This Privacy Policy ("Policy") describes how sr777 ("Company", "we", "us", "our") collects, uses, discloses, and safeguards personal information provided by users ("Player", "Member", "you") when accessing or using the sr777 online platform. By registering an account with sr777, you acknowledge that you have read and understood this Policy and consent to the data practices described herein. This Policy is incorporated by reference into the sr777 Terms & Conditions. Where this Policy and the Terms conflict, this Policy shall govern in matters relating specifically to personal data.
Definitions
For the purposes of this Policy, the following terms carry the meanings assigned below.
- "Personal Data" — any information that, alone or in combination with other data, can identify a living natural person, including name, date of birth, national identification number, address, email address, IP address, payment account details, and device identifiers.
- "Processing" — any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, transmission, alteration, or deletion.
- "Data Controller" — the entity that determines the purposes and means of Processing Personal Data. For all data collected via the sr777 Platform, the Data Controller is sr777.
- "Data Processor" — any third party that processes Personal Data on behalf of sr777 under a written data-processing agreement, such as KYC verification providers, payment gateway operators, and cloud infrastructure providers.
- "Consent" — a freely given, specific, informed, and unambiguous indication of the Player's agreement to the Processing of their Personal Data for a stated purpose, given by a clear affirmative action during account registration.
- "KYC" — Know Your Customer; the identity and age-verification procedures sr777 is required to conduct under its international gaming license before processing withdrawals or at any point where risk-management protocols require it.
- "Platform" — the sr777 website, web application, and any associated digital interfaces through which the Company's sportsbook, casino, and related services are delivered.
Data Controller
2.1 sr777 is the Data Controller for all Personal Data collected through the Platform. As Data Controller, sr777 determines the purposes for which Personal Data is processed and the means by which that processing is carried out.
2.2 sr777 operates under an international gaming license. The licensing jurisdiction's data-protection requirements form the baseline standard for this Policy. Where applicable local law — including Indonesian regulations — imposes stricter obligations, sr777 will apply the stricter standard.
2.3 All data-protection enquiries, subject-access requests, and formal complaints relating to this Policy should be directed in writing to [email protected] with the subject line "Data Protection — [Account ID]". The Company acknowledges all privacy-related correspondence within 5 business days of receipt.
Data We Collect
3.1 sr777 collects Personal Data across three primary contexts: data you provide directly, data generated automatically by your use of the Platform, and data received from authorised third-party service providers.
3.2 Data Provided Directly by You
- Registration data: full legal name, date of birth, email address, phone number, and residential address (city and province — for example, Jakarta, Surabaya, Bandung, Bali, or Yogyakarta).
- KYC documents: scanned or photographed copies of your KTP (Indonesian National Identity Card), passport, or driver's licence (SIM), including facial photograph and document number.
- Payment data: bank account numbers (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata), e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja), and transaction reference numbers. Full payment card numbers are not stored by sr777; card processing is handled end-to-end by PCI-DSS-compliant payment processors.
- Support correspondence: messages sent via live chat, emails to [email protected], and any files or screenshots attached to support tickets.
- Responsible gaming submissions: self-assessment responses, limit-setting choices, and self-exclusion requests submitted through the Platform's responsible gaming tools.
3.3 Data Collected Automatically
- Technical data: IP address, browser type and version, operating system, device model, screen resolution, and preferred language settings.
- Session data: login timestamps, session duration, pages visited within the Platform, game titles launched, bet slips viewed, and logout events.
- Transaction logs: deposit and withdrawal history, bonus claims, wagering activity (sports markets, casino games, togel draws), and balance movements.
- Cookie and local-storage data: see Section 7 for a full description of cookies used by sr777.
3.4 Data Received from Third Parties
- KYC verification providers: identity-match scores, document authenticity flags, and age-verification outcomes returned by the third-party KYC service sr777 uses to process identity documents.
- Payment processors: transaction status, failure codes, and fraud-risk scores returned by bank and e-wallet gateway APIs.
- Fraud and AML screening: sanctions-list check results and politically exposed person (PEP) screening outcomes from licensed compliance data providers.
sr777 applies the principle of data minimisation. We collect only the Personal Data that is strictly necessary for the purposes described in Section 4. Requests for data beyond what is listed above will never be made by sr777 through unofficial channels.
