smg77 Privacy Policy

In this Privacy Policy, the following terms carry the meanings set out below:

• "smg77" / "we" / "us" / "our" — refers to smg77.app and its internationally licensed operating entity, responsible for the collection and processing of personal data on this Platform.
• "Platform" — the smg77 website accessible at smg77.app, including all sub-pages, casino products, sportsbook features, account management tools, and associated mobile interfaces.
• "Player" / "you" / "your" — any individual who accesses, registers on, or interacts with the smg77 Platform.
• "Personal Data" — any information that identifies or can reasonably identify a living individual, whether alone or in combination with other data. This includes names, email addresses, bank account details, device identifiers, and IP addresses.
• "Processing" — any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, erasure, and destruction.
• "Data Controller" — the entity that determines the purposes and means of processing Personal Data. smg77 acts as Data Controller for all personal data collected through this Platform.
• "Data Processor" — a third party that processes Personal Data on behalf of smg77 under a binding data processing agreement.
• "KYC" — Know Your Customer; the identity and age verification procedures required by smg77's international licensing and anti-money-laundering (AML) compliance framework.
• "Cookies" — small text files placed on your device by a website to store information about your session, preferences, and behaviour. See Section 8 for full details.

This Privacy Policy applies to all Personal Data collected by smg77 through the Platform, including data collected during account registration, identity verification, deposits and withdrawals, gameplay, customer support interactions, and promotional activities.

smg77 is the Data Controller for the personal data described in this Policy. Where smg77 engages third-party service providers to process data on its behalf — such as payment processors, game studios, or cloud infrastructure providers — those parties act as Data Processors and are bound by written data processing agreements that prohibit unauthorised use or disclosure of your data.

This Policy is incorporated by reference into smg77's Terms & Conditions. By creating an Account or using the Platform, you acknowledge that you have read and understood this Policy.

smg77 collects Personal Data across several categories depending on how you interact with the Platform. The table below summarises the main data categories and examples of specific data points within each:

smg77 does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health records, or biometric data, except where a government-issued identity document supplied for KYC purposes incidentally contains such information, in which case it is processed solely for identity verification and stored in encrypted form.

smg77 collects Personal Data through the following channels:

• Direct submission: Data you provide when registering an Account, completing KYC, making a deposit or withdrawal, contacting support, or participating in a promotion.
• Automated technical collection: Data collected automatically when you access the Platform, including IP address, device identifiers, browser fingerprint, and session behaviour, via server logs, cookies, and similar tracking technologies.
• Payment processors: Transaction confirmation data and payment method verification data received from our partner payment processors (banks and e-wallet providers) when you initiate a financial transaction.
• KYC verification partners: Identity verification outcomes and fraud-risk scores from third-party KYC service providers used to authenticate identity documents.
• Game providers: Aggregated gameplay and session data from certified game studios (e.g., Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, Pocket Games Soft) that power smg77's casino products.
• Marketing analytics: Referral source data (e.g., which campaign or partner directed you to smg77) collected via UTM parameters and affiliate tracking pixels, where applicable and consented to.

smg77 processes your Personal Data only where a lawful basis exists. The legal bases we rely on are as follows:

• Contractual necessity: Processing required to provide the services you have requested under the Terms & Conditions — including Account operation, payment processing, game delivery, and customer support.
• Legal obligation: Processing necessary to comply with KYC, AML, and other regulatory requirements imposed on smg77 by its international gaming licence and applicable financial laws.
• Legitimate interests: Processing carried out for purposes that serve smg77's legitimate business interests and do not override your fundamental rights — including fraud prevention, security monitoring, platform improvement, and responsible gaming programme delivery.
• Consent: Processing for optional purposes where you have given clear, freely given, specific, and informed consent — principally for marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

smg77 uses your Personal Data for the following purposes:

