neo77 Privacy Policy

The following definitions apply throughout this Privacy Policy and are consistent with the definitions used in the neo77 Terms & Conditions.

This Privacy Policy applies to all Personal Data collected by neo77 in connection with the operation of the Platform and the provision of online casino, sportsbook, live casino, and related gaming services to players primarily located in Indonesia. It applies regardless of whether you access the Platform from Jakarta, Surabaya, Bandung, Bali, Medan, or any other location.

This Policy covers Personal Data collected through the following channels:

• Account registration and profile management on the neo77 Platform.
• Deposits and withdrawals processed through local Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja).
• Identity verification (KYC) procedures conducted at registration or during account review.
• Customer support interactions via email, live chat, or any other supported communication channel.
• Gameplay activity, session data, and betting history recorded during your use of the Platform.
• Technical data collected automatically through cookies, log files, and analytics tools when you browse the Platform.

This Policy does not apply to third-party websites, payment processors, or gaming studios that operate under their own independent privacy frameworks. Where neo77 links to or integrates with third-party services, those parties' privacy practices govern their own data collection activities.

neo77 collects the minimum amount of Personal Data necessary to deliver a secure, compliant, and high-quality gaming experience. The categories of data we collect, and the basis on which we collect each category, are set out in the table below.

neo77 collects Personal Data through the following mechanisms:

• Directly from you — when you complete the account registration form, submit KYC documents, make a deposit or withdrawal request, contact customer support, or configure your account settings and responsible gaming limits.
• Automatically through your use of the Platform — server logs, session management systems, and analytics tools record Technical Data and Gaming Activity Data each time you visit or interact with the Platform.
• Through cookies and similar tracking technologies — see Section 9 (Cookies & Tracking) for full details on the types of cookies used and how to manage your preferences.
• From payment processors and financial institutions — when you initiate a deposit or withdrawal, the relevant bank (e.g., BCA, BNI) or e-wallet provider (e.g., DANA, GoPay) transmits transaction confirmation data to neo77 to validate the payment. This data is limited to what is strictly necessary to process the transaction.
• From identity verification service providers — neo77 may engage certified KYC technology providers to assist with document authenticity checks and facial matching. These providers process KYC Data as Data Processors under written data processing agreements with neo77.

neo77 does not purchase Personal Data from data brokers or third-party marketing lists. All Personal Data held by neo77 originates from your own interactions with the Platform or from the payment and verification processes directly connected to your account activity.

neo77 processes your Personal Data only for specific, documented purposes. Each processing activity is supported by at least one of the following legal bases: (a) performance of a contract to which you are party; (b) compliance with a legal or regulatory obligation; (c) your freely given, specific, informed, and unambiguous consent; or (d) the legitimate interests of neo77, provided those interests are not overridden by your fundamental rights and interests.

Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. To withdraw consent for marketing communications, use the unsubscribe link in any marketing email or contact our support team. Withdrawing consent for processing that is necessary for the operation of your account (e.g., KYC processing) will result in account closure, as we cannot operate an account without fulfilling our legal obligations.

neo77 does not sell, rent, or trade your Personal Data to third parties for their own marketing or commercial purposes. Personal Data is shared only in the following limited and documented circumstances:

• Gaming Technology Providers: Studios such as Evolution Gaming, Pragmatic Play, PG Soft, NetEnt, Microgaming, and Spribe may receive session identifiers or game-specific player data necessary to deliver game content and calculate outcomes. These providers act as Data Processors under contractual data processing agreements.
• Payment Service Providers: Indonesian banks (BCA, BRI, BNI, Mandiri, Bank Permata) and e-wallet platforms (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the minimum financial and identity data required to execute and verify your payment transactions. Each provider operates under its own privacy policy for data it independently holds.
• KYC and Fraud Prevention Services: Specialist identity verification and anti-fraud technology providers receive KYC Data solely for the purpose of document authenticity checks, age verification, and risk scoring. All such providers are contractually bound to process data only on neo77's instructions.
• Regulatory and Law Enforcement Authorities: neo77 may disclose Personal Data to competent regulatory bodies, law enforcement agencies, or courts where required to do so by applicable law, valid legal process, or regulatory order. neo77 will notify affected players of such disclosure to the extent permitted by law.
• Professional Advisers: Lawyers, auditors, and insurers engaged by neo77 may access Personal Data on a confidential, need-to-know basis in connection with the provision of professional services to neo77.
• Business Transfers: In the event of a merger, acquisition, or sale of all or a material part of neo77's business assets, Personal Data held by neo77 may be transferred to the acquiring entity. Affected players will be notified prior to such a transfer and given the opportunity to close their accounts if they do not consent to the transfer of their data to the new entity.

neo77 retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligations. The following retention schedule applies:

