Privacy Policy

Definitions

For the purposes of this Privacy Policy, the following terms have the meanings assigned below:

• "cas77", "we", "us", or "our" refers to the operator of the cas77 platform accessible at cas77.vip and all associated subdomains and mobile interfaces.
• "Platform" means the cas77 website, mobile web interface, any native mobile applications, and all associated APIs and services operated by cas77.
• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, date of birth, email address, phone number, residential address, payment details, IP address, and device identifiers.
• "Member" or "You" refers to any individual who has registered an Account on the cas77 platform or who accesses the platform in any capacity.
• "Account" means a registered user account uniquely associated with a single verified individual on the cas77 platform.
• "KYC" (Know Your Customer) refers to the identity and age verification process required by cas77 prior to processing withdrawals or granting full Account functionality.
• "AML" (Anti-Money Laundering) refers to the suite of regulatory obligations and internal controls cas77 maintains to detect and prevent the use of the platform for financial crime.
• "Cookies" means small text files placed on your device by the cas77 platform to store session state, preferences, and analytics identifiers.
• "Third-Party Service Providers" means companies or individuals engaged by cas77 to perform specific functions on our behalf, including payment processors, KYC verification services, game content providers, cloud hosting providers, and customer support tools.
• "Data Subject Rights" means the rights afforded to individuals under applicable data protection law, including the rights of access, rectification, erasure, restriction, portability, and objection.

Data Controller

cas77 acts as the data controller in respect of the Personal Data collected from Members and visitors through the platform. As data controller, cas77 determines the purposes and means of processing your Personal Data, and is responsible for ensuring that such processing is carried out in accordance with applicable data protection law and the terms of this Privacy Policy.

For all data protection enquiries, data subject rights requests, or concerns about the handling of your Personal Data, you may contact the cas77 data protection point of contact at:

• Email: [email protected] — please include "Data Protection" in the subject line of your message to ensure prompt routing to the appropriate team.

Data We Collect

cas77 collects Personal Data across several categories depending on the nature of your interaction with the platform. The full scope of data collected is set out below:

3.1 Registration Data

When you create an Account on cas77, we collect the following information:

• Full legal name as it appears on your government-issued identity document.
• Date of birth (to verify that you are 21 years of age or older).
• Residential address, including city, province, and postal code within Indonesia.
• Email address (used as the primary communication channel for your Account).
• Mobile phone number registered in Indonesia or internationally.
• Username and encrypted password hash (we never store passwords in plaintext).
• Preferred currency (Indonesian Rupiah / IDR or cryptocurrency).

3.2 Identity Verification (KYC) Data

Prior to processing your first withdrawal, or at any point where enhanced verification is required, cas77 collects:

• Scanned copy or clear photograph of a government-issued photo ID (Indonesian KTP, passport, or SIM driving licence).
• Proof of residential address document (utility bill, bank statement, or official government correspondence dated within three months).
• Selfie photograph or liveness-check video for biometric matching against the identity document, where required.
• Bank account or e-wallet details confirming payment method ownership (account name and number).
• Source of funds documentation in cases where the deposit volume triggers enhanced due diligence under our AML programme.

3.3 Financial Transaction Data

Every financial transaction on the platform generates a record that we retain for regulatory and operational purposes:

• Deposit amounts, dates, timestamps, and the originating payment method (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja, cryptocurrency wallet address).
• Withdrawal amounts, dates, timestamps, and the destination payment method.
• Transaction reference numbers and confirmation codes issued by the payment network.
• Cryptocurrency wallet addresses used for deposits and withdrawals.
• Currency conversion rates applied at the time of each transaction.

3.4 Gameplay and Betting Data

• All bets placed, including stake amount, market or game selected, odds or RTP parameters, and settlement outcome.
• Session data for casino game rounds, including game title, provider (e.g., Pragmatic Play, Evolution Gaming, NetEnt), round ID, and result.
• Bonus and promotion redemption history.
• Responsible gaming tool configurations (deposit limits, session time limits, self-exclusion status).

3.5 Technical and Device Data

• IP address at the time of each login and transaction.
• Device type, operating system, and browser version.
• Geolocation data derived from your IP address (country and city-level precision only — cas77 does not access GPS or precise device location).
• Session duration, pages visited, features accessed, and click-path analytics data.
• Cookie identifiers and session tokens as described in Section 8 of this policy.

3.6 Communications Data

• Content of support tickets, live chat transcripts, and email correspondence between you and the cas77 support team.
• Feedback, complaints, and dispute records.
• Records of your marketing communication preferences and opt-in / opt-out history.

How We Collect Your Data

cas77 collects Personal Data through the following channels:

• Directly from you — when you register an Account, complete KYC verification, make a deposit or withdrawal, place a bet, contact support, or configure your Account settings.
• Automatically — through cookies, session tokens, server logs, and analytics tools that operate in the background while you browse and use the platform.
• From Third-Party Service Providers — identity verification partners return KYC check results and fraud risk scores to cas77; payment processors confirm deposit and withdrawal status; game providers transmit round results and RTP data to our back-end systems.
• From publicly available sources — in the context of AML and enhanced due diligence checks, cas77 may cross-reference information you have provided against publicly available databases, sanctions lists, and politically exposed persons (PEP) registries.