• Account management: Creating, maintaining, and securing your Player Account; authenticating your identity at login; enabling you to deposit, wager, and withdraw funds.
• KYC & AML compliance: Verifying your identity and age (21+ requirement); screening against sanctions and politically exposed persons (PEP) lists; monitoring transaction patterns for suspicious activity as required by our licensing obligations.
• Payment processing: Executing deposit and withdrawal transactions in IDR via your nominated bank (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, etc.) or e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja); maintaining accurate financial records.
• Game delivery: Transmitting necessary session data to licensed game studios to enable real-time gameplay; recording game outcomes for audit and dispute resolution purposes.
• Customer support: Responding to your queries, complaints, and disputes; maintaining records of support interactions to improve service quality and for regulatory audit trail purposes.
• Responsible gaming: Monitoring your gaming behaviour to identify patterns that may indicate problem gambling; administering self-exclusion, deposit limits, and other responsible gaming tools you have activated.
• Security & fraud prevention: Detecting and preventing unauthorised account access, bonus abuse, collusion, and financial fraud; protecting the integrity of the Platform and its Players.
• Platform improvement: Analysing aggregated, anonymised usage data to identify technical issues, improve user experience, and optimise platform performance.
• Marketing communications: Sending promotional emails, SMS, or in-platform notifications about bonuses, new games, and special events — only where you have consented or where a legitimate interest applies, and always with a clear opt-out mechanism.
• Legal & regulatory compliance: Retaining records as required by our international gaming licence; responding to lawful requests from regulatory authorities or law enforcement agencies.

smg77 shares your Personal Data only in the circumstances described below. We do not sell your data to third parties under any circumstances.

• Payment service providers: Banks and e-wallet operators (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, BSI, OVO, DANA, GoPay, ShopeePay, LinkAja) receive the minimum data necessary to process your deposit or withdrawal transaction.
• KYC & identity verification partners: Specialist third-party KYC providers receive your identity document images and personal details solely for the purpose of verifying your identity and age as required by our licensing obligations.
• Game studio providers: Licensed game studios (Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, Pocket Games Soft) receive session tokens and anonymised Player identifiers necessary to deliver real-time gameplay. These providers do not receive your full identity or financial data.
• Cloud infrastructure & IT service providers: smg77's hosting, database, and security service providers process data on our behalf under strict data processing agreements in their capacity as Data Processors.
• Regulatory & licensing authorities: smg77 may be required to disclose Player data to its international licensing regulator, or to law enforcement agencies in response to a lawful court order, subpoena, or equivalent legal process. We will notify you of such disclosures to the extent permitted by law.
• Professional advisers: Legal counsel, auditors, and compliance consultants who are bound by confidentiality obligations may access limited Personal Data in the course of providing professional services to smg77.

All third parties with whom smg77 shares Personal Data are contractually required to process that data only for the specified purpose, to maintain appropriate security standards, and to comply with applicable data protection laws. smg77 does not transfer Personal Data to countries that do not provide an adequate level of data protection without implementing appropriate safeguards such as standard contractual clauses.

smg77 uses cookies and similar tracking technologies to operate the Platform effectively, maintain session continuity, and analyse usage patterns. Below is a summary of the cookie categories in use:

You may manage or disable non-essential cookies at any time through your browser's cookie settings. Note that disabling strictly necessary cookies will prevent you from logging in or using core Platform features. smg77 does not use cookies to collect sensitive personal data such as health information, financial account credentials, or government ID numbers.

smg77 retains Personal Data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention guidelines apply:

• Active Account data: Retained for the duration of your Account's active status plus a minimum of five (5) years following account closure, to satisfy AML and licensing regulatory requirements.
• KYC documentation: Identity documents are retained for a minimum of five (5) years from the date of submission or from account closure, whichever is later, in accordance with international AML standards.
• Financial transaction records: Deposit, withdrawal, and wager records are retained for a minimum of seven (7) years following each transaction for financial audit and regulatory compliance purposes.
• Customer support records: Live chat transcripts and email correspondence are retained for three (3) years from the date of the interaction unless a longer retention period is required for an ongoing dispute or regulatory inquiry.
• Marketing preferences and consent records: Retained for the duration of your Account plus three (3) years from account closure, to demonstrate compliance with consent obligations.
• Technical and analytical data: Anonymised usage data is retained for up to twenty-four (24) months. Non-anonymised technical data (IP logs, session records) is retained for twelve (12) months unless required for an ongoing security investigation.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised using industry-standard data sanitisation procedures so that it can no longer be attributed to any individual.

