Privacy Policy for qris77

qris77 ("we", "us", "our", or "the Company") is the data controller responsible for the personal information collected through the Platform accessible at https://qris77.app and all associated subpages, mobile browser versions, and progressive web app (PWA) instances (collectively, "the Platform").

As data controller, qris77 determines the purposes and means by which your personal data is processed. Where we engage third-party service providers to process data on our behalf, those providers act as data processors and are contractually bound to handle your data only in accordance with our documented instructions and applicable data protection law.

If you have any questions or concerns about this Privacy Policy or about the way your personal data is handled, please contact our Data Protection team directly:

qris77 collects personal data through several distinct channels. The categories below describe what data is collected and at which point in your interaction with the Platform it is gathered.

2.1 — Registration Data: When you create an account, we collect your full name, date of birth, email address, and the password you choose (stored as a one-way cryptographic hash — we never store your password in plain text).

2.2 — KYC Verification Data: Before processing your first withdrawal, we require identity and address verification documents. These may include a scan or photograph of your Indonesian National Identity Card (KTP), passport, or driving licence; a proof-of-address document (utility bill, bank statement, or official correspondence dated within the last three months); and, where applicable, a proof-of-payment-method document showing your name and BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, or LinkAja account details.

2.3 — Financial Transaction Data: Every deposit and withdrawal you make is recorded, including the amount (in IDR or the relevant cryptocurrency denomination), the payment method used, the date and time of the transaction (WIB, UTC+7), and the transaction reference number issued by the payment processor.

2.4 — Betting and Gaming Activity: We maintain a full record of every wager you place on the Platform — including the game or event, stake amount, odds or RTP, outcome, and settlement timestamp. This data is used for account management, dispute resolution, bonus compliance, and responsible gaming monitoring.

2.5 — Technical and Device Data: When you access the Platform, our servers automatically log your IP address, browser type and version, operating system, device type, screen resolution, referring URL, session duration, and page-view sequences. This data is used for fraud prevention, security monitoring, and aggregate analytics.

2.6 — Communications Data: If you contact our support team — via email or live chat — we retain a record of that correspondence, including the content of messages, attachments, and metadata such as timestamps and agent identifiers. This allows us to maintain a consistent service history and to resolve disputes accurately.

2.7 — Cookies and Tracking Technologies: We use first-party cookies and similar technologies to maintain your session state, remember your preferences, and collect aggregate usage analytics. See Clause 6 for the full cookie policy.

qris77 processes your personal data under one or more of the following legal bases, depending on the specific processing activity:

• Contractual Necessity: Processing required to enter into and perform the contract with you — including account creation, managing your Balance, settling bets and togel draws, processing deposits and withdrawals, and providing customer support;
• Legal Obligation: Processing required to comply with applicable AML (anti-money laundering), counter-terrorism financing (CTF), and KYC regulations to which the Company is subject as an internationally licensed gaming operator;
• Legitimate Interests: Processing carried out to pursue the Company's legitimate business interests where those interests are not overridden by your rights — including fraud prevention, security monitoring, Platform improvement, and responsible gaming oversight;
• Consent: Where we rely on your consent — for example, to send you marketing communications or to set non-essential cookies — we will obtain that consent clearly and separately. You may withdraw consent at any time without affecting the lawfulness of any processing carried out before withdrawal.

The personal data we collect is used for the following specific purposes:

• Account Management: Creating, maintaining, and administering your qris77 Account; verifying your identity and age (21+); enabling login and session security; and processing account-closure requests;
• Payment Processing: Facilitating deposits via BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, OVO, DANA, GoPay, ShopeePay, LinkAja, and supported cryptocurrencies (USDT, BTC, ETH); processing withdrawals to your verified payment method; and maintaining accurate financial records;
• KYC and AML Compliance: Verifying your identity and the legitimacy of your funds in accordance with internationally recognised AML standards; reporting suspicious activity to the relevant compliance authorities where legally required;
• Betting and Gaming Operations: Recording and settling all wagers; resolving disputes over game outcomes or bet settlements; applying bonus terms and tracking wagering requirements; and generating account statements;
• Responsible Gaming: Monitoring your playing patterns to identify potential problem gambling behaviour; enforcing self-imposed deposit limits, loss limits, and self-exclusion periods; and proactively reaching out to players who exhibit indicators of gambling harm;
• Fraud Prevention and Security: Detecting and investigating multi-accounting, bonus abuse, payment fraud, identity theft, and unauthorised access attempts; maintaining the integrity and security of the Platform;
• Customer Support: Responding to your enquiries, complaints, and account-related requests; maintaining a support history to ensure consistent and accurate service;
• Marketing and Promotions: Sending you information about promotions, bonus offers, and seasonal campaigns relevant to players in Jakarta, Surabaya, Bali, Bandung, and across Indonesia — but only where you have consented to receive marketing communications or where we have a legitimate interest to do so;
• Platform Analytics and Improvement: Analysing aggregate, anonymised usage data to understand how players navigate the Platform, which games and features are most popular, and where the user experience can be improved.

