Privacy Policy

evo77 ("we", "us", "our", "the Platform") operates the online betting and casino platform accessible at evo77.pro. In the course of providing our services — including sportsbook betting, live casino, slot games, crash games, and live roulette — we collect and process personal data about the individuals who use our Platform.

We take our responsibility as a data controller seriously. This Privacy Policy is designed to give you a complete and transparent account of how evo77 handles personal data, consistent with internationally recognized data protection principles. We apply standards drawn from leading global frameworks, including the General Data Protection Regulation (GDPR) principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, and accountability.

This Policy applies to all personal data processing activities conducted by evo77 in connection with the Platform, including data collected during account registration, KYC verification, payment processing, gameplay, customer support interactions, and marketing communications. It applies to Members resident in Indonesia — the primary market evo77 serves — as well as to Members in any other jurisdiction where our Platform is accessible.

This Privacy Policy should be read alongside our Terms & Conditions, which govern your contractual relationship with evo77 as a Member. In the event of any conflict between this Policy and the Terms & Conditions with respect to data-related matters, this Privacy Policy shall prevail.

The following definitions apply throughout this Privacy Policy:

• "Personal Data" means any information relating to an identified or identifiable natural person, including name, email address, phone number, date of birth, national identity number, payment details, IP address, device identifiers, and behavioral data linked to an individual.
• "Member" means any individual who has registered and holds an active or closed Account on the evo77 Platform.
• "Account" means the individual user account on the evo77 Platform through which a Member accesses games, places bets, manages funds, and communicates with evo77 support.
• "KYC" means Know Your Customer — the identity and age verification process evo77 applies to all Members before processing withdrawal requests.
• "Processing" means any operation or set of operations performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, transmission, restriction, erasure, or destruction.
• "Data Controller" means evo77, as the entity that determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Processor" means any third party that processes Personal Data on behalf of evo77 under a written data processing agreement, including payment processors, KYC verification providers, and fraud detection services.
• "Consent" means a freely given, specific, informed, and unambiguous indication of agreement by a Member to the processing of their Personal Data for a stated purpose, expressed through a clear affirmative action.
• "Cookie" means a small text file placed on a Member's device by the Platform for the purposes of session management, analytics, preference storage, or targeted communication.
• "IDR" means Indonesian Rupiah — the sole transaction currency on the evo77 Platform.

evo77 collects Personal Data in the following categories. We collect only the data that is necessary for the purposes described in this Policy — consistent with the principle of data minimization.

Special Category Data. evo77 does not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data. However, government-issued identity documents submitted during KYC may incidentally contain such information (e.g., religion field on an Indonesian KTP). This data is stored under strict access controls and is used solely for identity verification purposes — it is not processed for any other purpose.

evo77 collects Personal Data through the following channels:

• Direct submission: When you register an Account, complete the KYC process, make a deposit or withdrawal, contact our support team, or update your account settings, you provide Personal Data directly to evo77.
• Automated technical collection: When you access and interact with the evo77 Platform, our servers automatically record Technical Data and Usage Data, including your IP address, device identifiers, session timestamps, and navigation behavior. This data is collected using server logs, cookies, and similar tracking technologies described in Clause 10.
• Payment processors: When you initiate a deposit or withdrawal, our payment processing partners (operating the BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja integrations) may share confirmation data with evo77, including transaction reference numbers and account name matching results, to enable payment verification.
• KYC service providers: evo77 may engage third-party identity verification services to assist in validating documents submitted during KYC. These providers process documents on evo77's behalf under a data processing agreement and do not use Member data for their own purposes.
• Fraud prevention and security services: evo77 works with third-party fraud detection providers that analyze Technical Data and Usage Data to identify patterns indicative of suspicious activity, multiple account creation, or money laundering. These providers operate as Data Processors under contractual data protection obligations.

evo77 processes your Personal Data for the following specific, legitimate purposes:

