Privacy Policy

1. Introduction

kayu77 ("we", "us", "our", or "the Platform") operates the online gaming and sports betting service accessible at https://kayu77.cam. This Privacy Policy describes our practices with respect to the collection, use, storage, disclosure, and protection of personal data submitted by or generated through the use of our services.

We recognise that privacy is a fundamental right. This Policy has been written to be clear and readable — not to bury important information in legal jargon. We strongly encourage you to read it in full before registering an account or using any service offered by kayu77. By accessing the Platform or creating an account, you acknowledge that you have read and understood this Policy and consent to the data practices described herein.

This Privacy Policy should be read in conjunction with our Terms & Conditions, which govern the overall relationship between you and kayu77. In the event of any conflict between this Policy and the Terms & Conditions on a privacy matter, this Privacy Policy takes precedence.

2. Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings defined below:

• "Personal Data" means any information that identifies or could reasonably be used to identify a living natural person, either directly (e.g., full name, national identity number) or indirectly (e.g., IP address combined with other identifiers).
• "Processing" means any operation performed on personal data, including collection, storage, retrieval, use, disclosure, transmission, erasure, and destruction.
• "Data Controller" means kayu77, the entity that determines the purposes and means of processing personal data collected through this Platform.
• "Data Processor" means any third party that processes personal data on behalf of kayu77 under a binding data processing agreement (e.g., KYC verification providers, payment processors, cloud infrastructure providers).
• "Consent" means a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your personal data for a stated purpose.
• "Cookie" means a small text file placed on your device by the Platform for the purposes of session management, preference storage, or analytical tracking.
• "Player" / "you" means any individual who accesses or uses the kayu77 Platform in any capacity.

3. Data We Collect

kayu77 collects personal data through several distinct pathways. The categories of data collected, the specific data points within each category, and the primary purpose for collection are summarised in the table below.

We do not collect sensitive personal data (including racial or ethnic origin, political opinions, religious beliefs, biometric data beyond KYC selfie verification, or health data) unless it is directly relevant to a responsible gaming assessment and you have given explicit consent for such processing.

4. How Data Is Collected

Personal data is collected through the following mechanisms:

• Direct Submission: Information you voluntarily provide when completing registration forms, KYC verification, payment setup, support requests, or feedback submissions.
• Automated Technical Collection: Data generated automatically when you access the Platform, including IP addresses, device identifiers, browser fingerprints, and session activity logs collected via server logs and analytics tools.
• Cookies and Tracking Technologies: Session cookies, persistent cookies, and similar technologies that track usage patterns and maintain login state across sessions. See Section 8 for full details.
• Third-Party Payment Processors: Confirmation data returned by your bank or e-wallet provider (BCA, BRI, Mandiri, OVO, DANA, GoPay, and others) when processing a deposit or withdrawal. kayu77 receives transaction reference numbers and name confirmation but does not store full card numbers or online banking passwords.
• KYC Verification Partners: Identity verification results and risk scores returned by our certified third-party KYC provider following document review.
• Game Providers: Gameplay outcome data and session logs returned by third-party game providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, and others) integrated into the Platform.

5. Legal Basis for Processing

kayu77 processes personal data on one or more of the following legal bases, consistent with internationally recognised data protection principles:

• Contractual Necessity: Processing required to fulfil our contractual obligations to you under the Terms & Conditions — including account management, payment processing, and gameplay — i s performed on this legal basis.
• Legal Obligation: Processing necessary to comply with applicable anti-money-laundering (AML) regulations, Know Your Customer (KYC) requirements, and international gaming compliance standards that kayu77 is subject to as a licensed operator.
• Legitimate Interests: Processing carried out for kayu77's legitimate business interests — such as fraud prevention, platform security, responsible gaming monitoring, and service improvement — where those interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing of data for optional purposes — such as sending promotional emails, personalised bonus offers, or depositing your data with marketing analytics platforms — is performed only where you have given clear, freely withdrawable consent. You may withdraw consent at any time through your Account Settings without affecting the lawfulness of prior processing.

6. How We Use Your Data

kayu77 uses the personal data it collects strictly for defined, documented purposes. We do not repurpose data for activities beyond the scope set out at the time of collection without notifying you and, where required, obtaining fresh consent. Our primary uses of personal data are as follows:

6.1 Account Management and Authentication

Your registration data is used to create and maintain your kayu77 account, verify your identity at login, facilitate password recovery, and maintain the security of your session. Without this processing, we cannot provide you with a personalised, secure gaming experience.

6.2 Payment Processing

Financial data — including your registered bank account details with BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, or e-wallet identifiers for OVO, DANA, GoPay, ShopeePay, or LinkAja — is used solely to process deposits and withdrawals, verify that payment accounts are registered in your name, and conduct AML transaction monitoring. We retain only the minimum financial data required for these purposes.

