Privacy Policy — sma77

The following definitions apply throughout this Privacy Policy wherever the capitalised terms appear:

• "sma77", "We", "Us", "Our" — the sma77 platform and its operators, who act as the data controller in respect of personal data collected through the website at https://sma77.pro.
• "Platform" — the sma77 website, mobile interface, and all associated products including the sportsbook, live casino, slots, togel (Indonesia's traditional numbers lottery), Keno, and sabung ayam (traditional cockfighting entertainment) services.
• "Member", "You", "Your" — any natural person who has registered an account with sma77 or who visits or interacts with the Platform in any capacity.
• "Personal Data" — any information that identifies or could reasonably be used to identify a natural person, including name, email address , date of birth, payment details, device identifiers, and IP address.
• "Processing" — any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, or deletion.
• "Third Party" — any person or organisation other than sma77 and the Member.
• "KYC" — Know Your Customer identity verification procedures required by sma77's compliance programme.
• "Cookies" — small text files placed on your device by the Platform to recognise your browser, remember preferences, and support analytics functions.

sma77 collects only the Personal Data that is necessary for us to provide our services, comply with our legal obligations, and maintain the security and integrity of the Platform. The categories of data we collect are set out in the table below:

sma77 collects Personal Data through the following means:

• Direct submission: When you register an account, complete KYC verification, make a deposit or withdrawal, contact our support team, or respond to a survey or promotion, you provide Personal Data directly to us.
• Automated collection: When you access and use the Platform, our servers automatically record Technical Data and Cookie & Usage Data. This collection is a necessary part of how any internet-based service operates.
• Payment service providers: When you transact via a local bank or e-wallet, our payment processing partners share transaction confirmation data with us — specifically the transaction reference, amount, and account identifier — to credit your sma77 wallet correctly.
• Identity verification partners: When you submit KYC documents, our identity verification service provider processes your document images and returns a verification result to sma77. We store the result and a reference to the document type; we do not store raw document scans beyond the period required for compliance.
• Fraud detection systems: Our automated risk-management systems analyse account activity patterns, device fingerprints, and IP geolocation data to detect and prevent fraudulent behaviour in real time.
• Cookies and tracking technologies: As described in Clause 9, Cookies placed on your device collect usage data when you interact with the Platform.

sma77 uses your Personal Data only for the purposes described below. We do not use your data for automated decision-making that produces legal effects without human oversight, and we do not sell your Personal Data to third parties for their own marketing purposes.

sma77 processes your Personal Data on one or more of the following legal bases, depending on the specific purpose of the processing activity:

• Contractual necessity: Processing required to open your account, accept your bets, process your deposits and withdrawals, and deliver the services described in our Terms & Conditions. Without this processing, sma77 cannot perform the contract with you.
• Legal obligation: Processing required to comply with applicable anti-money laundering (AML) regulations, KYC requirements, responsible gaming obligations, and any lawful order from a competent authority.
• Legitimate interests: Processing carried out for fraud prevention, platform security, abuse detection, and service improvement — where those interests are not overridden by your privacy rights. sma77 applies a balancing test before relying on legitimate interests.
• Consent: Processing for optional purposes such as marketing communications and non-essential analytics cookies, where you have given clear and informed consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Where sma77 processes data on the basis of legitimate interests, you have the right to object to that processing. Please refer to Clause 10 for details of how to exercise your rights.

sma77 does not sell, rent, or trade your Personal Data. We share your data only in the limited circumstances described below, and only to the minimum extent necessary for the stated purpose:

