Privacy Policy

1 Definitions

The following definitions apply throughout this Privacy Policy:

• "Personal Data" means any information relating to an identified or identifiable natural person — i.e., data that can directly or indirectly identify you as an individual, including your name, national identity number, email address, mobile phone number, IP address, device identifiers, and financial account details.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, consultation, use, disclosure, transmission, combination, restriction, erasure, or destruction.
• "Data Controller" means bada77, the entity that determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Processor" means any third-party service provider that processes Personal Data on behalf of bada77 under written contractual obligations, including payment processors, KYC verification vendors, and cloud infrastructure providers.
• "Player" / "You" means any registered account holder or visitor to the bada77 Platform whose Personal Data is collected and processed under this Policy.
• "Platform" means the bada77 website accessible at https://bada77.cam and all related services, features, and digital interfaces operated thereunder.
• "Cookies" means small text files placed on your device by the Platform for the purpose of session management, analytics, security, and personalization.
• "KYC" means Know Your Customer identity verification processes, including submission and review of government-issued identity documents and supporting financial documentation.
• "AML" means Anti-Money Laundering compliance obligations that require bada77 to monitor, record, and in certain circumstances report financial transactions and associated player data to competent authorities.

2 Scope & Applicability

This Privacy Policy applies to all Personal Data collected by bada77 in connection with the operation of the Platform, including data collected from:

• Individuals who register or apply to register a Player Account on the Platform
• Active registered Players accessing the Platform from any device or location
• Individuals who contact bada77 customer support via live chat, email, or WhatsApp without holding a registered account
• Visitors to the Platform who have not registered an account but whose technical data (IP addresses, browser fingerprints, cookie data) is passively collected during site visits
• Former Players whose accounts have been closed, suspended, or voluntarily deactivated, to the extent that applicable legal retention obligations require continued data storage

This Policy is written in English. The English version is the authoritative version. Indonesian-language summaries provided via customer service channels are for informational convenience only and do not supersede the English text of this Policy.

This Policy should be read alongside bada77's Terms & Conditions, which govern the overall contractual relationship between bada77 and Players.

3 Data We Collect

bada77 collects the following categories of Personal Data, depending on your relationship with the Platform:

Sensitive data: bada77 does not intentionally collect sensitive personal data categories such as racial or ethnic origin, religious beliefs, health data, or political opinions. Where identity documents incidentally reveal such information (e.g., religious designation on an Indonesian KTP), this data is not extracted, stored separately, or used for any processing purpose other than confirming identity authenticity.

4 How We Collect Data

bada77 collects Personal Data through the following mechanisms:

• Direct submission: Data you actively provide during account registration, KYC document upload, withdrawal bank account entry, customer support contacts, or promotional sign-ups.
• Automated technical collection: Data collected automatically by Platform infrastructure when you access the website, including IP addresses, session cookies, browser fingerprinting data, and device identifiers. This collection begins upon first Platform access regardless of whether you hold a registered account.
• Payment processing systems: Transaction data generated when you initiate deposits via BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, OVO, DANA, GoPay, ShopeePay, or LinkAja. Payment processors may share relevant transaction metadata with bada77 for reconciliation and AML monitoring purposes.
• Third-party verification services: KYC verification vendors may return enriched identity data (e.g., document authenticity scores, database match results) in addition to confirming the data you submitted.
• Game and bet activity logging: All wagering activity on the Platform is logged server-side as part of fair play assurance, dispute resolution capability, and regulatory compliance record-keeping.
• Cookies and similar tracking technologies: See Section 9 (Cookies & Tracking) for a detailed description of technologies used and opt-out mechanisms available.

5 Purposes & Legal Basis

bada77 processes your Personal Data only for specific, legitimate purposes. The table below summarizes the primary processing purposes and the legal basis relied upon for each:

Consent withdrawal: Where processing is based on consent (specifically, promotional communications), you may withdraw consent at any time by updating your preferences in Account Settings or contacting customer support. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal, and does not affect processing conducted on other legal bases.