• Account registration and management: To create and maintain your Member Account, authenticate your identity at login, and manage your account settings and preferences.
• Age and identity verification (KYC): To verify that you are at least 21 years of age and are who you claim to be, as required by our responsible gaming commitments and our licensing obligations. KYC is mandatory for all withdrawal requests.
• Payment processing: To process deposits in IDR from supported Indonesian payment methods (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, LinkAja) and to process withdrawal requests to verified payment accounts.
• Game and betting services: To provide access to our sportsbook (including BRI Liga 1, EPL, La Liga, Champions League, and other markets), live casino, slot games, crash games, and live roulette, and to record bet placement, settlement, and game history.
• Fraud prevention and platform security: To detect and prevent fraudulent activity, multiple account registration, money laundering, bonus abuse, and unauthorized platform access. This includes automated profiling of Technical Data and Usage Data by our fraud prevention systems.
• Responsible gaming compliance: To monitor gameplay patterns for signs of problem gambling behavior, enforce self-exclusion requests, apply deposit and session limits set by Members, and comply with our responsible gaming obligations.
• Customer support: To respond to inquiries, complaints, and support requests submitted via [email protected] and to maintain records of support communications for quality assurance and dispute resolution.
• Marketing communications: To send you promotional emails, bonus offers, and event notifications (including seasonal promotions tied to Idul Fitri, Ramadhan, Indonesian Independence Day, BRI Liga 1 milestones, and major international football tournaments) — only where you have opted in to receive such communications or where we have a legitimate interest basis as described in Clause 6.
• Legal and regulatory compliance: To maintain records required by applicable laws and our international gaming license, respond to lawful requests from authorized regulatory bodies, and enforce our Terms & Conditions.
• Platform improvement: To analyze aggregated, anonymized Usage Data to improve the Platform's user experience, game selection, payment method performance, and customer support quality.

evo77 will not use your Personal Data for any purpose not listed above without first obtaining your explicit Consent or establishing a new legitimate legal basis as described in Clause 6.

evo77 relies on the following legal bases to process your Personal Data. We identify the applicable basis for each major processing activity:

• Contractual necessity: Processing that is necessary to perform our contract with you as a Member — including account registration, payment processing, game service delivery, and KYC — is carried out on the basis of contractual necessity. Without this processing, we cannot provide you with the services described in our Terms & Conditions.
• Legitimate interests: We process Technical Data, Usage Data, and Communications Data on the basis of our legitimate interests in operating a secure, fraud-resistant platform; in improving our services; and in maintaining the integrity of our games and betting markets. We apply a balancing test before relying on this basis to ensure our interests do not override your fundamental rights.
• Legal obligation: Processing required by our international gaming license, anti-money-laundering (AML) obligations, or other applicable legal requirements is carried out on the basis of legal obligation. This includes retaining transaction records and KYC documents for the retention periods specified in Clause 8.
• Consent: Marketing communications and any non-essential Cookie placement are processed on the basis of your freely given Consent, which you provide at the time of registration or through your account settings. You may withdraw Consent at any time by contacting [email protected] or updating your notification preferences in your account dashboard. Withdrawal of Consent does not affect the lawfulness of processing carried out before withdrawal.

7.1 Principle of Limited Sharing. evo77 does not sell, rent, or trade your Personal Data to third parties for their own marketing or commercial purposes under any circumstances. Personal Data is shared with third parties only in the limited circumstances described in this Clause.

7.2 Data Processors. evo77 engages the following categories of third-party Data Processors who access Member Personal Data solely to perform services on our behalf:

• Payment processors: Partners who facilitate IDR transactions via BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja, and other supported methods. These processors receive the minimum data necessary to execute and verify payment transactions.
• KYC and identity verification providers: Specialist third-party services that assist in validating government-issued identity documents and performing age verification checks.
• Fraud prevention and AML screening services: Providers that analyze transaction and behavioral data to detect fraudulent activity, money laundering, and multiple account abuse.
• Game studios: Third-party game providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive anonymized session identifiers to enable gameplay. These studios do not receive personally identifiable Member data beyond what is technically required to deliver the game session.
• Cloud hosting and infrastructure providers: evo77 operates its Platform on encrypted cloud infrastructure. Hosting providers have physical access to server environments but are contractually prohibited from accessing the data stored on those servers for their own purposes.
• Email and communication service providers: Used to deliver transactional emails (account notifications, withdrawal confirmations) and, where Consent has been given, marketing communications.

All Data Processors are bound by written data processing agreements that restrict their use of Member data to the specified purposes, require them to implement appropriate security measures, and prohibit sub-processing without evo77's prior written consent.

7.3 Legal Disclosure. evo77 may disclose Personal Data to law enforcement agencies, regulatory authorities, or courts where required to do so by a lawful order, warrant, or legal obligation. In such cases, evo77 will disclose only the minimum data required to satisfy the legal request and, where legally permitted, will notify the affected Member.

8.1 Retention Principle. evo77 retains Personal Data only for as long as necessary to fulfill the purpose for which it was collected, to comply with applicable legal obligations, or to resolve disputes and enforce our agreements. When data is no longer required for any of these purposes, it is securely deleted or anonymized.

