Privacy Policy — aos77

This Privacy Policy describes how aos77 (referred to as "we", "us", or "the Company") collects, processes, stores, and protects personal data relating to individuals ("you", "Player", "User") who access or use the aos77 platform at https://aos77.cam, including all associated subdomains and services.

This Policy applies to all personal data processed by aos77 in connection with the operation of the Platform, including data collected during account registration, identity verification (KYC), deposits and withdrawals via Indonesian banks (BCA, BRI, BNI, Mandiri, and others) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja), gameplay activity, customer support interactions, and marketing communications.

aos77 is committed to processing personal data in a lawful, fair, and transparent manner, consistent with internationally recognised data protection principles. We take particular care in respect of Indonesian players' data given the context in which our Platform operates.

The following terms have the meanings assigned to them throughout this Privacy Policy.

• "Personal Data" means any information that identifies or can be used to identify you as a natural person, directly or indirectly, including your name, KTP number, email address, Indonesian mobile number, IP address, and payment details.
• "Processing" means any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, transmission, restriction, erasure, or destruction.
• "Data Controller" means aos77, the entity that determines the purposes and means of processing your personal data.
• "Data Processor" means a third party that processes personal data on behalf of aos77 under a written contractual arrangement, such as a payment gateway provider or cloud hosting service.
• "Consent" means a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your personal data for a stated purpose.
• "KYC" means Know Your Customer — the identity and address verification process required by anti-money laundering (AML) regulations applicable to the Platform.

The categories of personal data we collect depend on how you interact with the Platform. The table below summarises what we collect and why.

We do not collect special categories of sensitive personal data (such as racial or ethnic origin, religious beliefs, health data, or political opinions) and do not request such information at any stage of the account lifecycle.

aos77 collects personal data through the following channels and mechanisms:

aos77 processes personal data only where a lawful basis exists. The applicable bases, mapped to their processing purposes, are as follows:

• Contractual Necessity: Processing required to create and manage your Account, process deposits and withdrawals, settle wagers, and provide customer support. Without this processing, we cannot provide the Platform services described in the Terms & Conditions.
• Legal Obligation: Processing required for compliance with AML legislation, KYC regulatory obligations, tax reporting requirements, and responses to lawful requests from regulatory or law enforcement authorities. This includes retention of transaction records and KYC documents for the periods mandated by applicable law.
• Legitimate Interests: Processing for fraud prevention, network and information security, platform abuse detection, responsible gaming monitoring, and internal analytics — where such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for direct marketing communications (email, SMS, WhatsApp), personalised promotional offers, and non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

The primary purposes for which aos77 uses your personal data are set out below. We do not use personal data for any purpose that is incompatible with those stated at the time of collection.

• To register and maintain your Account on the aos77 Platform and verify your identity and eligibility (age 21+, Indonesia residency).
• To process deposits from and withdrawals to your registered Indonesian bank accounts (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja).
• To conduct KYC identity and address verification in compliance with AML and responsible gaming obligations.
• To detect, investigate, and prevent fraudulent transactions, bonus abuse, and other prohibited activities as defined in the Terms & Conditions.
• To monitor gaming activity for responsible gaming purposes, including identification of potentially problem gambling patterns, and to proactively offer support resources where appropriate.
• To send transactional communications relating to your Account — deposit confirmations, withdrawal notifications, KYC status updates, and security alerts. These messages are sent regardless of marketing consent as they are necessary to the contract.
• To send promotional communications, offers, and personalised recommendations where you have given valid consent.
• To operate, maintain, test, and improve the Platform's technical infrastructure and user experience.
• To manage and resolve disputes, including providing evidence in arbitration or legal proceedings where required.
• To comply with all applicable legal and regulatory obligations in the licensing jurisdiction and in Indonesia.

aos77 does not sell, rent, or commercially trade your personal data. We share data only in the following defined circumstances, and only to the minimum extent necessary for the stated purpose:

• Payment Service Providers: Banks and e-wallet operators (including BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay) receive only the financial data necessary to process the specific transaction. They act as independent data controllers for their own services.
• Identity Verification Services: Third-party KYC providers receive identity documents solely to perform verification checks. They are bound by strict data processing agreements and cannot use the data for any other purpose.
• Cloud Infrastructure & Hosting Providers: Our platform data is hosted on secure cloud infrastructure. Provider access is restricted by contractual data processing agreements and technical access controls.
• Fraud Prevention & Security Services: Anonymised or pseudonymised technical data (IP addresses, device fingerprints) may be shared with fraud screening services to protect the Platform and its players.
• Regulatory & Law Enforcement Authorities: Where required by applicable law, court order, or the lawful request of a competent regulatory authority, we will disclose personal data as required. We will notify affected Players where legally permissible to do so.
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of the Company's assets, your personal data may be transferred as part of that transaction. You will be notified in advance and given the opportunity to close your Account if you do not wish your data to be transferred.

As an internationally operated Platform, some processing of your personal data may occur on servers located outside Indonesia. Where data is transferred to countries that may not provide the same level of data protection as international standards require, aos77 implements appropriate safeguards including:

• Standard Contractual Clauses (SCCs) or equivalent contractual mechanisms providing binding data protection obligations on the recipient.
• Transfers only to processors certified under recognised international security frameworks (e.g., ISO 27001, SOC 2 Type II).
• Encryption of data in transit and at rest regardless of the jurisdiction in which it is stored.

