Privacy Policy — tot77

tot77 ("we", "us", "our", "the Platform") operates the online casino and sportsbook accessible at tot77.vip, serving members primarily based in Indonesia. As a platform that processes financial transactions, identity documents, and gaming activity data, tot77 recognises that privacy is not merely a compliance obligation — it is a foundational component of the trust our Members place in us.

This Privacy Policy applies to all personal data collected through the tot77 website, its mobile browser interface, customer support channels, and any other touchpoint through which you interact with tot77. It should be read in conjunction with our Terms & Conditions and our Responsible Gaming policy, both of which form part of the overall agreement governing your membership.

tot77 acts as the data controller for all personal information collected from its Members. We are accountable for ensuring that data processing under our direction is carried out lawfully, fairly, and transparently at all times.

For the purposes of this Privacy Policy, the following terms carry the meanings defined below:

tot77 collects the following categories of personal data from Members and prospective Members:

tot77 does not collect special categories of sensitive personal data (such as racial or ethnic origin, religious belief, health data, or biometric data beyond the standard identity photograph used for KYC) unless specifically required by applicable law or regulatory guidance.

tot77 collects Personal Data through the following channels:

• Direct Submission: Information you provide when you complete the registration form, submit KYC documents, initiate a deposit or withdrawal, or contact customer support.
• Automated Collection: Technical data collected automatically via server logs, browser cookies, and session analytics tools whenever you visit or interact with the tot77 website.
• Third-Party Verification: Identity confirmation data returned by our KYC verification partners when processing your submitted identity documents.
• Payment Processors: Transaction status and confirmation data relayed by our payment gateway partners (covering bank transfer and e-wallet transactions in IDR).
• Game Providers: Gaming activity data generated within third-party game engines (Pragmatic Play, Evolution Gaming, PG Soft, NetEnt, Microgaming, Spribe, and others) that is relayed to tot77's platform layer for account and reporting purposes.

tot77 processes your Personal Data on one or more of the following legal bases, as applicable to each processing activity:

• Contractual Necessity: Processing required to deliver the services described in the Terms & Conditions — including account management, transaction processing, game delivery, and withdrawal fulfilment.
• Legal Obligation: Processing required to comply with anti-money-laundering (AML) regulations, Know Your Customer (KYC) obligations, fraud prevention requirements, and data retention mandates applicable to licensed gaming operators.
• Legitimate Interests: Processing necessary for tot77's legitimate business interests, including platform security, fraud detection, service improvement, and responsible gaming monitoring — provided those interests are not overridden by your privacy rights.
• Consent: Where tot77 seeks to use your data for marketing communications or optional personalisation features, it will request your explicit, informed, and freely given consent, which you may withdraw at any time without affecting the lawfulness of prior processing.

tot77 uses the Personal Data it collects for the following specific purposes:

1. Account Creation and Management: To register your Account, verify your identity (KYC), maintain your profile, and enforce the single-account rule.
2. Transaction Processing: To execute deposits and withdrawals in IDR via local Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja), and to maintain accurate financial records for each transaction.
3. Platform Delivery: To provide access to the sportsbook, live casino, slot library, and all other gaming products available on tot77.
4. Security and Fraud Prevention: To monitor for suspicious login activity, detect multi-accounting, identify bonus abuse patterns, and prevent money laundering or other financial crimes.
5. Responsible Gaming: To track gaming behaviour patterns, enforce self-imposed limits, identify Members who may be exhibiting signs of problem gambling, and reach out proactively where appropriate.
6. Customer Support: To identify Members contacting support, retrieve relevant account history, resolve disputes, and process complaints.
7. Platform Improvement: To analyse aggregated, anonymised usage data that helps tot77 improve its UX, sportsbook markets, game selection, and payment infrastructure.
8. Promotional Communications: Where you have given consent, to send you personalised offers, bonus notifications, and promotional updates relevant to your gaming interests — including seasonal promotions aligned with Indonesian occasions such as Idul Fitri, Ramadhan, and Indonesian Independence Day (17 August).

