Privacy Policy — ufo77

Throughout this Privacy Policy, the following terms carry the meanings defined below:

• "Platform" — the ufo77 website at ufo77.bio and all associated services, games, and products accessible thereon.
• "Player" / "You" — any individual who accesses, registers on, or uses the ufo77 Platform.
• "Personal Data" — any information relating to an identified or identifiable natural person, including but not limited to name, date of birth, Indonesian national identity number (NIK), email address, mobile number, IP address, and payment account details.
• "Processing" — any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, and deletion.
• "Data Controller" — the entity that determines the purposes and means of Processing Personal Data — in this case, ufo77.
• "Third Party" — any person or organisation other than the Player and ufo77, including payment processors, game studios, and regulatory authorities.
• "KYC" — Know Your Customer; the identity and age verification process required before a Player's first withdrawal is processed.
• "Cookies" — small text files placed on a Player's device by the Platform to enable functionality, analytics, and session management.

ufo77 acts as the Data Controller for all Personal Data collected from Players through the Platform. ufo77 is licensed and regulated internationally and operates the Platform primarily for Players based in Indonesia. All data processing activities carried out by ufo77 are governed by the principles of purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality.

For all privacy-related enquiries, including requests to exercise your data rights, please contact us using the details in Section 14 of this policy.

ufo77 collects only the Personal Data that is necessary to provide the Platform's services securely and in compliance with applicable regulatory requirements. The categories of data we collect are set out below:

3.1 Registration & Identity Data

• Full legal name as it appears on your Indonesian government-issued identity document (KTP or passport);
• Date of birth (to verify that you are at least 21 years of age);
• Email address and Indonesian mobile phone number;
• Username and encrypted password;
• City or region of residence (e.g., Jakarta, Surabaya, Bandung, Bali, Medan, Makassar, Yogyakarta).

3.2 KYC & Verification Data

• Scanned copy or photograph of your KTP, passport, or other government-issued identification;
• Selfie or facial image submitted for identity matching purposes;
• Proof of payment method (e.g., screenshot of your DANA, OVO, GoPay, or bank account in your name).

3.3 Financial & Transaction Data

• Bank account details (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata) or e-wallet identifiers (DANA, OVO, GoPay, ShopeePay, LinkAja) linked to your Account;
• Deposit and withdrawal amounts, dates, and reference numbers;
• Transaction history and balance movements within your Account.

3.4 Gameplay & Behavioural Data

• Games played, bet amounts, win/loss outcomes, and session durations;
• Sports betting market selections, odds accepted, and settlement outcomes;
• Bonus claims, wagering progress, and promotion participation history.

3.5 Technical & Device Data

• IP address, approximate geolocation derived from IP;
• Device type, operating system, and browser version;
• Session timestamps, page interaction logs, and referral source;
• Cookie identifiers and analytics event data.

3.6 Communications Data

• Content of messages exchanged with ufo77 customer support via live chat or email;
• Feedback, complaints, and dispute submissions;
• Promotional opt-in and opt-out preferences.

ufo77 collects Personal Data through the following channels:

• Directly from you — when you register an Account, complete KYC verification, make a deposit or withdrawal, contact support, or participate in a promotion;
• Automatically — through Cookies, server logs, and analytics tools embedded in the Platform when you browse or interact with any part of ufo77.bio;
• From payment partners — transaction confirmation data received from BCA, BRI, BNI, Mandiri, DANA, OVO, GoPay, ShopeePay, and LinkAja when you initiate a deposit or withdrawal;
• From identity verification services — responses from third-party KYC providers when we submit your identity documents for automated or manual review;
• From fraud prevention services — risk signals and device fingerprint data from fraud detection partners used to protect the integrity of Player Accounts.

The table below summarises the primary purposes for which ufo77 processes your Personal Data and the legal basis for each:

ufo77 does not sell, rent, or transfer your Personal Data to unaffiliated third parties for their own marketing or commercial purposes. Data is shared only in the following limited and controlled circumstances:

6.1 Payment Processors

To facilitate deposits and withdrawals, we share necessary financial and identity data with our Indonesian payment partners — including BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, DANA, OVO, GoPay, ShopeePay, and LinkAja. Data shared with these partners is limited strictly to what is required to complete the transaction.

6.2 Identity Verification Providers

To fulfil our KYC obligations, we share identity documents and personal details with certified third-party verification service providers. These providers are contractually bound to process your data solely for verification purposes and may not retain or use it for any other purpose.

6.3 Game Studio Partners

Certain gameplay data (such as session tokens and game round identifiers) is shared with licensed game studio partners — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, PG Soft, and Spribe — to the extent required to operate and settle game rounds. These studios do not receive your full Account profile or payment details.

6.4 Fraud Prevention & Security Services

Technical data and transaction signals may be shared with fraud detection partners to identify suspicious activity, protect the integrity of Player Accounts, and prevent money laundering. All such partners operate under strict confidentiality agreements.

