Privacy Policy

The following terms carry specific meanings throughout this Privacy Policy:

• "Company" / "We" / "Us" — qris77, the operator of the Platform at qris77.cam, acting as the data controller in respect of all personal data described in this policy.
• "Platform" — the qris77 website accessible at qris77.cam, including all associated pages, tools, and mobile-optimised versions.
• "User" / "You" — any natural person who accesses or uses the Platform, whether as a registered member or a guest visitor.
• "Personal Data" — any information that identifies or could reasonably be used to identify a natural person, including but not limited to name, date of birth, residential address, email address, device identifiers, and financial account details.
• "Processing" — any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, and deletion.
• "KYC" — Know Your Customer identity and age verification procedures required to comply with anti-money laundering (AML) and responsible gaming obligations.
• "Cookies" — small text files placed on your device by the Platform to enable functionality, remember preferences, and support analytics.
• "Third-Party Processor" — any external service provider that processes Personal Data on behalf of qris77 under a data processing agreement, including payment gateways, KYC verification services, and analytics platforms.

qris77 collects only the data necessary to deliver a secure, compliant, and high-quality gaming experience. The categories of Personal Data we may collect are set out in the table below:

We do not collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, biometric data, or health data, except where age verification (a health-adjacent data point) is strictly required by our responsible gaming and KYC obligations.

qris77 collects Personal Data through three primary channels:

1. Directly from you — when you complete the registration form, submit KYC documents, make a deposit or withdrawal request, contact our support team, respond to a survey, or update your account profile. You choose what information to provide in these contexts, though certain fields are mandatory for account creation and regulatory compliance.
2. Automatically — when you visit or use the Platform, our servers and analytics tools automatically record Technical Data and Usage Data. This includes cookies, web beacons, and server log files. See Section 9 for full details on cookies and how to manage them.
3. From third parties — we may receive Identity Data and verification outcomes from licensed KYC and AML service providers who cross-reference your submitted documents against official government databases. We may also receive fraud-risk signals from payment processors such as the local Indonesian banking networks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, BSI) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja).

We process your Personal Data only for defined, legitimate purposes. The table below maps each data category to its processing purpose:

We will not repurpose your Personal Data for any use incompatible with the purposes listed above without first obtaining your explicit consent or establishing a separate lawful basis for doing so.

qris77 processes your Personal Data on one or more of the following legal bases, depending on the specific activity:

• Contractual necessity — processing required to fulfil our obligations to you as a registered member, including account management, payment processing, and dispute resolution.
• Legal obligation — processing required to comply with applicable AML legislation, KYC regulations, responsible gaming rules, and any court or regulatory order served on the Company.
• Legitimate interests — processing carried out for fraud prevention, security monitoring, platform stability, and internal analytics, where those interests are not overridden by your fundamental privacy rights.
• Consent — processing for marketing communications and certain non-essential cookies, which you may withdraw at any time through your Account settings or by contacting our support team.

qris77 does not sell, rent, or trade your Personal Data to any third party for their own commercial purposes. We share data only in the following limited circumstances:

1. Licensed Third-Party Processors: We engage trusted service providers — including KYC/AML verification firms, payment processors, cloud infrastructure providers, and fraud detection services — who process data strictly on our instructions and under binding data processing agreements that prohibit independent use.
2. Game Content Providers: Certain Usage Data (game session identifiers, bet outcomes) may be shared with our licensed game studios — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft — solely to deliver, secure, and audit game content.
3. Regulatory and Law Enforcement Bodies: We will disclose Personal Data to competent authorities where we are legally required to do so, including in response to court orders, regulatory investigations, or verified fraud reports.
4. Business Transfers: In the event of a merger, acquisition, or sale of substantially all assets of qris77, your Personal Data may be transferred to the successor entity, subject to the same privacy protections described in this policy. You will be notified of any such transfer via the email address registered on your Account.

All Third-Party Processors are contractually required to maintain data confidentiality, implement appropriate security measures, and process data only for the purposes specified by qris77.

We retain your Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our standard retention periods are as follows:

• Account and KYC records: Retained for a minimum of five (5) years from the date of Account closure, in compliance with standard AML record-keeping requirements.
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction.
• Support communications: Retained for three (3) years from the date of the last interaction, to facilitate dispute resolution.
• Technical and usage logs: Retained for up to 12 months on active systems, then archived for a further 24 months in compressed secure storage before permanent deletion.
• Marketing preference records: Retained for as long as your Account is active and for 12 months following any opt-out, to prevent inadvertent re-subscription.