How We Use Your Data

cas77 processes your Personal Data for the following specific, documented purposes:

cas77 does not use your Personal Data to make fully automated decisions that produce legal or similarly significant effects without human review, except for routine fraud-detection screening which may temporarily place an Account on hold pending manual investigation.

Legal Basis for Processing

Where data protection law requires cas77 to identify a lawful basis for processing your Personal Data, we rely on the following bases:

• Contract performance: Processing necessary to create and maintain your Account, process transactions, settle bets, and deliver the services you have requested from us.
• Legal obligation: Processing required to comply with applicable AML regulations, sanctions screening obligations, age verification requirements, and responses to lawful requests from regulatory or law enforcement authorities.
• Legitimate interests: Processing carried out for our legitimate interests in operating a secure, fraud-free platform, improving our products and services, and communicating with Members about account-related matters — provided that such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for marketing communications, non-essential cookies, and any other purpose where we have specifically requested and received your opt-in consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Sharing Your Data

cas77 does not sell your Personal Data. We may share your data with the following categories of recipients, strictly on a need-to-know basis and under appropriate contractual confidentiality obligations:

• KYC and Identity Verification Partners: Third-party providers that process identity documents and liveness-check data on our behalf to fulfil our age and identity verification obligations. These providers act as data processors under contract with cas77 and may not use your data for their own independent purposes.
• Payment Processors and Banking Partners: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga), e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja), and cryptocurrency network infrastructure providers necessary to process your deposit and withdrawal requests.
• Game Content Providers: Licensed game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft receive the minimum technical data necessary to deliver game sessions and certify results. These providers are contractually prohibited from using player data for their own marketing purposes.
• Cloud Infrastructure and Hosting Providers: cas77's platform is hosted on enterprise-grade cloud infrastructure. Hosting providers have access to server-level data but operate under strict data processing agreements that prohibit access to player content.
• Regulatory and Law Enforcement Authorities: cas77 will disclose Personal Data to government authorities, regulators, or law enforcement agencies where required to do so by law, court order, or other binding legal process. We will, where legally permitted, notify the affected Member of any such disclosure.
• Professional Advisors: Lawyers, auditors, and compliance consultants engaged by cas77 who are subject to professional confidentiality obligations and require access to Member data solely in connection with their advisory engagement.
• Business Successors: In the event of a merger, acquisition, restructuring, or sale of all or part of the cas77 business, Member data may be transferred to the successor entity, subject to equivalent privacy protections and prior notice to affected Members where practicable.

Cookies & Tracking Technologies

The cas77 platform uses cookies and similar tracking technologies to deliver core functionality, maintain session state, and — with your consent — improve the platform through analytics. The categories of cookies we use are described below:

You may manage your cookie preferences at any time through the Cookie Preferences panel accessible in your Account settings. Please note that disabling functional or analytics cookies will not affect your ability to place bets, deposit, or withdraw funds on the cas77 platform.

cas77 does not use third-party advertising cookies, retargeting pixels, or cross-site tracking technologies that track your browsing activity outside of the cas77 platform.

Data Retention

cas77 retains your Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

• Active Account data (registration, KYC, transaction, and gameplay records): Retained for the full duration of your active Account relationship with cas77, plus a minimum of five years following Account closure, in compliance with AML and financial record-keeping regulations.
• KYC documentation (identity documents, proof of address): Retained for a minimum of five years following the completion of the KYC check, or five years following Account closure — whichever is later — as required by internationally recognised AML standards.
• Financial transaction records: Retained for a minimum of five years following the date of the transaction, in line with standard financial regulatory requirements.
• Support communications: Retained for three years following the resolution of the support interaction, to allow for dispute escalation and quality assurance review.
• Marketing consent records: Retained for three years following the date of the most recent opt-in or opt-out action, to demonstrate compliance with consent-based marketing obligations.
• Technical and device data (logs): Retained for 12 months from the date of generation, except where retained for a longer period as part of an active fraud or security investigation.
• Closed Accounts — self-exclusion records: Self-exclusion status and the associated Account identifier are retained indefinitely to prevent re-registration by a self-excluded individual, even after Account closure.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in accordance with industry-standard data destruction procedures.

Data Security

cas77 implements a comprehensive, layered security programme to protect your Personal Data against unauthorised access, disclosure, alteration, and destruction. The key technical and organisational measures we maintain include:

• Transport Encryption: All data in transit between your device and the cas77 platform is encrypted using TLS 1.3 with 256-bit AES cipher suites. Outdated protocol versions (SSL 3.0, TLS 1.0, TLS 1.1) are disabled.
• Data-at-Rest Encryption: Sensitive data stored in our databases — including KYC documents, payment details, and password hashes — is encrypted at rest using AES-256 encryption with keys managed through a dedicated key management system.
• Access Controls: Access to systems storing Personal Data is restricted to authorised personnel on a strict need-to-know basis, enforced through role-based access control (RBAC) and multi-factor authentication (MFA) for all administrative systems.
• Penetration Testing: The cas77 platform undergoes regular third-party penetration testing and vulnerability assessments to identify and remediate security weaknesses before they can be exploited.
• Intrusion Detection: Real-time intrusion detection and anomaly monitoring systems operate continuously across the cas77 infrastructure, with automated alerting and response protocols for suspected security events.
• Incident Response: cas77 maintains a documented data breach incident response plan. In the event of a breach affecting your Personal Data, we will notify affected Members and relevant authorities within the timeframe required by applicable law.

