Privacy Policy

This Privacy Policy ("Policy") sets out how bara77 ("the Company", "we", "us", "our") collects, processes, stores, and shares personal data in connection with the operation of the bara77 online betting and casino platform, accessible at https://bara77.cam ("the Platform").

The Company is committed to protecting the privacy and personal data of all registered players ("Users") and visitors to the Platform. This Policy has been drafted in accordance with internationally recognised data-protection principles, including those reflected in the General Data Protection Regulation (GDPR) framework, which we apply as a baseline standard across all markets we serve — including Indonesia.

By registering an Account on the bara77 Platform, completing the KYC (Know Your Customer) verification process, or continuing to use the Platform after the effective date of this Policy, you acknowledge that you have read and understood this Policy in its entirety and consent to the processing of your personal data as described herein. If you do not agree to this Policy, you must not register an Account or continue using the Platform.

For the purposes of this Policy, the following terms have the meanings set out below:

The Company collects Personal Data in the following categories, depending on the nature and stage of your interaction with the Platform:

The Company collects Personal Data through the following channels:

• Directly from you: When you register an Account, complete KYC verification, submit a deposit or withdrawal request, contact our support team, or respond to a survey or promotion.
• Automatically through the Platform: Via cookies, web beacons, server logs, and similar tracking technologies that record Technical Data each time you access the Platform. See Section 8 (Cookies & Tracking) for full details.
• From third-party service providers: Including identity verification bureaus that cross-reference your KTP or other identity documents; payment processors (e.g., bank transfer networks, e-wallet platforms including OVO, DANA, GoPay, ShopeePay, and LinkAja) that process your financial transactions; and AML/fraud-screening services that flag unusual account activity.
• From publicly available sources: Including sanctions lists, politically exposed person (PEP) databases, and adverse media sources used for AML compliance screening.

The Company processes Personal Data on the following legal bases:

• Contractual necessity: Processing is required to perform the contract between you and the Company — specifically, to operate your Account, process deposits and withdrawals in IDR, settle wagers, and deliver promotional offers you have opted into.
• Legal obligation: Processing is required for the Company to comply with applicable laws and regulations, including anti-money laundering (AML) obligations, counter-terrorism financing (CTF) requirements, and the terms of the Company's international gaming licence.
• Legitimate interests: Processing is necessary for the Company's legitimate interests in fraud prevention, platform security, responsible gaming monitoring, product improvement, and customer service delivery — provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: For non-essential processing activities — such as sending you promotional communications about new offers, seasonal promotions (e.g., Idul Fitri bonuses, Ramadhan reload promotions), or participation in optional responsible gaming self-assessment tools — we rely on your freely given, specific, and revocable consent.

The Company uses the Personal Data it collects for the following specific purposes:

• Account management: Creating, verifying, and maintaining your bara77 Account; processing login and authentication requests; managing Account security settings.
• Transaction processing: Executing deposits and withdrawals via supported Indonesian payment methods (BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, LinkAja, and others); reconciling transaction records; managing your IDR Wallet Balance.
• KYC & compliance: Verifying your identity and age (21+ requirement); screening against AML and sanctions databases; fulfilling reporting obligations under the Company's gaming licence.
• Gaming operations: Delivering the Platform's full product range — including sports betting, live casino, togel (Indonesia's traditional numbers lottery), slot games, and crash games; settling wagers; applying bonus wagering requirements; and enforcing game-specific rules.
• Customer support: Responding to your inquiries, complaints, and dispute submissions through live chat and email; maintaining a record of communications for quality assurance and audit purposes.
• Responsible gaming: Monitoring gaming patterns for indicators of problem gambling; enforcing deposit limits, loss limits, session controls, and self-exclusion orders you have activated; proactively reaching out to Users who display at-risk behaviour.
• Fraud prevention and security: Detecting and investigating suspicious account activity, unauthorised access attempts, bonus abuse, and multi-accounting; protecting the integrity of the Platform and its Users.
• Marketing communications: Sending you promotional emails and notifications about offers relevant to your gaming preferences — only where you have provided explicit consent and have not subsequently opted out. You may withdraw consent at any time by contacting our support team.
• Platform improvement: Analysing aggregated, anonymised usage data to understand how players interact with the Platform and to inform product development decisions.

