Privacy Policy

1Definitions

For the purposes of this Policy, the following terms carry the meanings assigned to them below:

2Data Controller

xe77 acts as the Data Controller for all Personal Data collected through the Platform. We determine the purposes for which your data is used and the means by which it is processed. Where we engage third-party Data Processors (such as payment gateways, KYC verification providers, and analytics services), we do so under binding data-processing agreements that impose equivalent privacy and security obligations.

If you have questions about how xe77 handles your Personal Data or wish to exercise any of your rights as described in Section 12, please contact our Data Protection point of contact at [email protected] with the subject line "Data Privacy Request".

3Data We Collect

xe77 collects only the Personal Data that is necessary for the specific purposes described in this Policy. The categories of data we collect are set out below.

3.1 Identity & Contact Data

• Full legal name (as it appears on your national identity card / KTP).
• Date of birth.
• Residential address within Indonesia (including city and postal code).
• Email address.
• Indonesian mobile phone number.
• Photograph or scanned image of your identity document (for KYC purposes).
• Selfie photograph taken during the identity verification process.

3.2 Financial Data

• Bank account number, account holder name, and bank name (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, or other supported Indonesian banks).
• E-wallet account identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja).
• Deposit and withdrawal transaction history.
• Account balance and wagering history.

3.3 Technical & Usage Data

• IP address and approximate geolocation.
• Device type, operating system, and browser version.
• Pages visited, features used, and session duration.
• Login timestamps and logout events.
• Clickstream and navigation data within the Platform.
• Error logs and crash reports.

3.4 Communications Data

• Contents of live chat transcripts with our support team.
• Email correspondence sent to or received from xe77.
• Records of any complaints, disputes, or responsible gaming requests.

4How We Collect Data

4.1 Data You Provide Directly

The majority of your Personal Data is collected directly from you when you: register an Account; complete KYC verification; make a deposit or withdrawal; contact our customer support team; respond to a survey or promotion; or update your Account profile.

4.2 Data Collected Automatically

When you access the Platform, our servers automatically record technical data including your IP address, device identifiers, browser type, and session activity. This data is collected via server logs, cookies, and similar tracking technologies (see Section 11 for full cookie details).

4.3 Data from Third Parties

xe77 may receive Personal Data about you from the following third-party sources:

• KYC Verification Providers: Third-party identity verification services confirm the authenticity of your identity documents and may share verification status and risk scores with us.
• Payment Processors: Indonesian bank partners and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) share transaction confirmation data with us to reconcile deposits and withdrawals.
• Fraud Detection Services: Third-party anti-fraud platforms may share device fingerprint data, known fraud signals, or blacklist indicators to help us protect your account.
• Marketing Partners: If you were referred to xe77 via an affiliate partner, we may receive limited referral attribution data (no financial or identity information).

5Purpose of Processing

We use your Personal Data only for the purposes described below. We do not use your data for any purpose that is incompatible with the purposes listed here without first seeking your explicit consent.

6Legal Basis for Processing

xe77 processes your Personal Data on one or more of the following legal bases, depending on the specific purpose:

• Contractual Necessity: Processing is required to perform the contract between you and xe77 — for example, processing your deposits and withdrawals, verifying your identity, and operating your Account.
• Legal Obligation: Processing is required to comply with applicable laws and our international gaming license conditions — for example, retaining transaction records and performing anti-money-laundering checks.
• Legitimate Interests: Processing is necessary to pursue xe77's legitimate business interests — for example, fraud prevention, platform security, and improving our services — provided those interests are not overridden by your fundamental rights.
• Consent: Where we rely on your consent — for example, to send you marketing communications — you may withdraw that consent at any time by contacting us at [email protected] or by updating your Account notification preferences. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

7Data Sharing

xe77 does not sell, rent, or trade your Personal Data to third parties for their own marketing purposes. We share your data only in the limited circumstances described below.

7.1 Service Providers (Data Processors)

We engage carefully vetted third-party service providers who process data on our behalf under binding data-processing agreements. These include:

• Identity Verification Providers: To perform KYC checks and confirm you meet the 21+ age requirement.
• Payment Gateways: Indonesian bank partners and e-wallet platforms (OVO, DANA, GoPay, ShopeePay, LinkAja) to facilitate deposits and withdrawals.
• Cloud Infrastructure Providers: To host the Platform, store data securely, and ensure availability.
• Analytics Providers: To analyse Platform usage patterns in aggregated, anonymized form.
• Fraud Detection & AML Screening Services: To identify and prevent fraudulent transactions and money-laundering activity.
• Customer Support Platforms: To power our 24/7 live chat and ticketing system.

7.2 Legal Disclosures

xe77 may disclose your Personal Data to competent regulatory, law enforcement, or judicial authorities where we are legally compelled to do so, or where disclosure is necessary to protect the rights, property, or safety of xe77, our players, or the general public.

7.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of xe77's business, your Personal Data may be transferred to the acquiring entity. We will notify you by email prior to any such transfer and will ensure the receiving party is bound by privacy obligations no less protective than those in this Policy.

8International Data Transfers

As xe77 operates under an international gaming license and uses globally distributed cloud infrastructure, your Personal Data may be transferred to and stored on servers located outside Indonesia. Wherever such transfers occur, xe77 ensures that appropriate safeguards are in place, including:

• Binding contractual clauses with recipient entities that impose data-protection obligations equivalent to those applicable to xe77.
• Transfers only to jurisdictions that offer an adequate level of data protection as assessed by relevant international standards.
• Technical controls including encryption in transit (TLS 1.3) and encryption at rest (AES-256) for all data transferred across borders.