6.3 Identity Verification and Fraud Prevention

KYC documentation and identity verification results are used to confirm that you meet our eligibility requirements (21 years of age and Indonesian residency), prevent the use of the Platform by prohibited persons, detect fraudulent account activity, and comply with international AML obligations. This processing is a legal requirement and cannot be opted out of.

6.4 Responsible Gaming Monitoring

Gameplay and session data is analysed to identify behavioural patterns that may indicate problem gambling — such as escalating deposit frequency, extended unbroken sessions, or rapid increases in bet size. Where such patterns are detected, our responsible gaming team may reach out proactively to offer support tools. This processing is in the legitimate interest of player welfare. See our Responsible Gaming page for full details.

6.5 Customer Support

Communication data — including live chat transcripts and email correspondence — is retained to resolve your support requests, maintain a history of interactions for follow-up purposes, conduct quality assurance reviews, and train support agents. Transcripts are stored for a period of 24 months from the date of the interaction.

6.6 Personalisation and Marketing (Consent-Based)

Where you have consented to receive marketing communications, we use your preference data, gameplay history, and deposit patterns to tailor promotional offers — such as bonus notifications during BRI Liga 1 football fixtures, Ramadhan cashback promotions, or Idul Fitri special events — to your interests. You may withdraw this consent at any time through the Notifications section of your Account Settings.

6.7 Platform Security and Analytics

Technical data including IP addresses, device fingerprints, and access logs is used to detect and block unauthorised access, identify coordinated fraud rings, investigate breaches, and improve the performance and reliability of the Platform for all users.

7. Data Sharing & Disclosure

kayu77 does not sell your personal data. We share data only in the limited circumstances described below, and only to the extent necessary for the stated purpose.

7.1 Service Providers (Data Processors)

We engage carefully selected third-party service providers who process personal data on our behalf under binding data processing agreements. These include:

• KYC and Identity Verification Providers: to confirm the authenticity of identity documents submitted during account verification.
• Payment Infrastructure Partners: to facilitate transaction routing through Indonesian banking channels and e-wallet networks.
• Cloud Infrastructure and Hosting Providers: to store Platform data on secure, access-controlled servers.
• Customer Support Platform Providers: to operate our live chat and ticketing systems.
• Game Software Providers: including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft — who receive session tokens and bet data necessary to operate their games. These providers do not receive your identity documents or payment details.

All data processors are contractually prohibited from using your data for any purpose beyond the service they provide to kayu77.

7.2 Legal and Regulatory Disclosure

kayu77 may disclose personal data to law enforcement agencies, financial intelligence units, or regulatory bodies where we are legally compelled to do so — for example, in response to a valid court order, subpoena, or regulatory investigation. We will notify you of such disclosures where permitted by law.

7.3 Business Transfers

In the event of a merger, acquisition, asset sale, or corporate restructuring involving kayu77, your personal data may be transferred to the acquiring or successor entity. We will provide advance notice of any such transfer and the new entity will be bound by this Privacy Policy or a policy offering equivalent or greater protection.

7.4 Aggregated and Anonymised Data

We may share aggregated, fully anonymised statistical data — such as total active players per city (Jakarta, Surabaya, Bandung, Medan, Bali) or aggregate deposit volumes by payment method — with business partners or publish them publicly. This data cannot be used to identify any individual player.

8. Cookies & Tracking Technologies

kayu77 uses cookies and similar technologies to operate the Platform efficiently, maintain your login session, and understand how players use our services. Below is a summary of the cookie categories we deploy.

8.1 Strictly Necessary Cookies

These cookies are essential for the Platform to function. They manage your login session, maintain your account state between page loads, and protect against cross-site request forgery (CSRF) attacks. They cannot be disabled without breaking core Platform functionality.

8.2 Analytical and Performance Cookies

We use first-party analytical cookies to understand how players navigate the Platform — which pages are visited most frequently, how long sessions last, and where users encounter friction in the deposit or registration flow. This data is used exclusively to improve Platform performance. It is not shared with third-party advertising networks.

8.3 Preference Cookies

These cookies remember your stated preferences — such as notification settings, last-used payment method, and responsible gaming limit values — so you do not need to re-enter them on each visit.

8.4 Managing Cookies

You can configure your browser to refuse all cookies, accept only first-party cookies, or prompt you before accepting each cookie. Note that disabling strictly necessary cookies will prevent you from logging in or using core Platform features. Browser cookie settings are typically found under the "Privacy" or "Security" section of your browser's preferences. Common instructions apply to Chrome, Firefox, Safari, and Edge on both desktop and mobile.