The Company does not sell your Personal Data to any third party. We share Personal Data only in the following circumstances and only to the extent strictly necessary for each purpose:

• Payment processors: Your financial data is shared with the relevant Indonesian bank transfer networks, e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja), and payment gateway providers to execute your deposit and withdrawal instructions. These providers act as Data Processors under binding data-processing agreements with the Company.
• Identity verification providers: Your Identity Data and supporting KYC documents are shared with our contracted third-party identity and age-verification service to confirm that you meet the 21+ eligibility requirement and that your identity matches the payment method registered to your Account.
• AML and fraud-screening services: Identity and transaction data is shared with AML compliance screening tools that cross-reference your details against sanctions lists and PEP databases as required under the Company's licensing obligations.
• Game content providers: Technical session data — such as your Account identifier, stake amounts, and game outcomes — is shared with licensed game studios (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft) to deliver their games through the Platform. These studios do not receive your name, contact details, or financial account information.
• Regulatory and law enforcement authorities: The Company will disclose Personal Data to competent regulatory bodies, financial intelligence units, or law enforcement agencies where required to do so by applicable law, court order, or valid legal process. We will, where permitted by law, notify you of such a disclosure.
• Professional advisers: Lawyers, auditors, and insurers engaged by the Company may access Personal Data on a strictly need-to-know basis under professional confidentiality obligations.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of the Company's business, your Personal Data may be transferred to the acquiring entity. You will be notified of any such transfer and your rights under this Policy will continue to apply.

All third parties with whom we share Personal Data are required to implement appropriate technical and organisational security measures and to process data only in accordance with our documented instructions. The Company conducts due-diligence reviews of all Data Processors before engagement and on a periodic basis thereafter.

The bara77 Platform uses cookies and similar tracking technologies to deliver a functional, secure, and personalised experience. A cookie is a small text file placed on your device by the Platform's server when you visit the site. The following categories of cookies are used:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function. They manage your authenticated session, remember your login state, and ensure security features such as CSRF (cross-site request forgery) protection operate correctly. These cookies cannot be disabled without breaking core Platform functionality.
• Functional Cookies: These cookies remember your preferences — such as your preferred currency display format (IDR), language settings, and responsible gaming tool configurations — so you do not need to re-enter them on each visit.
• Analytics Cookies: Aggregated, anonymised data collected via analytics cookies helps the Company understand which areas of the Platform are most frequently used, how long Users spend on each page, and where technical errors occur. This data is used exclusively to improve the Platform. No analytics cookie links data to your Account identity.
• Security Cookies: These cookies help the Company detect and prevent fraudulent activity, including multi-accounting and bot-driven behaviour, by tracking device fingerprints, IP addresses, and session patterns over time.

You may control cookie behaviour through your browser settings. Please note that disabling certain cookie categories — particularly strictly necessary cookies — may impair or prevent your use of the Platform. The Company does not use cookies to serve third-party advertising or to track your activity on websites other than the bara77 Platform.

The Company retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply as a general guide:

• Account Data and Identity Data: Retained for the duration of your active Account, plus a minimum of five (5) years following Account closure. This period is dictated by the Company's AML record-keeping obligations under its international gaming licence.
• Transaction and Financial Data: Retained for a minimum of five (5) years from the date of each transaction, in compliance with financial record-keeping regulations.
• KYC Documents: Retained for the duration of your active Account plus five (5) years, or longer if required by a specific regulatory obligation, investigation, or legal proceeding.
• Gaming Activity Data: Retained for five (5) years from the date of each gaming session to support dispute resolution, responsible gaming monitoring, and regulatory reporting.
• Communications and Support Records: Retained for three (3) years from the date of each interaction, unless the communication relates to an unresolved dispute or regulatory matter, in which case it is retained until final resolution.
• Marketing Consent Records: Retained for the duration of your active consent plus two (2) years, to demonstrate your consent history if challenged.

Upon expiry of the relevant retention period, Personal Data is securely deleted or anonymised such that it can no longer be used to identify you. Anonymised and aggregated data may be retained indefinitely for statistical and product-development purposes.

The Company implements a layered set of technical and organisational security measures designed to protect your Personal Data against unauthorised access, loss, alteration, disclosure, or destruction. Key measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the Platform's servers is encrypted using industry-standard 256-bit SSL/TLS protocols, ensuring that your credentials, financial data, and gaming activity cannot be intercepted in transit.
• Encrypted Data Storage: Sensitive Personal Data — including Identity Data, Financial Data, and KYC documents — is encrypted at rest using AES-256 encryption in the Company's secure data infrastructure.
• Access Controls: Access to Personal Data within the Company is restricted on a strict need-to-know basis. All staff with access to Personal Data are subject to confidentiality obligations and receive regular data-protection training.
• Multi-Factor Authentication (MFA): Administrative access to data systems requires multi-factor authentication. Users are strongly encouraged to enable MFA on their own Accounts for additional protection.
• Penetration Testing and Vulnerability Management: The Platform undergoes regular independent security audits and penetration tests. Identified vulnerabilities are remediated according to a documented priority framework.
• Incident Response: The Company maintains a documented data-breach response plan. In the event of a security incident that poses a material risk to your rights and freedoms, we will notify affected Users and, where required, the relevant regulatory authority, within the timeframe prescribed by applicable law.