Legitimate interest balancing: Where bada77 relies on legitimate interests as a legal basis, we have assessed that our interests (platform security, fraud prevention, service improvement) do not override your fundamental privacy rights, given the nature of the data involved and the reasonable expectations of players using a gaming platform.

6 Sharing Your Data

bada77 does not sell, rent, or trade your Personal Data to third-party marketing companies. Your data is shared only in the following defined circumstances, with parties bound by appropriate confidentiality and data protection obligations:

• Payment processors: Indonesian bank transfer networks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) receive transactional data necessary to execute deposits and withdrawals. These providers operate under their own privacy policies and applicable Indonesian financial regulations.
• KYC verification vendors: Specialist identity verification service providers receive your identity documents and return verification results. These vendors are contractually prohibited from using your data for any purpose other than providing verification services to bada77.
• Game content providers: Third-party game studios (Pragmatic Play, Evolution Gaming, PG Soft, Microgaming, Spribe, and others) may receive a pseudonymized player identifier and session token to enable game session initialization. These providers do not receive your full identity data.
• Cloud infrastructure and hosting providers: bada77's platform infrastructure relies on third-party cloud hosting services. These providers store and process data on bada77's behalf under strict data processing agreements and are prohibited from accessing or using your data independently.
• Cybersecurity and fraud prevention services: Third-party security vendors may receive technical data (IP addresses, device fingerprints, behavioral analytics) to assist with fraud detection, bot prevention, and account security monitoring.
• Legal and regulatory authorities: bada77 may disclose Personal Data to law enforcement agencies, financial intelligence units, regulatory bodies, or courts where required to do so by applicable law, court order, or regulatory directive. bada77 will disclose only the minimum data required to satisfy the legal obligation and will notify the affected Player where legally permitted to do so.
• Corporate transactions: In the event of a merger, acquisition, restructuring, or sale of bada77's business or assets, Player Personal Data may be transferred to the acquiring or successor entity. Players will be notified of any such transfer and of any material change to this Privacy Policy resulting from the transaction, with a minimum of 30 days' advance notice.

7 International Data Transfers

bada77 operates internationally and your Personal Data may be stored or processed in jurisdictions outside Indonesia, including countries where data protection laws may differ from Indonesian standards. When transferring your data internationally, bada77 applies the following safeguards:

• Contractual protections: All international data transfers to third-party processors are governed by data processing agreements that impose data protection obligations equivalent to those applied within Indonesia, including restrictions on onward transfers, security requirements, and data subject rights.
• Adequacy assessments: Before engaging any international processor, bada77 conducts a transfer impact assessment to evaluate the data protection regime in the destination country and identify any supplementary measures needed to ensure adequate protection of your data.
• Encryption in transit: All data transferred internationally is encrypted using industry-standard TLS 1.2 or TLS 1.3 protocols during transmission, and AES-256 encryption at rest on receiving servers.

By using the bada77 Platform, you acknowledge that your Personal Data may be transferred to and processed in countries outside Indonesia as described in this section. bada77 will always ensure that such transfers are conducted with appropriate safeguards in place.

8 Data Retention

bada77 retains Personal Data only for as long as necessary to fulfill the purposes for which it was collected, and to comply with applicable legal, regulatory, and contractual obligations. The following retention schedules apply:

• Active account data (Identity, Contact, Financial): Retained for the full duration of the Player's active account relationship with bada77, plus a minimum of 5 years following account closure. This extended retention period reflects AML regulatory requirements applicable to financial services providers.
• Transaction records (Deposits, Withdrawals, Bet History): Retained for a minimum of 5 years from the date of each transaction, in compliance with financial record-keeping obligations and for potential dispute resolution.
• KYC documentation: Retained for a minimum of 5 years following account closure or the completion of the business relationship to which the KYC relates, in accordance with AML best practices.
• Customer support communications: Retained for 3 years from the date of the most recent communication in a support thread, to facilitate dispute resolution and service quality review.
• Technical and log data (IP logs, session logs): Retained for 12 months from collection date, after which they are anonymized or deleted. Logs related to active security investigations are retained until the investigation is formally closed.
• Marketing preference records: Retained for the duration of the account relationship. Opt-out records are retained indefinitely to prevent accidental re-enrollment in marketing communications.
• Anonymized analytics data: Aggregated, anonymized platform usage statistics that cannot be linked back to any individual are retained indefinitely for platform improvement purposes.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymized using industry-standard data destruction methods. Deletion is irreversible; Players who submit data deletion requests should be aware that legal retention obligations may prevent immediate deletion of certain data categories as described above.

9 Cookies & Tracking Technologies

bada77 uses cookies and similar tracking technologies to operate and improve the Platform. The following categories of cookies are deployed:

• Strictly Necessary Cookies: Essential for core Platform functionality including login session management, security token validation, and fraud prevention. These cookies cannot be disabled without impairing core Platform features. No consent is required for strictly necessary cookies.
• Performance and Analytics Cookies: Collect anonymized or pseudonymized data about how Players navigate the Platform — page views, session duration, error events, game load times — to help bada77 identify performance issues and optimize the user experience. These cookies require your consent and can be disabled via your browser settings.
• Functional Cookies: Remember your preferences such as language settings, last-visited game category, and notification preferences to provide a more personalized experience. Disabling these cookies will not prevent Platform use but may reduce convenience.
• Security Cookies: Support fraud detection and account protection systems by maintaining a secure session state and flagging anomalous login behavior from unrecognized devices or IP addresses.

Managing cookies: You can control cookie settings through your browser's privacy settings. Most modern browsers allow you to view, block, or delete cookies at any time. Please note that blocking strictly necessary cookies will prevent you from logging in to the Platform. For detailed guidance on managing cookies in popular browsers, refer to your browser's official help documentation.

bada77 does not use third-party advertising cookies or behavioral tracking technologies for the purpose of serving targeted advertisements on external websites.

10 Children's Privacy

The bada77 Platform is strictly intended for adults aged 21 years and older. bada77 does not knowingly collect, process, or store Personal Data from individuals under the age of 21. This policy reflects both bada77's responsible gaming commitments and the legal age requirements applicable to online gaming in the Indonesian market context.

If bada77 becomes aware that Personal Data has been collected from an individual under the age of 21 — whether through misrepresentation during registration, post-registration KYC review, or any other means — bada77 will:

• Immediately suspend the associated account pending review
• Delete all Personal Data collected from the underage individual as promptly as technically feasible, subject only to any mandatory legal retention obligations
• Refund any real-money deposits made to the account to the originating payment source
• Permanently bar the associated identity from re-registering on the Platform

Parents or legal guardians who believe their child may have registered an account on bada77 are encouraged to contact customer support immediately at [email protected] so the matter can be investigated and resolved without delay.

11 Your Rights

As a Player whose Personal Data is processed by bada77, you hold the following rights with respect to your data. bada77 is committed to honoring these rights promptly and without undue bureaucratic friction:

How to exercise your rights: Submit a written request to [email protected] with the subject line "Data Subject Request — [Your Username]". Include your registered email address, registered username, and a clear description of the right you wish to exercise. bada77 will acknowledge your request within 3 business days and complete the request within 30 calendar days. Where requests are complex or numerous, this period may be extended by up to an additional 30 days, with prior written notice to you explaining the reason for the extension.

Identity verification for rights requests: To protect your data from unauthorized access or deletion, bada77 will verify your identity before processing any data subject request. You will be asked to confirm your registered email address and may be asked to provide additional verification information consistent with your existing KYC status.

