haya77 Privacy Policy

haya77 is an internationally licensed online betting and casino platform accessible at https://haya77.bet. The Platform offers sports betting markets — including BRI Liga 1, EPL, La Liga, Champions League, and Timnas Indonesia fixtures — live casino games, slots, togel (Indonesia's traditional numbers lottery), crash games, and keno, all denominated in Indonesian Rupiah (IDR).

haya77 operates as an offshore gaming entity under an international license. While the Platform is designed primarily to serve English-preference players located in Indonesia — in cities including Jakarta, Surabaya, Bandung, Medan, Bali, Yogyakarta, and Semarang — it is accessible globally. Players are individually responsible for verifying that their access to the Platform complies with local law.

For all privacy-related queries, the data controller may be contacted at [email protected].

haya77 collects personal data only to the extent necessary for the lawful operation of the Platform. The categories of personal data we may collect are set out in the table below:

We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or biometric data unless specifically required by law or KYC regulation.

haya77 collects personal data through the following channels:

3.1 Direct Submission

You provide personal data directly when you complete the account registration form, submit KYC verification documents, make a deposit or withdrawal request, contact our support team via live chat or email, or participate in a promotion or survey.

3.2 Automated Collection

When you visit or use the Platform, our systems automatically record certain technical and usage data, including your IP address, device identifiers, browser characteristics, session timestamps, and in-Platform navigation patterns. This data is captured using server logs, cookies, web beacons, and similar tracking technologies. See Clause 7 for full details on our cookie practices.

3.3 Third-Party Sources

We may receive or verify personal data from the following third-party sources:

• Payment processors: Transaction confirmation details from BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, OVO, DANA, GoPay, ShopeePay, and LinkAja
• KYC verification providers: Identity and document verification services that cross-reference your submitted documents against official databases
• Fraud prevention services: Third-party risk-scoring providers that flag unusual account or transaction patterns
• Game providers: Aggregated game-round data from providers such as Pragmatic Play, Evolution Gaming, Spribe, Pocket Games Soft, and Microgaming for settlement and dispute purposes

haya77 uses collected personal data for the following specific and lawful purposes:

• Account management: Creating, maintaining, and securing your haya77 account; verifying your identity and age (21+ requirement); and processing account closure requests
• Transaction processing: Receiving IDR deposits via Indonesian bank transfer and e-wallet channels; processing withdrawal requests to your verified bank account or e-wallet
• Regulatory compliance: Conducting KYC and AML checks as required under the international gaming license under which haya77 operates; retaining transaction records for audit purposes
• Responsible gaming: Monitoring wagering patterns to identify signs of problem gambling; applying player-requested deposit limits, loss limits, session reminders, and self-exclusion tools; complying with any mandatory intervention protocols
• Customer support: Responding to your queries via live chat, email, or other support channels; resolving payment disputes; and investigating complaints
• Fraud and security: Detecting and preventing unauthorized account access, bonus abuse, multi-accounting, money laundering, match-fixing, and other prohibited activities
• Marketing communications: Sending promotional offers, reload bonuses, seasonal promotions (e.g., Idul Fitri, Ramadhan, Indonesian Independence Day specials), and platform news — but only where you have consented to receive such communications and have not subsequently opted out
• Platform improvement: Analyzing aggregated usage data to improve game selection, site navigation, payment flows, and the overall player experience
• Legal proceedings: Establishing, exercising, or defending legal claims in the event of a dispute between you and haya77

haya77 processes your personal data on the following legal grounds:

Where processing is based on consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. To withdraw consent, contact [email protected].

haya77 does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We may share your data with the following categories of recipients only where strictly necessary:

6.1 Payment Partners

Transaction data — including your account name, payment reference, and IDR amount — is shared with the relevant Indonesian bank (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata) or e-wallet provider (OVO, DANA, GoPay, ShopeePay, LinkAja) solely to execute your deposit or withdrawal request. These parties process your data in their own right as independent data controllers subject to their own privacy policies.

6.2 KYC and AML Providers

Identity documents and verification data are shared with accredited third-party KYC providers for the purpose of confirming your age, identity, and residence. These providers are contractually required to handle your data securely and to use it only for verification purposes.

6.3 Game Providers

Your username and game-round data may be shared with third-party game studios — including Pragmatic Play, Evolution Gaming, Spribe, Pocket Games Soft, NetEnt, and Microgaming — to the extent necessary for game settlement, RTP certification, and dispute resolution. No additional personal data is shared beyond what is required for these technical purposes.

6.4 Regulatory and Law Enforcement Authorities

haya77 may disclose personal data to competent regulatory, law enforcement, or judicial authorities where required by law, court order, or formal regulatory request. We will notify you of such disclosures where we are legally permitted to do so.

