Privacy Policy

In this Privacy Policy, the following terms carry the meanings set out below unless context requires otherwise:

• "bro77" / "we" / "us" / "our" — refers to the bro77 online gambling platform accessible at bro77.app, including all associated subdomains, mobile interfaces, and related services operated under the bro77 brand.
• "Player" / "you" / "your" — refers to any individual who registers an account on, accesses, or otherwise interacts with the bro77 platform, including visitors who browse the site without registering.
• "Personal Data" — any information that identifies or could reasonably be used to identify a specific natural person, including but not limited to name, national identity number, date of birth, email address, mobile phone number, IP address, and financial account details.
• "Processing" — any operation performed on personal data, including collection, storage, organization, use, disclosure, and deletion.
• "KYC" — Know Your Customer; the identity and age verification process bro77 conducts prior to processing withdrawal requests, involving submission of government-issued identity documents.
• "Cookies" — small text files stored on your device by the bro77 platform or its technology partners, used to maintain session state, remember preferences, and analyze platform usage.
• "Third-Party Service Provider" — any external organization engaged by bro77 to provide a service that requires access to personal data, including payment processors, KYC verification platforms, fraud prevention services, and customer support infrastructure providers.
• "Consent" — a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your personal data for a defined purpose, provided by a clear affirmative action such as checking a consent box during registration.

bro77 collects personal data across several categories depending on the nature of your interaction with the platform. The categories below describe the full scope of data that may be collected:

Registration & Identity Data

• Full legal name as it appears on your Indonesian KTP or passport.
• Date of birth (used to verify that you meet the 21+ age requirement).
• Indonesian National Identity Number (NIK) from your KTP.
• Residential address in Indonesia.
• Email address and Indonesian mobile phone number.
• Username and encrypted password hash (passwords are never stored in plaintext).

KYC Verification Data

• Photographs or scans of government-issued identity documents (KTP or passport).
• Proof of address documentation (utility bills, bank statements dated within three months).
• Facial verification data where biometric KYC methods are used, processed exclusively by our KYC technology partner and not stored by bro77 directly.

Financial & Transaction Data

• Indonesian bank account details for deposit and withdrawal transactions, including bank name (BCA, BRI, BNI, Mandiri, CIMB Niaga), account holder name, and account number.
• E-wallet identifiers for OVO, DANA, GoPay, ShopeePay, and LinkAja (typically the registered mobile number).
• Deposit and withdrawal history, including amounts in IDR, timestamps (WIB, UTC+7), and transaction reference numbers.
• Wagering history, game session records, bonus claim records, and balance movements.

Technical & Usage Data

• IP address and approximate geolocation derived from IP.
• Device type, operating system, browser type and version.
• Session timestamps, pages visited, features used, and clickstream data.
• Error logs and crash reports generated during platform use.

Communications Data

• Records of all support interactions, including live chat transcripts, email correspondence, and call recordings where applicable.
• Feedback, complaints, and dispute records submitted by you to bro77.

bro77 collects personal data through the following mechanisms:

• Direct submission: Data you provide when registering an account, completing KYC, initiating a deposit or withdrawal, contacting support, or responding to a survey or promotion.
• Automated collection: Technical and usage data collected automatically as you interact with the bro77 platform, including data gathered via cookies, server logs, and analytics tools.
• Payment channel providers: Transaction confirmation data received from BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, LinkAja, Visa, and Mastercard when you initiate a deposit or withdrawal.
• KYC technology partners: Identity verification results and risk scores generated by our third-party KYC platform in response to document submissions you initiate.
• Fraud prevention services: Device fingerprint data and behavioral risk signals generated by our fraud prevention technology partner during account creation and login events.

bro77 does not purchase personal data from third-party data brokers or obtain personal data from social media platforms without your explicit consent.