Where Personal Data is no longer required, we take reasonable steps to securely delete or irreversibly anonymise it so that it cannot be used to identify any individual.

qris77 implements a layered security architecture to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction. Our key security controls include:

• 256-bit SSL/TLS encryption across all data transmissions between your device and our servers.
• Data encryption at rest for all sensitive Personal Data stored in our databases, using AES-256 or equivalent standards.
• Access controls — internal access to Personal Data is restricted to employees and contractors with a demonstrable business need, enforced through role-based access management and multi-factor authentication on all administrative systems.
• Intrusion detection and monitoring — our infrastructure is continuously monitored for anomalous activity, with automated alerts and incident response procedures in place.
• Regular security audits — independent penetration testing and vulnerability assessments are conducted on a scheduled basis.
• Staff training — all employees with access to Personal Data receive mandatory data protection and security awareness training.

qris77 uses cookies and similar tracking technologies to ensure the Platform functions correctly, to remember your preferences, and to understand how visitors interact with our pages. The categories of cookies we use are:

You may manage or withdraw your cookie consent at any time through your browser settings or by contacting our support team. Please note that disabling strictly necessary or functional cookies may impair your ability to use certain features of the Platform.

As a qris77 member, you hold the following rights in relation to your Personal Data. To exercise any of these rights, contact us at the details in Section 15:

• Right of Access: You may request a copy of the Personal Data we hold about you, along with information about how it is processed.
• Right to Rectification: You may request correction of any Personal Data that is inaccurate or incomplete. For basic profile details, you can update these directly in your Account settings.
• Right to Erasure: You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations under AML and KYC regulations.
• Right to Restriction: You may request that we restrict processing of your Personal Data in certain circumstances — for example, while the accuracy of data is contested.
• Right to Data Portability: You may request that we provide your Personal Data in a structured, commonly used, machine-readable format so that you can transfer it to another service provider.
• Right to Object: You may object to processing carried out on the basis of legitimate interests, including profiling for responsible gaming monitoring. We will assess whether our legitimate interests override your objection.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

We will respond to all rights requests within 30 days of receipt. In complex cases, this period may be extended by a further 60 days, in which case we will notify you of the extension and the reasons for it.

The qris77 Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect Personal Data from individuals under the age of 21. Age verification is a mandatory step of our registration and KYC process.

If we become aware that Personal Data has been submitted by a person under the age of 21, we will take immediate steps to delete that data and close the associated Account. If you believe a minor has registered on our Platform, please notify us immediately at support@qris77.cam so that we can investigate and act promptly.

qris77 operates on infrastructure hosted in data centres that may be located outside of Indonesia. When your Personal Data is transferred outside the country where it was collected, we take steps to ensure that appropriate safeguards are in place, including:

• Executing standard contractual clauses with all Third-Party Processors that receive Personal Data across borders.
• Transferring data only to jurisdictions or organisations that maintain security and privacy standards equivalent to those described in this policy.
• Maintaining complete records of all cross-border data flows as part of our data processing register.

By using the Platform and submitting your Personal Data, you acknowledge that your data may be transferred to, stored in, and processed in jurisdictions outside Indonesia, subject to the safeguards described above.

The Platform may reference or integrate services provided by licensed third-party game studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft) and payment technology providers. These third parties operate under their own terms of service and privacy policies, which qris77 does not control.

qris77 is not responsible for the privacy practices of any third-party service. We recommend that you review the privacy policies of any third-party provider whose services you interact with through or alongside the Platform. Our responsibility extends only to the data we collect and process directly as described in this policy.

qris77 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform functionality. When we make material changes, we will notify registered Users by email and by posting a prominent notice on the Platform for a minimum of 14 days before the revised policy takes effect.

The "Last Updated" date at the top of this document reflects when the most recent version entered into force. We encourage you to review this policy periodically. Your continued use of the Platform after the effective date of a revised policy constitutes your acceptance of the updated terms. If you do not agree with any revision, you should close your Account before the effective date.

If you have any questions, concerns, or requests relating to this Privacy Policy or our handling of your Personal Data, please contact us through the following channels:

• Email: support@qris77.cam  (plain text — not a clickable link)
• Subject line for privacy requests: "Privacy Request — [Your Registered Email]"
• Response time: We aim to acknowledge all privacy-related enquiries within 24 hours WIB (UTC+7) and to provide a substantive response within 30 days.
• Live Chat: Available 24/7 on the Platform for general enquiries. For formal rights requests, written communication via email is preferred to ensure a proper audit trail.

qris77 has designated a Data Protection Officer (DPO) responsible for overseeing compliance with this policy and applicable data protection obligations. Privacy rights requests directed to our support email are escalated to the DPO for review and action.