paso77 Privacy Policy

1. Definitions

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person, including name, identification number, location data, or online identifiers.
• "Processing" means any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" means paso77, the entity that determines the purposes and means of processing personal data.
• "Data Processor" means any third party that processes personal data on behalf of paso77 under a written data processing agreement.
• "Member" or "you" means any individual who has registered an account on the paso77 platform or who browses the Platform without an account.
• "Services" means all betting, casino, card-game, and gaming services provided through the paso77 platform.
• "Cookies" means small text files placed on your device by the Platform for session management, analytics, and preference storage.
• "KYC" means Know Your Customer — the identity verification process paso77 conducts to confirm member identity, age, and source of funds in compliance with licensing obligations.

2. Who We Are

paso77 is an internationally licensed offshore gaming platform operating at paso77.net, serving members across Indonesia including Jakarta, Surabaya, Medan, Bandung, Bali, Yogyakarta, and other cities. paso77 acts as the Data Controller in respect of all personal data collected through its platform and is responsible for ensuring that such data is processed lawfully, fairly, and transparently.

All data-related enquiries, access requests, and complaints should be directed to our support team using the contact details provided in Section 14 of this policy.

3. Personal Data We Collect

3.1 Identity and Contact Data

When you register an account with paso77, we collect your full legal name, date of birth, email address, and country/city of residence. This information is required to open and maintain your account, verify your age (21+ requirement), and communicate with you regarding your account activity.

3.2 Identity Verification (KYC) Data

To comply with our licensing obligations and prevent financial crime, paso77 may request copies of:

• Government-issued photo identification (Indonesian KTP, SIM, or passport).
• Proof of residential address (utility bill or bank statement dated within 90 days).
• Proof of ownership of payment methods used for deposits.
• Source-of-funds documentation where deposit volumes require enhanced due diligence.

3.3 Financial Data

paso77 collects transaction data including deposit amounts, withdrawal requests, payment method identifiers (bank account numbers associated with BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata), and e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja). Full card numbers and full bank account numbers are never stored on paso77 servers; only masked identifiers are retained for transaction matching purposes.

3.4 Usage and Technical Data

paso77 automatically collects technical data when you access the Platform, including your IP address, device type, operating system, browser type and version, referring URL, pages viewed, session duration, and login timestamps. This data is used for security monitoring, fraud detection, platform optimisation, and responsible gaming analytics.

3.5 Communications Data

If you contact paso77 via live chat, email, or any other support channel, we retain records of that communication including the content of messages, timestamps, and the resolution outcome. This data is used to manage support requests and to improve service quality.

4. How We Collect Personal Data

paso77 collects personal data through the following channels:

• Direct interactions: Data you provide when registering an account, completing KYC, making deposits or withdrawals, completing promotional forms, or contacting support.
• Automated technologies: Cookies, server logs, and similar tracking technologies that record your interactions with the Platform — see Section 10 for full details.
• Third-party sources: Identity verification agencies, fraud prevention databases, and payment processors may provide paso77 with supplementary data to verify the accuracy of information you have provided.
• Public sources: Publicly available information such as electoral registers or public social media profiles may be used to verify identity details in limited circumstances.

5. Purposes and Legal Basis for Processing

paso77 processes personal data only where a lawful basis exists. The table below sets out the primary purposes for which personal data is processed and the corresponding legal basis:

Purpose	Data Categories Used	Legal Basis
Account registration and management	Identity, Contact	Performance of contract
Age and identity verification (KYC)	Identity, KYC documents	Legal obligation / Licensing requirement
Processing deposits and withdrawals	Financial, Identity	Performance of contract
Fraud prevention and security monitoring	Usage, Financial, Identity	Legitimate interests
Responsible gaming monitoring	Usage, Financial	Legal obligation / Legitimate interests
Customer support and dispute resolution	Identity, Communications	Performance of contract
Platform analytics and improvement	Usage (anonymised)	Legitimate interests
Regulatory compliance and audit	All categories	Legal obligation
Direct marketing communications	Contact, Usage	Consent (opt-in only)

6. Data Sharing and Disclosure

paso77 does not sell personal data. We may share personal data with the following categories of recipients, strictly on a need-to-know basis and subject to contractual data protection obligations:

6.1 Payment Processors

To process deposits and withdrawals via Indonesian bank channels (BCA, BRI, BNI, Mandiri, and others) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja), paso77 shares the minimum financial data necessary with licensed payment processors. These processors are bound by strict confidentiality and data security obligations.

6.2 Identity Verification Providers

paso77 may share identity documents with licensed KYC and anti-money-laundering (AML) service providers for the purpose of verifying member identity and screening against sanctions lists and fraud databases. These providers act as Data Processors under written agreements with paso77.

6.3 Game Software Providers

Game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive limited usage data (e.g., session identifiers) necessary to deliver their game content. These studios do not receive personally identifiable information beyond what is strictly necessary for game delivery and RNG certification.

