Privacy Policy

This Privacy Policy ("Policy") describes how mas77 ("the Platform", "we", "us", "our") collects, processes, stores, shares, and protects the personal data of individuals ("you", "Member", "User") who access or use any service provided through https://mas77.onl — including the sportsbook, live casino, slot games, togel (Indonesia's traditional numbers lottery), Keno, and Sic Bo products.

This Policy forms part of, and should be read together with, the mas77 Terms & Conditions available at /terms-conditions. By registering an account or otherwise using the mas77 platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein.

mas77 is committed to protecting the privacy of every member. We operate an online gaming platform built for Indonesian players, and we understand that the trust you place in us extends far beyond the games you play — it includes entrusting us with personal and financial information that you reasonably expect to be handled with the highest level of care, discretion, and security.

This Policy has been drafted to meet the standards of internationally recognized data protection frameworks. We collect only the data we need, use it only for the purposes stated, retain it only for as long as necessary, and apply robust technical and organizational safeguards to protect it throughout its lifecycle. We do not sell your personal data to any third party for marketing or advertising purposes.

mas77 processes personal data in accordance with its obligations as a licensed and regulated international online gaming operator. This means our data practices are subject to audit and oversight, and we take that responsibility seriously.

For the purposes of this Policy, mas77 acts as the data controller in respect of all personal data collected from Members through the platform. As data controller, mas77 determines the purposes and means by which your personal data is processed.

Where mas77 engages third-party service providers to process personal data on its behalf — for example, payment processors, KYC verification providers, or fraud detection services — those third parties act as data processors under written agreements that bind them to process data only on mas77's documented instructions and to maintain appropriate security measures.

mas77 collects personal data across several categories, depending on your interaction with the platform. The table below summarizes the types of data we collect and the context in which they arise:

We do not intentionally collect any special categories of sensitive personal data (such as racial or ethnic origin, religious beliefs, health data, or political opinions) unless specifically required to fulfil our responsible gaming obligations — for example, where a Member voluntarily discloses a gambling-related health concern in connection with a self-exclusion request.

mas77 collects personal data through the following channels:

• Direct Submission: Data you actively provide when creating your account, completing KYC verification, making deposits or withdrawals, contacting our support team, or updating your account profile.
• Automated Technical Collection: Data collected automatically as you navigate and interact with the platform, including through cookies, server logs, and similar tracking technologies. See Section 7 for full cookie details.
• Payment Processors: Transaction confirmation data returned by Indonesian bank transfer systems (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) following deposit and withdrawal processing.
• KYC & Identity Verification Providers: Verification outcomes and risk scores returned by our licensed third-party identity verification partners following review of documents you submit.
• Fraud & AML Monitoring Systems: Behavioral signals and risk indicators generated by our automated fraud detection and anti-money-laundering (AML) screening tools, which analyze platform activity patterns in real time.
• Publicly Available Sources: In limited circumstances related to AML compliance and fraud investigation, mas77 may cross-reference data against publicly available sanction lists or adverse-media databases.

mas77 processes your personal data only when it has a lawful basis for doing so. The table below maps our primary processing activities to their purpose and legal basis:

mas77 does not sell, rent, or trade your personal data to any third party for their own commercial use. We share your data only in the following limited, controlled circumstances:

• Licensed Payment Processors: Your financial data (bank account or e-wallet details) is shared with the relevant Indonesian payment network operators solely to execute deposit and withdrawal transactions you have initiated. This includes BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, and LinkAja.
• KYC & Identity Verification Services: Identity documents and verification data are shared with our licensed KYC technology partners for the purpose of identity verification and age confirmation. These partners are contractually prohibited from using your data for any purpose other than verification on our behalf.
• Game Content Providers: Aggregated, pseudonymized gaming activity data may be shared with licensed game studios (Pragmatic Play, Evolution Gaming, Microgaming, Spribe, Pocket Games Soft, and others) solely for the purpose of game settlement, technical support, and regulatory reporting required by those studios' licenses.
• Fraud & Security Service Providers: Technical data and behavioral signals are shared with fraud detection and cybersecurity platforms under strict data processing agreements to protect the platform and its members from unauthorized access and financial crime.
• Legal and Regulatory Authorities: mas77 will disclose personal data to competent regulatory bodies, law enforcement agencies, or courts of law where required to do so by applicable law, valid legal process, or court order. mas77 will notify the affected Member of such disclosure where legally permitted to do so.
• Corporate Transactions: In the event of a merger, acquisition, or sale of all or substantially all of mas77's assets, your personal data may be transferred to the acquiring entity, provided that the acquiring entity agrees to be bound by this Privacy Policy or a policy that affords equivalent protection.

The mas77 platform uses cookies and similar tracking technologies to operate the site, maintain your login session, remember your preferences, analyze usage patterns, and detect fraud. A cookie is a small text file stored on your device by your browser when you visit a web page.

mas77 uses the following categories of cookies:

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication cookies that keep you logged in, CSRF protection tokens, and load-balancing cookies. These cannot be disabled without disrupting core platform functionality.
• Functional Cookies: Store your preferences — such as display settings, responsible gaming limit configurations, and preferred game categories — so that you do not need to re-enter them each session.
• Analytical Cookies: Collect anonymized or pseudonymized data about how Members navigate and use the platform, which pages generate the most engagement, and where technical errors occur. This data is used solely for platform improvement purposes.
• Security & Fraud Detection Cookies: Support our fraud prevention systems by identifying unusual behavioral patterns, tracking device fingerprints across sessions, and flagging potentially compromised accounts for review.

