sby77 Privacy Policy

In this Privacy Policy, the following terms carry the meanings defined below unless the context clearly requires otherwise:

• "Personal Data" means any information relating to an identified or identifiable natural person — including but not limited to a name, national identity number (NIK), email address, phone number, bank account number, IP address, device identifier, or transaction history.
• "Processing" means any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, storage, use, disclosure, erasure, or destruction.
• "Data Controller" means sby77, as the entity that determines the purposes and means of Processing Personal Data collected through sby77.app.
• "Data Processor" means a third party that Processes Personal Data on behalf of sby77 under a data processing agreement (e.g., payment gateway providers, KYC verification services, cloud hosting providers).
• "User" / "you" means any individual who registers an account on sby77.app or otherwise submits Personal Data to sby77 through any channel.
• "Sensitive Data" means a subset of Personal Data that warrants heightened protection, including national identity documents (KTP, passport), financial account details, and any data related to health conditions disclosed in connection with responsible gaming requests.
• "Consent" means a freely given, specific, informed, and unambiguous indication of the User's agreement to the Processing of their Personal Data for a stated purpose.
• "Cookie" means a small text file stored on a User's device by a web browser, used to retain session information, user preferences, and analytics data as further described in Clause 6.

sby77 collects Personal Data through several distinct channels. The categories of data collected through each channel are described in the table below:

sby77 does not collect data from third-party social media platforms, advertising networks, or data brokers. All Personal Data held by sby77 is submitted directly by the User or generated through the User's interaction with sby77.app.

sby77 uses your Personal Data exclusively for the purposes listed below. Each stated purpose is linked to a specific legal basis (see Clause 4):

• Account creation and authentication: To create and maintain your sby77 account, verify your identity at login, and keep your account secure against unauthorised access.
• Service delivery: To provide access to all betting, casino, slot, Dragon Tiger, and Slot Tournament services available on sby77.app; to settle bets and game outcomes; to credit winnings and process withdrawals.
• Payment processing: To facilitate deposits and withdrawals via your nominated Indonesian bank account or e-wallet, and to maintain accurate transaction records.
• KYC and age verification: To verify that you are at least 21 years of age and a resident of Indonesia, and to fulfil identity verification obligations.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent transactions, bonus abuse, multi-accounting, money laundering, and other prohibited conduct as defined in the Terms & Conditions.
• Responsible gaming: To enforce self-exclusion requests, deposit limits, loss limits, and time-out periods you set; to monitor for indicators of problem gambling and reach out proactively where a User may need support.
• Customer support: To respond to your queries, complaints, and formal dispute submissions via live chat or email at [email protected].
• Platform improvement: To analyse aggregated, anonymised usage data to improve website performance, game selection, and user experience.
• Promotional communications (opt-in only): To send you personalised bonus offers, tournament announcements, and promotions tied to events such as Ramadhan, Idul Fitri, and BRI Liga 1 match schedules — only where you have opted in to marketing communications in your account settings.
• Legal and regulatory compliance: To respond to valid requests from law enforcement or regulatory authorities, and to maintain records as required by applicable law.

sby77 processes your Personal Data only where a valid legal basis exists. The legal bases applicable to our principal processing activities are as follows:

• Contractual necessity: Processing required to perform our contractual obligations to you — account creation, bet settlement, payment processing, and customer support — is lawful because it is necessary for the performance of the contract between you and sby77 (the Terms & Conditions).
• Legal obligation: KYC identity verification, age verification, transaction record retention, and cooperation with law enforcement requests are processed because sby77 is legally required to undertake these activities under applicable regulations.
• Legitimate interests: Fraud detection, security monitoring, platform analytics, and responsible gaming monitoring are conducted on the basis of sby77's legitimate business interest in operating a secure, compliant, and financially sustainable platform. These interests do not override your fundamental privacy rights.
• Consent: Promotional and marketing communications are sent only where you have provided explicit, opt-in consent. Processing of Sensitive Data related to health disclosures in the context of responsible gaming is also consent-based. You may withdraw consent at any time.

sby77 does not sell your Personal Data. We share data only in the limited circumstances described below, and in each case only to the extent necessary for the stated purpose:

• Payment processors: Your bank account or e-wallet details are shared with the relevant Indonesian payment gateway (covering BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, and LinkAja) solely for the purpose of executing your transaction. Payment processors operate under strict contractual data-protection terms.
• KYC verification providers: Identity documents and biometric data submitted during KYC are shared with a certified third-party identity verification service solely for the purpose of verifying your identity and age. This provider operates under a data processing agreement and is prohibited from using your data for any purpose other than verification for sby77.
• Game content providers: When you play a game supplied by a third-party studio (such as Evolution Gaming, Pragmatic Play, Pocket Games Soft, NetEnt, Microgaming, or Spribe), your account identifier, wager data, and game session information are transmitted to that provider's platform. These studios receive only the minimum data required to deliver the game and settle the result. They are contractually prohibited from using this data for independent marketing purposes.
• Cloud infrastructure providers: sby77's platform is hosted on a reputable cloud infrastructure provider. Data stored on this infrastructure is subject to the provider's security certifications and our contractual data protection requirements.
• Law enforcement and regulators: sby77 will disclose Personal Data in response to a valid court order, subpoena, regulatory demand, or law enforcement request, to the extent required by applicable law. Where legally permitted to do so, sby77 will notify the affected User before disclosing their data.
• Business transfers: In the event of a merger, acquisition, or sale of all or a material part of sby77's assets, Personal Data held by sby77 may be transferred to the acquiring entity. Users will be notified of any such transfer and of any change to this Privacy Policy that results from it.

sby77 uses cookies and similar tracking technologies to provide a functional, secure, and personalised platform experience. The categories of cookies in use are described below:

sby77 does not use third-party advertising cookies, retargeting pixels, social media tracking scripts, or cross-site tracking technologies of any kind. You can manage non-essential cookie preferences at any time from the Privacy Settings section of your account dashboard.

sby77 retains your Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The standard retention periods applicable to principal data categories are set out below:

• Account data (name, email, address, username): Retained for the lifetime of your active account, plus a minimum of five (5) years after account closure, to comply with anti-money laundering record-keeping obligations.
• KYC and identity documents: Retained for a minimum of five (5) years from the date of verification or account closure (whichever is later), in accordance with applicable financial crime regulations.
• Transaction records (deposit, withdrawal, wager history): Retained for a minimum of five (5) years from the date of each transaction.
• Customer support correspondence: Retained for three (3) years from the date of the most recent interaction, or until any associated dispute is finally resolved, whichever is later.
• Performance analytics data: Aggregated and anonymised within 90 days of collection. Anonymised analytical data may be retained indefinitely as it no longer constitutes Personal Data.
• Marketing consent records: Retained for as long as the consent remains active, plus three (3) years after withdrawal of consent, as evidence that communications were lawfully sent.
• Responsible gaming records (self-exclusion, limit settings): Retained for a minimum of seven (7) years after the expiry of a self-exclusion period, to prevent circumvention of exclusion orders and to protect vulnerable users.

When data is no longer required under these retention schedules, sby77 will securely delete or permanently anonymise it. Secure deletion of digital records uses industry-standard overwrite techniques; physical documents are cross-shredded.

sby77 implements a layered, defence-in-depth security architecture to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure. Our security measures include, but are not limited to:

• Encryption in transit: All data transmitted to and from sby77.app is encrypted using TLS 1.2 or higher with strong cipher suites. HTTP connections are automatically redirected to HTTPS.
• Encryption at rest: Sensitive database fields — including hashed passwords, KYC document references, and payment identifiers — are encrypted at rest using AES-256.
• Password security: User passwords are never stored in plain text. They are hashed using a strong, salted hashing algorithm (bcrypt or Argon2) before storage. sby77 staff cannot retrieve your password; only a password reset is possible.
• Access controls: Access to production systems containing Personal Data is restricted to a minimum number of authorised personnel on a strict need-to-know basis. All access is logged and subject to periodic review.
• Two-factor authentication (2FA): sby77 strongly recommends that all users enable 2FA on their accounts. 2FA is mandatory for all internal staff accounts with access to User data.
• Penetration testing: sby77's platform undergoes regular third-party penetration testing and vulnerability assessments. Critical findings are remediated on a priority basis.
• Incident response: sby77 maintains a documented data breach response plan. In the event of a security incident that materially affects your Personal Data, sby77 will notify affected users and relevant authorities within the timeframes required by applicable law.