8.2 Retention Periods. The following retention periods apply to the main categories of Member data:

8.3 Early Deletion Requests. Where you request erasure of your Personal Data under Clause 11 (Your Rights), evo77 will assess the request against the retention obligations above. Where a legal obligation requires us to retain specific data, we will inform you of this constraint and retain only the minimum data required for that legal purpose. All other data subject to an erasure request will be deleted within 30 days of the request being validated.

9.1 Technical Measures. evo77 implements a comprehensive set of technical security controls to protect Member Personal Data against unauthorized access, disclosure, alteration, and destruction:

• 256-bit SSL/TLS encryption on all data transmissions between Member devices and the evo77 Platform, ensuring that no data exchanged over the network can be intercepted in a readable form.
• Encrypted data storage for all sensitive Personal Data — including identity documents, financial records, and password hashes — on servers with restricted access controls.
• Password hashing using a modern, salted cryptographic hashing algorithm. evo77 stores only the hashed representation of your password — not the plain-text password itself. evo77 staff cannot retrieve your password; only a reset is possible.
• Two-Factor Authentication (2FA) available to all Members as an additional layer of account access security.
• Regular penetration testing and security audits conducted by independent third-party security specialists to identify and remediate vulnerabilities in the Platform's code, infrastructure, and access controls.
• Intrusion detection and monitoring systems that alert evo77's security team in real time to anomalous access patterns, brute-force login attempts, and other potential security incidents.

9.2 Organizational Measures. Access to Member Personal Data within evo77 is restricted on a strict need-to-know basis. Staff members with access to Personal Data are subject to confidentiality obligations and receive regular data protection training. Access rights are reviewed quarterly and revoked immediately upon staff departure.

9.3 Data Breach Response. In the event of a security incident that is reasonably likely to result in a risk to Member rights and freedoms — including unauthorized access to or disclosure of Personal Data — evo77 will notify affected Members within 72 hours of becoming aware of the breach, where feasible. Notification will be sent to the registered email address associated with the affected Account and will describe the nature of the breach, the data categories involved, the likely consequences, and the measures taken to address it.

9.4 Member Responsibility. Notwithstanding the security measures above, Members are responsible for maintaining the confidentiality of their own Account credentials. You should use a strong, unique password for your evo77 Account, enable 2FA, and never share your login details with any third party. If you believe your Account credentials have been compromised, contact [email protected] immediately.

10.1 What Are Cookies. Cookies are small text files placed on your device when you visit a website. They allow the website to recognize your device, remember your preferences, maintain your session, and collect analytics data about your browsing behavior.

10.2 Cookies Used by evo77. The evo77 Platform uses the following categories of cookies:

• Strictly necessary cookies: Required for the Platform to function correctly. These include session authentication cookies that keep you logged into your Account and security tokens that protect against cross-site request forgery (CSRF). These cookies cannot be disabled as they are essential to the service. No Consent is required for strictly necessary cookies.
• Functional cookies: Remember your preferences, such as your preferred display language (English), notification settings, and responsible gaming tool configurations. These cookies enhance your experience but are not essential. They are placed on the basis of Consent.
• Analytics cookies: Collect anonymized data about how Members and visitors use the Platform — including which pages are visited most frequently, how long sessions last, and which game categories attract the most engagement. This data is used in aggregated, anonymized form to improve the Platform. Placed on the basis of Consent.
• Marketing cookies: Used to track the effectiveness of any promotional communications and to understand how Members navigate to the Platform from external sources. Placed only on the basis of explicit Consent. evo77 does not use third-party advertising network cookies to serve targeted ads on external websites.

10.3 Managing Cookies. You can manage cookie preferences through your browser settings. Most modern browsers allow you to block or delete cookies, though disabling strictly necessary cookies will prevent you from logging into your Account. You may also update your marketing and analytics cookie preferences by contacting [email protected].

10.4 Similar Technologies. In addition to cookies, evo77 may use similar tracking technologies including web beacons (transparent pixel images embedded in emails to confirm delivery and open rates), local storage objects, and session storage for functional purposes. These technologies are subject to the same Consent requirements described above.

As a Member of the evo77 Platform, you have the following rights with respect to your Personal Data. These rights may be exercised at any time by contacting [email protected]. evo77 will respond to all valid rights requests within 30 days of receipt.