Most modern browsers allow you to manage cookie preferences through your browser settings. Disabling strictly necessary cookies will prevent you from accessing certain features of the platform, including login. Disabling analytical cookies will not affect your ability to use the platform but will reduce our ability to identify and fix usability issues.

mas77 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, and for as long as required to meet our legal, regulatory, and contractual obligations. The following retention guidelines apply:

• Active Account Data: Identity, contact, financial, and gaming activity data are retained for the duration of your active account relationship with mas77, plus a minimum of five years following account closure to meet AML record-keeping requirements.
• KYC Documents: Copies of identity documents submitted during KYC verification are retained for a minimum of five years following the end of the Member relationship, in compliance with international AML and counter-terrorism financing (CTF) standards.
• Transaction Records: Full records of all deposit and withdrawal transactions conducted in IDR are retained for a minimum of five years for financial audit and regulatory reporting purposes.
• Support Communications: Live chat transcripts and email support correspondence are retained for 24 months from the date of the interaction, after which they are archived or deleted.
• Technical & Log Data: Server logs, IP address records, and device fingerprint data are retained for 12 months for fraud investigation purposes, then deleted or anonymized.
• Analytical Data: Aggregated, anonymized usage analytics data may be retained indefinitely as it cannot be used to identify any individual.

When the applicable retention period expires, mas77 will securely delete or irreversibly anonymize your personal data so that it can no longer be associated with your identity.

mas77 implements a comprehensive, layered security architecture to protect your personal and financial data against unauthorized access, disclosure, alteration, or destruction. Our security measures include:

• 256-Bit SSL/TLS Encryption: All data transmitted between your device and mas77's servers is encrypted using 256-bit SSL/TLS — the same encryption standard used by Indonesia's leading national banks, including BCA, BRI, BNI, and Mandiri.
• Encryption at Rest: Sensitive personal data — including identity documents, bank account details, and KYC records — is encrypted at rest using AES-256 encryption within our database infrastructure.
• Access Controls: Access to Member personal data within mas77's internal systems is restricted to personnel with a documented operational need. Role-based access controls (RBAC) and audit logging are applied to all systems that process personal data.
• Two-Factor Authentication (2FA): mas77 strongly recommends that all Members enable 2FA on their accounts via the account security settings. Internal mas77 systems that process personal data require 2FA for all staff access.
• Penetration Testing & Vulnerability Management: mas77 engages independent cybersecurity professionals to conduct regular penetration tests and vulnerability assessments of the platform. Critical vulnerabilities are remediated within defined SLA timeframes.
• Incident Response: In the event of a confirmed personal data breach that poses a risk to your rights and freedoms, mas77 will notify affected Members without undue delay and, where required, report the breach to the relevant supervisory authority.

As a mas77 Member, you have the following rights in relation to your personal data. To exercise any of these rights, contact us at [email protected] with your username and the subject line "Data Rights Request — [Right Type]". We will respond within 30 calendar days of receiving a valid, verified request.

The mas77 platform is strictly intended for adults aged 21 and over. We do not knowingly collect, process, or store personal data from any individual under the age of 21. Age verification is a mandatory step in our KYC process, and accounts found to belong to individuals under 21 will be immediately and permanently terminated, with all associated data deleted in accordance with our retention obligations.

If you are a parent or guardian and believe that a person under 21 in your care has registered an account on the mas77 platform without your knowledge, please contact us immediately at [email protected]. We will investigate and, if confirmed, immediately close the account and delete all associated personal data without retention beyond our minimum legal obligations.

The mas77 platform may contain references to or integrations with third-party services — including licensed game studios (Pragmatic Play, Evolution Gaming, Microgaming, Spribe, Pocket Games Soft), payment networks (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay), and sports data providers. These third parties operate under their own privacy policies, which mas77 has no control over and takes no responsibility for.

When you interact directly with a third-party service — for example, when completing a bank transfer through your BCA or BRI mobile banking app — that interaction is governed solely by that third party's terms and privacy policy. mas77 receives only the transaction outcome data returned by the payment network; it does not access your banking credentials or your full transaction history with those institutions.

mas77 may update this Privacy Policy from time to time to reflect changes in our data practices, new product features, regulatory developments, or improvements in our security posture. When material changes are made, we will update the "Last Updated" date at the top of this page and, where practicable, notify active Members via email or an in-platform notification.

Your continued use of the mas77 platform after the revised Policy has been published constitutes your acceptance of the updated terms. If you do not agree with any material change to this Policy, you should cease using the platform and contact [email protected] to request account closure before the effective date of the change.

We encourage you to review this Policy periodically so that you are always aware of how your personal data is being handled. Prior versions of this Policy are available on request by contacting our support team.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way mas77 handles your personal data, please contact our support team through the following channel:

For formal data subject access requests, erasure requests, or portability requests, please include sufficient identifying information to allow us to verify your identity and locate your account. mas77 will not process data rights requests it cannot verify.