When a retention period expires and there is no outstanding legal hold or dispute requiring the data, neo77 will securely delete or anonymise the relevant Personal Data. Anonymised, aggregated data (which can no longer identify any individual) may be retained indefinitely for statistical and business analytics purposes.

neo77 implements a layered security programme designed to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction. Key technical and organisational measures include:

• Encryption in Transit: All data exchanged between your browser or device and the neo77 Platform is encrypted using TLS 1.2 or higher (256-bit SSL). You can confirm this by the padlock icon and "https://" prefix in your browser's address bar.
• Encryption at Rest: Sensitive data fields — including KYC document images, financial account numbers, and password hashes — are encrypted at rest using industry-standard symmetric encryption (AES-256 or equivalent).
• Access Controls: Access to production systems holding Personal Data is restricted to authorised neo77 personnel on a strict need-to-know basis. All internal access is authenticated via multi-factor authentication and logged for audit purposes.
• Password Storage: neo77 never stores passwords in plain text. Passwords are hashed using a strong one-way hashing algorithm with unique per-user salting. Even neo77 staff cannot retrieve your original password.
• Intrusion Detection: Automated intrusion detection and anomaly monitoring systems operate continuously across the Platform's infrastructure. Suspicious activity triggers real-time alerts for the security operations team.
• Penetration Testing: neo77 conducts periodic independent security assessments, including penetration tests and vulnerability scans, to identify and remediate security weaknesses before they can be exploited.
• Data Breach Response: neo77 maintains a documented data breach response procedure. In the event of a breach that is likely to result in risk to player rights and freedoms, affected players will be notified without undue delay with details of the nature of the breach, the data affected, and the remediation steps taken.

neo77 uses cookies and similar tracking technologies to operate the Platform, remember your preferences, analyse usage patterns, and detect fraud. The table below describes the categories of cookies in use:

You can control or delete cookies through your browser settings. Note that disabling functional or analytics cookies may affect your experience on the Platform. Disabling strictly necessary or security cookies may prevent you from logging in or using core Platform features.

neo77 does not use third-party advertising cookies or participate in cross-site tracking networks for advertising retargeting purposes.

As a neo77 player, you hold the following rights with respect to your Personal Data. neo77 will respond to all valid rights requests within 30 calendar days of receipt. If an extension is required due to complexity or volume of requests, you will be notified within the initial 30-day period.

To exercise any of the above rights, please contact the neo77 Data Protection contact at the email address listed in Section 14. Requests must include sufficient information to verify your identity before neo77 can process the request. neo77 will not charge a fee for reasonable, good-faith requests.

The neo77 Platform is strictly intended for adults aged 21 years or older. neo77 does not knowingly collect Personal Data from individuals under the age of 21. Age verification is a mandatory step in the account registration and KYC process.

If neo77 discovers, at any point, that an account has been registered by or on behalf of an individual under 21, the account will be immediately suspended, all pending wagers will be voided, and any deposited funds not subject to forfeiture will be returned to the originating payment method. All associated Personal Data will be deleted from neo77's active systems within 30 days, subject to any mandatory legal retention obligations regarding the incident record.

neo77 operates on an international infrastructure basis. Personal Data collected from Indonesian players may be stored on or processed by servers located outside of Indonesia. In such cases, neo77 ensures that appropriate safeguards are in place to protect your data during cross-border transfers, including:

• Contractual clauses in Data Processing Agreements with third-party processors that impose data protection standards equivalent to those described in this Policy.
• Selecting hosting and technology providers that maintain internationally recognised security certifications (e.g., ISO/IEC 27001).
• Limiting the scope of data transferred internationally to the minimum necessary for the specific processing purpose.

By using the neo77 Platform, you acknowledge and consent to the transfer of your Personal Data to servers and processors located outside of Indonesia where necessary to deliver the Services described in these terms.

neo77 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or Platform features. Material changes — those that affect your rights, the categories of data collected, the purposes of processing, or the parties with whom data is shared — will be communicated to registered players via email to the address on file, with a minimum of 14 days' notice before the changes take effect.

Non-material clarifications or formatting updates may be made without prior notice. The "Last updated" date at the top of this page will always reflect the date of the most recent revision. We encourage you to review this page periodically so that you remain informed about how neo77 protects your information.

Your continued use of the neo77 Platform after the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. If you do not agree to the revised terms, you must cease using the Platform and may close your account in accordance with the account closure process described in the Terms & Conditions.

If you have any questions about this Privacy Policy, wish to exercise any of your privacy rights, have a concern about how neo77 handles your Personal Data, or need to report a suspected data security incident, please contact the neo77 Data Protection team through the following channel:

Support is available in both English and Indonesian. neo77 aims to acknowledge all privacy-related inquiries within 48 hours and to fully resolve standard requests within 30 calendar days. For urgent data security matters — such as suspected unauthorised account access — please indicate "URGENT SECURITY" in your email subject line for prioritised handling.