bro77 processes personal data for the following defined purposes. Each purpose is matched to the category of data used and the legal basis on which processing is conducted:

bro77 does not use personal data for automated individual decision-making that produces significant legal effects without human review. Where automated tools are used to flag accounts for fraud or responsible gaming review, a trained compliance team member reviews all flagged cases before any account action is taken.

bro77 processes personal data on one or more of the following legal bases, as indicated in the purpose table in Clause 4:

• Contract performance: Processing is necessary to perform the contract between bro77 and you as a registered player — including account creation, game access, and financial transaction processing. Without this data, bro77 cannot provide its core services.
• Legal obligation: Processing is required to comply with applicable legal and regulatory requirements, including KYC obligations, anti-money laundering (AML) rules, responsible gaming mandates, and financial record-keeping requirements imposed by the jurisdiction in which bro77 holds its international operating licence.
• Legitimate interests: Processing is conducted for bro77's legitimate business interests — such as fraud prevention, platform security, and service improvement — where those interests are not overridden by your fundamental rights and freedoms. bro77 conducts a balancing assessment before relying on legitimate interests as a basis.
• Consent: Where processing is based on your consent — principally for marketing communications — you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. Withdrawal of marketing consent does not affect your ability to use the bro77 platform.

bro77 does not sell, rent, or trade your personal data. We share personal data with third parties only in the specific circumstances described below, and only to the extent necessary for the identified purpose:

• Payment processors and banking partners: Transaction data shared with BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, LinkAja, Visa, and Mastercard solely to process deposits and withdrawals you initiate. Each payment channel provider operates under its own privacy policy and is independently responsible for data it receives through the payment network.
• KYC and identity verification providers: Identity documents and verification data shared with our certified KYC technology partner for the sole purpose of verifying your identity and age. Our KYC partner is contractually prohibited from using your data for any purpose beyond identity verification.
• Fraud prevention and AML services: Device fingerprint data, transaction patterns, and risk signals shared with our fraud prevention and AML monitoring platform to detect and prevent prohibited conduct as defined in the bro77 Terms & Conditions.
• Customer support infrastructure: Communications data processed through our customer support platform provider. Support agents access your registration data and transaction history solely to assist with your specific support enquiry.
• Legal and regulatory authorities: Personal data disclosed to law enforcement, regulatory bodies, or courts where bro77 is legally required to do so, or where disclosure is necessary to protect the rights, property, or safety of bro77, its players, or third parties. bro77 will notify you of any such disclosure where permitted by law.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of bro77's assets, personal data may be transferred to the acquiring entity. You will be notified of any such transfer and any changes to this Privacy Policy that result from it.

bro77 uses cookies and similar tracking technologies to operate the platform, maintain your session, remember your preferences, and analyze how the platform is used. The following cookie categories are in use:

You may manage cookie preferences — other than strictly necessary and security cookies — through your browser settings. Most modern browsers allow you to block or delete cookies. Note that blocking functional or analytics cookies may affect your experience on the bro77 platform but will not prevent you from accessing core gaming features.

bro77 does not use advertising or retargeting cookies that track your activity across third-party websites for the purpose of serving behavioral advertising.

bro77 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The retention periods below apply unless a longer period is required by law:

• Account and registration data: Retained for the duration of your active account, plus a minimum of 5 years following account closure. This period supports AML compliance and the resolution of any outstanding disputes.
• KYC verification documents: Retained for a minimum of 5 years from the date of verification, as required under standard financial compliance frameworks applicable to internationally licensed gambling operators.
• Financial transaction records: Retained for a minimum of 5 years from the date of the transaction. This includes deposit records, withdrawal records, and wagering history.
• Customer support communications: Retained for 2 years from the date of the last interaction in the relevant support thread, or longer if the communication relates to a formal dispute or legal proceeding.
• Marketing consent records: Retained for the duration of your marketing opt-in, plus 2 years following withdrawal of consent, to demonstrate compliance with consent requirements.
• Analytics and usage data: Anonymized after 13 months and retained in aggregated form indefinitely for platform improvement purposes. Anonymized data is not personal data and is not subject to the retention limits above.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized. Where full deletion is not immediately technically feasible (e.g., data held in encrypted backup systems), bro77 will ensure that the data is quarantined and excluded from active processing until it can be securely deleted at the next scheduled backup cycle.

