Privacy Policy

1 Scope & Definitions

1.1 This Privacy Policy governs the collection, processing, storage, and sharing of personal data by cair77 ("we", "us", "our", "the Platform") in connection with the provision of online betting and gaming services to members located in Indonesia.

1.2 For the purposes of this policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person, including name, identity document number, email address, IP address, device identifiers, and financial account details.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, or deletion.
• "Member" means any individual who has registered an account on the cair77 platform.
• "KYC Data" means identity and document data submitted as part of the Know Your Customer verification process, including KTP scans and selfie photographs.
• "Third-Party Processor" means any external company engaged by cair77 to process personal data on our behalf under a binding data processing agreement.

2 Data We Collect

2.1 cair77 collects personal data across the following categories:

2.2 cair77 does not collect or store full payment card numbers. Where card payments are processed, they are handled directly by PCI-DSS-compliant payment processors, and cair77 receives only a tokenized reference.

3 How We Collect Data

3.1 Directly from You. The majority of the personal data cair77 holds is provided directly by you during the registration process, KYC submission, deposit and withdrawal transactions, and any communications with our support team via live chat, email, or WhatsApp.

3.2 Automatically. When you visit or use the cair77 platform, certain technical and usage data is collected automatically through cookies, web beacons, log files, and similar tracking technologies. This includes your IP address, device identifiers, browser configuration, and in-session behavior patterns. See Clause 8 for full details on cookies and tracking.

3.3 From Third Parties. cair77 may receive limited personal data from third-party sources in the following circumstances:

• Payment processors and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) confirming transaction outcomes;
• Identity verification service providers used to cross-reference KYC submissions against authoritative data sources;
• Fraud detection and anti-money-laundering (AML) screening services that flag risk signals associated with a particular identity or device fingerprint;
• Analytics platforms that provide aggregated, anonymized audience data to help us understand platform usage patterns.

3.4 Inferred Data. cair77 may derive additional data points about your preferences and behavior from the data we already hold — for example, inferring your preferred sports markets based on your betting history, or identifying your preferred deposit method. Inferred data is used solely for platform personalization and is not shared with third parties for profiling purposes.

4 Purposes of Processing

4.1 cair77 processes personal data only for the specific, legitimate purposes described below. We do not use personal data for any purpose that is incompatible with the purpose for which it was originally collected without first obtaining your consent.

5 Legal Basis for Processing

5.1 Contractual Necessity. Most personal data processing by cair77 is necessary for the performance of the contract between you and the platform — specifically, to operate your account, process your bets, and execute your deposit and withdrawal instructions. Without this processing, cair77 cannot provide its services.

5.2 Legal Obligation. Certain processing is required by law. This includes our obligations to conduct KYC identity verification, to screen transactions against AML and counter-terrorism financing (CTF) watchlists, and to maintain financial records for the retention periods specified in Clause 9.

5.3 Legitimate Interests. cair77 processes some personal data on the basis of legitimate interests — including fraud detection, platform security, abuse prevention, and general platform analytics. We apply a balancing test before relying on this basis and will not use it where your fundamental rights and interests override our legitimate interests.

5.4 Consent. Where processing is not required by contract or law, cair77 will seek your explicit consent — for example, before sending promotional emails or SMS campaigns. You may withdraw consent at any time as described in Clause 12. Withdrawal of consent does not affect the lawfulness of processing that occurred before the withdrawal.

6 Data Sharing

6.1 cair77 does not sell or commercially transfer personal data. We share data only in the following limited circumstances and only to the extent strictly necessary:

• Payment Processors & Banking Partners: Financial data is shared with Indonesian bank partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) solely to execute deposit and withdrawal instructions.
• Identity Verification Providers: KYC Data is shared with licensed identity verification service providers to confirm document authenticity and cross-reference identity claims. These providers operate under binding data processing agreements and may not use the data for any other purpose.
• Game Content Studios: Gameplay data (game session identifiers, bet amounts, outcomes) may be shared with licensed game studios — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft — for the purpose of game result verification and fairness auditing.
• Fraud & AML Service Providers: Technical Data and Financial Data may be processed by specialist fraud-detection and AML-screening vendors operating as Third-Party Processors under strict contractual controls.
• Legal and Regulatory Authorities: cair77 will disclose personal data to competent authorities where required by applicable law, court order, or a binding regulatory demand. We will, where legally permissible, notify you of any such request.
• Corporate Transactions: In the event of a merger, acquisition, or restructuring of cair77's operating entity, personal data may be transferred to the successor entity. You will be notified of any such transfer and any material change to this policy that results from it.

6.2 All Third-Party Processors engaged by cair77 are required to implement appropriate technical and organizational security measures and are contractually prohibited from using your personal data for any purpose beyond the specific service they provide to cair77.

7 International Data Transfers

7.1 cair77 operates internationally, and some personal data may be stored or processed on servers located outside of Indonesia. Where such transfers occur, cair77 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that applicable in Indonesia.

7.2 Safeguards applied to international data transfers include:

• Binding contractual clauses in agreements with all Third-Party Processors operating outside Indonesia;
• Transfer only to jurisdictions that maintain adequate data protection standards as assessed by cair77's compliance team;
• Encryption of data in transit and at rest regardless of the jurisdiction in which it is stored.

7.3 If you would like further information about the specific safeguards applied to a particular international transfer, please contact our support team.