How We Use Your Data
4.1 sr777 processes Personal Data for the following clearly defined purposes. Each purpose is linked to a specific legal basis described in Section 5.
| Purpose | Data Categories Used | Legal Basis |
|---|---|---|
| Account creation and authentication | Registration data, device/IP data | Contract performance |
| KYC / age and identity verification | KYC documents, registration data, third-party verification data | Legal obligation; contract performance |
| Processing deposits and withdrawals | Payment data, transaction logs | Contract performance |
| Fraud prevention and AML compliance | All collected data; third-party screening results | Legal obligation; legitimate interest |
| Customer support resolution | Support correspondence, account data, transaction logs | Contract performance; legitimate interest |
| Platform analytics and improvement | Session data, technical data (anonymised where possible) | Legitimate interest |
| Responsible gaming monitoring | Wagering activity, session data, responsible gaming submissions | Legal obligation; legitimate interest |
| Promotional communications (where opted in) | Email address, wagering preferences | Consent |
| Legal and regulatory reporting | All categories as required by applicable law | Legal obligation |
4.2 sr777 does not use Personal Data for automated decision-making that produces legal or similarly significant effects on Players, except where such automated processing is required for AML screening under our licensing obligations. In those cases, Players retain the right to request human review of any automated decision that adversely affects their account.
4.3 Players who have opted in to promotional communications may withdraw that consent at any time by contacting [email protected]. Withdrawal of consent for marketing communications does not affect the lawfulness of processing carried out prior to withdrawal, and does not affect the Company's ability to send service-related communications (e.g., withdrawal confirmations, security alerts, Terms updates).
Legal Basis for Processing
5.1 sr777 relies on one or more of the following legal bases when processing your Personal Data, as indicated in the table in Section 4:
- Contract performance: processing is necessary to perform the contract between you and sr777 (your account registration agreement and these Terms) or to take steps at your request before entering into that contract.
- Legal obligation: processing is necessary for sr777 to comply with applicable legal requirements, including KYC/AML obligations under our international gaming license and any applicable Indonesian law.
- Legitimate interest: processing is necessary for sr777's legitimate business interests — including fraud prevention, Platform security, and service improvement — provided those interests are not overridden by your fundamental rights and freedoms.
- Consent: you have given clear, specific, and freely revocable consent for a particular processing activity (e.g., receiving promotional communications by email).
5.2 Where sr777 processes data on the basis of legitimate interest, we conduct a balancing test before commencing that processing to confirm that the legitimate interest is not overridden by your interests, rights, or freedoms. Records of those assessments are maintained by sr777's compliance team.
Data Sharing & Third Parties
6.1 sr777 does not sell, rent, or trade your Personal Data to any third party for commercial or marketing purposes. Data is shared with third parties only in the limited circumstances described below.
6.2 Authorised Data Processors. The following categories of third-party service providers act as Data Processors for sr777, processing Personal Data strictly under written data-processing agreements and only on sr777's documented instructions:
- KYC / identity verification providers: receive copies of identity documents to perform document authenticity checks and age verification. These providers are prohibited from using submitted documents for any purpose other than the KYC check.
- Payment processors and banking partners: receive the minimum transaction data necessary to execute deposits and withdrawals via BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, LinkAja, and other supported channels.
- Cloud and hosting infrastructure providers: provide the servers and storage on which Platform data is held. These providers have no independent right to access or use Player data beyond their infrastructure role.
- Fraud prevention and AML screening services: receive account and transaction data to perform sanctions-list and PEP screening as required by our licensing obligations.
- Customer support software providers: process support-ticket content and chat transcripts to enable the delivery of our 24/7 support service.
- Analytics providers: receive anonymised or pseudonymised session data for the purpose of Platform performance analysis. No directly identifiable Personal Data is passed to analytics providers.
6.3 Legal Disclosures. sr777 may disclose Personal Data to governmental authorities, law enforcement agencies, or regulatory bodies where required to do so by a valid legal instrument (court order, regulatory directive, or equivalent). We will notify affected Players of such disclosures where permitted by law.
6.4 Business Transfers. In the event of a merger, acquisition, or sale of all or substantially all of sr777's assets, Personal Data held by sr777 may be transferred to the acquiring entity. Affected Players will be notified by email at least 30 days before any such transfer takes effect, and the acquiring entity will be required to honour this Policy or provide equivalent privacy protection.
Important: sr777 will never share your Personal Data with unaffiliated third-party advertisers, social media platforms, or data brokers. If you receive unsolicited communications claiming to be from sr777 partners, treat them as suspicious and report them to [email protected] immediately.