6.5 Professional Advisors

We may share personal data with our legal counsel, accountants, or auditors where necessary to obtain professional advice or to establish, exercise, or defend legal claims. Such parties are bound by professional confidentiality obligations.

haya77 uses cookies and similar technologies to deliver, secure, and improve the Platform. A cookie is a small text file placed on your device by your browser when you visit a website. The following categories of cookies are used:

You may manage or disable non-essential cookies through your browser settings. Please note that disabling functional or analytical cookies may degrade certain features of the Platform. Instructions for managing cookies in common browsers are available from each browser's official support documentation.

haya77 retains personal data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable law or our international gaming license obligations. The following retention periods apply:

• Account and identity data: Retained for a minimum of five (5) years from the date of account closure. This period is required by AML regulations and gaming license conditions.
• Transaction and financial records: Retained for a minimum of five (5) years from the date of each transaction, consistent with financial record-keeping requirements.
• KYC documents: Retained for a minimum of five (5) years from the date of submission or from account closure, whichever is later.
• Support communications: Retained for three (3) years from the date of resolution of the relevant query or complaint.
• Marketing consent records: Retained for as long as your account is active, plus three (3) years thereafter, to demonstrate compliance with consent requirements.
• Technical and usage data: Aggregated or anonymized and retained indefinitely for analytical purposes; individually identifiable records retained for up to twenty-four (24) months from collection.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized. If you request earlier deletion of your data, haya77 will assess whether legal or regulatory obligations require continued retention and will inform you of the outcome within thirty (30) days of your request.

Subject to applicable law and any overriding regulatory obligations, you have the following rights in relation to the personal data haya77 holds about you. To exercise any of these rights, please submit a written request to [email protected], clearly stating your registered username and the nature of your request. haya77 will respond within thirty (30) days.

haya77 operates exclusively as an adults-only platform. Registration and use of the Platform is strictly prohibited for any person under the age of 21. This policy is consistent with haya77's commitment to responsible gaming and reflects the standard applied to premium international online gaming brands operating in the Indonesian market.

haya77 does not knowingly collect personal data from anyone under 21 years of age. If we discover — through KYC verification, behavioral signals, or any other means — that a registered player is below the minimum age, we will immediately:

• Suspend the account pending investigation
• Initiate a full KYC review
• Refund any deposits made, less any amounts wagered prior to detection
• Permanently close the account and delete associated personal data except where retention is required by law

haya77 employs a layered security architecture to protect your personal data against unauthorized access, loss, alteration, or disclosure. Key security measures include:

• Encryption in transit: All data exchanged between your browser or app and our servers is encrypted using 256-bit SSL/TLS protocols. HTTPS is enforced site-wide with HSTS headers applied.
• Encryption at rest: Sensitive stored data — including financial records, KYC documents, and password hashes — is encrypted at rest using AES-256 or equivalent standards.
• Access controls: Internal access to personal data is restricted on a strict need-to-know basis. All staff with data access are subject to background screening and regular data-protection training.
• Two-factor authentication (2FA): Players are strongly encouraged to enable 2FA on their haya77 account via the account security settings panel. 2FA is mandatory for all internal administrative access to player data systems.
• Penetration testing: haya77 engages independent security specialists to conduct regular penetration testing and vulnerability assessments of the Platform infrastructure.
• Incident response: haya77 maintains a documented data breach response procedure. In the event of a security incident affecting your personal data, you will be notified within seventy-two (72) hours of our becoming aware of the breach, where such notification is required.

Despite these measures, no internet-based platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your account password and for logging out of the Platform when using shared or public devices.

The haya77 Platform does not include outbound links to third-party websites for general browsing purposes. Where third-party game providers (such as Pragmatic Play, Evolution Gaming, or Spribe) deliver content within the Platform interface, those providers operate under their own privacy frameworks in relation to data processed on their own infrastructure. haya77 is not responsible for the data practices of third-party game studios in relation to data they independently collect.

If you access any external resource referenced in a haya77 communication (such as a game provider's terms page), please review the applicable third-party privacy policy before providing any personal data to that resource.

haya77 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or the services we offer. Material changes will be communicated to registered players via email notification or a prominent on-Platform notice at least seven (7) days before the revised Policy takes effect.

The "Last Updated" date at the top of this page will be revised with each new version. We recommend that you review this Policy periodically. Your continued use of the Platform after a revised Policy has come into effect constitutes your acceptance of the updated terms.

If any update to this Policy requires a new form of consent from you — for example, a new category of processing not covered by your original registration consent — we will request that consent separately before proceeding with the new processing activity.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way haya77 handles your personal data, please contact our Data Protection team through the following channel:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24 hours a day, 7 days a week via the haya77 Platform, including during Ramadhan, Idul Fitri, and Indonesian national public holidays
• Response time: Privacy-related requests are acknowledged within twenty-four (24) hours and fully resolved within thirty (30) days. Complex or high-volume subject access requests may take up to an additional thirty (30) days, of which you will be notified.

Native Indonesian-speaking support agents are available on every shift to assist with privacy queries in your preferred language. All formal data subject requests should be submitted in writing via email to [email protected], referencing your registered username and clearly stating the nature of your request.