Privacy Policy — idr707

idr707 ("we", "us", "our", "the Platform") is an international online betting and gaming platform built for the Indonesian market. As a responsible data controller, idr707 is committed to protecting the privacy and personal data of every player who uses our platform. This Privacy Policy has been drafted to give you a clear, complete, and honest account of our data practices.

This Policy should be read in conjunction with idr707's Terms & Conditions, which govern the broader contractual relationship between you and idr707. Where this Privacy Policy is silent on a matter relating to your account or your use of the platform, the Terms & Conditions will apply.

idr707 processes personal data for Indonesian players — residents of Jakarta, Surabaya, Medan, Bandung, Bali, Yogyakarta, Semarang, Makassar, and other cities across Indonesia — using payment methods including BCA, BRI, BNI, Mandiri, OVO, GoPay, DANA, ShopeePay, and LinkAja. The personal and financial data associated with these transactions is handled with the highest standard of care described throughout this document.

The following definitions apply throughout this Privacy Policy:

• "Personal Data" means any information that identifies or can reasonably be used to identify a living individual, directly or in combination with other information. This includes name, email address, date of birth, IP address, device identifiers, and financial details.
• "Processing" means any operation performed on personal data — including collection, recording, storage, retrieval, use, disclosure, transmission, restriction, erasure, or destruction.
• "Data Controller" means the entity that determines the purposes and means of processing personal data. idr707 is the data controller for all personal data collected through the Platform.
• "Data Processor" means a third party that processes personal data on behalf of the data controller, under contractual obligations and subject to data protection requirements.
• "Consent" means a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your personal data for a stated purpose.
• "KYC Data" means identity verification documents submitted by Players as part of the Know Your Customer process, including government-issued ID (e.g., Indonesian KTP), selfie photographs, and proof of payment method ownership.
• "Cookies" means small text files placed on your device by the Platform or its third-party service providers to store session information, preferences, or analytics identifiers.

idr707 collects personal data in the following categories. We collect only what is necessary for the purposes described in Clause 5:

idr707 collects personal data through the following channels and mechanisms:

• Direct Submission: Data you provide when creating an account, completing KYC verification, making a deposit or withdrawal request, contacting our support team, or submitting any form on the Platform.
• Automated Collection: Technical and behavioral data collected automatically as you navigate the Platform, using server logs, session tracking, and analytics tools. This data is collected regardless of whether you are logged in to your account.
• Payment Processors: When you make a deposit or request a withdrawal via a local bank (BCA, BRI, BNI, Mandiri, CIMB Niaga) or e-wallet (OVO, GoPay, DANA, ShopeePay, LinkAja), the relevant payment provider may share transaction confirmation data with idr707 to reconcile your account balance.
• Cookies and Similar Technologies: As described in Clause 8, idr707 uses cookies and similar tracking technologies to maintain your session, remember your preferences, and collect aggregated analytics data about Platform usage patterns.
• Third-Party Game Providers: Game studios integrated into the idr707 Platform — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft — may transmit game session data (bet amounts, game outcomes, session IDs) to idr707 for account settlement and dispute resolution purposes.
• Identity Verification Partners: Where idr707 uses a third-party KYC verification service to process your identity documents, that service provider will share a verification outcome (pass/fail/pending) and relevant extracted data fields with idr707.

idr707 processes your personal data for the following defined purposes. We do not use your data for any purpose that is incompatible with those listed below without first obtaining your consent or establishing a new lawful basis:

• Account Management: To create, maintain, and administer your idr707 account, including processing deposits and withdrawals in Indonesian Rupiah (IDR), applying bonuses, and recording your betting and gaming activity.
• Identity Verification (KYC): To verify that you are at least 21 years of age, to confirm your identity and residential address, and to prevent the creation of duplicate accounts. KYC is a mandatory step before withdrawals are processed.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent transactions, unauthorized account access, money laundering, bonus abuse, multi-accounting, and other forms of prohibited conduct as defined in our Terms & Conditions.
• Responsible Gaming Compliance: To monitor betting patterns and session behavior for indicators of problem gambling, to enforce deposit limits and self-exclusion requests, and to fulfill our obligations under responsible gaming best practices. See our Responsible Gaming page for details.
• Customer Support: To respond to your support inquiries, process complaints, and maintain records of our communications with you for quality assurance and audit purposes.
• Payment Processing: To instruct payment providers (BCA, BRI, BNI, Mandiri, OVO, GoPay, DANA, ShopeePay, LinkAja) to execute deposit credits and withdrawal transfers to your verified account.
• Platform Improvement: To analyze aggregated, anonymized usage data to improve the performance, design, and feature set of the idr707 Platform. Individual player data is anonymized before it is used for platform analytics.
• Marketing Communications (with consent): To send you promotional emails, SMS notifications, or in-platform messages about bonuses, seasonal promotions (e.g., Ramadhan, Idul Fitri, Indonesian Independence Day campaigns), and new game releases — but only where you have opted in to receive such communications.
• Legal and Regulatory Compliance: To retain transaction records, KYC documents, and communication logs for the periods required by applicable law, and to respond to lawful requests from law enforcement or regulatory authorities.