While sby77 employs comprehensive technical and organisational measures, no internet-based system is entirely immune to security risks. You are responsible for keeping your login credentials confidential and for notifying sby77 immediately at [email protected] if you suspect unauthorised access to your account.

As a registered User of sby77, you hold the following rights with respect to your Personal Data. To exercise any of these rights, contact our support team at [email protected] with the subject line "Privacy Rights Request — [Account Username]":

sby77 will respond to all valid privacy rights requests within 30 calendar days. Where a request is complex or numerous, we may extend this period by a further 60 days, and will notify you of the extension within the initial 30-day window. There is no charge for exercising your rights, unless a request is manifestly unfounded or excessive.

If sby77 discovers or has reason to believe that Personal Data has been collected from an individual under the age of 21, the following actions will be taken immediately:

• The relevant account will be suspended pending investigation.
• All Personal Data associated with the underage user will be securely deleted from sby77's active systems, subject to any minimum legal retention obligations that may apply.
• Any real-money deposits made will be returned to the deposit source following verification of the depositor's identity.
• The account will be permanently closed and flagged to prevent re-registration.

If you are a parent or guardian and believe that your child under 21 has registered an account on sby77.app, please contact us immediately at [email protected] with the subject line "Underage Account — Urgent". We will prioritise your request and respond within 24 hours.

sby77's primary data infrastructure is maintained on servers located in Southeast Asia. Certain service providers — including game content studios such as Evolution Gaming, Pragmatic Play, Pocket Games Soft, NetEnt, Microgaming, and Spribe — operate infrastructure in jurisdictions outside Indonesia. Where Personal Data is transferred internationally, sby77 ensures that appropriate safeguards are in place, including:

• Contractual protections: All international Data Processors are bound by data processing agreements that require them to maintain data protection standards no less stringent than those described in this Privacy Policy.
• Adequacy assessments: Prior to engaging any new international Data Processor, sby77 conducts a data transfer impact assessment to evaluate the data protection laws of the destination jurisdiction and the specific safeguards the processor has in place.
• Data minimisation: Only the minimum Personal Data necessary for the stated processing purpose is transferred internationally. Game session data transmitted to studio providers contains only an anonymised session token, wager amount, and game outcome — your name, KYC documents, and banking details are never shared with game studios.
• Encryption in transit: All international data transfers are conducted exclusively over encrypted channels (TLS 1.2 or higher).

By registering an account on sby77.app, you acknowledge and consent to the international transfer of your Personal Data in the limited circumstances and with the safeguards described in this clause.

sby77 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, our data processing practices, or the services we offer. When we make a material change to this Policy, we will take the following steps:

• Update the "Last Updated" date displayed in the page header.
• Post a prominent notice on the sby77.app homepage and in the account dashboard notification centre for a period of not less than 14 days prior to the effective date of the change (except where an urgent legal obligation requires immediate amendment).
• Send an in-platform notification and, where the change materially affects how we process your data, an email notification to the registered email address on your account.

Your continued use of sby77.app following the effective date of any amendment constitutes acceptance of the revised Privacy Policy. If you do not agree to the amended Policy, you must cease using the platform and may request account closure by contacting [email protected].

sby77 recommends reviewing this Privacy Policy periodically, even in the absence of a formal notification, to remain informed of how your Personal Data is handled.

If you have any questions about this Privacy Policy, wish to exercise your data rights, or want to raise a concern about how sby77 handles your Personal Data, please contact our support team using the details below:

• Email: [email protected] (plain text — not a clickable link)
• Subject line format: "Privacy — [Your Account Username] — [Nature of Request]"
• Live Chat: Available 24 hours a day, 7 days a week, from your account dashboard (00:00–24:00 WIB).
• Response time: We aim to acknowledge all privacy-related inquiries within 2 business days and to provide a substantive response within 30 calendar days.

If you are not satisfied with sby77's response to a privacy complaint, you have the right to escalate the matter to the relevant data protection authority in your jurisdiction. sby77 is committed to co-operating in good faith with any regulatory investigation.