Privacy Policy — upo77

In this Privacy Policy, the following terms carry the meanings set out below unless the context clearly requires otherwise:

• "Platform" means the upo77 website at https://upo77.org, including all pages, subpages, services, games, and features accessible through it.
• "We", "Us", "Our", or "upo77" refers to the operator of the upo77 Platform and all associated entities, officers, employees, agents, and authorised processors acting on its behalf.
• "You" or "Member" means any individual who has registered a upo77 Account or who accesses the Platform in any capacity, including as a visitor without an Account.
• "Personal Data" means any information that relates to an identified or identifiable natural person, including but not limited to name, date of birth, email address, phone number, residential address, financial account details, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, consultation, use, disclosure, transmission, restriction, erasure, or destruction.
• "KYC" means Know Your Customer — the identity and age verification process upo77 conducts to comply with anti-money laundering obligations and to enforce the 21+ age restriction.
• "Cookies" means small text files placed on your device by the Platform to enable core functionality, personalisation, analytics, and security features.
• "Third-Party Processor" means any external company or service provider that processes Personal Data on upo77's behalf under a data processing agreement, including payment gateway operators, identity verification providers, and analytics platforms.

upo77 collects the following categories of Personal Data, depending on the nature of your interaction with the Platform:

upo77 collects Personal Data through the following channels:

1. Directly from You: When you register an Account, complete the KYC verification process, make a deposit or withdrawal, contact our support team, or update your Account preferences, you provide Personal Data to upo77 directly.
2. Automatically: When you access and use the Platform, our servers, analytics tools, and cookies automatically record Technical Data and Usage Data, including your IP address, device information, session timestamps, and in-platform activity. This collection occurs regardless of whether you are logged in to an Account.
3. From Third-Party Processors: upo77 may receive Personal Data from authorised Third-Party Processors, including identity verification services that confirm KYC document authenticity, payment processors that confirm transaction status, and fraud-detection providers that flag anomalous account activity.
4. From Publicly Available Sources: In limited circumstances relevant to fraud prevention or regulatory compliance, upo77 may cross-reference data against publicly available sanctions lists, watchlists, or adverse media databases.

upo77 processes your Personal Data for the following specific, explicit, and legitimate purposes:

1. Account Management: Creating and maintaining your upo77 Member Account, authenticating logins, enabling secure access to the Platform, and managing Account preferences.
2. Identity Verification (KYC): Verifying your identity and age (21+ requirement) prior to processing withdrawals, and fulfilling anti-money laundering (AML) compliance obligations. Indonesian residents are required to provide their KTP as the primary identity document.
3. Payment Processing: Facilitating deposits via Indonesian bank transfers (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja), processing withdrawal requests, and maintaining accurate financial records.
4. Service Delivery: Providing access to sports betting markets (including BRI Liga 1, Timnas Indonesia, EPL, Champions League, and other competitions), live casino games, slots, fish shooting, and video poker features.
5. Responsible Gaming: Monitoring gameplay patterns to identify indicators of problem gambling behaviour, enforcing deposit limits, session time reminders, cool-off periods, and self-exclusion requests in accordance with our Responsible Gaming commitments.
6. Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent activity, money laundering, multiple account creation, bonus abuse, and unauthorised access. Technical Data including IP addresses and device fingerprints are used for this purpose.
7. Customer Support: Responding to enquiries, resolving disputes, and maintaining communication records for quality assurance and training purposes.
8. Marketing Communications: Sending promotional offers, bonus notifications, and seasonal campaign information (such as Idul Fitri, Ramadhan, or Chinese New Year promotions) to Members who have opted in to receive such communications. You may opt out at any time.
9. Analytics & Platform Improvement: Analysing aggregated usage data to understand how Members interact with the Platform, identify technical issues, and improve the user experience, game selection, and payment flow.
10. Legal & Regulatory Compliance: Complying with applicable legal obligations, responding to lawful requests from regulatory authorities, and maintaining records as required by law.

upo77 processes your Personal Data on the following legal bases, which vary by purpose:

• Contractual Necessity: Processing required to fulfil our contractual obligations to you as a Member — including Account management, payment processing, and game delivery — is carried out on the basis that it is necessary for the performance of the contract between you and upo77.
• Legal Obligation: KYC verification, AML screening, and record-keeping are carried out to comply with applicable legal and regulatory requirements binding on upo77 as a licensed operator.
• Legitimate Interests: Fraud prevention, platform security, responsible gaming monitoring, and analytics are carried out on the basis of upo77's legitimate interest in operating a safe, fair, and commercially viable platform, provided that interest is not overridden by your privacy rights.
• Consent: Marketing communications and non-essential cookies are processed only where you have given your explicit, freely given, informed consent. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

upo77 does not sell your Personal Data. We share Personal Data only in the following limited circumstances:

1. Authorised Third-Party Processors: upo77 engages Third-Party Processors to perform specific functions on our behalf, including payment gateway operators (to process IDR deposits and withdrawals), identity verification providers (to authenticate KYC documents), live casino studio providers (including Evolution Gaming and Pragmatic Play), and platform analytics services. These processors are contractually bound to process Personal Data only on upo77's documented instructions and to implement appropriate security measures.
2. Game Studio Providers: When you participate in games powered by third-party studios (such as Pragmatic Play, NetEnt, Microgaming, Spribe, or Pocket Games Soft), limited transactional data (such as session tokens and bet amounts) is transmitted to the studio's platform to enable game functionality. Studio providers are contractually prohibited from using this data for their own marketing purposes.
3. Regulatory and Law Enforcement Authorities: upo77 may disclose Personal Data to competent regulatory bodies, law enforcement agencies, or courts where required by applicable law, lawful court order, or where upo77 reasonably believes disclosure is necessary to prevent illegal activity, fraud, or imminent harm.
4. Business Transfers: In the event of a merger, acquisition, or sale of all or a material portion of upo77's assets, Personal Data may be transferred to the acquiring entity. You will be notified via your registered email address and a Platform notice prior to any such transfer taking effect, and you will have the right to request Account closure if you do not consent to the transfer.
5. With Your Explicit Consent: upo77 will not share your Personal Data with any other third party without your prior explicit consent, except as described in this Section.

upo77 uses cookies and similar tracking technologies to ensure the Platform functions correctly, to remember your preferences, to protect your Account, and to understand how the Platform is used. The following categories of cookies are in use:

You may manage your cookie preferences at any time through your browser settings. Please note that disabling Strictly Necessary or Security cookies will impair or prevent your use of the Platform. upo77 does not use third-party advertising or retargeting cookies.

upo77 retains Personal Data for as long as is necessary to fulfil the purposes for which it was collected, including satisfying legal, regulatory, and operational requirements. The following retention periods apply as a general guide:

• Account and Identity Data: Retained for the duration of your active Membership and for a minimum of five (5) years following Account closure, to comply with AML record-keeping obligations.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction in accordance with applicable financial record-keeping requirements.
• KYC Documents: Retained for a minimum of five (5) years following Account closure or the completion of the KYC process, whichever is later.
• Customer Support Communications: Retained for three (3) years from the date of the most recent interaction, for quality assurance and dispute resolution purposes.
• Usage and Technical Data: Retained in identifiable form for up to twelve (12) months, after which data is aggregated and anonymised for long-term analytics. Anonymised data is not subject to this Policy.
• Marketing Preference Records: Retained for as long as your Account is active, and for one (1) year following Account closure to document the lawfulness of any marketing communications sent during the Membership period.

At the end of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised in accordance with upo77's data disposal procedures.

upo77 implements a range of technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, alteration, or disclosure. These measures include:

1. Transport Encryption: All data transmitted between your device and the upo77 Platform is encrypted using TLS 1.2 or higher (256-bit SSL). The padlock icon displayed in your browser confirms that your connection is secure.
2. Data-at-Rest Encryption: Sensitive Personal Data stored in upo77's databases — including financial account details and KYC documents — is encrypted at rest using AES-256 encryption.
3. Access Controls: Access to Member Personal Data by upo77 staff and authorised processors is restricted on a strict need-to-know basis. Access privileges are reviewed periodically, and all data access is logged for audit purposes.
4. Penetration Testing: upo77 conducts periodic security assessments and penetration tests to identify and remediate vulnerabilities in the Platform's infrastructure and codebase.
5. Password Security: Member passwords are stored as salted cryptographic hashes. upo77 staff cannot view your password in plain text; our support team will never ask you to provide your password.
6. Incident Response: In the event of a data security incident that poses a risk to your rights and freedoms, upo77 will take prompt remedial action and notify affected Members as soon as reasonably practicable, along with details of the nature of the incident and the steps taken to address it.

