hit77 Privacy Policy

hit77 ("we", "us", "our") operates the online casino and sportsbook platform accessible at https://hit77.vu (the "Platform"). We are committed to protecting the privacy of every individual who registers an account, browses the Platform, or contacts our support team. This Privacy Policy describes our practices with respect to the collection, use, storage, sharing, and protection of personal data.

This Policy applies to all personal data processed in connection with your use of the hit77 Platform, including data submitted during registration, data generated through your gameplay and transactions, and data collected automatically through cookies and similar technologies. It applies regardless of the device or network you use to access the Platform.

By registering an account or using the Platform, you confirm that you have read and understood this Privacy Policy and that you consent to the processing of your personal data as described herein. If you do not agree with this Policy, you must discontinue use of the Platform immediately.

The following terms have the meanings assigned to them below throughout this Privacy Policy.

hit77 collects Personal Data in the following categories. We collect only what is necessary for the purposes identified in Section 5 of this Policy.

hit77 collects Personal Data through the following channels:

• Direct submission: Data you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting customer support, or responding to a survey or promotion.
• Automated collection: Data gathered automatically through cookies, web beacons, server logs, and similar technologies when you access or interact with the Platform. See Section 12 for details on our cookie practices.
• Payment providers: Transaction confirmation data (amount, timestamp, masked account reference) received from BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, LinkAja, and any other payment provider integrated with the Platform at the time of your transaction.
• KYC and fraud-prevention partners: Identity verification data and risk-scoring signals received from contracted third-party KYC vendors and anti-fraud service providers during the verification process.
• Game studios and data feeds: Game result data and sportsbook data feeds received from licensed studio and data providers (including Pragmatic Play, Evolution Gaming, PG Soft, and others) in connection with your gameplay sessions.

hit77 processes your Personal Data for the following specific purposes:

• Account creation and management: To register your account, maintain your profile, authenticate your identity at login, and manage your account settings and preferences.
• Payment processing: To receive deposits, execute withdrawals, record transaction history, and resolve payment disputes via local Indonesian payment channels.
• Identity verification (KYC): To verify that you are who you claim to be, that you meet the 21+ age requirement, and that you are eligible to hold an account on the Platform under applicable compliance standards.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, money laundering, multi-accounting, bonus abuse, and other prohibited conduct described in our Terms & Conditions.
• Responsible gaming: To monitor gaming patterns for signs of problem gambling, enforce deposit limits and self-exclusion requests, and fulfil our duty-of-care obligations to players.
• Customer support: To respond to your queries, resolve complaints, and maintain records of support interactions for quality assurance and dispute resolution.
• Platform improvement and analytics: To understand how players use the Platform, identify technical issues, and improve the overall experience — using aggregated and, where possible, anonymised data.
• Bonus and promotional administration: To credit bonuses accurately, verify wagering requirement compliance, and administer targeted promotions during events such as Idul Fitri, Ramadhan, and BRI Liga 1 season milestones.
• Legal and regulatory compliance: To meet obligations imposed by our international licensing authority, including record-keeping, transaction reporting, and cooperation with lawful regulatory enquiries.
• Marketing communications (optional): To send you promotional emails, push notifications, or in-platform messages about hit77 offers and new features — only where you have given, and not subsequently withdrawn, your consent.

hit77 processes your Personal Data on one or more of the following legal grounds, depending on the purpose:

• Contract performance: Processing that is necessary to register your account, process your transactions, and deliver the gaming services you have requested — i.e., to fulfil our contractual obligations to you under the Terms & Conditions.
• Legitimate interests: Processing necessary for fraud prevention, platform security, responsible gaming monitoring, and business analytics, where those interests are not overridden by your fundamental rights and freedoms.
• Legal obligation: Processing required to comply with anti-money-laundering rules, KYC obligations, record-keeping requirements, and other legally mandated duties imposed by our licensing authority.
• Consent: Processing for optional marketing communications, where you have given clear, informed, and freely withdrawn consent. You may withdraw this consent at any time without affecting any other aspect of your account.

hit77 does not sell, rent, or exchange your Personal Data with third parties for their own commercial purposes. We share data only in the following limited circumstances, and only to the extent strictly necessary:

• Payment processors: Your bank account or e-wallet details are shared with the relevant Indonesian payment provider (BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, LinkAja) solely to execute the specific deposit or withdrawal transaction you have requested.
• KYC and identity verification vendors: KYC Documents and identity data are shared with contracted third-party verification providers who process this data under strict data processing agreements and are prohibited from using it for any purpose other than identity verification on hit77's behalf.
• Game studios and platform providers: Minimum necessary session and wager data is shared with licensed game studios (Pragmatic Play, Evolution Gaming, PG Soft, NetEnt, Microgaming, and others) to deliver and record game results. These studios are independently licensed and operate certified RNG environments.
• Hosting and infrastructure providers: Personal Data is stored on servers operated by contracted infrastructure providers who have no independent right to access or use that data.
• Regulatory and law enforcement authorities: hit77 will disclose Personal Data to its international licensing authority, financial intelligence units, or other competent authorities when required to do so by law, regulation, court order, or a lawful regulatory demand. We will notify you of any such disclosure to the extent permitted by law.
• Professional advisors: Legal counsel, auditors, and compliance consultants may access limited Personal Data on a strictly confidential, need-to-know basis in connection with the provision of professional services to hit77.

hit77 operates internationally, and some of our Data Processors are located in jurisdictions outside Indonesia. Where Personal Data is transferred internationally, hit77 ensures that appropriate contractual and technical safeguards are in place to protect your data to a standard equivalent to, or higher than, the protections described in this Policy.

Specifically, international transfers are governed by data processing agreements that impose binding obligations on the recipient to process Personal Data only in accordance with hit77's documented instructions, to maintain equivalent security standards, and to delete or return data upon termination of the service relationship.

hit77 retains Personal Data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law and our licensing obligations. The following retention periods serve as a general guide:

• Account and identity data: Retained for the duration of your active Account plus a minimum of five years following account closure, to fulfil post-closure KYC, anti-money-laundering, and dispute-resolution obligations.
• Transaction records: Retained for a minimum of five years from the date of the transaction in accordance with financial record-keeping requirements.
• Gaming session logs: Retained for a minimum of three years from the date of the session, used for dispute resolution and responsible gaming analysis.
• KYC Documents: Retained for the duration of the account relationship plus five years, consistent with anti-money-laundering record-keeping standards. Original document images are stored in encrypted form with access restricted to the compliance team.
• Customer support records: Retained for three years from the date of the interaction, unless a longer period is required for an ongoing dispute or regulatory enquiry.
• Marketing consent records: Retained until consent is withdrawn plus a reasonable evidence-retention period of one year to demonstrate that consent was validly obtained.

When data is no longer required, it is securely deleted or irreversibly anonymised. Anonymised data may be retained indefinitely for aggregate statistical analysis and platform improvement purposes.

hit77 employs a layered security architecture to protect Personal Data against unauthorised access, disclosure, alteration, and destruction. Our security measures include, but are not limited to:

• Transport encryption: All data transmitted between your device and the hit77 Platform is encrypted using TLS 1.3 (Transport Layer Security). Connections are enforced over HTTPS; unencrypted HTTP connections are rejected.
• Password hashing: Player passwords are stored exclusively as salted cryptographic hashes using a modern, computationally intensive algorithm. No hit77 employee or system can retrieve your plaintext password.
• Access controls: Internal access to Personal Data is governed by role-based access controls. Staff members can access only the data that is strictly necessary for their job function. All internal data access is logged and auditable.
• Server-side security: hit77's server infrastructure is protected by firewalls, intrusion detection systems, and regular independent security assessments. Servers hosting Personal Data are physically secured in access-controlled data centres.
• Data minimisation in transit: Payment card details are never stored on hit77 servers; they pass directly through certified payment processors. Bank account references shared for withdrawal processing are masked in internal logs beyond the minimum necessary digits.
• Incident response: hit77 maintains a documented data breach response procedure. In the event of a breach that is likely to result in a risk to players' rights, we will notify affected Players and the relevant regulatory authority within the timeframe required by applicable law.