9. Data Retention

kayu77 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply:

Following the expiry of the applicable retention period, personal data is securely destroyed or irreversibly anonymised. Anonymised data (which can no longer be linked to any individual) may be retained indefinitely for statistical and platform improvement purposes.

Where you request erasure of your data under Section 11 below, we will delete all data that we are not legally required to retain. Data that is subject to a mandatory retention period under AML or gaming regulations cannot be erased prior to the expiry of that period regardless of your request.

10. Data Security

kayu77 implements a layered security architecture to protect personal data against unauthorised access, disclosure, alteration, and destruction. Our key security measures include:

• 256-bit SSL/TLS Encryption: All data in transit between your device and our servers is encrypted using industry-standard TLS 1.3 protocols.
• Encryption at Rest: Stored personal data — including KYC documents, financial records, and authentication credentials — is encrypted on disk using AES-256 encryption.
• Access Controls: Access to personal data within kayu77's internal systems is restricted on a strict need-to-know basis. Administrative access requires multi-factor authentication (MFA) and is logged and audited.
• Intrusion Detection and Monitoring: Our infrastructure is monitored continuously for anomalous access patterns, brute-force attempts, and other indicators of compromise.
• Password Hashing: User passwords are never stored in plaintext. We apply a modern adaptive hashing algorithm (bcrypt) with a per-account salt to ensure that even in the event of a database breach, passwords cannot be recovered.
• Penetration Testing: The Platform undergoes periodic third-party security penetration testing to identify and remediate vulnerabilities before they can be exploited.

Despite these measures, no online platform can guarantee absolute security. In the event of a data breach that poses a material risk to your rights and freedoms, kayu77 will notify affected players without undue delay and take all reasonable steps to contain and remediate the breach.

11. Your Rights

As a player on the kayu77 Platform, you hold the following rights with respect to your personal data. To exercise any of these rights, contact our support team at the email address listed in Section 15. We will respond to verified requests within 30 calendar days.

12. Minors & Age Restriction

kayu77 strictly enforces a minimum age of 21 years for all registered players. The Platform is not directed at, and does not knowingly collect personal data from, individuals under the age of 21. This restriction aligns with Indonesia's widely recognised social norm for adult gaming participation and our commitment to responsible gaming.

During the registration process, all applicants must declare their date of birth. This declaration is verified during KYC, which requires submission of a government-issued identity document. Any account where the player is found to be under 21 years of age will be immediately suspended, all funds will be returned to the depositing payment method (less any winnings generated), and the personal data associated with the account will be flagged and securely deleted within 30 days, except where retention is required by AML law.

If you are a parent or guardian and believe that a person under 21 in your care has registered an account on kayu77, please contact our support team immediately at [email protected]. We treat all such reports with the utmost urgency and confidentiality.

13. International Data Transfers

kayu77 operates server infrastructure and engages service providers across multiple international jurisdictions. As a result, personal data collected from Indonesian players may be transferred to, stored in, or processed in countries outside Indonesia. These countries may have different data protection laws than those applicable in Indonesia.

Where such transfers occur, kayu77 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to this Policy. These safeguards may include:

• Binding contractual clauses with the receiving entity requiring them to apply equivalent data protection standards.
• Transfers to jurisdictions recognised as providing adequate data protection by international standard-setting bodies.
• Internal group data transfer policies where kayu77 affiliated entities are involved.

You may request further information about the specific safeguards applied to any international data transfer involving your personal data by contacting us at the address provided in Section 15.

14. Policy Amendments

kayu77 reserves the right to update or revise this Privacy Policy at any time. Changes may be made to reflect updates in our data processing practices, changes in applicable law, feedback from players, or operational improvements to our security architecture.

When material changes are made — meaning changes that substantively affect how we collect or use your personal data, or that alter your rights — we will notify you by email to the address registered on your account at least 7 calendar days before the changes take effect. For minor or administrative amendments (such as correcting typographic errors or clarifying existing practices without changing their substance), we will update the "Last Updated" date at the top of this page and the revised Policy will take effect immediately upon publication.

Your continued use of the Platform following the effective date of any revised Policy constitutes your acknowledgement of the changes. If you disagree with any revision, you may close your account and request withdrawal of your remaining balance in accordance with our Terms & Conditions.

15. Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise any of the rights described in Section 11, or want to raise a concern about how kayu77 handles your personal data, please contact our dedicated Data Protection team through the channels below. All inquiries are handled by staff trained in data protection principles, with responses available in both English and Bahasa Indonesia.

We take all privacy complaints seriously and aim to resolve them promptly and fairly at the first point of contact. If you remain dissatisfied following our response, you have the right to escalate your complaint to the relevant data protection supervisory authority in your jurisdiction or in the jurisdiction in which kayu77 is incorporated and licensed.