Privacy Policy

Definitions

For the purposes of this Privacy Policy, the following terms have the meanings set out below:

• "spu777" / "we" / "us" / "our" — the spu777 platform operator, accessible at https://spu777.cam.
• "You" / "Member" / "Data Subject" — any individual whose personal data is processed by spu777, including registered members, prospective members, and visitors to the platform.
• "Personal Data" — any information that identifies or could reasonably be used to identify you as a natural person, including your name, email address, Indonesian KTP number, date of birth, IP address, device identifiers, and financial account details.
• "Processing" — any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" — the entity that determines the purposes and means of processing personal data. For spu777 members, the data controller is the internationally licensed entity operating the spu777 platform.
• "Third-Party Service Provider" — a company or individual engaged by spu777 to deliver a specific service function (e.g., payment processing, identity verification, customer support software) under a contract that restricts the provider's use of personal data to that specific function.
• "KYC" (Know Your Customer) — the identity and address verification process mandated by spu777's compliance framework.
• "IDR" / "Rp" — Indonesian Rupiah, the currency in which all spu777 transactions are denominated.

Data Controller

spu777 acts as the data controller for all personal data collected from members and users of the platform. As data controller, spu777 is responsible for determining the purposes for which personal data is processed and ensuring that processing is carried out in a lawful, fair, and transparent manner.

spu777 operates under an international gaming license and is headquartered outside Indonesian territory. Indonesian members access the platform on a cross-border basis. spu777 applies data protection standards consistent with internationally recognised frameworks including the principles of the European General Data Protection Regulation (GDPR), which represents the global benchmark for data subject rights, even where GDPR does not apply as a matter of strict legal obligation.

For data protection enquiries, members may contact the spu777 Data Protection point of contact at: [email protected] with the subject line "Data Protection Request".

Data We Collect

spu777 collects personal data through several channels. The categories of data collected and their typical sources are summarised below:

spu777 does not collect sensitive special-category data (e.g., health data, racial or ethnic origin, biometric data) except where a member voluntarily discloses health-related information in the context of a responsible gaming self-exclusion or welfare request, in which case such data is processed solely for the purpose of providing appropriate support.

Purposes of Processing & Legal Basis

spu777 processes your personal data only for defined, documented purposes. Each processing activity is supported by at least one recognised legal basis:

• Account creation and management: Processing your identity and contact data to create and maintain your spu777 account. Legal basis: performance of a contract (the membership agreement between you and spu777).
• Financial transaction processing: Processing your bank account and e-wallet details to execute deposits and withdrawals in Indonesian Rupiah (Rp). Legal basis: performance of a contract; compliance with legal obligations (anti-money-laundering requirements).
• Identity verification (KYC): Verifying your identity and age (21+) using government-issued Indonesian ID documents and proof of address. Legal basis: compliance with legal obligations imposed by spu777's international gaming license.
• Fraud prevention and security: Monitoring account activity, device fingerprinting, and IP analysis to detect and prevent fraud, money laundering, and account takeover. Legal basis: legitimate interests of spu777 and its members in maintaining a secure platform.
• Responsible gaming compliance: Monitoring gaming behaviour patterns to identify signs of problem gambling, and administering self-exclusion, deposit limit, and cool-off requests. Legal basis: compliance with legal obligations; legitimate interests in player welfare.
• Customer support: Using your contact and communications data to respond to support queries, process complaints, and provide account assistance. Legal basis: performance of a contract.
• Marketing communications: Sending promotional emails and notifications about spu777 offers, seasonal campaigns (e.g., Idul Fitri, Ramadhan, Indonesian Independence Day promotions), and VIP program updates — only where you have provided explicit consent. Legal basis: consent (freely given, specific, and withdrawable at any time).
• Platform analytics and improvement: Using aggregated, anonymised technical data to understand usage patterns and improve platform performance. Legal basis: legitimate interests in operating an efficient and user-friendly platform.

Data Sharing

spu777 may share your personal data with the following categories of recipients:

• Payment processors and banking partners: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the minimum financial data necessary to execute your deposit or withdrawal instructions.
• KYC and identity verification providers: spu777 uses a third-party identity verification service to process KYC document uploads. This provider operates under a data processing agreement that restricts use of your documents to identity verification only.
• Customer support software providers: Live chat and ticketing platform providers process your support communications data solely to enable the delivery of customer support. These providers do not use your data for their own commercial purposes.
• IT infrastructure and cloud hosting providers: spu777's platform data is hosted on secure cloud infrastructure. Hosting providers are contractually prohibited from accessing member data except as required to perform maintenance and ensure platform availability.
• Regulatory and law enforcement authorities: Where required by a valid legal order, court instruction, or regulatory directive, spu777 may be obligated to disclose member data to competent authorities. spu777 will notify affected members of such disclosure requests where legally permitted to do so.
• Corporate successors: In the event of a merger, acquisition, or transfer of spu777's business operations, member personal data may be transferred to the acquiring entity, subject to the same privacy protections described in this policy. Members will be notified of any such transfer.

International Data Transfers

As an internationally operated platform serving Indonesian members, spu777 may transfer personal data to servers and service providers located outside Indonesia. Such transfers are necessary to operate the platform and deliver its services.

Where personal data is transferred to jurisdictions that do not have data protection laws equivalent to internationally recognised standards, spu777 ensures that appropriate safeguards are in place. These safeguards include:

• Standard contractual clauses (SCCs) or equivalent data transfer mechanisms incorporated into agreements with service providers located in lower-protection jurisdictions.
• Binding corporate rules where transfers occur between entities within the same corporate group.
• Technical and organisational measures (encryption at transit and at rest, access controls, audit logging) that apply regardless of the transfer destination.