6.5 Regulatory & Law Enforcement Authorities

ufo77 may disclose Personal Data to regulators, law enforcement agencies, or courts where required to do so by applicable law or by order of a competent authority. In such cases, ufo77 will disclose only the minimum data necessary to satisfy the legal requirement.

ufo77 retains Personal Data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The general retention periods applied by ufo77 are as follows:

• Active Account data — retained for the full duration of your Account's active status plus a minimum of five (5) years following Account closure, to satisfy regulatory and audit requirements;
• KYC and identity verification documents — retained for a minimum of five (5) years from the date of submission or Account closure, whichever is later;
• Transaction records — retained for a minimum of five (5) years from the date of each transaction;
• Customer support communications — retained for two (2) years from the date of the last interaction;
• Technical and device logs — retained for twelve (12) months from collection, after which they are anonymised or deleted;
• Marketing preference records — retained until withdrawal of consent, plus a short additional period sufficient to demonstrate compliance with any prior opt-out request.

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised so that it can no longer be associated with an identified individual.

ufo77 applies industry-standard technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, alteration, or disclosure. These measures include:

• Transport Layer Security (TLS 1.2 / 1.3) — all data transmitted between your device and the ufo77 Platform is encrypted using 256-bit SSL/TLS;
• At-rest encryption — sensitive Personal Data stored in ufo77's databases is encrypted using AES-256;
• Access controls — access to Personal Data is restricted on a strict need-to-know basis; all internal access is logged and auditable;
• Password hashing — Account passwords are stored as salted cryptographic hashes; ufo77 staff cannot view your password in plain text;
• Two-factor authentication (2FA) — Players are encouraged to enable 2FA on their Accounts via the Account Settings panel;
• Penetration testing — the Platform undergoes regular security assessments by independent security professionals;
• Incident response — ufo77 maintains a documented data breach response procedure; in the event of a breach affecting your data, you will be notified promptly in accordance with applicable regulatory requirements.

ufo77 uses Cookies and similar tracking technologies on the Platform to ensure proper functionality, maintain session security, and improve your experience. The categories of Cookies used are described below:

Essential Cookies are strictly necessary for the Platform to function and cannot be disabled. For all other Cookie categories, you may manage your preferences through your browser settings. Please note that disabling Functional or Analytics Cookies may degrade your experience on the Platform.

Subject to applicable law and any overriding regulatory obligations, you hold the following rights in relation to your Personal Data held by ufo77:

• Right of Access — you may request a copy of the Personal Data ufo77 holds about you, together with information about how it is processed;
• Right to Rectification — you may request correction of any inaccurate or incomplete Personal Data relating to you;
• Right to Erasure — you may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to ufo77's legal retention obligations;
• Right to Restriction — you may request that ufo77 restrict processing of your Personal Data in certain circumstances, for example while a rectification request is under review;
• Right to Data Portability — you may request a structured, machine-readable copy of the Personal Data you provided to ufo77, where processing is based on your consent or on contractual necessity;
• Right to Object — you may object to processing of your Personal Data where it is based on ufo77's legitimate interests, including direct marketing;
• Right to Withdraw Consent — where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, please submit a written request to [email protected]. ufo77 will acknowledge your request within 48 hours and aim to resolve it within 30 calendar days. ufo77 may request additional identity verification before actioning a data rights request to ensure the security of your Personal Data.

ufo77 operates internationally and may store or process Personal Data on servers or through service providers located outside of Indonesia. Where Personal Data is transferred to a jurisdiction that does not provide an equivalent level of data protection to that of Indonesia, ufo77 will implement appropriate safeguards — including contractual data protection clauses — to ensure that your Personal Data remains protected to the standard set out in this Privacy Policy.

Data transfers to licensed game studio partners (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, PG Soft, and Spribe) are limited in scope to the minimum data required to operate game sessions and are governed by data processing agreements consistent with applicable international data protection standards.

ufo77 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. Where a change is material, ufo77 will notify registered Players by email or by displaying a prominent notice on the Platform for a minimum of seven (7) days prior to the revised policy taking effect.

The "Last updated" date at the top of this page will be revised whenever a change is made. We encourage you to review this Privacy Policy periodically to stay informed about how ufo77 protects your data. Continued use of the Platform after the effective date of any revision constitutes acceptance of the updated Privacy Policy.

For all privacy-related queries, data rights requests, or concerns about how ufo77 processes your Personal Data, please contact our privacy team using the details below. All communications are handled in strict confidence.

Our privacy team is available via live chat within the Platform 24 hours a day, 7 days a week. Written email requests will receive an acknowledgement within 48 hours and a substantive response within 30 calendar days. For urgent matters — such as suspected unauthorised access to your Account — please use the live chat channel for the fastest response.