tot77 does not use automated decision-making that produces significant legal or similarly significant effects on Members, except where required for AML compliance purposes, in which case a human review is always available upon request.

tot77 does not sell, rent, or trade your Personal Data to unaffiliated third parties for their own marketing or commercial purposes. Data is shared only in the following strictly defined circumstances:

• Game Providers: Game studios (Pragmatic Play, Evolution Gaming, PG Soft, NetEnt, Microgaming, Spribe, and others) receive a session token and balance data sufficient to deliver the game session. They do not receive your full identity data or financial account details.
• Payment Processors: Banking and e-wallet gateway partners receive the minimum transactional data required to process a deposit or withdrawal — typically account reference, amount in IDR, and transaction identifier. Full bank account numbers are handled directly between you and your financial institution.
• KYC Verification Partners: Identity document images and associated metadata are shared with our accredited KYC verification service provider for the sole purpose of verifying your identity and age. These partners operate under strict data processing agreements with tot77.
• Fraud & AML Services: IP addresses, device fingerprints, and behavioural signals may be shared with fraud detection partners to identify and mitigate suspicious activity. Data shared for this purpose is subject to data processing agreements and may not be used by those partners for any other purpose.
• Legal and Regulatory Authorities: tot77 may disclose Personal Data to competent legal or regulatory authorities where required by applicable law, valid court order, or regulatory demand — including AML investigative bodies. tot77 will notify the affected Member of any such disclosure where legally permitted to do so.
• Business Transfers: In the event of a merger, acquisition, or sale of substantially all of tot77's assets, Member Personal Data may be transferred to the acquiring entity. Members will be notified of any such transfer in advance wherever practicable.

tot77 applies a layered security architecture to protect Member Personal Data against unauthorised access, accidental loss, alteration, or disclosure. Our security measures include:

• Transport Encryption: All data transmitted between your browser and tot77's servers is protected using 256-bit TLS (Transport Layer Security) encryption. The tot77 website is served exclusively over HTTPS.
• Credential Hashing: Account passwords are stored exclusively as salted, one-way cryptographic hashes using industry-standard algorithms. No tot77 employee or system can retrieve your password in plain text.
• Payment Data Tokenisation: Bank account numbers and e-wallet identifiers are tokenised immediately upon receipt. Full payment identifiers are not stored on tot77's application servers after the transaction has been confirmed.
• Access Controls: Access to Member Personal Data within tot77 is restricted to authorised personnel on a strict need-to-know basis. All internal access to sensitive data is logged and audited.
• Infrastructure Security: tot77's platform is hosted on enterprise-grade infrastructure with intrusion detection systems, web application firewalls, and continuous security monitoring in place.
• Security Audits: tot77 commissions periodic third-party security assessments to identify and remediate vulnerabilities in its platform infrastructure and data handling practices.

Despite these measures, no digital platform can guarantee absolute security. In the unlikely event of a data breach affecting your Personal Data, tot77 will notify affected Members without undue delay and take all reasonable steps to mitigate the impact of the breach.

tot77 retains Personal Data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The general retention schedules applied by tot77 are as follows:

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in accordance with tot77's data disposal procedures. Anonymised, aggregated data (from which no individual can be identified) may be retained indefinitely for analytical and business improvement purposes.

tot77 uses cookies and similar tracking technologies to operate the platform effectively and to improve your experience as a Member. The categories of cookies used by tot77 are described below:

• Strictly Necessary Cookies: Required for core platform functionality — including session authentication, bet slip management, cashier session handling, and security token validation. These cookies cannot be disabled without impairing basic platform operation.
• Functional Cookies: Store your preferences such as preferred deposit method, table stakes preference, and lobby display settings — allowing tot77 to present a personalised experience on subsequent visits.
• Analytics Cookies: Collect anonymised data about how Members navigate the platform — including pages visited, time on page, and device type — to help tot77 understand usage patterns and improve the product. Analytics data is aggregated and does not identify individual Members.
• Security Cookies: Used by tot77's fraud detection infrastructure to identify unusual session behaviour, detect credential stuffing attempts, and prevent account takeover attacks.