You may request further information about specific transfer mechanisms by contacting our support team at [email protected] (plain text, not a link).

aos77 retains personal data only for as long as is necessary for the purpose for which it was collected, or as required by applicable legal or regulatory obligations. The following retention periods apply as a general framework:

• Account Data & KYC Documents: Retained for the duration of the active Account relationship plus 5 years following account closure, in accordance with AML record-keeping requirements.
• Transaction Records (deposits, withdrawals, wager history): Retained for 7 years from the date of the transaction to meet financial regulatory obligations and support dispute resolution.
• Support Communications: Retained for 3 years from the date of the final interaction to support ongoing dispute resolution and quality management.
• Marketing Consent Records: Retained for 3 years from the date of the most recent opt-in event or until consent is withdrawn, whichever is earlier, as evidence of the legal basis for marketing communications sent.
• Technical Logs (IP, session data): Retained for 12 months for security and fraud investigation purposes, then anonymised or deleted.
• Anonymised Analytics Data: May be retained indefinitely in aggregate, anonymised form for internal reporting and Platform development purposes, as it cannot be used to identify individuals.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our internal data lifecycle management procedures.

The aos77 Platform uses cookies and similar technologies (local storage, session tokens) to ensure the Platform functions correctly and to support analytics. We do not use third-party advertising cookies or cross-site tracking technologies.

You can manage or delete cookies at any time through your browser settings. Disabling non-essential cookies will not significantly affect your ability to use the Platform, though some preference-related features may not persist between sessions.

aos77 implements a layered security architecture to protect your personal data against unauthorised access, accidental loss, disclosure, or destruction. Our key technical and organisational security measures include:

• Encryption in Transit: All data exchanged between your browser and the Platform is encrypted using TLS 1.3 with 256-bit AES cipher suites. HSTS (HTTP Strict Transport Security) is enforced.
• Encryption at Rest: Sensitive data (KYC documents, payment details, passwords) is encrypted at rest using AES-256. Passwords are hashed using bcrypt with appropriate salt rounds and are never stored in plain text.
• Access Controls: Internal access to personal data is restricted by role-based access controls (RBAC) on a need-to-know basis. Multi-factor authentication is required for all administrative access.
• Infrastructure Security: Platform servers are hosted in ISO 27001-certified data centres. Regular penetration testing and vulnerability assessments are conducted by independent third parties.
• Breach Response: In the event of a personal data breach, aos77 will notify affected Players without undue delay and will cooperate fully with applicable regulatory authorities as required.
• Employee Training: All staff with access to personal data receive mandatory data protection training. Data handling obligations are embedded in employment contracts and subject to disciplinary enforcement.

While we employ best-practice security measures, no internet-based platform can guarantee absolute security. You also play a role in protecting your data by keeping your account credentials confidential and using strong, unique passwords.

As a Player whose personal data is processed by aos77, you hold the following rights in respect of your personal data. To exercise any of these rights, contact our support team at [email protected]. We will respond within 30 calendar days of a verified request.

The aos77 Platform is strictly intended for adults aged 21 years or older. We do not knowingly collect, process, or store personal data from individuals under the age of 21. Our KYC verification process is specifically designed to detect and prevent underage registrations.

If we become aware that personal data has been collected from an individual under the age of 21 — through misrepresentation or a failure of our verification processes — we will immediately close the relevant Account, void any outstanding balance, and permanently delete all associated personal data. Any funds deposited by a minor will be handled in accordance with applicable law.

If you believe a minor has registered an Account on the Platform, please notify us immediately at [email protected].

aos77 reviews and updates this Privacy Policy periodically to reflect changes in our data processing practices, platform features, applicable laws, or regulatory guidance. Where changes are material, we will:

• Notify you by email to your registered address at least 14 calendar days before the changes take effect.
• Display a prominent notice on the Platform indicating that the Privacy Policy has been updated.
• Update the "Effective Date" and "Version" fields at the top of this page.

Continued use of the Platform after the effective date of any update constitutes your acceptance of the revised Policy. If you do not accept material changes, you may close your Account in accordance with the Terms & Conditions and request deletion of your data where legally permissible. Prior versions of this Policy are archived and available upon request.

If you have any questions about this Privacy Policy, wish to exercise a data subject right, or wish to raise a complaint about our data processing practices, please contact the aos77 Data Protection team through the following channels. All contact details are displayed as plain text and are not clickable links.

• Email: [email protected] — Use the subject line "Privacy Request – [Your Account ID]" for data subject rights requests. We respond within 30 calendar days of a verified request.
• Live Chat: Available 24/7 on the Platform. Live chat is suitable for general privacy questions but not for formal data subject rights requests, which must be submitted in writing via email.
• WhatsApp: +62 811-0000-7777 (display only — not a telephone link). Suitable for general enquiries during extended business hours (08:00–24:00 WIB).

If you are not satisfied with our response to a privacy complaint, you have the right to escalate the matter to the supervisory authority in the applicable licensing jurisdiction, or to seek redress through applicable Indonesian consumer protection channels.

This Privacy Policy was last updated on 1 January 2026 and is current as of Version 2.4. It supersedes all prior versions.