Privacy Policy

Throughout this Privacy Policy, the following terms carry the specific meanings defined below:

• "otp77" / "We" / "Us" / "Our" refers to the otp77 Platform, its operating entity, and all personnel acting on its behalf in connection with the processing of Member personal data.
• "Platform" refers to the otp77 website at https://otp77.pro, encompassing all pages, sub-domains, features, and services operated thereunder.
• "Member" / "You" / "Your" refers to any individual who has registered an account on the Platform or who otherwise interacts with the Platform in a way that results in the collection of their personal data.
• "Personal Data" refers to any information that identifies or could reasonably be used to identify a natural person — directly or in combination with other data — including name, date of birth, email address, device identifiers, and financial account details.
• "Processing" refers to any operation performed on Personal Data, including collection, storage, retrieval, consultation, use, disclosure, and deletion.
• "KYC" (Know Your Customer) refers to the identity and document verification process that otp77 may require a Member to complete, including submission of government-issued photo identification such as a KTP (Indonesian National Identity Card).
• "Cookies" refers to small text files placed on a Member's device by the Platform to facilitate session management, analytics, and personalization.
• "Third-Party Processor" refers to any external service provider engaged by otp77 to process Personal Data on otp77's behalf under a contractual data-processing agreement.

otp77 collects only the Personal Data that is strictly necessary to deliver a secure, compliant, and high-quality betting experience. The categories of data we collect are detailed in the table below:

otp77 collects Personal Data through the following mechanisms:

• Direct Submission: Data you actively provide when completing the registration form, submitting KYC documentation, initiating a deposit or withdrawal, contacting customer support, or participating in a promotion.
• Automated Technical Collection: Data collected automatically when you visit the Platform, including IP address, device identifiers, browser fingerprint, and session activity, gathered via server logs and first-party analytics scripts.
• Cookies and Similar Technologies: Session cookies, persistent cookies, and local storage tokens placed on your device to maintain your login session, remember preferences, and generate aggregate usage statistics. See Section 9 for full details.
• Payment Processors: Transaction confirmation data returned to otp77 by our certified Indonesian payment gateway partners following a successful deposit or withdrawal — limited to transaction reference numbers, amounts, and timestamps. Full bank account credentials are never transmitted to or stored by otp77 directly.
• KYC and Identity Verification Partners: Where otp77 uses a third-party KYC service to verify your identity documents, that service may return a verification result and risk score. The underlying document images are processed by the KYC provider under their own data-handling terms and are not permanently retained by otp77.
• Fraud Prevention and Security Systems: Automated signals from our fraud-detection and device-fingerprinting systems, used to identify anomalous account activity, multi-account patterns, and unauthorized access attempts.

otp77 processes your Personal Data for the following clearly defined purposes only. We do not use your data for any purpose that is incompatible with those listed here without seeking fresh consent.

• Account Creation and Management: To register your account, authenticate your identity at login, maintain your account settings and balance, and provide you with access to all Platform features.
• Transaction Processing: To process deposits and withdrawals in Indonesian Rupiah (IDR) through your chosen payment method — whether a local bank such as BCA, BRI, BNI, or Mandiri, or an Indonesian e-wallet such as OVO, DANA, or GoPay — and to maintain an accurate and auditable transaction history.
• KYC and Regulatory Compliance: To verify your identity and age (otp77 enforces a strict 21+ policy), satisfy our anti-money-laundering obligations, and respond to requests from law enforcement or regulatory bodies where legally required.
• Platform Operation and Improvement: To monitor Platform performance, identify and fix technical issues, analyze usage patterns in aggregate, and develop new features and product enhancements that better serve Indonesian players.
• Responsible Gaming: To monitor betting behavior for indicators of problematic gambling, enforce self-exclusion requests and deposit limits, and deliver proactive responsible gaming notifications to Members who may benefit from them.
• Fraud Prevention and Security: To detect and prevent unauthorized access, multi-accounting, bonus abuse, and financial fraud — protecting both individual Members and the integrity of the Platform.
• Customer Support: To understand the context of your enquiry, resolve disputes, process complaints, and maintain a record of our communications for quality assurance and training purposes.
• Marketing and Promotions: To send you personalized promotional offers, bonus notifications, and event-based communications (such as seasonal promotions around Idul Fitri, Ramadhan, or Indonesian Independence Day) — subject to your communication preferences and applicable opt-out rights.