12 Security Measures

bada77 implements a comprehensive, layered security framework to protect your Personal Data against unauthorized access, accidental loss, alteration, or disclosure. Our security measures include:

• Encryption in transit: All data transmitted between your device and bada77 servers is encrypted using TLS 1.3, the current industry gold standard for transport layer security. Our SSL certificate is verified by a trusted certificate authority.
• Encryption at rest: Sensitive data stored on bada77 servers — including identity documents, financial data, and account credentials — is encrypted using AES-256 encryption.
• Access control: Personal Data is accessible only to bada77 personnel and third-party processors with a genuine operational need. Access rights are role-based, regularly reviewed, and revoked promptly upon role change or employment termination.
• Password hashing: Player account passwords are never stored in plaintext. Passwords are hashed using bcrypt with an appropriate work factor, ensuring that even internal bada77 staff cannot retrieve your actual password.
• Two-factor authentication (2FA): Players are strongly encouraged to enable 2FA on their accounts. Where suspicious login activity is detected from an unrecognized device or IP, 2FA is automatically required before account access is granted.
• Penetration testing: bada77 commissions independent security audits and penetration testing exercises on a regular basis to identify and remediate vulnerabilities in Platform infrastructure before they can be exploited.
• Incident response: bada77 maintains a documented data breach response plan. In the event of a data breach affecting Player Personal Data, bada77 will notify affected Players and relevant regulatory authorities within the timeframes required by applicable law.
• Staff training: All bada77 personnel with access to Player data receive mandatory data protection and security training upon onboarding and on an annual basis thereafter.

While bada77 applies robust security measures, no system is entirely immune to risk. Players are encouraged to use strong, unique passwords, enable 2FA, and report any suspected unauthorized account activity to customer support immediately.

13 Third-Party Links

The bada77 Platform may, from time to time, reference or display content from third-party game providers whose game interfaces are embedded within the Platform. These third-party interfaces operate under their own privacy policies, and bada77 does not control or accept responsibility for the data practices of third-party game studios or any external websites that may be linked from promotional content.

bada77 does not host third-party advertising banners or affiliate links on the Platform that would cause your browsing data to be shared with external advertisers. If you navigate away from the bada77 Platform to any third-party site, your activity on that site is governed by that site's own privacy policy, not this Policy.

14 Changes to This Policy

bada77 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform features. The "Last Updated" date at the top of this page indicates when the most recent revision was published.

For material changes — those that meaningfully alter how we collect, use, or share your Personal Data, or that materially affect your privacy rights — bada77 will provide advance notice via the email address registered to your account no fewer than 14 calendar days before the changes take effect. The notification will summarize the key changes in plain language and link to the full updated Policy.

For non-material changes (typographic corrections, clarifications that do not alter substantive meaning, or updates reflecting minor operational changes), bada77 may update the Policy without advance notice, and the revised version will be effective upon publication.

Your continued use of the Platform following the effective date of any revised Privacy Policy constitutes your acknowledgment and acceptance of the updated terms. If you do not agree to the revised Policy, you must cease using the Platform and may request account closure through customer support.

15 Contact & Data Requests

For all privacy-related inquiries, data subject requests, or concerns about bada77's data processing practices, please contact us through the channels below. All privacy communications are handled by our dedicated Data Protection team and treated with strict confidentiality.

• Privacy & Data Protection Requests: [email protected] — for data access, rectification, erasure, portability, restriction, and objection requests
• General Customer Support: [email protected] — for account-related privacy questions, cookie preferences, and marketing opt-out requests
• Legal & Compliance Correspondence: [email protected] — for formal legal notices, regulatory authority correspondence, and data breach notifications from third parties
• Live Chat Support: Available 24/7 on the Platform for immediate assistance with routine privacy queries
• Response Commitment: All privacy requests acknowledged within 3 WIB business days; substantive responses within 30 calendar days

When submitting a privacy request by email, please include your registered username, the email address associated with your account, and a clear, specific description of your request. This enables our team to verify your identity and process your request without unnecessary delays.