As a bro77 player and data subject, you have the following rights in relation to your personal data. These rights may be exercised at any time by contacting bro77 support from your verified account email address:

• Right of access: You may request a copy of all personal data bro77 holds about you, along with information about how it is being used and the legal basis for processing. bro77 will respond to access requests within 14 calendar days.
• Right to rectification: If any personal data bro77 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. Certain data corrections (e.g., changes to your registered name) may require documentary evidence.
• Right to erasure ("right to be forgotten"): You may request deletion of your personal data where: (a) the data is no longer needed for the purpose it was collected; (b) you have withdrawn consent and no other legal basis applies; (c) you object to processing and there are no overriding legitimate grounds; or (d) the data has been unlawfully processed. This right is subject to legal retention obligations — bro77 cannot delete transaction records it is legally required to retain.
• Right to restrict processing: You may request that bro77 temporarily suspend active use of your personal data (without deleting it) while a correction request or objection is being assessed.
• Right to data portability: You may request a copy of personal data you have provided to bro77 in a structured, commonly used, machine-readable format (JSON or CSV), where technically feasible and where processing is based on contract or consent.
• Right to object: You have the right to object to processing based on legitimate interests. bro77 will cease such processing unless compelling legitimate grounds exist that override your interests, rights, and freedoms, or where processing is necessary for legal claims.
• Right to withdraw marketing consent: You may withdraw consent to receive marketing communications at any time, without affecting the lawfulness of prior processing or your ability to use the bro77 platform. Withdrawal takes effect within 48 hours of receipt.

The bro77 platform is strictly intended for adults aged 21 and over. bro77 does not knowingly collect personal data from individuals under the age of 21. Any account found to have been registered by a person under 21 years of age will be immediately and permanently closed, all associated balances will be forfeited, and any personal data collected in connection with that account will be deleted from active systems as soon as practicable.

If you have reason to believe that a minor has registered a bro77 account or that a minor has gained access to a registered account, please contact bro77 support immediately at [email protected]. bro77 will investigate all such reports as a high-priority matter and take immediate action where underage access is confirmed.

bro77 implements a multi-layered security architecture to protect your personal data against unauthorized access, disclosure, alteration, and destruction. The following technical and organizational measures are in place:

• Encryption in transit: All data transmitted between your device and bro77 servers is encrypted using TLS 1.2 or higher (effectively 256-bit SSL). Connections using outdated protocol versions are blocked.
• Encryption at rest: Sensitive personal data stored in bro77 databases — including identity documents, financial account details, and KYC records — is encrypted at rest using AES-256 encryption.
• Password security: Player passwords are never stored in plaintext. bro77 stores only a salted cryptographic hash of your password using a modern hashing algorithm (bcrypt or equivalent). bro77 staff cannot retrieve your password — only a reset can be performed.
• Access controls: Access to personal data within bro77's internal systems is restricted on a strict need-to-know basis. All internal access is logged and subject to audit. Access privileges are reviewed quarterly.
• Two-factor authentication: bro77 offers optional two-factor authentication (2FA) for player accounts and mandates 2FA for all internal staff accounts with access to player data.
• Penetration testing: bro77's platform and infrastructure undergo regular third-party security assessments and penetration testing. Critical vulnerabilities are remediated within 48 hours of identification.
• Incident response: bro77 maintains a formal data breach response plan. In the event of a breach affecting your personal data, bro77 will notify you within 72 hours of becoming aware of the incident, in accordance with applicable notification obligations.

Despite these measures, no internet-based platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your own login credentials and for ensuring the security of the device you use to access bro77. If you suspect that your account has been compromised, contact bro77 support immediately to initiate an account lockdown.

