faf77 Privacy Policy

1.Introduction & Scope

1.1 This Privacy Policy ("Policy") describes how faf77 ("faf77", "we", "us", "our") collects, uses, stores, shares, and protects the personal data of users ("Player", "you", "your") who access or register on the faf77 online gaming platform at faf77.app, including all associated subdomains and mobile interfaces.

1.2 This Policy applies to all personal data processed in connection with your use of the faf77 Platform, regardless of the device or network you use to access it. It covers data collected directly from you (e.g., when you register an account or make a deposit), data generated by your use of the Platform (e.g., bet history, session logs), and data received from third parties (e.g., identity verification partners).

1.3 By registering an account with faf77, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree with any part of this Policy, you should not register an account or continue using the Platform.

1.4 This Policy should be read alongside the faf77 Terms & Conditions, which govern the contractual relationship between faf77 and its Players, and the faf77 Responsible Gaming policy, which sets out our commitments to Player welfare.

2.Data Controller

2.1 faf77 acts as the data controller in respect of all personal data collected through the Platform. As data controller, faf77 determines the purposes for which your personal data is processed and the means by which that processing is carried out.

2.2 faf77 is a Trusted and Secure Platform, Licensed and Regulated Internationally. Our platform is operated in accordance with the terms of our international gaming licence and the data protection standards applicable within that licensing jurisdiction.

2.3 For all privacy-related enquiries, requests, or complaints, you may contact our dedicated Data Protection team at: [email protected] (plain text — not a clickable link). Our team will acknowledge all privacy-related correspondence within 48 hours.

3.Data We Collect

3.1 faf77 collects personal data in three primary ways: data you provide directly, data generated automatically through your use of the Platform, and data we receive from trusted third-party partners. The categories of data collected are set out below.

3.1 Data You Provide Directly

• Registration data: Full legal name, date of birth, Indonesian residential address, mobile phone number (registered with an Indonesian network), and email address.
• Identity documents: Copies of your Indonesian National Identity Card (KTP) or Indonesian passport, and where required, proof of address documents submitted for KYC purposes.
• Payment data: Bank account details (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata), e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja), and card details (Visa, Mastercard) used for deposits and withdrawals. Full card numbers are never stored by faf77 — they are tokenised by our payment processor.
• Support communications: The content of messages, emails, and live chat transcripts exchanged between you and faf77 customer support agents.
• Survey and feedback data: Responses to optional player satisfaction surveys or bonus feedback forms.

3.2 Data Generated Automatically

• Technical identifiers: IP address, device fingerprint, operating system, browser type and version, screen resolution, and time zone.
• Session data: Login timestamps, session duration, pages visited, features accessed, and logout timestamps (all recorded in WIB, UTC+7).
• Betting and gaming activity: Full history of bets placed across sportsbook (including BRI Liga 1, EPL, La Liga, Serie A, Bundesliga, Champions League, AFF Cup, and other markets), casino table games, live dealer sessions, slot spins, and any other wagering activity.
• Transaction logs: Complete records of all deposits, withdrawals, bonus credits, wagering contributions, and balance adjustments.
• Geolocation data: Approximate location derived from your IP address, used solely to verify that you are accessing the Platform from a permitted jurisdiction.

3.3 Data Received from Third Parties

• KYC verification results: Confirmation of identity match, age verification outcome, and document authenticity score from our regulated KYC partner.
• Fraud and risk signals: Aggregated risk indicators from our fraud prevention service providers, used to protect both faf77 and its Players from account takeover, payment fraud, and bonus abuse.
• Payment provider data: Transaction reference numbers and status confirmations from Indonesian banks and e-wallet operators.

4.Purposes & Legal Basis for Processing

4.1 faf77 processes your personal data only where it has a legitimate legal basis to do so. The table below sets out the primary purposes of processing, the categories of data involved, and the legal basis relied upon for each purpose.

4.2 Where faf77 relies on your consent as the legal basis for processing (e.g., for marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. Withdrawal of consent for marketing will not affect your ability to use the Platform.

5.Data Retention

5.1 faf77 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligations. The following retention periods apply as a general guide:

• Account and identity data: Retained for the lifetime of the account plus a minimum of five (5) years after account closure, in accordance with anti-money-laundering (AML) regulatory requirements.
• Transaction and betting records: Retained for a minimum of five (5) years from the date of each transaction, for AML compliance and audit purposes.
• KYC documents: Retained for five (5) years from the date of the most recent KYC review or account closure, whichever is later.
• Support communications: Retained for two (2) years from the date of the last interaction, unless a longer period is required for ongoing dispute resolution.
• Marketing preferences and consent records: Retained for the duration of the account and for two (2) years following account closure, as evidence of consent status.
• Anonymised analytics data: May be retained indefinitely as it cannot be used to identify individual Players.