smg77 implements a layered security architecture to protect your Personal Data against unauthorised access, alteration, disclosure, or destruction. Key security measures include:

• Transport security: All data in transit between your browser or device and smg77's servers is protected by TLS 1.2 or higher with 256-bit AES encryption, indicated by the HTTPS padlock in your browser.
• Data at rest encryption: Personal data stored in smg77's databases — including identity documents, financial records, and authentication credentials — is encrypted using AES-256 encryption.
• Password security: Player passwords are never stored in plain text. They are hashed using a cryptographically strong algorithm (bcrypt with a high work factor) so that even smg77 staff cannot view your password.
• Access controls: Access to production systems and Player data is restricted to authorised personnel on a strictly need-to-know basis, enforced via role-based access controls and multi-factor authentication (MFA) for all administrative accounts.
• Penetration testing: smg77's infrastructure undergoes regular independent security assessments and penetration tests to identify and remediate vulnerabilities before they can be exploited.
• Incident response: smg77 maintains a documented data breach response plan. In the event of a breach that is likely to result in a risk to Players' rights or freedoms, smg77 will notify affected Players and relevant regulatory authorities within the timeframes required by applicable law.

You have the following rights with respect to your Personal Data held by smg77. To exercise any of these rights, contact us at [email protected] with the subject line "Data Rights Request" and your registered username. We will respond within thirty (30) days of receiving a valid request.

smg77 is strictly an adults-only platform. The minimum age requirement to register and use the Platform is 21 years. smg77 does not knowingly collect Personal Data from individuals under the age of 21. If you are a parent or guardian and believe that a minor has provided Personal Data to smg77 or has registered an Account, please contact us immediately at [email protected]. Upon confirmation, we will promptly close the Account, delete all associated Personal Data, and refund any real-money balance to the payment method used for deposits where this is verifiably traceable.

The smg77 Platform may reference or integrate third-party services — principally licensed game studios and payment processors — in the course of delivering its products. smg77 does not control the privacy practices of third-party websites or services and is not responsible for their privacy policies or data handling. This Privacy Policy applies solely to data collected directly by smg77 through the Platform.

If you access any third-party service from within the smg77 interface (for example, a game's own help page), we encourage you to review that third party's privacy policy. smg77 cannot be held responsible for any data collection or processing carried out by third parties outside of smg77's direct control.

smg77 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or Platform features. The most current version of this Policy is always available at /privacy-policy. The "Last Updated" date at the top of this page indicates when the most recent revision was published.

For material changes that significantly affect how your Personal Data is processed, smg77 will provide advance notice via email to the address registered on your Account no fewer than fourteen (14) days before the changes take effect, where practicable. Your continued use of the Platform after the effective date of a revised Policy constitutes your acceptance of the updated terms. If you do not agree with the revised Policy, you must stop using the Platform and may request Account closure by contacting support.

This Privacy Policy is governed by the laws of the jurisdiction in which smg77's operating entity is incorporated, as disclosed in smg77's current licensing documentation. To the extent that any provision of this Policy conflicts with mandatory data protection laws applicable in the jurisdiction where you reside, those mandatory provisions shall take precedence to the extent of the conflict.

Any dispute arising out of or in connection with this Privacy Policy that cannot be resolved through smg77's internal complaints procedure shall be subject to the dispute resolution process set out in smg77's Terms & Conditions.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data by smg77, please contact us through the following channels:

• Email: [email protected] — please include "Privacy" or "Data Rights Request" in the subject line, along with your registered username and a clear description of your query. We aim to respond within thirty (30) days of receiving your request.
• Live Chat: Available 24 hours a day, seven days a week via the chat interface on the Platform. Indonesian-speaking agents are available during peak hours (07:00–23:00 WIB, UTC+7).

When submitting a data rights request, please provide sufficient information to allow us to verify your identity before processing the request. This protects you against unauthorised third parties accessing or deleting your data. Verification may require you to confirm details on your registered Account or, in some cases, to complete a supplementary KYC step.