Privacy Policy

01 Introduction

rf777 takes data privacy seriously. We operate an online gaming platform primarily serving players in Indonesia, and we recognize that the personal and financial information you share with us is sensitive. This Policy is written to be as clear and specific as possible — not to satisfy a legal checkbox, but because we believe every player has the right to know precisely how their data is handled.

This Policy applies to all personal data processed by rf777 in connection with your use of the platform, including data collected during Account registration, deposits and withdrawals, identity verification (KYC), customer support interactions, and your general browsing activity on the rf777 website.

This Policy should be read alongside our Terms & Conditions and Responsible Gaming page, which together form the complete framework governing your relationship with rf777.

02 Definitions

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information that identifies or could reasonably be used to identify a natural person, directly or in combination with other data.
• "Processing" means any operation performed on personal data — including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" means rf777, which determines the purposes and means of processing personal data collected through the platform.
• "Data Processor" means a third-party service provider that processes personal data on behalf of rf777 under a contractual data-processing agreement.
• "KYC" means Know Your Customer — the identity and age verification process required before withdrawals are processed.
• "Consent" means a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your personal data for a stated purpose.
• "Cookie" means a small text file placed on your device by the rf777 platform to support platform functionality, session management, and analytics.

03 Data We Collect

rf777 collects personal data through several channels. The categories of data collected, and the context in which they are collected, are set out in the table below:

04 How We Use Your Data

rf777 uses your personal data only for the specific purposes set out below. We do not use your data in any way that is incompatible with the original purpose for which it was collected without first notifying you and, where required, obtaining your consent.

4.1 Account Management

To create, maintain, and administer your rf777 Account, including verifying your identity, managing your Account settings, and enforcing our Terms & Conditions.

4.2 Transaction Processing

To process deposits and withdrawals via local Indonesian payment channels (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, OVO, DANA, GoPay, ShopeePay, LinkAja, Visa, Mastercard), detect and prevent fraudulent transactions, and comply with anti-money-laundering (AML) regulations.

4.3 Identity Verification (KYC)

To verify that you are who you claim to be, that you are at least 21 years of age, and that your payment methods belong to you — as required by our licensing obligations and responsible gaming commitments.

4.4 Platform Security

To monitor for unauthorized Account access, detect and investigate suspicious activity, enforce our prohibited-conduct policies, and protect the integrity of all games and markets on the platform.

4.5 Customer Support

To respond to your support queries, resolve disputes, and maintain records of communications in case they are needed for subsequent review or regulatory purposes.

4.6 Responsible Gaming

To monitor gaming behavior for signs of problematic gambling, enforce self-imposed limits, and proactively reach out to players who may be at risk — in line with our responsible gaming obligations.

4.7 Platform Improvement

To analyze aggregated, anonymized behavioral data to understand how the platform is used, identify areas for improvement, and develop new features that better serve Indonesian players.

4.8 Legal Compliance

To comply with applicable laws, respond to lawful requests from regulatory or law-enforcement authorities, and enforce our legal rights.

05 Legal Basis for Processing

rf777 processes your personal data on the following legal bases:

• Contractual Necessity: Processing required to perform our obligations under the Terms & Conditions you accepted at registration — including Account management, payment processing, and KYC verification.
• Legal Obligation: Processing required to comply with applicable laws, including anti-money-laundering regulations, identity verification requirements, and record-keeping obligations.
• Legitimate Interests: Processing carried out to pursue rf777's legitimate business interests — including platform security, fraud prevention, and responsible gaming monitoring — where those interests are not overridden by your rights and freedoms.
• Consent: Where rf777 relies on your consent as the legal basis for processing (for example, optional marketing communications), you may withdraw that consent at any time by contacting support. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

06 Data Sharing & Disclosure

rf777 does not sell, rent, or trade your personal data. We share your data only in the following limited circumstances:

6.1 Service Providers

rf777 engages third-party Data Processors to provide specific platform functions — including payment gateway operators, KYC verification providers, cloud infrastructure providers, live chat software vendors, and game-content studios (such as Pragmatic Play, Evolution Gaming, Spribe, and NetEnt). Each service provider is bound by a written data-processing agr eement that prohibits them from using your data for any purpose other than providing the contracted service to rf777.

6.2 Regulatory and Law-Enforcement Authorities

rf777 may disclose personal data to government agencies, regulators, or law-enforcement authorities where required to do so by applicable law, court order, or binding regulatory direction. Where legally permitted, rf777 will notify you of such a disclosure request before complying.

6.3 Fraud Prevention and AML

rf777 may share limited personal data with industry fraud-prevention and anti-money-laundering networks where there are reasonable grounds to suspect fraudulent activity or money laundering. Such sharing is strictly limited to the data necessary for the investigation and is carried out under appropriate data-sharing agreements.

6.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of rf777's business, your personal data may be transferred to the acquiring entity as part of the transaction. You will be notified of any such transfer and of any changes to this Privacy Policy that result from it, prior to the transfer taking effect.

6.5 With Your Consent

rf777 may share your personal data with additional third parties where you have provided explicit, informed consent to that specific disclosure. You may withdraw such consent at any time by contacting our support team.

07 International Data Transfers

rf777 operates infrastructure and engages service providers located in multiple countries. As a result, your personal data may be transferred to and stored in countries outside Indonesia. Where such transfers occur, rf777 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that which applies within Indonesia, including:

• Contractual clauses requiring the recipient to apply data-protection standards consistent with this Policy;
• Use of service providers that maintain internationally recognized security certifications (such as ISO 27001 or SOC 2 Type II); and
• Transfer only to jurisdictions that provide an adequate level of data protection as assessed by rf777's data-protection review process.