5.2 At the end of the applicable retention period, personal data is securely deleted or permanently anonymised in accordance with faf77's data destruction protocols.

6.Sharing & Disclosure

6.1 faf77 may share your personal data with the following categories of recipients:

• KYC and identity verification providers: Regulated third-party services that assist faf77 in verifying the identity and age of Players, as required under our licensing obligations.
• Payment processors and financial institutions: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata), e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja), and international card networks (Visa, Mastercard) — solely to process your deposit and withdrawal transactions.
• Fraud prevention and security services: Specialist third-party providers that analyse technical signals to detect account takeover, bonus abuse, multi-accounting, and other prohibited activities.
• Regulatory and law enforcement authorities: Where faf77 is legally required to disclose information to a competent authority, court, or regulator — for example, in response to a valid legal order, subpoena, or mandatory regulatory report.
• Technology and infrastructure providers: Cloud hosting providers, database administrators, and cybersecurity vendors who process data on faf77's behalf under strict data-processing agreements that prohibit any secondary use.
• Professional advisors: Lawyers, accountants, auditors, and insurers who require access to data in the course of providing professional services to faf77, subject to confidentiality obligations.

6.2 All third parties with whom faf77 shares personal data are required to maintain appropriate technical and organisational security measures and are contractually prohibited from using that data for any purpose beyond the specific service they are providing to faf77.

6.3 In the event that faf77 undergoes a corporate restructuring, merger, acquisition, or sale of assets, your personal data may be transferred to a successor entity as part of that transaction. We will notify you in advance of any such transfer and ensure that the receiving entity is bound by data protection obligations at least as stringent as those in this Policy.

7.International Transfers

7.1 faf77 operates globally and some of our service providers and infrastructure partners are located outside Indonesia. As a result, your personal data may be transferred to and processed in countries other than Indonesia.

7.2 Where personal data is transferred outside Indonesia, faf77 ensures that appropriate safeguards are in place to protect that data. These safeguards may include:

• Contractual clauses that impose data protection obligations on the recipient that are equivalent to those required by our licensing jurisdiction;
• Transfers to countries that have been assessed as providing an adequate level of data protection by a recognised international authority;
• Transfers to entities that have implemented binding corporate rules or equivalent internal data protection standards.

7.3 You may request details of the specific safeguards in place for any international transfer of your data by contacting our Data Protection team at [email protected].

8.Cookies & Tracking Technologies

8.1 faf77 uses cookies and similar tracking technologies to operate the Platform securely and to understand how Players interact with it. The following categories of cookies are used:

8.2 faf77 does not use advertising or cross-site tracking cookies. We do not share your browsing behaviour with advertising networks, social media platforms, or data brokers.

8.3 You can control and manage cookies through your browser settings. Please note that disabling strictly necessary or security cookies will impair your ability to log in and use the Platform. Guidance on managing cookies in major browsers is available from the browser's own support documentation.

9.Security Measures

9.1 faf77 implements a layered set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include, but are not limited to:

• Encryption in transit: All data transmitted between your device and faf77 servers is encrypted using TLS 1.2 or TLS 1.3 with 256-bit cipher suites.
• Encryption at rest: All personal data and financial records stored on faf77 servers are encrypted using AES-256.
• Access controls: Access to personal data is restricted to faf77 personnel who require it to perform their specific job functions. All staff with data access are subject to confidentiality obligations and regular security training.
• Multi-factor authentication: Administrative access to faf77 backend systems requires multi-factor authentication. Players are encouraged to enable two-factor authentication (2FA) on their own accounts.
• Penetration testing: faf77's systems undergo regular penetration testing by independent security professionals to identify and remediate vulnerabilities before they can be exploited.
• Incident response: faf77 maintains a documented incident response plan. In the event of a confirmed data breach affecting Player data, we will notify impacted Players by email within 72 hours of becoming aware of the incident.

9.2 Whilst faf77 takes every reasonable step to protect your data, no internet transmission or electronic storage system is entirely secure. You are responsible for keeping your account credentials confidential and for notifying us immediately if you suspect unauthorised access to your account.