The bro77 platform integrates with third-party service providers to deliver its full range of features. While bro77 carefully selects and contracts with all such providers, each operates under its own privacy policy and terms of service in respect of data it independently collects or controls. bro77 is not responsible for the privacy practices of third parties beyond the data processing obligations set out in the agreements between bro77 and those providers.

The primary third-party integrations that may interact with your personal data include:

• Game studios: Live casino game streams from Evolution Gaming, Pragmatic Play Live, and SA Gaming are delivered via the studios' own platforms. Game round data transmitted to the studio's servers is subject to the studio's privacy policy. bro77 receives game result data for settlement and record-keeping purposes only.
• Slot providers: RNG slot titles from Pragmatic Play, NetEnt, Microgaming, Pocket Games Soft, and Spribe are delivered via aggregated game APIs. Gameplay data processed by the provider is subject to the provider's privacy policy.
• Payment partners: Payment processing data shared with BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, LinkAja, Visa, and Mastercard is governed by each provider's respective privacy policy and terms of service.
• Analytics platform: bro77 uses a privacy-respecting analytics platform that processes anonymized usage data. The analytics provider does not receive personally identifiable information and does not link usage data to individual player identities.

bro77 does not embed third-party social media tracking pixels, advertising networks, or cross-site behavioral tracking tools on its platform.

bro77 sends promotional emails, platform notifications, and SMS messages to players who have provided explicit opt-in consent at registration or through their account notification settings. Marketing communications may include information about new games, promotions, seasonal bonuses tied to Indonesian cultural events such as Idul Fitri, Ramadhan, and Indonesian Independence Day, deposit match offers, and platform updates.

You may opt out of all marketing communications at any time using any of the following methods:

• Clicking the unsubscribe link included at the footer of every bro77 marketing email.
• Updating your notification preferences in your account settings after login.
• Contacting bro77 support at [email protected] with the subject line "Marketing Opt-Out".

Opt-out requests are processed within 48 hours. You may continue to receive transactional communications (e.g., deposit confirmations, withdrawal notifications, KYC status updates, security alerts) regardless of your marketing preferences, as these are necessary for the operation of your account and are not subject to marketing consent requirements.

bro77 does not share your contact details with third-party advertisers for the purpose of sending you marketing communications on their behalf.

bro77 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or the services we offer. When material changes are made, bro77 will notify registered players via email and/or a prominent notice on the platform at least 7 days before the changes take effect. For non-material changes (such as clarifications, corrections of typographical errors, or minor restructuring that does not affect the substance of our data practices), bro77 may update the policy without advance notice.

The "Last Updated" date displayed at the top of this page reflects the date on which the most recent version of this Privacy Policy became effective. We encourage you to review this page periodically to stay informed of any updates. Your continued use of the bro77 platform following the effective date of any revision constitutes your acknowledgment of the updated policy. If you do not agree with the revised policy, you should close your account and cease using the platform prior to the effective date of the changes.

Previous versions of this Privacy Policy are available on request by contacting bro77 support. bro77 maintains an internal version history of all previous policies for a minimum of 5 years.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way bro77 processes your personal data, please contact the bro77 Data Privacy team using the details below:

• Email: [email protected] (plain text — not a clickable link)
• Subject line format: "Privacy Enquiry — [Your Username]" for general enquiries, or "Data Rights Request — [Request Type]" for formal rights requests.
• Response time: bro77 aims to acknowledge all privacy-related communications within 2 business hours and to provide a substantive response within 14 calendar days. Complex requests or those involving multiple data categories may require up to 30 days; you will be informed if an extension is necessary.
• Support availability: bro77's customer support team is available 24 hours a day, 7 days a week, including during Indonesian public holidays. Indonesian-speaking support agents are available at all times.

All privacy-related communications must be sent from the email address registered on your bro77 account to allow us to verify your identity before processing any request involving personal data. Requests submitted from unverified email addresses cannot be actioned for security reasons.