Cookies & Tracking
7.1 sr777 uses cookies and similar browser-storage technologies to ensure the Platform functions correctly and to understand how Players interact with it. We do not deploy third-party advertising cookies or cross-site tracking pixels.
7.2 The following table lists all cookies currently in use on the sr777 Platform:
| Cookie Name / Type | Purpose | Duration | Essential? |
|---|---|---|---|
| Session cookie (sr_sess) | Maintains the authenticated login session while you are active on the Platform | Session (deleted on browser close) | Yes |
| CSRF token (sr_csrf) | Prevents cross-site request forgery attacks on account actions | Session | Yes |
| Preferences cookie (sr_pref) | Stores display preferences such as odds format and language selection | 12 months | No (functional) |
| Analytics cookie (sr_anl) | Collects anonymised page-visit and interaction data to improve Platform performance | 6 months | No (analytics) |
| Responsible gaming flag (sr_rg) | Records active session-time limit or reality-check interval set by the Player | Matches limit duration set by Player | Yes (when limit is active) |
7.3 Essential cookies cannot be disabled as they are necessary for the Platform to function. Non-essential cookies (functional and analytics) can be disabled by adjusting your browser settings. Disabling functional cookies may affect your experience — for example, your odds-format preference will not be remembered between sessions.
7.4 sr777 does not use fingerprinting techniques, supercookies, or persistent identifiers beyond the cookies documented above.
Data Security
8.1 sr777 implements a layered security architecture to protect Personal Data against unauthorised access, disclosure, alteration, and destruction. Key technical and organisational measures include:
- Encryption in transit: all data exchanged between your browser or device and sr777's servers is encrypted using TLS 1.2 or TLS 1.3 with 256-bit AES cipher suites. The Platform enforces HTTPS exclusively; HTTP connections are automatically redirected.
- Encryption at rest: Personal Data stored in sr777's databases — including KYC documents, payment details, and account records — is encrypted at rest using AES-256.
- Access control: access to systems containing Personal Data is restricted to sr777 personnel and authorised Data Processors on a strict need-to-know basis, enforced through role-based access control (RBAC) and multi-factor authentication (MFA).
- Intrusion detection: sr777 operates automated intrusion-detection and anomaly-alerting systems that monitor for unauthorised access attempts and unusual data-access patterns around the clock.
- Penetration testing: the Platform undergoes independent security penetration testing at regular intervals. Critical findings are remediated on an expedited timeline.
- Staff training: all sr777 personnel with access to Personal Data receive mandatory data-protection and security-awareness training at onboarding and annually thereafter.
8.2 In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected Players, sr777 will notify affected Players without undue delay — and in any event within 72 hours of becoming aware of the breach — by email to the address registered on the affected account. The notification will describe the nature of the breach, the categories of data involved, the likely consequences, and the measures sr777 has taken or proposes to take to address it.
8.3 Players are strongly encouraged to enable two-factor authentication (2FA) on their accounts and to use a unique, strong password not reused on other services. sr777 will never ask for your account password through any channel. The security of your credentials is a shared responsibility.
Data Retention
9.1 sr777 retains Personal Data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by the legal and regulatory obligations applicable to a licensed gaming operator. The table below summarises our standard retention periods:
| Data Category | Retention Period | Reason |
|---|---|---|
| Account registration data | Duration of active account + 5 years after closure | Licensing obligation / AML record-keeping |
| KYC identity documents | 5 years from the date of verification | Licensing obligation / AML record-keeping |
| Financial transaction logs | 7 years from the transaction date | Financial record-keeping obligations |
| Support correspondence | 3 years from the date of the support interaction | Legitimate interest (dispute resolution) |
| Session and analytics data | 13 months from collection (anonymised after 6 months) | Platform improvement; anonymised after rolling period |
| Responsible gaming records | 5 years from account closure | Licensing obligation / duty of care |
9.2 When a retention period expires, Personal Data is securely deleted or irreversibly anonymised. Data subject to ongoing legal proceedings or regulatory investigations is retained until the matter is fully resolved, after which the standard deletion process applies.
9.3 Players who have been inactive for more than 24 consecutive months will receive an email notification informing them of the upcoming account review. If no login or contact is made within 30 days of that notification, the account may be designated inactive and subject to data minimisation measures, retaining only the data categories required by regulatory obligations.
Your Rights
10.1 Subject to applicable law and the limitations inherent to sr777's regulatory obligations, you have the following rights with respect to your Personal Data:
- Right of access: you may request a copy of all Personal Data sr777 holds about you, together with information about how it is being processed.