• Right of Access: You have the right to request a copy of all Personal Data that evo77 holds about you, together with information about how it is being used. evo77 will provide this information in a clear, structured format.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete Personal Data held about you. You may update certain account details directly through your account dashboard; other corrections may require support assistance and identity re-verification.
• Right to Erasure ("Right to be Forgotten"): You have the right to request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn Consent, or where processing was unlawful. This right is subject to the retention obligations described in Clause 8 — data that evo77 is legally required to retain will not be erased until the mandatory retention period expires.
• Right to Restriction of Processing: You have the right to request that evo77 restrict the processing of your Personal Data in specific circumstances — for example, while a rectification request is being assessed, or where you contest the legal basis for processing.
• Right to Data Portability: You have the right to receive the Personal Data you have provided to evo77 in a structured, commonly used, machine-readable format, and to have this data transferred to another controller where technically feasible.
• Right to Object: You have the right to object to processing carried out on the basis of legitimate interests, including profiling for fraud prevention purposes, where you have grounds relating to your particular situation. You also have an absolute right to object to processing of your Personal Data for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on your Consent, you have the right to withdraw that Consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal. To withdraw marketing Consent, update your account notification settings or contact [email protected].

12.1 Strict 21+ Policy. The evo77 Platform is strictly intended for adults aged 21 years and over. evo77 does not knowingly collect Personal Data from individuals under the age of 21. Age verification is a mandatory step in the registration process, and KYC document checks confirm date of birth for all Members prior to withdrawal processing.

12.2 Discovery of Underage Data. If evo77 discovers or is notified that Personal Data has been collected from an individual who was under 21 at the time of registration, evo77 will immediately suspend the relevant Account, void any Wallet Balance, and permanently delete all Personal Data associated with that Account. Any deposits made to that Account will be returned to the originating payment method where technically feasible.

12.3 Parental Controls. evo77 strongly recommends that parents and guardians of households with individuals under the age of 21 implement device-level parental control software to restrict access to online gambling platforms. evo77 cannot be held responsible for underage access that occurs as a result of a minor gaining unauthorized access to an adult's Account credentials.

13.1 Cross-Border Processing. evo77 operates as an internationally licensed platform. As a result, Personal Data collected from Members resident in Indonesia may be transferred to and processed in jurisdictions outside Indonesia. This may occur, for example, when KYC verification services, fraud prevention providers, or cloud infrastructure partners operate servers outside Indonesian territory.

13.2 Transfer Safeguards. Where Personal Data is transferred internationally, evo77 ensures that appropriate safeguards are in place to protect Member data to a standard equivalent to that described in this Privacy Policy. Safeguards may include:

• Standard contractual clauses incorporating internationally recognized data protection obligations.
• Data processing agreements requiring the recipient to apply security standards consistent with those described in Clause 9.
• Transfer to jurisdictions that maintain an adequate level of data protection as recognized by relevant international standards.

13.3 Member Awareness. By registering an Account on the evo77 Platform and accepting these terms, you acknowledge that your Personal Data may be transferred and processed internationally as described in this Clause, subject to the safeguards above. If you have concerns about a specific international transfer, you may contact [email protected] for further information.

14.1 Right to Update. evo77 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law, or improvements to our Platform's data governance framework. The version number and effective date at the top of this page will be updated with each revision.

14.2 Notification of Material Changes. Where a change to this Privacy Policy is material — meaning it significantly affects how we use your Personal Data, your rights, or the categories of data we collect — evo77 will notify active Members by email to their registered address at least 14 days before the change takes effect. For non-material clarifications or wording improvements, the updated Policy will be published without prior notice and the effective date updated accordingly.

14.3 Continued Use. Your continued use of the evo77 Platform following publication of an updated Privacy Policy constitutes your acknowledgment of the revised terms. If you do not agree with a material change to this Policy, you may close your Account in accordance with the Terms & Conditions and submit a data rights request under Clause 11.

If you have any questions, concerns, or requests relating to this Privacy Policy or evo77's handling of your Personal Data, please contact us through the following channel:

• Email: [email protected] — use the subject line "Privacy Inquiry" or "Data Rights Request" for the fastest routing to our data protection team.
• Support Hours: 24 hours a day, 7 days a week, including Indonesian public holidays. Our team operates in WIB (Western Indonesia Time, UTC+7) with Indonesian-speaking agents on every shift.
• Response Time: evo77 aims to acknowledge all Privacy Policy inquiries within 4 hours and to provide a substantive response within 14 calendar days.

For data rights requests (access, erasure, portability, rectification, objection), please include your registered email address and a brief description of your request. evo77 may request identity verification before processing any data rights request to ensure we do not disclose or delete data in response to an unauthorized request.