Every instance of Personal Data processing carried out by otp77 rests on at least one of the following recognized legal bases:

• Contractual Necessity: Processing that is required to perform the contract between otp77 and a Member — including account creation, transaction processing, and customer support — is carried out on the basis that it is necessary to deliver the services you have requested.
• Legal Obligation: Processing required to comply with applicable legal obligations, including KYC verification, anti-money-laundering record-keeping, and responses to lawful requests from government authorities or law enforcement agencies.
• Legitimate Interests: Processing undertaken to advance otp77's legitimate business interests — such as fraud prevention, platform security, and aggregate analytics — where those interests are not overridden by the fundamental rights of Members.
• Consent: Processing for marketing communications and non-essential cookies, where otp77 has obtained your explicit, freely given, and informed consent. You may withdraw this consent at any time without affecting the lawfulness of processing based on consent prior to withdrawal.

otp77 does not sell, rent, or trade your Personal Data to third parties for their own commercial purposes. Data is shared only in the following limited circumstances:

• Payment Gateway Partners: Your financial transaction data is shared with otp77's certified Indonesian payment processing partners solely to execute the deposit or withdrawal you have initiated. These partners are contractually bound to process your data only for that specific purpose.
• KYC and Identity Verification Providers: Your identity documents and verification data may be shared with a third-party KYC provider for the purpose of completing the identity verification process. Such providers operate as data processors on otp77's behalf under binding data-processing agreements.
• Game Content Providers: Your account identifier and wagering activity may be shared with licensed game providers — including Evolution Gaming, Pragmatic Play, PG Soft (Pocket Games Soft), NetEnt, and Microgaming — to the extent required to render their games on the Platform and record game outcomes. These providers do not receive your full identity or financial data.
• Fraud Prevention and Security Services: Anonymized or pseudonymized device and behavioral signals may be shared with fraud-detection service providers to identify and prevent account compromise, collusion, and financial crime.
• Legal and Regulatory Authorities: Where otp77 is subject to a valid legal obligation, court order, or regulatory direction, we may disclose your Personal Data to the relevant authority. We will notify you of such disclosure wherever we are legally permitted to do so.
• Corporate Transactions: In the event of a merger, acquisition, or sale of all or a material part of otp77's business, your Personal Data may be transferred to the acquiring entity as part of that transaction, subject to the same privacy protections described in this Policy.

otp77 retains Personal Data only for as long as is necessary to fulfill the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention schedule applies as a general guideline:

When Personal Data reaches the end of its applicable retention period, otp77 will securely delete or anonymize it such that it can no longer be linked to an identifiable individual. Anonymized and aggregated data derived from your usage may be retained indefinitely for statistical and product-improvement purposes, as it no longer constitutes Personal Data.

otp77 implements a comprehensive, defense-in-depth approach to protecting your Personal Data. Our technical and organizational security measures include:

• TLS 1.3 Encryption in Transit: All data transmitted between your browser or device and the otp77 Platform is encrypted using Transport Layer Security (TLS) version 1.3 — the current industry standard for secure web communications. Connections using older, insecure TLS versions are rejected.
• Encryption at Rest: Personal Data stored in otp77's databases — including identity records, financial information, and communication logs — is encrypted at rest using AES-256, preventing access even in the event of physical media compromise.
• Password Hashing: Member passwords are never stored in plaintext. All passwords are processed using bcrypt with a per-user salt, making brute-force and rainbow-table attacks computationally infeasible.
• Access Controls: Access to production systems and Member data is strictly limited to authorized otp77 personnel on a need-to-know basis. All internal access is authenticated via multi-factor authentication and logged for audit purposes.
• Automated Anomaly Detection: otp77's security infrastructure includes real-time monitoring for unusual account activity, mass-login attempts, and data access patterns inconsistent with normal operations. Anomalies trigger automatic alerts and, where necessary, account-level protective measures.
• Regular Security Audits: The Platform undergoes periodic third-party penetration testing and internal security reviews to identify and remediate vulnerabilities before they can be exploited.
• Data Breach Response: In the event of a confirmed Personal Data breach that poses a material risk to Members, otp77 will notify affected Members as promptly as is reasonably practicable, providing details of the nature of the breach, the data affected, and the steps taken to contain it.

The otp77 Platform uses cookies and similar client-side technologies to support essential Platform functionality and to gather aggregate usage analytics. The following cookie categories are in use:

You may manage your non-essential cookie preferences through your Account settings panel at any time. Please note that disabling strictly necessary cookies or fraud-prevention tokens will impair the Platform's ability to maintain your login session and may affect the availability of certain features. otp77 does not use third-party advertising cookies or cross-site tracking pixels to serve behavioral advertisements on external websites.

otp77 recognizes and respects the following rights in relation to your Personal Data. To exercise any of these rights, contact our support team via the 24/7 live chat service or by email at the address provided in Section 14.