• Payment service providers: We share financial and identity data with our banking and e-wallet partners (including the operators of BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, OVO, DANA, GoPay, ShopeePay, and LinkAja integrations) to facilitate deposit and withdrawal transactions. These providers act as independent data controllers and are subject to their own privacy policies.
• Identity verification providers: We share document images and personal details with our KYC technology partner solely for the purpose of identity verification. All KYC providers used by sma77 are contractually bound to process data only as instructed and to maintain appropriate security standards.
• Game content providers: When you play a game supplied by a third-party studio such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, or Spribe, limited technical data (session token, bet amount, game result) is exchanged with that studio's platform to run the game. Game studios do not receive your name, national ID, or bank details.
• Fraud and risk management services: We may share Technical Data and anonymised activity data with specialist fraud-detection partners to identify and prevent money laundering, bonus abuse, and account takeover attacks.
• Legal and regulatory authorities: We will disclose Personal Data to government authorities, law enforcement agencies, or courts when required to do so by a valid legal order, or when we reasonably believe that disclosure is necessary to prevent imminent harm to persons or property.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of sma77's business assets, your Personal Data may be transferred to the acquiring entity. You will be notified via email and/or on-site notice prior to any such transfer, and you will have the opportunity to request Account closure before the transfer takes effect.

sma77 retains your Personal Data for as long as your account is active and for such additional period as is required by applicable law, our legitimate interests in fraud prevention and dispute resolution, or our responsible gaming obligations. The following retention periods apply as a general guide:

When your data is no longer required for the purpose for which it was collected, or when the applicable retention period expires, sma77 will securely delete or anonymise it so that it can no longer be associated with you. Anonymised and aggregated data that cannot identify any individual may be retained indefinitely for statistical and reporting purposes.

sma77 takes the security of your Personal Data seriously and implements a layered set of technical and organisational controls designed to protect your information against unauthorised access, loss, alteration, or disclosure.

• 256-bit SSL/TLS encryption: All data transmitted between your browser or device and the sma77 Platform is encrypted in transit using industry-standard TLS 1.3 protocols.
• Encrypted data storage: Sensitive data fields — including national ID numbers, bank account details, and passwords — are stored in encrypted form at rest. Password hashes use modern one-way hashing algorithms; sma77 staff cannot view your plaintext password.
• Access controls: Access to systems containing Personal Data is restricted to authorised sma77 personnel on a strict need-to-know basis. All internal access is logged and periodically audited.
• Intrusion detection: sma77 operates continuous network monitoring and intrusion detection systems to identify and respond to suspicious activity in real time.
• Two-factor authentication (2FA): Members are encouraged to enable 2FA on their sma77 accounts. This provides an additional layer of protection against unauthorised access even if your password is compromised.
• Penetration testing: sma77 engages independent security specialists to conduct regular penetration tests and vulnerability assessments of the Platform infrastructure.

In the event of a data breach that is likely to result in a high risk to your rights and freedoms, sma77 will notify affected Members as promptly as is practicable, providing details of the nature of the breach, the categories of data affected, and the steps sma77 is taking to mitigate the impact.

sma77 uses Cookies and similar tracking technologies (including pixel tags and local storage objects) to operate and improve the Platform. The Cookies we use fall into the following categories:

• Strictly necessary cookies: These Cookies are essential for the Platform to function. They include session authentication tokens, security cookies, and load-balancing cookies. They cannot be disabled without rendering the Platform non-functional.
• Functional cookies: These remember your preferences — such as your preferred language setting and the last game category you browsed — to provide a more personalised experience. They are enabled by default but can be disabled in your browser settings.
• Analytics cookies: We use analytics cookies to understand how Members navigate the Platform, which pages are most popular, and where users encounter difficulty. This helps us improve the product. Analytics data is aggregated and is not used to identify you personally. You may opt out of analytics cookies via your account settings.
• Marketing and attribution cookies: If you arrived at sma77 via an affiliate partner or an advertising campaign, an attribution cookie records the referral source for the purpose of paying our affiliate partners accurately. These cookies do not track your activity across third-party websites.

sma77 does not use cross-site tracking technologies that follow your browsing activity on websites other than the sma77 Platform. We do not participate in advertising networks that build profiles of individual users across the broader web.