While hit77 takes every reasonable precaution to protect your data, no internet-based system is entirely immune to risk. You are responsible for maintaining the security of your account credentials and for notifying hit77 promptly if you believe your account has been compromised.

Subject to applicable law and certain limitations arising from our legal and compliance obligations, you have the following rights with respect to your Personal Data held by hit77:

• Right of access: You may request a copy of the Personal Data we hold about you, together with information about how it is being processed.
• Right to rectification: You may request that we correct inaccurate or incomplete Personal Data. You may also update basic profile details (email address, phone number, contact address) directly through your account settings.
• Right to erasure ("right to be forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where processing is unlawful. This right is subject to our legal obligation to retain certain data as described in Section 9.
• Right to restriction: You may request that we restrict processing of your Personal Data in certain circumstances — for example, while the accuracy of the data is being contested.
• Right to data portability: You may request a structured, machine-readable copy of the Personal Data you have provided to us, for transfer to another controller where technically feasible.
• Right to object: You may object to processing based on our legitimate interests. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time by contacting us at [email protected].

To exercise any of the above rights, please submit a written request to [email protected] with the subject line "Privacy Rights Request". We will verify your identity before processing any data request and will respond within five business days. Complex requests may take up to 30 days; we will notify you if an extension is required.

hit77 uses cookies and similar technologies to operate the Platform effectively, maintain your login session, remember your preferences, and gather aggregate analytics data. The cookies we use fall into the following categories:

• Strictly necessary cookies: These cookies are essential for the Platform to function. They maintain your authenticated session, store your language and currency preferences, and enable secure navigation between pages. These cookies cannot be disabled without significantly impairing your ability to use the Platform.
• Functional cookies: These cookies remember your optional preferences — such as your preferred game lobby view or notification settings — to provide a more personalised experience on return visits.
• Analytics cookies: hit77 uses privacy-respecting, server-side analytics tools to understand aggregate usage patterns (page views, session durations, error rates). Where third-party analytics tools are employed, they operate under data processing agreements that prohibit them from using hit77 player data for their own purposes.
• Security cookies: Short-lived cookies used to support fraud prevention and bot detection functions, including CSRF (cross-site request forgery) protection tokens.

You may manage cookie preferences through your browser settings. Most browsers allow you to refuse new cookies, delete existing cookies, or receive a notification when a cookie is set. Please note that disabling strictly necessary cookies will affect your ability to log in and use core Platform features.

The hit77 Platform is strictly for adults aged 21 and over. We do not knowingly collect, process, or retain Personal Data from any individual under the age of 21. If we become aware that a person under 21 has provided Personal Data to hit77 or has registered an account, we will immediately suspend the account, delete the associated data (except where retention is required by law for fraud investigation purposes), and — where applicable — return any real-money deposits to the verified payment source.

If you believe that a minor has accessed the Platform or submitted data to hit77, please contact us immediately at [email protected] so that we can take swift and appropriate action.

hit77 may update this Privacy Policy from time to time to reflect changes in our data processing practices, operational requirements, or applicable law. The date of the most recent revision is displayed at the top of this page.

Where a change materially affects how we process your Personal Data or reduces your rights under this Policy, we will notify you via the email address registered on your account at least 14 days before the change takes effect. For minor or clarificatory changes, we may update this page without advance notice.

Your continued use of the Platform after the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the changes, you must close your account and cease using the Platform before the effective date.

For all privacy-related enquiries, data access requests, consent withdrawals, or complaints regarding our data processing practices, please contact the hit77 Data Protection team through the following channel:

• Email: [email protected] — please use the subject line "Privacy Rights Request" for data subject requests to ensure prompt routing to the compliance team.
• Live Chat: Available 24/7 directly on the Platform. Our Indonesian-speaking support agents are available around the clock across WIB (UTC+7), WITA (UTC+8), and WIT (UTC+9) time zones.
• Response time: hit77 commits to acknowledging all privacy requests within 24 hours and providing a substantive response within five business days. Complex requests involving large data sets or third-party coordination may take up to 30 calendar days.

If you are unsatisfied with our response to a privacy complaint, you may escalate the matter to the relevant supervisory authority under our international licensing framework, or seek independent legal advice regarding your rights under applicable Indonesian data protection law.