10.Your Rights

10.1 As a Player registered with faf77, you hold the following rights in respect of your personal data:

• Right of Access: You may request a copy of all personal data faf77 holds about you, along with information about how it is being processed.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. For basic profile corrections (e.g., email address, phone number), you may update these directly within your account settings.
• Right to Erasure ("Right to Be Forgotten"): You may request that faf77 delete your personal data. This right is subject to exceptions — for example, faf77 is legally required to retain certain transaction records for a minimum of five years under AML regulations, and erasure requests cannot override those obligations.
• Right to Restrict Processing: You may request that faf77 limit the processing of your data in certain circumstances, for example while a dispute about its accuracy is being resolved.
• Right to Data Portability: You may request a machine-readable copy of the personal data you have provided to faf77 directly (e.g., account registration data, transaction history), which you may transmit to another service provider.
• Right to Object: You may object to the processing of your data where faf77 relies on legitimate interest as its legal basis, including profiling for responsible gaming purposes. faf77 will cease processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing emails), you may withdraw consent at any time by updating your communication preferences in account settings or by contacting support.

10.2 faf77 will not charge a fee for processing data rights requests unless a request is manifestly unfounded or excessive. In such cases, faf77 reserves the right to charge a reasonable administrative fee or to refuse the request, with written reasons provided to you.

11.Minors

11.1 The faf77 Platform is strictly for individuals aged 21 years and over. We do not knowingly collect personal data from persons under the age of 21. If faf77 becomes aware — at any stage — that an account has been opened by, or on behalf of, a person under 21, that account will be immediately suspended and all data associated with it will be deleted, except to the extent that retention is required for legal or regulatory purposes.

11.2 If you are the parent or guardian of a minor and believe that your child has submitted personal data to faf77, please contact us immediately at [email protected] so that we can investigate and take appropriate action without delay.

11.3 faf77 strongly recommends that parents and guardians use parental control software to prevent minors from accessing online gaming platforms. A range of free and commercially available filtering tools are compatible with all major browsers and devices.

12.Marketing Communications

12.1 faf77 may send you promotional communications — including bonus offers, tournament announcements, seasonal promotions tied to Indonesian cultural events (Idul Fitri, Ramadhan, Nyepi, Imlek, Indonesian Independence Day, and others), and new feature announcements — by email or SMS, but only where you have explicitly opted in to receive such communications during registration or via your account settings.

12.2 You may opt out of marketing communications at any time by:

• Clicking the "Unsubscribe" link at the bottom of any faf77 promotional email;
• Updating your notification preferences in the Communications section of your account settings; or
• Contacting faf77 support at [email protected] and requesting removal from all marketing lists.

12.3 Opting out of marketing communications will not affect transactional messages that faf77 is required to send you as part of the service — such as deposit confirmations, withdrawal notifications, KYC status updates, or security alerts. These service messages cannot be disabled while your account remains active.

12.4 faf77 does not send marketing communications on behalf of third-party brands or share your contact details with any external marketers.

13.Policy Changes

13.1 faf77 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or platform functionality. The "Last Updated" date at the top of this page indicates when the Policy was most recently revised.

13.2 Where changes are material — meaning they significantly affect how we process your personal data, or reduce your rights in any way — faf77 will notify you by email to your registered address at least seven (7) calendar days before the changes take effect.

13.3 Minor clarifications and non-substantive updates may take effect immediately without advance notice. Continued use of the Platform following the effective date of any update constitutes your acceptance of the revised Policy.

13.4 We recommend that you review this Privacy Policy periodically. Previous versions of this Policy are available upon request by contacting our Data Protection team.

14.Contact & Complaints

14.1 If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or would like to raise a concern about how faf77 handles your personal data, please contact us using the following details:

• Email: [email protected] — subject line: "Privacy Enquiry" or "Data Rights Request"
• Live Chat: Available 24/7 from any page on faf77.app — please state that your query is privacy-related so it can be directed to the appropriate team member
• FAQ: Common privacy questions are answered on our FAQ page

14.2 faf77 is committed to resolving all privacy complaints promptly and fairly. If, after contacting us, you remain unsatisfied with our response, you may escalate your complaint to the data protection supervisory authority or dispute resolution body designated by faf77's licensing regulator. Contact details for the relevant authority will be provided upon request.

14.3 faf77's support team is staffed by native Indonesian-speaking agents, available 24 hours a day, seven days a week — including throughout Indonesian public holidays and Ramadhan. All privacy-related communications are handled in strict confidence.