Subject to applicable law and certain limitations inherent in the operation of an online gambling platform (such as mandatory KYC and AML record-keeping obligations), you have the following rights in respect of your Personal Data held by upo77:

1. Right of Access: You have the right to request a copy of the Personal Data upo77 holds about you, along with information about how it is being processed. Requests will be fulfilled within 30 days of receipt.
2. Right to Rectification: You have the right to request the correction of inaccurate or incomplete Personal Data. Where your name, address, or contact details have changed, you may update these directly in your Account settings or by contacting support.
3. Right to Erasure: You have the right to request the deletion of your Personal Data in certain circumstances, such as where the data is no longer necessary for the purposes for which it was collected. This right is subject to upo77's legal obligation to retain certain data for AML and record-keeping purposes.
4. Right to Restriction: You have the right to request that upo77 restrict the processing of your Personal Data in specific circumstances, such as while a dispute regarding data accuracy is being resolved.
5. Right to Data Portability: You have the right to receive a copy of the Personal Data you have provided to upo77 in a structured, commonly used, machine-readable format, and to transmit that data to another controller where technically feasible.
6. Right to Object: You have the right to object at any time to the processing of your Personal Data for direct marketing purposes. You may also object to processing carried out on the basis of legitimate interests, though upo77 may override this objection where it can demonstrate compelling legitimate grounds.
7. Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications and non-essential cookies), you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, please contact upo77's support team via live chat or at [email protected]. upo77 may request proof of identity before processing your request to protect against unauthorised data access.

The upo77 Platform is intended exclusively for adults who are 21 years of age or older. upo77 does not knowingly collect Personal Data from individuals under the age of 21.

During the registration process, upo77 collects date of birth information and verifies it against the KTP (Indonesian National Identity Card) provided during KYC verification. Any Account found to have been registered by a person under 21 years of age will be immediately suspended, all pending transactions will be reversed, and any balance held will be returned to the depositing payment method following verification.

If you are a parent or guardian and you believe that a minor in your care has registered an Account on the upo77 Platform without your knowledge, please contact our support team immediately at [email protected] so that we may take prompt action to close the Account and return any deposited funds.

The upo77 Platform may display informational references to third-party services such as game studio providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft), sports data providers, or payment processors. upo77 does not maintain live outbound links to external websites within the Platform's content areas.

Where any link to a third-party website is present, upo77 is not responsible for the privacy practices or the content of those external sites. We encourage you to read the privacy policy of any third-party site you visit. upo77's Privacy Policy applies solely to data collected through the upo77 Platform at https://upo77.org.

upo77 reserves the right to update or amend this Privacy Policy at any time. Changes may be made to reflect updates in applicable law, changes to our data processing practices, new Platform features, or the onboarding of new Third-Party Processors.

When material changes are made, upo77 will post a notice on the Platform and update the "Last Updated" date at the top of this page. Where the changes significantly affect how we process your Personal Data, upo77 will additionally notify you via your registered email address and, where required by law, seek your renewed consent before the changes take effect.

Your continued use of the Platform after the publication of an updated Privacy Policy constitutes your acknowledgement of and agreement to the updated terms. The current version of this Privacy Policy is always available at https://upo77.org/privacy-policy. upo77 recommends that you review this page periodically to remain informed of how your data is being handled.

If you have any questions, concerns, or requests relating to this Privacy Policy or upo77's handling of your Personal Data, please contact us through the following channels:

• Live Chat: Available 24/7 via the on-site chat widget. For urgent privacy or data security concerns, live chat is the recommended first point of contact. Average response time is under 2 minutes. Indonesian-speaking agents are available during WIB (UTC+7) peak hours.
• Data & Privacy Enquiries: [email protected] — please include "Privacy Request" in the subject line of your email to ensure your query is routed to the appropriate team.
• Business & Partnership Inquiries: [email protected]

upo77 aims to acknowledge all privacy-related email enquiries within one WIB business day (Monday–Friday, WIB UTC+7, Jakarta) and to resolve data subject access requests, rectification requests, and erasure requests within thirty (30) calendar days of receipt.