without affecting your ability to use the Platform.

11.3 Functional Cookies

Functional cookies remember your in-session preferences such as preferred payment method, game lobby filter settings, and live chat widget state. They improve the quality of your experience but are not strictly essential. You may disable these via your browser settings, though some features may behave differently as a result.

11.4 Managing Your Cookie Preferences

Most web browsers allow you to control cookies through their settings preferences. Deleting or blocking cookies may impact the functionality of certain Platform features. For detailed instructions on managing cookies in your specific browser, refer to the browser's official help documentation. Note that deleting cookies does not delete your account or any personal data held on our servers.

12. Your Privacy Rights

As a data subject, you hold a number of rights with respect to the personal data that web777 holds about you. We are committed to honoring these rights promptly and without undue delay. Requests should be submitted in writing to the contact address provided in Section 16, and we will respond within 30 days of receipt.

Please note that certain rights are subject to exceptions. For example, the right to erasure does not apply where we are legally required to retain data under AML or financial regulations. We will always explain the reason if we are unable to fulfill a specific request.

13. Minors' Privacy

web777 strictly prohibits the use of the Platform by any individual under the age of 21. We do not knowingly collect personal data from minors. Age verification is performed at registration and reinforced through our KYC process. If we become aware that personal data has been collected from an individual who is under 21 years of age, we will immediately suspend that account, delete all associated personal data, and return any deposited funds to the originating payment method after appropriate verification.

Parents and guardians who believe that a minor may have registered an account on web777 should contact our support team immediately. We treat all such reports as an urgent priority and will take immediate action upon receipt of a credible report.

14. Third-Party Links & Embedded Content

The web777 Platform may contain references to third-party game providers and payment services whose own privacy practices apply to data processed through their systems. web777 is not responsible for the privacy practices of any third-party game studios, payment processors, or other external service providers. We encourage you to review the privacy policies of any third-party services you interact with in connection with your use of the Platform.

Note that web777 does not include external hyperlinks to third-party websites within the Platform's navigational structure. Any third-party integrations are embedded within the Platform itself and governed by the data processing agreements described in Section 7.1.

15. Policy Amendments

web777 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable regulations, or Platform services. Material changes will be communicated to registered players via email notification and a prominent notice on the Platform at least 14 days before the updated Policy takes effect. The "Last Updated" date at the top of this page will be revised accordingly. We encourage you to review this Policy periodically to stay informed about how we protect your data. Your continued use of the Platform following the effective date of any amendment constitutes your acknowledgment of the updated Policy.

16. Contact & Data Requests

For any questions, concerns, or formal requests relating to your privacy rights or the handling of your personal data by web777, please contact our Data Protection team through the following channels:

• Live Chat: Available 24/7 directly from the Platform — the fastest channel for general privacy queries
• Email: [email protected] — for formal written data subject access requests, erasure requests, and complaints
• Response Time: General queries via live chat are answered within 2 minutes; formal written data requests are acknowledged within 5 business days and resolved within 30 days

All formal privacy requests must be submitted in writing by email to ensure a proper audit trail and enable us to verify your identity before disclosing or modifying any personal data. We respond in both English and Indonesian (Bahasa Indonesia) to ensure full accessibility for all our players across Jakarta, Surabaya, Medan, Bandung, Bali, and beyond.