As a User whose Personal Data is processed by bara77, you hold the following rights with respect to your data. To exercise any of these rights, please contact our support team at [email protected]. We will respond to all verified rights requests within thirty (30) calendar days.

• Right of Access: You have the right to request a copy of the Personal Data we hold about you, together with an explanation of how it is being used and the legal basis for each processing activity.
• Right to Rectification: You have the right to request the correction of any inaccurate or incomplete Personal Data we hold about you. Where data accuracy is critical to financial transactions or KYC compliance, verification may be required before corrections are applied.
• Right to Erasure ("Right to Be Forgotten"): You may request the deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where the data has been unlawfully processed. This right is subject to the Company's legal retention obligations described in Section 9.
• Right to Restriction of Processing: You may request that we restrict the processing of your Personal Data in certain circumstances — for example, while the accuracy of data is contested, or while an objection to processing is under review.
• Right to Data Portability: You may request that we provide your Personal Data in a structured, commonly used, machine-readable format so that you can transfer it to another service provider, where technically feasible and where the processing is based on consent or contractual necessity.
• Right to Object: You have the right to object at any time to the processing of your Personal Data on the basis of the Company's legitimate interests. If you object, the Company will cease processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where the Company's processing of your data is based on consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
• Right to Lodge a Complaint: If you believe that the Company has processed your Personal Data in violation of applicable data-protection law, you have the right to lodge a complaint with the relevant data-protection supervisory authority in your jurisdiction.

The bara77 Platform is strictly intended for adults aged 21 years and older. The Company does not knowingly collect, store, or process Personal Data belonging to individuals under the age of 21. All Users are required to confirm during registration that they meet the minimum age requirement, and this is verified through our mandatory KYC process.

If the Company becomes aware that Personal Data belonging to a person under 21 years of age has been collected — whether through misrepresentation during registration or any other means — that Account will be immediately suspended, all associated data will be securely deleted to the extent not required for regulatory reporting, and any funds in the Account will be handled in accordance with our legal obligations. We may also report the matter to the relevant authority if the circumstances warrant.

If you are a parent or guardian and believe that your child has registered an Account on the Platform without your knowledge, please contact our support team immediately at [email protected] so that we may investigate and take appropriate action without delay.

The Company operates internationally and may transfer Personal Data to servers, service providers, or group entities located in countries outside Indonesia. Where such transfers occur, the Company ensures that appropriate safeguards are in place to maintain a level of data protection equivalent to that described in this Policy, including:

• Standard contractual clauses (SCCs) or equivalent legally approved transfer mechanisms included in agreements with all Data Processors in third countries.
• Transfer only to jurisdictions that have been assessed by the Company as providing an adequate level of data protection relative to the purpose of the transfer.
• Binding contractual obligations on all international Data Processors restricting their use of Personal Data to the specific purposes for which it was transferred.

The Company reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, our data-processing practices, or the services we offer. When we make a material change to this Policy — meaning a change that substantively affects how we collect, use, or share your Personal Data — we will notify you via the email address associated with your Account or via a prominent notice on the Platform, at least seven (7) days before the change takes effect.

Non-material clarifications, corrections, and formatting updates may be made without prior notice. The "Last Updated" date at the top of this page reflects the date of the most recent revision. We encourage you to review this Policy periodically. Continued use of the Platform after the effective date of any amendment constitutes your acceptance of the revised Policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or the Company's data-processing practices, please contact our Data Protection team through any of the following channels. We are committed to responding promptly and transparently to all privacy-related inquiries.

• Email: [email protected] — please include "Privacy Request" in the subject line for fastest routing to the correct team.
• Live Chat: Available 24 hours a day, seven days a week, through the chat interface on the Platform. Our Indonesian-speaking support agents can assist you in Bahasa Indonesia if preferred, even though the Platform itself is operated in English.
• Response Times: We aim to acknowledge all privacy-related inquiries within 24 hours (WIB, UTC+7) and to provide a substantive written response within 30 calendar days. Complex requests — such as full data-access exports — may require additional time, in which case we will inform you of the expected timeline.