idr707 relies on the following legal bases to process your personal data. At least one valid legal basis applies to every processing activity described in this Privacy Policy:

• Contractual Necessity: Processing required to perform the contract between idr707 and you as a registered Player — including account creation, transaction processing, KYC verification, and customer support. Without this processing, idr707 cannot provide the services you have signed up for.
• Legitimate Interests: Processing necessary for idr707's legitimate business interests, where those interests are not overridden by your rights and freedoms. This includes fraud prevention, platform security, abuse detection, and aggregated analytics for service improvement.
• Legal Obligation: Processing required to comply with applicable legal obligations, including anti-money-laundering (AML) record-keeping requirements, responses to court orders or law enforcement requests, and data retention mandates under applicable law.
• Consent: Processing carried out on the basis of your explicit, freely given consent — specifically, the sending of direct marketing communications. You may withdraw your consent at any time by updating your notification preferences in your account settings or by contacting our support team.

idr707 does not sell your personal data. We share personal data with third parties only in the following limited circumstances, and only to the minimum extent necessary for the stated purpose:

• Payment Service Providers: We share transaction data with Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) and e-wallet operators (OVO, GoPay, DANA, ShopeePay, LinkAja) to process your deposits and withdrawals. These providers act as data processors under contractual data protection obligations.
• KYC and Identity Verification Partners: Where a third-party KYC service is used to process your identity documents, we share the documents you submit with that provider for the sole purpose of verifying your identity. The provider is bound by strict confidentiality and data security obligations.
• Game Technology Providers: Game studios (Pragmatic Play, Evolution Gaming, Spribe, etc.) receive the minimum technical data required to operate their games within the idr707 environment — typically a session token and stake value. They do not receive your name, contact details, or payment information.
• IT Infrastructure and Hosting Providers: idr707 uses third-party cloud infrastructure and hosting services to operate the Platform. These providers store platform data — including player account data — on behalf of idr707 and are bound by data processing agreements that prohibit them from using your data for their own purposes.
• Legal and Regulatory Authorities: idr707 may disclose personal data to law enforcement agencies, regulatory bodies, or courts when required to do so by a valid legal order, warrant, or mandatory regulatory obligation. We will notify you of such disclosures where legally permitted to do so.
• Business Transfers: In the event that idr707 undergoes a merger, acquisition, restructuring, or asset sale, your personal data may be transferred to the successor entity as part of that transaction. You will be notified in advance of any such transfer and given the opportunity to close your account if you do not wish your data to be transferred.

idr707 uses cookies and similar tracking technologies to operate the Platform, maintain your session, and understand how the Platform is used. The following categories of cookies are in use:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function. They maintain your login session, remember your account preferences, and enable core features such as the bet slip and deposit interface. These cookies cannot be disabled without disrupting your use of the Platform.
• Functional Cookies: These cookies remember your preferences — such as your preferred language, display settings, and notification configurations — so that you do not need to re-enter them on each visit. Disabling these cookies may reduce the personalization of your experience.
• Analytics Cookies: idr707 uses analytics tools to collect aggregated, anonymized data about how players navigate the Platform — which pages are most visited, where users encounter errors, and which features drive the most engagement. This data is used solely to improve the Platform and is never linked back to individual player identities.
• Security Cookies: These cookies support fraud prevention and account security measures, including device fingerprinting to detect unauthorized login attempts, multi-account detection, and bot activity identification.