By using the rf777 platform, you acknowledge that your personal data may be transferred internationally as described in this section.

08 Cookies & Tracking Technologies

rf777 uses cookies and similar tracking technologies to ensure the platform functions correctly, to maintain your session, and to understand how players interact with our services. The cookie categories we deploy are as follows:

rf777 does not deploy third-party advertising cookies, retargeting pixels, or social-media tracking scripts on the platform. You can manage or delete cookies at any time through your browser settings. Note that disabling strictly necessary cookies will prevent you from logging in and using the platform.

09 Data Retention

rf777 retains personal data only for as long as necessary to fulfill the purpose for which it was collected, or as required by applicable law. The following retention periods apply:

• Account and Identity Data: Retained for the duration of your active Account, plus a minimum of five (5) years following Account closure. This period satisfies anti-money-laundering record-keeping obligations.
• Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, in line with financial record-keeping requirements.
• KYC Verification Documents: Retained for a minimum of five (5) years from the date of verification or Account closure, whichever is later.
• Customer Support Communications: Retained for three (3) years from the date of the most recent communication in a given ticket thread.
• Technical and Behavioral Data: Retained in identifiable form for up to twelve (12) months, after which it is anonymized or deleted. Anonymized aggregated data may be retained indefinitely for analytical purposes.
• Cookie Data: Session cookies expire when you close your browser. Persistent functional and analytical cookies expire within thirteen (13) months of placement.

When personal data is no longer required for its stated purpose and no legal retention obligation applies, rf777 securely deletes or irreversibly anonymizes the data using industry-standard methods.

10 Security Measures

rf777 implements a layered set of technical and organizational security measures designed to protect your personal data against unauthorized access, accidental loss, destruction, or disclosure. These measures include:

• Encryption in Transit: All data transmitted between your device and rf777 servers is protected by 256-bit SSL/TLS encryption. HTTPS is enforced site-wide with HTTP Strict Transport Security (HSTS).
• Encryption at Rest: Sensitive personal and financial data stored on rf777 servers is encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data within rf777's internal systems is restricted on a strict need-to-know basis. All staff access is logged and regularly audited.
• Two-Factor Authentication: rf777 supports two-factor authentication (2FA) on player Accounts and requires it for all internal staff with access to player data systems.
• Penetration Testing: rf777's platform undergoes regular third-party penetration testing and vulnerability assessments to identify and remediate security weaknesses before they can be exploited.
• Incident Response: In the event of a data breach that poses a risk to your rights and freedoms, rf777 will notify affected players and the relevant regulatory authority within 72 hours of becoming aware of the breach.

11 Your Data Rights

As a player on the rf777 platform, you hold the following rights with respect to your personal data. To exercise any of these rights, submit a written request to [email protected] (plain text — not a clickable link). We will verify your identity before processing any request and will respond within 30 calendar days.

• Right of Access: You may request a copy of all personal data rf777 holds about you, along with information about how it is used and with whom it is shared.
• Right to Rectification: If any personal data rf777 holds about you is inaccurate or incomplete, you have the right to request that it be corrected or completed.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent, or where you object to processing based on legitimate interests. This right is subject to rf777's legal retention obligations — data that must be kept by law cannot be erased on request.
• Right to Restriction: You may request that rf777 restrict the processing of your personal data in certain circumstances — for example, while the accuracy of the data is being contested.
• Right to Data Portability: Where processing is based on your consent or a contract, you may request that rf777 provide your personal data in a structured, commonly used, machine-readable format so that you can transfer it to another service provider.
• Right to Object: You may object to processing carried out on the basis of rf777's legitimate interests. rf777 will cease that processing unless it can demonstrate compelling legitimate grounds that override your rights.
• Right to Withdraw Consent: Where rf777 processes your data on the basis of your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

12 Minors & Age Verification

rf777 does not knowingly collect personal data from any person under the age of 21. The platform is intended exclusively for adults aged 21 and above. Age is verified at Account registration and again at the point of first withdrawal via our KYC process.

If rf777 discovers that personal data has been collected from a person under 21 — whether through the KYC process, a parental complaint, or any other means — the relevant Account will be closed immediately, all funds will be returned to the original deposit source, and all personal data associated with the underage user will be securely deleted, except to the extent that retention is required by law to document the incident.

13 Policy Amendments

rf777 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or platform functionality. Material changes — those that significantly affect your rights or how your data is used — will be communicated to registered players by email at least 7 days before the amended Policy takes effect.

Non-material changes (such as typographical corrections, clarifications that do not affect your rights, or updates to contact details) take effect immediately upon publication on this page. The "Last updated" date at the top of this Policy will always reflect the most recent revision.

Your continued use of the rf777 platform after the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. We recommend bookmarking this page and reviewing it periodically so you remain informed of how your data is being handled.

14 Contact & Complaints

If you have any questions, concerns, or complaints about this Privacy Policy or the way rf777 handles your personal data, please contact our Data Protection team through any of the following channels:

• Email: [email protected] (plain text — not a clickable link). Please use the subject line "Privacy Request" or "Data Complaint" so your message is routed to the correct team.
• Live Chat: Available 24/7 via the chat widget on the rf777 platform. Native Indonesian-speaking support agents are available around the clock (WIB, UTC+7).
• In-App Messaging: Accessible through your Account dashboard after login.

rf777 will acknowledge all privacy-related requests within 48 hours and provide a substantive response within 30 calendar days. Complex requests may take up to 60 days, in which case we will notify you of the extended timeline and the reason for it.

If you are not satisfied with rf777's response to a privacy complaint, you have the right to escalate your complaint to the data-protection authority or regulatory body applicable in your jurisdiction.