- Right to rectification: you may request correction of any inaccurate or incomplete Personal Data held on your account. For registration details, many corrections can be made directly via the Account settings panel.
- Right to erasure ("right to be forgotten"): you may request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (where consent is the legal basis), or where you object to processing based on legitimate interest and that interest does not override yours. Note: sr777 cannot erase data it is legally obligated to retain (see Section 9).
- Right to restriction of processing: you may request that sr777 suspend processing of your data in certain circumstances — for example, while a rectification request is being assessed.
- Right to data portability: where processing is based on consent or contract performance and is carried out by automated means, you may request a copy of your Personal Data in a structured, commonly used, machine-readable format.
- Right to object: you may object at any time to processing based on sr777's legitimate interests. Sr777 will cease that processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
- Right to withdraw consent: where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.
10.2 To exercise any of the above rights, submit a written request to [email protected] with the subject line "Data Rights Request – [Right Type] – [Account ID]". sr777 will respond within 30 calendar days of receipt. In complex cases, this period may be extended by a further 60 days; you will be notified of any extension within the initial 30-day period.
10.3 sr777 will not charge a fee for handling data rights requests in ordinary circumstances. Where requests are manifestly unfounded, repetitive, or excessive, a reasonable administrative fee may be applied. You will be informed of any fee before it is charged and given the option to withdraw the request.
When you submit a data rights request, sr777 is required to verify your identity before disclosing or acting on any Personal Data. You may be asked to supply a copy of your KTP or passport as part of this verification. This is a security measure designed to protect your data — not a barrier to exercising your rights.
Minors
11.1 The sr777 Platform is strictly intended for adults aged 21 years and over. sr777 does not knowingly collect or process Personal Data from any person under the age of 21. Age verification is a mandatory step in our KYC process.
11.2 If sr777 becomes aware that Personal Data has been collected from a person under 21 years of age — whether through a KYC finding, a complaint, or any other means — we will immediately suspend the associated account, void all wagers placed, and permanently delete the minor's Personal Data from our systems, subject only to the minimum retention required by applicable law.
11.3 If you believe that a person under the age of 21 has registered an account on the sr777 Platform, please contact us immediately at [email protected] with the subject line "Underage Account Report". We treat such reports with the highest priority.
International Data Transfers
12.1 sr777 operates infrastructure in multiple jurisdictions to ensure Platform reliability and performance. As a result, Personal Data collected from Players in Indonesia may be transferred to and stored in servers located outside Indonesia.
12.2 All international transfers of Personal Data are subject to appropriate safeguards. Where data is transferred to a Data Processor located in a jurisdiction without an equivalent level of data-protection law, sr777 implements contractual protections (standard contractual clauses or equivalent data-transfer agreements) to ensure your Personal Data receives protection consistent with the standards described in this Policy.
12.3 Players who wish to obtain further information about the specific safeguards in place for any given international transfer may request this information by contacting [email protected].
Amendments
13.1 sr777 reserves the right to update or replace this Privacy Policy at any time. The current version of the Policy, together with its version number and effective date, is always accessible at sr777.cam/privacy-policy.
13.2 Where a proposed amendment materially affects your rights or the way in which we process your Personal Data, sr777 will notify you by email to your registered address no less than 14 calendar days before the amendment takes effect. Continued use of the Platform after the effective date constitutes acceptance of the amended Policy.
13.3 Players who do not accept a material amendment may request account closure and withdrawal of their full available balance before the effective date of the amendment by contacting [email protected].
Contact & Complaints
14.1 For any query, concern, or request relating to this Privacy Policy or the way sr777 handles your Personal Data, please contact us using the details below:
- Email: [email protected] — use the subject line "Privacy Enquiry – [Account ID]" for the fastest response.
- Live Chat: available 24/7 directly on the sr777 Platform. For data rights requests, a written email record is recommended.
14.2 If you are dissatisfied with sr777's response to a privacy concern, you have the right to escalate your complaint to the regulatory authority in the jurisdiction under which sr777's gaming license is issued. Details of the relevant authority are available upon request from [email protected].
14.3 This Privacy Policy was last updated in January 2026 and constitutes Version 2.0 of the sr777 platform privacy document. It replaces and supersedes all prior versions.
Reminder: sr777 will never contact you by phone, SMS, or email to request your password, OTP, or full payment card details. Any such communication purporting to be from sr777 should be treated as fraudulent. Report it immediately to [email protected] so we can investigate and alert other Players if necessary.