We will not use your personal data for any purpose that is incompatible with those stated above without first obtaining your explicit consent or providing you with prior notice and the opportunity to object.

qris77 does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. We share your data only in the limited circumstances described below, and only to the minimum extent necessary for each purpose.

5.1 — Payment Processors: To process your deposits and withdrawals, we share relevant transaction data with our payment processing partners. These include bank transfer gateway operators, e-wallet API providers (OVO, DANA, GoPay, ShopeePay, LinkAja), and cryptocurrency custodial and exchange services. Payment processors receive only the data necessary to complete the specific transaction.

5.2 — KYC and Identity Verification Providers: To fulfil our KYC obligations, we may share your identity documents and personal details with a third-party identity verification service. These providers are contractually prohibited from using your data for any purpose other than the verification we request.

5.3 — Fraud Prevention and AML Partners: We participate in industry-standard fraud prevention networks. Where we have reasonable grounds to suspect fraudulent activity, we may share relevant account and transaction data with specialist fraud detection providers and, where legally required, with competent regulatory or law enforcement authorities.

5.4 — Game Studio Providers: Game studios including Pragmatic Play, Evolution Gaming, PG Soft, Microgaming, Spribe, and Habanero may receive anonymised gameplay data (session identifiers, bet amounts, game outcomes) for audit, fair-play verification, and technical support purposes. These providers do not receive your name, email address, or financial account details.

5.5 — Legal and Regulatory Disclosure: We may disclose your personal data to courts, regulators, or law enforcement agencies where we are required to do so by a legally binding order, subpoena, or applicable law. Where permitted, we will notify you of such a disclosure request before complying.

5.6 — Business Transfers: In the event that qris77 undergoes a merger, acquisition, restructuring, or sale of all or part of its business assets, your personal data may be transferred to the acquirer or successor entity as part of that transaction. You will be notified of any such change that materially affects how your data is processed.

qris77 uses cookies and similar browser storage technologies to operate the Platform effectively, remember your preferences, maintain your login session, and collect aggregate analytics data.

qris77 does not use third-party advertising cookies or retargeting pixels. You can manage functional and analytics cookie preferences at any time via your browser settings. Note that disabling essential or fraud-prevention cookies will impair the Platform's ability to maintain a secure session for your account.

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected, and for as long as required to meet our legal, regulatory, and contractual obligations. The following retention periods apply as a general guide:

• Active Account Data: Retained for the duration of your active account relationship with qris77;
• Post-Closure Account Data: Following account closure, core account data (name, email, account history, KYC records, and transaction logs) is retained for a minimum of 5 years to comply with AML record-keeping obligations. This period may be extended if an investigation is ongoing at the time of closure;
• Financial Transaction Records: Retained for 7 years from the date of each transaction, in line with international financial record-keeping standards;
• KYC Documents: Retained for 5 years following the end of the customer relationship, or longer if required by applicable regulatory guidance;
• Support Communications: Retained for 3 years from the date of the last communication, or for the duration of any unresolved dispute;
• Analytics Data: Aggregate, anonymised analytics data may be retained indefinitely as it cannot be used to identify individual players;
• Marketing Consent Records: Retained for 3 years from the date of consent or from the date of last marketing interaction, whichever is later.

When personal data is no longer required, it is securely deleted or anonymised in a manner that prevents re-identification. Physical documents are destroyed using certified secure-destruction methods.

qris77 takes the security of your personal data seriously. We have implemented a layered set of technical and organisational security controls designed to protect your information against unauthorised access, accidental loss, disclosure, alteration, or destruction.

• Encryption in Transit: All communication between your browser or app and our servers is encrypted using TLS 1.3. Connections using older, insecure TLS versions are rejected;
• Encryption at Rest: Sensitive stored data — including KYC documents, payment records, and account credentials — is encrypted at rest using AES-256 encryption;
• Password Security: Account passwords are never stored in plain text. We use bcrypt with a high work factor to store password hashes, making brute-force attacks computationally infeasible;
• Two-Factor Authentication (2FA): Players are strongly encouraged to enable 2FA on their accounts. 2FA adds a critical second layer of verification that protects your account even if your password is compromised;
• Access Controls: Internal access to personal data is strictly role-based. Only staff with a documented operational need can access player data, and all internal access is logged and audited;
• Penetration Testing: Our Platform undergoes regular independent security assessments, including penetration testing and vulnerability scanning, to identify and remediate weaknesses before they can be exploited;
• Incident Response: We maintain a documented data breach response plan. In the event of a breach affecting player data, we will take immediate containment action and notify affected players as quickly as practicable.