Your Data Subject Rights

Subject to applicable data protection law and our legal retention obligations, you have the following rights with respect to your Personal Data held by cas77:

• Right of Access: You may request a copy of all Personal Data cas77 holds about you. We will provide a response within 30 days of receiving a valid access request, along with information about the categories of data held, the purposes of processing, and the recipients with whom data has been shared.
• Right to Rectification: If any Personal Data we hold about you is inaccurate or incomplete, you may request that it be corrected. For registration details (name, address, email, phone number), you may update many fields directly within your Account settings. For KYC data, updates require resubmission of documentation.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (for consent-based processing), or where you object to processing. Note that this right is subject to our legal obligation to retain certain financial and identity records for a minimum of five years under AML regulations.
• Right to Restriction of Processing: You may request that cas77 restrict the processing of your Personal Data in certain circumstances — for example, while a dispute about data accuracy is being resolved, or where you have objected to processing and we are assessing the grounds for continued processing.
• Right to Data Portability: For data processed on the basis of consent or contract performance, you may request that your Personal Data be provided to you in a structured, commonly used, machine-readable format, or transmitted directly to another controller where technically feasible.
• Right to Object: You have the right to object to processing carried out on the basis of our legitimate interests. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or unless the processing is necessary for the establishment, exercise, or defence of legal claims.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time through your Account settings or by contacting [email protected]. Withdrawal of consent does not affect the lawfulness of any processing carried out before the withdrawal.

To exercise any of the above rights, please submit your request in writing to [email protected] with the subject line "Data Subject Rights Request". Please include your registered username, the specific right you wish to exercise, and sufficient information to verify your identity. We will acknowledge receipt of your request within 5 business days and provide a substantive response within 30 days.

Children's Privacy

The cas77 platform is strictly intended for adults who are 21 years of age or older. cas77 does not knowingly collect Personal Data from individuals under the age of 21. Registration by individuals under 21 is prohibited under our Terms & Conditions and constitutes a violation of our responsible gaming policy.

If cas77 becomes aware that Personal Data has been collected from a person under the age of 21 — whether through the registration process, KYC documentation review, or any other means — the relevant Account will be closed immediately, all funds will be returned to the originating payment method, and all associated Personal Data will be deleted or anonymised without delay.

If you believe that a person under the age of 21 may have registered an Account on the cas77 platform, please contact us immediately at [email protected]. cas77 treats all child protection reports as urgent and will investigate and respond within 24 hours.

International Data Transfers

The cas77 platform serves Members primarily located in Indonesia. However, certain Third-Party Service Providers engaged by cas77 — including KYC verification partners, cloud hosting infrastructure providers, and game content providers — may process Personal Data on servers located outside of Indonesia.

Where Personal Data is transferred to a country that does not maintain an equivalent level of data protection to the standards applied within Indonesia, cas77 will implement appropriate safeguards to ensure that your data remains adequately protected. These safeguards may include:

• Standard contractual clauses incorporated into our data processing agreements with Third-Party Service Providers.
• Data processing agreements that impose equivalent data protection standards on the recipient organisation.
• Transfer to jurisdictions that have been assessed as providing an adequate level of data protection by relevant international standards bodies.

You may request further information about the specific safeguards applicable to any international data transfer involving your Personal Data by contacting [email protected].

Updates to This Privacy Policy

cas77 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory guidance, or platform functionality. Where a change is material — for example, a new category of data collection, a new sharing arrangement, or a change to the legal basis for processing — cas77 will provide at least 14 days' advance notice by publishing the revised policy on the platform and, where practicable, notifying registered Members via their registered email address.

The date shown in the "Last Updated" notice at the top of this page reflects the effective date of the most recent version of this Privacy Policy. Your continued use of the cas77 platform after the effective date of any revision constitutes your acceptance of the updated policy. If you do not agree to the revised policy, you must close your Account before the effective date and withdraw your remaining balance.

Prior versions of this Privacy Policy may be requested by contacting [email protected] with the subject line "Previous Privacy Policy Version".

Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or the way in which cas77 handles your Personal Data, please contact our team through the following channel:

• Email: [email protected] — please include "Privacy Policy Enquiry" or "Data Subject Rights Request" in the subject line as appropriate. Our compliance team operates 24/7 and will acknowledge receipt of your message within 5 business days.

Please note that cas77 does not accept privacy-related correspondence via telephone or physical mail. All formal data protection communications must be submitted in writing via the email address above to ensure a documented and fully auditable record.

For responsible gaming concerns, deposit limit requests, or self-exclusion, please visit the Responsible Gaming page.

For the full terms governing your use of the cas77 platform, please review our Terms & Conditions.