As a sma77 Member, you have the following rights in relation to your Personal Data. sma77 will respond to all valid requests within 30 days of receipt:

• Right of access: You may request a copy of the Personal Data sma77 holds about you, together with information about how we use it.
• Right to rectification: If any of your Personal Data is inaccurate or incomplete, you have the right to request that we correct it. You may update most contact details directly from your account dashboard.
• Right to erasure ("right to be forgotten"): You may request that sma77 delete your Personal Data. Note that this right is subject to our legal obligations to retain certain data for compliance purposes (see Clause 7). Where we cannot fully erase your data, we will explain the reason and apply appropriate data minimisation measures.
• Right to restriction of processing: You may ask sma77 to restrict processing of your Personal Data — for example, while we investigate a complaint — rather than delete it.
• Right to data portability: You may request that sma77 provide your Personal Data in a structured, commonly used, machine-readable format so that you can transfer it to another service provider.
• Right to object: You may object to processing based on legitimate interests (see Clause 5). You may also object to marketing communications at any time without giving a reason.
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

To exercise any of the above rights, please submit a written request to [email protected] with the subject line "Privacy Rights Request — [Your Account Username]". We may ask you to verify your identity before processing the request. There is no charge for exercising your rights unless your request is manifestly unfounded or excessive, in which case a reasonable administrative fee may apply.

The sma77 Platform may display links to third-party content or integrate third-party services such as game studios, live streaming providers, and payment gateways. When you interact with these third-party services — for example, by launching a live casino game streamed by Evolution Gaming or Pragmatic Play Live — you are also subject to the privacy policies of those providers in respect of data processed on their own infrastructure.

sma77 is not responsible for the privacy practices or the content of third-party websites or services. We encourage you to review the privacy notices of any third-party services you interact with through the Platform. The appearance of a third-party integration within the sma77 Platform does not constitute an endorsement of that party's data-handling practices.

The sma77 Platform is strictly restricted to individuals aged 21 years and older. sma77 does not knowingly collect Personal Data from persons under the age of 21. If sma77 becomes aware — through KYC verification, account review, or any other means — that a Member is under 21 years of age, we will immediately suspend the account, delete or quarantine any Personal Data associated with that account beyond what is required for regulatory reporting, and refund any eligible real-money Funds in accordance with our Terms & Conditions.

If you are a parent or guardian and believe that a person under 21 in your care has registered an account with sma77 or provided their personal information to the Platform, please contact us immediately at [email protected] with the subject line "Minor Account Report". We will investigate and take appropriate action within 24 hours of receiving a credible report.

sma77 reviews this Privacy Policy periodically and may update it to reflect changes in our data processing practices, new legal requirements, or improvements to our services. When we make material changes — such as changes to the categories of data we collect, the purposes for which we use it, or the third parties with whom we share it — we will:

• Update the "Last Updated" date at the top of this page.
• Send an email notification to all registered Members at their registered email address, providing a summary of the key changes and the effective date.
• Display a prominent notice on the Platform for at least 14 days following the effective date of the change.

Your continued use of the sma77 Platform after the effective date of any updated Privacy Policy constitutes your acknowledgement that you have read and understood the revised policy. If you do not agree with the changes, you should cease using the Platform and request Account closure before the effective date.

The most current version of this Privacy Policy is always available at https://sma77.pro/privacy-policy.

For any questions, concerns, or requests relating to this Privacy Policy or to the Personal Data sma77 holds about you, please contact our Data Privacy team through the following channel:

• Email: [email protected] — please include "Privacy Policy Enquiry" in the subject line
• Live Chat: Available 24/7 via the sma77 Platform dashboard after login
• Response Time: sma77 aims to acknowledge all privacy-related enquiries within 24 hours (WIB) and to provide a substantive response within 30 days
• Support Languages: Bahasa Indonesia and English — native Indonesian-speaking agents are available on every shift