8 Cookies & Tracking Technologies

8.1 cair77 uses cookies and similar technologies to operate the platform, remember your preferences, maintain session security, and analyze usage patterns. The following categories of cookies are in use:

8.2 Most browsers allow you to control or disable cookies through their settings. Please note that disabling strictly necessary cookies will prevent you from logging in to your cair77 account. Disabling analytics and functional cookies will not prevent you from using the platform but may affect your experience.

9 Data Retention

9.1 cair77 retains personal data for only as long as necessary to fulfill the purpose for which it was collected, or as required by applicable regulatory or legal obligations. The following retention periods apply as a general guide:

9.2 Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in a manner that prevents re-identification.

10 Data Security

10.1 cair77 implements a layered security architecture to protect your personal data against unauthorized access, accidental loss, alteration, or disclosure. Key security measures include:

• 256-bit SSL/TLS encryption for all data in transit between your browser or app and our servers;
• AES-256 encryption for personal data stored in our databases;
• Multi-factor authentication (MFA) for all internal staff accessing production systems containing personal data;
• Role-based access controls ensuring that employees access only the data necessary for their specific job function;
• Regular penetration testing and vulnerability assessments conducted by independent third-party security firms;
• 24/7 automated threat monitoring and intrusion detection systems on all production infrastructure.

10.2 In the event of a personal data breach that is likely to result in a risk to your rights and interests, cair77 will notify affected members without undue delay, with a description of the nature of the breach, the data categories affected, and the steps cair77 has taken and is taking to mitigate the impact.

10.3 You also play a role in keeping your data secure. You are responsible for maintaining the confidentiality of your login credentials and for ensuring that your registered email account is secured with a strong, unique password and two-factor authentication where available.

11 Children's Privacy

11.1 The cair77 platform is strictly for adults aged 21 and over. We do not knowingly collect personal data from individuals under the age of 21. All registration attempts are subject to age verification, and accounts are suspended pending KYC where age eligibility cannot be confirmed at the point of registration.

11.2 If we become aware that personal data has been collected from a person under the age of 21, we will take immediate steps to delete that data and close the associated account. If you believe that a minor has registered on the platform, please contact our support team immediately.

12 Marketing Communications

12.1 With your consent, cair77 may send you promotional communications by email, SMS, or in-platform notification. These may include information about new games, seasonal promotions tied to Indonesian events such as Idul Fitri, Ramadhan, Independence Day (17 August), and Chinese New Year (Imlek), as well as sports-betting promotions linked to BRI Liga 1, EPL, Champions League, and other major football competitions.

12.2 Transactional communications — including deposit confirmations, withdrawal notifications, security alerts, and KYC status updates — are not marketing communications and will be sent regardless of your marketing preferences, as they are necessary for the operation of your account.

12.3 You may withdraw your consent to marketing communications at any time by:

• Updating your notification preferences in the account dashboard;
• Clicking the unsubscribe link included in any promotional email;
• Contacting our support team via live chat or email.

12.4 Withdrawal of marketing consent will take effect within 72 hours. You may continue to receive transactional communications after withdrawing marketing consent, as these remain necessary for account operation.

13 Exercising Your Data Rights

13.1 To exercise any of the rights described in the "Your Data Rights" section above — access, rectification, erasure, restriction, portability, or objection — please submit a request to our support team via live chat or by emailing [email protected]. Please note that this email address is displayed as plain text and is not a clickable link.

13.2 For security purposes, we will verify your identity before processing any data rights request. You will be asked to confirm details that only the registered account holder would know, and in some cases to provide a copy of your KTP.

13.3 cair77 will respond to verified data rights requests within thirty (30) calendar days. Where a request is complex or where multiple requests have been submitted, we may extend this period by a further sixty (60) days, in which case we will notify you of the extension and the reason for it.

13.4 cair77 will not charge a fee for processing data rights requests unless a request is manifestly unfounded or excessive — for example, where the same request is submitted repeatedly in a short period of time. In such cases, we reserve the right to charge a reasonable administrative fee or to decline the request, explaining our reasons in writing.

14 Third-Party Links

14.1 The cair77 platform may contain references to third-party services — for example, links to game studio support pages or payment provider help centers. These third-party services operate under their own privacy policies, which cair77 does not control and is not responsible for.

14.2 cair77 recommends that you review the privacy policy of any third-party service before providing them with your personal data. The existence of a link to a third-party service on the cair77 platform does not constitute an endorsement of that service's privacy practices.

15 Policy Amendments

15.1 cair77 reserves the right to update this Privacy Policy at any time. Material changes — those that affect the categories of data we collect, the purposes for which we use it, or the rights available to you — will be communicated to registered members via the email address on file at least seven (7) days before the change takes effect.

15.2 Minor updates — such as clarifications of existing practices, correction of typographical errors, or changes to contact information — may be made without prior notice. The effective date shown at the top of this document will always reflect the most recently published version.

15.3 Your continued use of the cair77 platform after the effective date of any amendment to this Privacy Policy constitutes your acknowledgment of the revised policy. If you do not agree with a material change, you should cease using the platform and request account closure before the effective date of the change.

16 Contact & Complaints

16.1 For any questions, concerns, or requests relating to this Privacy Policy or the way cair77 handles your personal data, please contact us through any of the following channels:

16.2 If you are not satisfied with cair77's response to a privacy complaint, you have the right to escalate your complaint to the relevant data protection authority or supervisory body in the jurisdiction applicable to your situation. cair77 will cooperate fully with any such authority in the resolution of a complaint.

16.3 For responsible gaming concerns that involve personal data — for example, requesting deletion of your account under a self-exclusion arrangement — please refer to our Responsible Gaming page for specific guidance on the process and timelines involved.