6.4 Legal and Regulatory Authorities

paso77 may disclose personal data to regulatory authorities, law enforcement agencies, or courts where required by law, court order, or our licensing obligations. paso77 will notify affected members of any such disclosure to the extent permitted by law.

6.5 Corporate Transactions

In the event of a merger, acquisition, or sale of all or part of paso77's business, member personal data may be transferred to the acquiring entity as part of that transaction. Affected members will be notified of any change in Data Controller prior to the transfer taking effect.

7. International Data Transfers

paso77 operates internationally, and your personal data may be processed on servers located outside Indonesia. Where data is transferred to a jurisdiction that does not provide an equivalent level of data protection, paso77 implements appropriate safeguards including standard contractual clauses and data processing agreements to ensure your data remains protected to the standards described in this policy.

8. Data Retention

paso77 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law and licensing obligations. The following indicative retention periods apply:

Data Category	Retention Period	Basis
Account and identity data	Duration of account + 5 years post-closure	Licensing / AML obligation
KYC documents	Duration of account + 5 years post-closure	Licensing / AML obligation
Financial transaction records	Duration of account + 5 years post-closure	Licensing / AML obligation
Betting and gaming history	Duration of account + 2 years post-closure	Dispute resolution / Legitimate interests
Customer support communications	3 years from last interaction	Legitimate interests
Usage and technical logs	13 months from collection	Security / Fraud prevention
Marketing consent records	Until consent is withdrawn + 1 year	Legal obligation (consent evidence)

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be associated with any individual member.

9. Security Measures

paso77 implements a comprehensive suite of technical and organisational security measures to protect personal data against unauthorised access, loss, destruction, or alteration. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between member devices and paso77 servers.
• AES-256 encryption at rest for sensitive personal and financial data stored on paso77 infrastructure.
• Role-based access controls (RBAC) ensuring that only authorised personnel with a legitimate operational need can access member data.
• Multi-factor authentication on all internal administrative systems.
• Regular penetration testing and vulnerability assessments conducted by independent security professionals.
• 24/7 security monitoring with automated intrusion detection and anomaly-alerting systems.
• Incident response procedures with defined timelines for notifying affected members and relevant authorities in the event of a confirmed data breach.

10. Cookies and Tracking Technologies

10.1 What Cookies We Use

paso77 uses the following categories of cookies and similar technologies when you access the Platform:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication tokens, security cookies, and load-balancing cookies. These cookies cannot be disabled without impairing Platform functionality.
• Functional Cookies: Used to remember your preferences such as language settings and display options to provide a more personalised experience.
• Analytics Cookies: Used to understand how members interact with the Platform — pages visited, session duration, navigation paths — to improve the Platform's performance and content. Analytics data is aggregated and does not identify individual members.
• Security Cookies: Used to detect and prevent fraudulent activity, including account takeover attempts and bot traffic.

10.2 Managing Cookies

You may configure your browser to refuse non-essential cookies or to alert you when cookies are being set. Please note that disabling certain cookies may affect the functionality of the Platform, including your ability to log in or access certain game features. Instructions for managing cookies are available in your browser's help documentation.

11. Children's Privacy

The paso77 platform is strictly intended for adults aged 21 and over. paso77 does not knowingly collect personal data from anyone under the age of 21. If paso77 becomes aware that personal data has been collected from a person under the minimum age, that data will be deleted immediately and the associated account will be closed. If you believe a minor has registered on paso77, please contact us immediately at [email protected].

12. Exercising Your Data Rights

To exercise any of the rights described in this policy — including access, rectification, erasure, restriction, portability, or objection — please submit a written request to [email protected] with the subject line "Data Rights Request". You will need to verify your identity before your request can be processed.

paso77 will acknowledge your request within 5 business days and provide a substantive response within 30 calendar days of receipt. Where a request is complex or involves a large volume of data, this period may be extended by a further 30 days, and you will be notified of the extension with reasons.

There is no charge for exercising your data rights unless requests are manifestly unfounded or excessive, in which case paso77 reserves the right to charge a reasonable administrative fee or decline to act on the request.

13. Amendments to This Policy

paso77 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, operational requirements, or applicable law. Material changes will be communicated to registered members via email to the address on file and via a prominent notice on the Platform no less than seven (7) days before the changes take effect. The "Last Updated" date at the top of this document will be revised accordingly.

Your continued use of the Platform after the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. If you do not accept the revised policy, you must close your account before the amendment takes effect.

14. Contact and Complaints

For all privacy-related enquiries, data rights requests, or complaints regarding paso77's handling of your personal data, please contact us through the following channels:

• Email: [email protected] — Subject line: "Privacy Enquiry" or "Data Rights Request" (plain text — not a clickable link)
• Live Chat: Available 24/7 via the Platform, staffed by native Indonesian-speaking agents.

paso77 aims to acknowledge all privacy-related enquiries within 24 hours (WIB, UTC+7) and to resolve complaints fully within 30 calendar days. If you are not satisfied with paso77's response, you may escalate the matter to the data protection authority or dispute resolution body associated with paso77's licensing jurisdiction.