As a player on the qris77 Platform, you hold the following rights over your personal data. To exercise any of these rights, contact us at [email protected] with the subject line "Data Rights Request — [Your Right]". We will verify your identity before acting on any request and will respond within 30 calendar days.

Please note that some rights are subject to limitations where our legal retention obligations require us to keep certain data (for example, KYC and AML records). We will always explain any such limitations clearly when responding to your request.

qris77 operates as an international platform. Your personal data may be processed and stored on servers located outside of Indonesia, including in jurisdictions that may not have data protection laws equivalent to those in your home country.

Where we transfer personal data internationally — for example, to KYC verification providers, fraud prevention partners, or cloud infrastructure providers — we take steps to ensure that appropriate safeguards are in place. These safeguards may include:

• Standard contractual clauses (SCCs) approved by recognised data protection authorities, requiring the recipient to protect the data to an equivalent standard as required under international best-practice frameworks;
• Binding corporate rules where data is transferred within a group of companies subject to a shared privacy governance framework;
• Reliance on adequacy decisions where the destination country has been recognised as providing an adequate level of data protection.

By creating an account and using the Platform, you acknowledge that your personal data may be transferred to and processed in countries outside Indonesia. If you would like more information about the specific safeguards in place for any particular transfer, please contact our Data Protection team.

If we become aware — through KYC review, third-party age verification checks, or any other means — that a registered account is held by a person under the age of 21, we will immediately suspend that account, reverse any transactions where legally permissible, and permanently delete all personal data associated with the account, except where retention is required by AML law.

If you are a parent or guardian and believe that a minor in your care has registered an account on the Platform, please contact us immediately at [email protected] so that we can take prompt action.

Where you have consented to receive marketing communications, qris77 may contact you by email with information about new games, promotional bonuses, reload offers, seasonal campaigns (including Idul Fitri, Ramadhan, and Indonesian Independence Day promotions), and platform updates.

We will never send unsolicited SMS marketing messages or contact you via third-party messaging platforms without your prior consent. Our marketing messages will always clearly identify qris77 as the sender and will always include a straightforward, one-click unsubscribe mechanism.

Opting Out: You may withdraw your marketing consent at any time by:

• Clicking the "Unsubscribe" link at the bottom of any marketing email;
• Updating your communication preferences in your Account dashboard;
• Contacting our support team at [email protected] and requesting removal from all marketing lists.

Withdrawal of marketing consent will not affect the delivery of transactional communications — such as deposit confirmations, withdrawal notifications, account security alerts, and KYC status updates — which are sent as a necessary part of the service regardless of your marketing preferences.

The Platform may occasionally reference third-party brands, game studios, or sports leagues by name (for example, Pragmatic Play, Evolution Gaming, BRI Liga 1, or EPL) in the course of describing game content or sportsbook markets. These references do not constitute endorsements and do not imply any formal partnership beyond the licensing agreements under which their products are distributed on our Platform.

qris77 does not embed third-party advertising content, affiliate tracking pixels, or outbound links to external websites from within the main Platform pages. If you independently navigate away from the Platform to a third-party website, qris77 has no control over and accepts no responsibility for the privacy practices or content of that external site. We encourage you to review the privacy policy of any external website you visit.

qris77 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory guidance, or the services we offer. When we make a material change — one that significantly affects your rights or how we handle your data — we will notify you by:

• Displaying a prominent notice on the Platform homepage or your Account dashboard for a minimum of 7 days before the change takes effect;
• Sending an email notification to the address registered to your Account;
• Updating the "Last Updated" date at the top of this page.

Minor changes — such as typographical corrections, clarifications that do not alter the substance of any clause, or updates required urgently for legal compliance — may take effect immediately without advance notice.

Your continued use of the Platform following the effective date of any revision constitutes your acceptance of the updated Privacy Policy. If you do not agree with the changes, you should stop using the Platform and may request account closure in accordance with our Terms & Conditions. We recommend bookmarking this page and reviewing it periodically to stay informed of how we protect your data.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to raise a concern about how your personal information has been handled, please contact our Data Protection team. We are available 24 hours a day, 7 days a week.

Formal Complaints Process: If you are dissatisfied with how we have handled a privacy concern after raising it through our standard support channels, you may escalate your complaint by emailing [email protected] with the subject line "Formal Privacy Complaint — [Your Account Username]". We operate a two-stage internal complaints process: we will acknowledge receipt within 48 hours and provide a full written response within 14 calendar days.