If you would like further information about the specific safeguards applied to international transfers of your data, please contact us at [email protected].

9Data Retention

xe77 retains your Personal Data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law and our licensing obligations. The following retention periods apply:

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymized so that it can no longer be associated with you as an individual.

10Security Measures

xe77 takes the security of your Personal Data seriously. We have implemented a layered set of technical and organizational controls designed to protect your data against unauthorized access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your browser and the xe77 Platform is encrypted using industry-standard TLS 1.3 protocols.
• AES-256 Encryption at Rest: Sensitive data stored in our databases — including financial records and KYC documents — is encrypted at the storage layer.
• Two-Factor Authentication (2FA): Available to all registered users and strongly recommended to prevent unauthorized Account access.
• Role-Based Access Controls: Only xe77 personnel with a legitimate operational need are permitted to access Personal Data, and all such access is logged and audited.
• Penetration Testing: Our Platform undergoes regular third-party security assessments to identify and remediate vulnerabilities.
• Data Breach Response Plan: xe77 maintains a documented incident response procedure. In the event of a breach that poses a risk to your rights, we will notify you promptly and take immediate remediation steps.

11Cookies & Tracking Technologies

xe77 uses cookies and similar tracking technologies to provide core platform functionality, improve your experience, and analyze Platform usage. The following categories of cookies are used:

11.1 Strictly Necessary Cookies

These cookies are essential for the Platform to function and cannot be disabled. They enable core features such as user authentication, session management, and security controls. No personally identifiable information is stored in these cookies beyond your encrypted session token.

11.2 Functional Cookies

Functional cookies remember your preferences — such as your preferred language, odds display format, and notification settings — so you do not need to reconfigure them each time you visit. These cookies persist for up to 12 months.

11.3 Analytics Cookies

We use analytics tools to understand how players navigate the Platform, which features are most popular, and where technical errors occur. Analytics data is collected in aggregated, anonymized form and is not linked back to individual user identities. You may opt out of analytics cookies via your Account settings.

11.4 Managing Cookies

You can control cookies through your browser settings — most modern browsers allow you to block or delete cookies. Note that disabling strictly necessary cookies will impair your ability to use core Platform features, including logging in and placing wagers. For detailed browser-specific instructions, refer to your browser's help documentation.

12Your Rights

Subject to applicable data protection law and our regulatory obligations, you have the following rights with respect to your Personal Data held by xe77:

• Right of Access: You may request a copy of the Personal Data we hold about you, along with information about how it is processed.
• Right to Rectification: You may request that we correct any inaccurate or incomplete Personal Data. Minor corrections (such as updating your phone number) can be made directly in your Account settings.
• Right to Erasure: You may request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected. Note that we may be required to retain certain data for legal compliance purposes even after Account closure (see Section 9).
• Right to Restriction: You may request that we restrict processing of your Personal Data — for example, while a dispute or accuracy challenge is being resolved.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity, you may request a copy of your Personal Data in a structured, machine-readable format.
• Right to Object: You may object to processing based on legitimate interests (including profiling for marketing purposes) at any time. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, submit a written request to [email protected] with the subject line "Data Privacy Request". We will acknowledge your request within 48 hours and provide a substantive response within 30 calendar days. In complex cases, this period may be extended by a further 30 days, in which case we will notify you of the extension and the reason for it.

13Minors

The xe77 Platform is strictly intended for adults aged 21 years and older. We do not knowingly collect Personal Data from any individual under the age of 21. Age verification is conducted as a mandatory step during Account registration and at the point of first withdrawal.

If you are a parent or guardian and believe that a minor has registered an Account or provided Personal Data to xe77 without your consent, please contact us immediately at [email protected]. Upon confirmation, we will close the Account, forfeit any accrued balances, and delete all associated Personal Data without undue delay.

14Third-Party Services

The xe77 Platform may contain references to third-party services such as payment providers (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay), game studios (Pragmatic Play, Evolution Gaming, Spribe), and sports data providers. When you interact with these third-party services, their own privacy policies govern how they handle your data. xe77 is not responsible for the privacy practices of third parties, and we encourage you to review their policies directly.

We do not embed third-party social media plugins, advertising trackers, or cross-site tracking pixels on the Platform that would allow third parties to build advertising profiles based on your betting activity.

15Amendments to This Policy

xe77 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory guidance. Where changes are material, we will notify you at least 14 days in advance via the email address registered on your Account and via a prominent notice on the Platform.

The "Last Updated" date at the top of this page will always reflect the date of the most recent revision. Your continued use of the Platform following the effective date of any amendment constitutes acceptance of the revised Policy. If you do not agree with any changes, you should close your Account before the effective date.

16Contact & Complaints

If you have any questions, concerns, or complaints about how xe77 processes your Personal Data, or if you wish to exercise any of your rights under Section 12, please reach out through the following channels:

• Email: [email protected] — use subject line "Data Privacy Request" for all privacy-related enquiries.
• Live Chat: Available 24/7 via the xe77 Platform — ask to be connected to the Data Privacy team.
• Response Time: We acknowledge all privacy requests within 48 hours and aim to resolve them fully within 30 calendar days.

We take every privacy complaint seriously and will investigate all concerns thoroughly. If you are not satisfied with our response, you have the right to escalate your complaint to the competent data protection supervisory authority in the jurisdiction under which xe77 holds its international gaming license.