You may control cookies through your browser settings. However, disabling strictly necessary cookies will prevent you from logging in or completing transactions on tot77. tot77 does not use third-party advertising cookies or cross-site tracking cookies.

As a Member of tot77, you hold a number of rights with respect to your Personal Data. tot77 is committed to facilitating the exercise of these rights promptly and without undue barrier:

To exercise any of the above rights, please contact tot77 at [email protected] with the subject line "Data Rights Request" and a description of the right you wish to exercise. tot77 will acknowledge your request within 5 business days and respond substantively within 30 calendar days of receipt.

tot77 is strictly prohibited for persons under the age of 21. We do not knowingly collect Personal Data from any person under 21 years of age. The registration process requires confirmation of date of birth, and KYC verification independently confirms that the Member meets the 21+ age requirement before withdrawal privileges are granted.

If tot77 discovers or has reason to believe that a Member is under the age of 21, the Account will be immediately suspended, all pending transactions will be frozen, and any funds on the account will be handled in accordance with tot77's underage account policy. Any Personal Data collected from an underage individual will be securely deleted promptly following identification.

If you are aware of any person under 21 years of age who may have registered an account on tot77, please notify us immediately at [email protected].

The tot77 platform integrates a number of third-party services to deliver its full product offering. These include game studios, payment infrastructure providers, and platform security tools. Each category is described below from a data privacy perspective:

• Game Studios: Pragmatic Play, Evolution Gaming, PG Soft, NetEnt, Microgaming, Spribe, and other certified content providers supply game engines accessible through the tot77 lobby. When you launch a game, a session is initiated with that provider's servers. These providers operate under their own privacy policies; tot77 shares only the minimum session data required to launch and authenticate the game session.
• Payment Gateways: tot77 works with licensed payment gateway partners to process IDR transactions via local Indonesian banks and e-wallets. These gateways operate independently from tot77 and are subject to their own privacy policies and Indonesian financial regulation.
• Analytics: tot77 uses server-side analytics tools that process anonymised, aggregated usage data. No personally identifiable data is transmitted to analytics providers.
• Fraud Detection: Third-party fraud and AML screening tools may receive technical signals (device fingerprints, IP addresses, behavioural patterns) for the sole purpose of detecting financial crime. These partners are contractually prohibited from using this data for any other purpose.

tot77 does not embed third-party social media widgets, advertising networks, or data broker trackers on its platform. All third-party integrations on tot77 are exclusively operational in nature.

tot77 reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, platform functionality, or data processing practices. The version number and effective date shown at the top of this document identify the currently applicable version.

Where an amendment materially affects Member rights or how tot77 uses Personal Data, tot77 will provide at least 14 days' advance notice via a prominent platform notification and, where an email address is on file, by direct email. Your continued use of tot77 following the effective date of a material amendment constitutes your acceptance of the revised policy.

For non-material corrections — such as typographical fixes or clarifications that do not alter the substance of any data practice — tot77 may update this policy immediately without advance notice.

We encourage Members to review this Privacy Policy periodically to stay informed of how tot77 handles their Personal Data. The archived history of prior policy versions is available on request from [email protected].

If you have any questions, concerns, or requests relating to this Privacy Policy or tot77's handling of your Personal Data, please contact us through the following channels:

• Live Chat: Available 24/7 directly within the tot77 platform. The fastest channel for all privacy queries including data access requests and marketing opt-outs. Our agents are native Indonesian speakers and will assist you fully in understanding your data rights.
• Email: [email protected] — for formal data rights requests, breach notifications, and written complaints. Please use the subject line "Privacy Request" or "Data Rights Request" to ensure your message is routed to the appropriate team. Formal email responses within 24 hours (WIB).

tot77 takes all privacy complaints seriously. Upon receipt of a complaint, tot77 will acknowledge it within 5 business days and provide a substantive resolution within 30 calendar days. If you are not satisfied with our response, you have the right to escalate your complaint to the relevant data protection authority in your jurisdiction.