Data Retention

spu777 does not hold personal data for longer than is necessary for the purpose for which it was collected. The following indicative retention periods apply:

At the end of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with any individual.

Security Measures

spu777 implements a layered security framework to protect personal data against unauthorised access, alteration, disclosure, or destruction. Key measures include:

• Encryption in transit: All data exchanged between your browser or app and spu777's servers is encrypted using TLS 1.3 with 256-bit AES. HTTPS is enforced across all pages of the platform.
• Encryption at rest: Personal data and financial records stored in spu777's databases are encrypted at rest using AES-256.
• Access controls: Access to member personal data within spu777's internal systems is role-based and limited to staff whose job functions require it. All internal access is logged and audited.
• Two-factor authentication (2FA): Available to all members for account login. spu777 strongly recommends enabling 2FA to protect against unauthorised account access.
• Penetration testing: spu777 commissions periodic third-party penetration tests of its platform infrastructure to identify and remediate vulnerabilities.
• Data breach response: spu777 maintains a documented data breach response procedure. In the event of a breach likely to affect member rights, affected members will be notified without undue delay.

While spu777 takes all reasonable precautions, no online platform can guarantee absolute security. Members are encouraged to use strong, unique passwords, enable 2FA, and report any suspected unauthorised account activity to [email protected] immediately.

Cookies & Tracking Technologies

spu777 uses cookies and similar tracking technologies to operate the platform effectively and improve the member experience. The following categories of cookies are used:

• Strictly necessary cookies: Required for the platform to function. These include session cookies that keep you logged in, CSRF protection tokens, and load-balancing cookies. These cannot be disabled without breaking the platform.
• Functional cookies: Remember your preferences, such as language settings, currency display, and notification preferences. These improve usability but are not essential to platform operation.
• Analytics cookies: Collect anonymised data about how members navigate the platform — which pages are visited most frequently, where members drop off during account flows, and session duration. This data helps spu777 improve platform design and performance. Analytics data is aggregated and does not identify individual members.
• Security cookies: Used to detect fraudulent activity, bot traffic, and suspicious login patterns. These are an integral component of spu777's fraud prevention framework.

spu777 does not use third-party advertising or retargeting cookies that track your activity across other websites. The use of cookies by spu777 is limited to the categories described above and is confined to the spu777 domain.

Most browsers allow you to control or delete cookies through browser settings. Disabling strictly necessary cookies will impair your ability to use the spu777 platform. For guidance on managing cookies in your browser, refer to your browser's help documentation.

Your Data Subject Rights

spu777 recognises and respects the following data subject rights. To exercise any of these rights, submit a written request to [email protected] with the subject line "Data Subject Request" from the email address registered to your spu777 account. Requests are processed within 30 calendar days.

Minors

If spu777 discovers or is notified that an account has been registered by a person under 21 years of age, the account will be immediately suspended, all associated transactions reviewed, and any winnings voided. Any funds that represent real-money deposits by the underage individual will be returned to the originating payment method following completion of a compliance review.

If you are a parent or guardian and believe that your child may have registered on spu777, please contact us immediately at [email protected]. We will investigate and act promptly.

Marketing Communications

spu777 sends marketing communications — including promotional bonus offers, VIP program updates, and seasonal campaign notifications tied to Indonesian calendar events such as Idul Fitri, Ramadhan, and Nyepi — only to members who have provided explicit opt-in consent at registration or subsequently through their account settings.

You may withdraw your consent to receive marketing communications at any time by:

• Clicking the "Unsubscribe" link included in every marketing email sent by spu777.
• Updating your notification preferences in the "Account Settings" section of your spu777 account.
• Contacting spu777 support at [email protected] with the request to opt out of marketing.

Withdrawal of marketing consent does not affect your ability to use any other part of the spu777 platform and does not constitute account closure. spu777 will continue to send transactional communications (deposit confirmations, withdrawal notifications, KYC requests, and security alerts) regardless of marketing consent status, as these are necessary for the operation of your account.

Third-Party Links

The spu777 platform does not contain links to third-party websites as a general practice. In the event that any informational content on spu777 references an external source, spu777 is not responsible for the privacy practices or content of any third-party website. This Privacy Policy applies solely to data processed by spu777 in connection with the spu777 platform at https://spu777.cam.

Changes to This Privacy Policy

spu777 may update this Privacy Policy from time to time to reflect changes in our data practices, operational requirements, or applicable law. Material changes will be communicated to registered members by email at least seven (7) days before taking effect. Non-material changes (such as minor clarifications of existing policy) may be updated without advance notice but will always be reflected in the "Last Updated" date at the top of this page.

The current version of this Privacy Policy is the version in effect and governs your use of spu777. If you do not agree with any material changes to this policy, you may close your account in accordance with the process described in the Terms & Conditions.

Contact & Complaints

For all privacy-related enquiries, data subject requests, or complaints regarding spu777's data handling practices, please contact us at:

If you are not satisfied with spu777's response to a data protection complaint, you have the right to escalate your complaint to the competent data protection supervisory authority in the jurisdiction where spu777 is licensed, or to seek judicial remedy in the courts of that jurisdiction.

For questions about the security of your spu777 account, please also review our FAQ or contact our 24/7 live chat support team directly from the spu777 platform.