You can manage your cookie preferences through your browser settings. Most modern browsers allow you to block or delete cookies. Note that blocking strictly necessary cookies will prevent you from logging in to your idr707 account. For detailed guidance on managing cookies in your specific browser, please consult your browser's help documentation.

idr707 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized. Where deletion is not immediately possible due to backup schedules or technical constraints, the data is isolated from active processing until deletion can be completed.

idr707 implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, destruction, or disclosure. These measures include but are not limited to:

• Transport Encryption: All data transmitted between your device and the idr707 Platform is encrypted using TLS 1.2 or higher. The Platform enforces HTTPS on all connections and does not serve any content over unencrypted HTTP.
• At-Rest Encryption: Sensitive personal data stored in idr707's databases — including KYC documents, financial records, and authentication credentials — is encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data within idr707's internal systems is restricted on a strict need-to-know basis. Staff members are granted only the minimum level of data access required to perform their job functions. All internal access is authenticated, logged, and regularly audited.
• Two-Factor Authentication: idr707 supports and strongly encourages the use of two-factor authentication (2FA) on all player accounts. Internal staff accounts with access to player data are required to use 2FA without exception.
• Penetration Testing: idr707's platform and infrastructure undergo regular security assessments, including penetration testing, to identify and remediate vulnerabilities before they can be exploited.
• Data Breach Response: In the event of a personal data breach that poses a risk to your rights and freedoms, idr707 will notify affected players without undue delay and take immediate steps to contain, assess, and remediate the breach. All data breaches are internally documented regardless of whether they meet the threshold for external notification.

As a registered player on idr707, you hold the following rights with respect to your personal data. These rights can be exercised at any time by contacting our support team at [email protected]:

To exercise any of the above rights, please contact our support team at [email protected] with the subject line "Data Rights Request". We will acknowledge your request within 48 hours and fulfill it within 30 days. Where a request is complex or numerous, we may extend this period by a further 30 days with prior notice to you.

idr707 does not knowingly collect or process personal data from individuals under the age of 21. The Platform is strictly intended for adults aged 21 and over. By completing the registration process, you confirm that you are at least 21 years of age.

If idr707 discovers — through KYC verification, parental notification, or any other means — that a registered Player is under 21 years of age, we will immediately:

• Suspend and permanently close the account;
• Freeze any remaining balance pending further review;
• Delete all personal data associated with the minor's account, except where retention is required to prevent re-registration or to comply with legal obligations;
• Refund any deposited funds to the original payment method used, less any amounts that cannot be recovered due to the prohibited nature of the account.

idr707 operates as an international platform. As a result, personal data collected from players in Indonesia may be processed and stored on servers located outside of Indonesia. When personal data is transferred internationally, idr707 takes the following steps to ensure that your data remains protected:

• Transfers are made only to countries or service providers that offer an adequate level of data protection, as assessed by idr707's data protection review process.
• Where no adequacy determination exists for the destination country, idr707 implements contractual safeguards — such as standard data protection clauses — to ensure that your data receives a comparable level of protection to that described in this Privacy Policy.
• All international data transfers involving KYC documents or payment data are subject to the same AES-256 encryption standards described in Clause 10, both during transmission and at rest at the destination.
• idr707 maintains a record of all international data transfer mechanisms in use and reviews these arrangements periodically to ensure they remain appropriate and effective.

idr707 may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or the services we offer. When we make material changes to this Policy, we will notify registered Players via email to the address on file and/or a prominent notice on the Platform, at least 7 days before the changes take effect.

Non-material changes — such as typographical corrections, clarifications that do not alter the substance of any provision, or updates required to reflect a new feature that has already been communicated to you separately — may be made immediately upon publication without advance notice.

The "Effective Date" displayed at the top of this page reflects the date on which the current version of this Privacy Policy came into force. We encourage you to review this page periodically to stay informed about how idr707 protects your personal data. Your continued use of the Platform after any update constitutes your acceptance of the revised Privacy Policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or idr707's data practices, please reach out to our support team using the details below. All privacy-related inquiries are treated as a priority and handled by staff with specific data protection responsibilities.

• Email: [email protected] — For formal written privacy inquiries, data rights requests (subject line: "Data Rights Request"), and data breach notifications. We aim to respond to all privacy-related emails within 24 hours on WIB business days.
• Live Chat: Available 24 hours a day, 7 days a week, including Indonesian public holidays such as Idul Fitri, Nyepi, and Indonesian Independence Day (17 August). For urgent data security concerns (e.g., suspected unauthorized account access), live chat is the fastest channel to reach our team.
• Response Commitment: Data rights requests are acknowledged within 48 hours and fulfilled within 30 days. Data breach reports are acknowledged within 24 hours. General privacy inquiries are responded to within 2 WIB business days.