• Right of Access: You have the right to request confirmation of whether otp77 holds Personal Data about you, and if so, to receive a copy of that data and the information described in this Privacy Policy in relation to it.
• Right to Rectification: You have the right to request the correction of any Personal Data we hold about you that is inaccurate or incomplete. For changes to core identity data, KYC re-verification may be required.
• Right to Erasure: You may request the deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (and no other legal basis applies), or where processing is unlawful. This right is subject to any overriding legal retention obligations — for example, financial transaction records required for anti-money-laundering compliance cannot be deleted on request.
• Right to Restriction: You may request that otp77 restrict the processing of your Personal Data in certain circumstances — for example, while a dispute about data accuracy is being resolved — meaning we may continue to store the data but not actively process it.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity, you may request a copy of your Personal Data in a structured, commonly used, machine-readable format (such as JSON or CSV).
• Right to Object: You may object at any time to processing based on legitimate interests — including profiling for fraud prevention — or to the use of your data for direct marketing purposes. We will cease that processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

otp77 will respond to all valid data rights requests within 30 days of receipt. Where a request is complex or voluminous, we may extend this period by a further 60 days, in which case we will notify you of the extension and the reason for it within the initial 30-day window. otp77 will not charge a fee for handling data rights requests unless they are manifestly unfounded or excessive.

The otp77 Platform is strictly intended for adults aged 21 and over. otp77 does not knowingly collect Personal Data from individuals under the age of 21. The Platform's registration process includes an age declaration step, and otp77 reserves the right to request documentary proof of age — such as a KTP, SIM (Indonesian driver's license), or passport — at any stage of a Member's lifecycle.

If otp77 discovers or has reasonable grounds to believe that a registered Member is under the age of 21, it will immediately suspend the Account, initiate a full investigation, void all associated Wagers, and permanently delete the Personal Data of the underage individual except where retention is required by law. Any balance held in the Account will be managed in accordance with otp77's Terms & Conditions and applicable legal requirements.

The otp77 Platform integrates with a number of third-party services to deliver its full feature set. Each third-party integration involves a limited and purpose-bound transfer of data as described below:

• Game Studios (Evolution Gaming, Pragmatic Play, PG Soft, NetEnt, Microgaming, Spribe): These providers power the live casino, slots, and togel (Indonesia's traditional numbers lottery) experiences on the Platform. They receive your account session token and game-specific data. Their game software operates under licenses obtained by otp77; their data handling is governed by agreements that restrict use to game-delivery purposes only.
• Payment Gateways (Indonesian Bank Partners and E-Wallet Providers): Your transaction instructions — including the amount in IDR and your registered bank account or e-wallet identifier — are transmitted to the relevant payment gateway to execute the transfer. otp77 does not store your full bank credentials on its own servers.
• Identity Verification Provider: Where a third-party KYC service is used, your submitted identity documents are processed by that provider under their own certified data-protection framework. otp77 receives only the verification outcome (pass/fail) and a risk score.
• Hosting and Infrastructure: otp77's Platform is hosted on enterprise-grade infrastructure with physical and network security controls. Infrastructure providers process Technical Data on otp77's behalf and are bound by data-processing agreements that prohibit independent use of that data.

otp77 is not responsible for the independent privacy practices of third-party services that operate outside the scope of their data-processing agreements with otp77. Members are encouraged to review the privacy policies of any third-party service they interact with independently — for example, when using their OVO, DANA, or GoPay application directly to initiate a transfer.

otp77 reviews this Privacy Policy periodically and may update it to reflect changes in our data-processing practices, operational requirements, or applicable legal obligations. When material changes are made — meaning changes that affect your rights or the way your data is used in a substantive way — otp77 will provide advance notice by posting a prominent update notice on the Platform's homepage and, where we hold a verified email address for you, by sending a notification to that address prior to the changes taking effect.

The effective date at the top of this Privacy Policy reflects the date of the most recent revision. Your continued use of the Platform after an updated Privacy Policy has been published constitutes your acceptance of the revised terms. If you disagree with any change to this Privacy Policy, you must discontinue use of the Platform and may request account closure by contacting our customer support team.

otp77 maintains an internal archive of previous versions of this Privacy Policy. If you wish to review a prior version, please contact support and we will provide the requested document within a reasonable timeframe.

For any questions, requests, or concerns relating to this Privacy Policy or otp77's data-processing practices, please reach our support team through the following channels:

• Live Chat: Available 24/7 directly within the Platform — average first-response time under 90 seconds, with Indonesian and English-speaking agents standing by.
• Email: contact @ otp77.pro — please allow up to 24 hours for a substantive written response to email enquiries. Include "Privacy Request" in your subject line along with your registered Member username to ensure prompt routing.
• Data Rights Requests: To exercise any of the rights described in Section 10, please state clearly in your message which right you wish to exercise and provide sufficient detail for us to identify your Account. We will respond within 30 days.
• Languages: Support for both Indonesian and English is available across all channels.
• Operating Hours: 24 hours a day, 7 days a week — including all Indonesian public holidays. Support operates on WIB (UTC+7).