Privacy Policy — two777

two777 ("we", "us", "our", "Company") is the operator of the online betting and gaming platform accessible at https://two777.cam. We are committed to protecting the privacy and security of every individual whose personal data we process. This commitment is not merely a compliance obligation — it is a fundamental part of how we earn and sustain the trust of the players who choose two777 as their platform.

This Policy describes our practices with respect to the collection, use, storage, disclosure, and deletion of personal data. It also outlines the rights available to you and the mechanisms through which you may exercise them. We encourage you to read this document in full and contact us if anything is unclear.

By registering a Player Account on the two777 Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

The following definitions apply throughout this Policy:

• "Personal Data" — any information that identifies or could reasonably identify a natural person, directly or indirectly. This includes names, email addresses, phone numbers, IP addresses, device identifiers, and financial account details.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" — two777, the entity that determines the purposes and means of processing Personal Data.
• "Data Processor" — a third party that processes Personal Data on behalf of two777 under a contractual obligation.
• "Player" — an individual who holds a registered Player Account on the Platform.
• "KYC" — Know Your Customer; the identity and document verification process required of all players before withdrawals are processed.
• "Sensitive Personal Data" — a subset of Personal Data warranting heightened protection, including government-issued ID numbers (such as the Indonesian KTP number), financial account details, and biometric data.

The following table summarises the categories of Personal Data two777 collects, along with examples and the contexts in which they are gathered:

We do not knowingly collect special categories of personal data (such as health, religious, or political information) unless you voluntarily provide such information in the context of a responsible gaming assessment or support interaction, in which case it is handled under strict confidentiality protocols.

two777 collects Personal Data through the following means:

• Direct submission: Information you provide when registering, completing KYC, making deposits or withdrawals, contacting support, or updating account settings.
• Automated technical collection: Data collected passively when you access the Platform — including IP addresses, device fingerprints, browser headers, and session activity — via server logs, analytics tools, and fraud-detection systems.
• Third-party identity verification providers: KYC partners may return enriched identity-matching data based on the documents you submit. These providers are contractually bound to handle your data in compliance with applicable data-protection standards.
• Payment processors and banking partners: When you initiate a deposit or withdrawal via BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, or LinkAja, transaction confirmation data is relayed to us by the respective payment gateway.
• Anti-fraud and AML screening tools: We may receive risk-score data or watchlist-match alerts from third-party compliance screening services as part of our mandatory anti-money-laundering programme.

Every instance of Personal Data processing at two777 is grounded in at least one of the following lawful bases:

• Contract performance: Processing necessary to register your account, accept and settle bets, process deposits and withdrawals, and provide customer support. Without this processing, we cannot deliver the Platform's core services.
• Legal obligation: Processing required to comply with our international gaming licence conditions, including KYC/AML obligations, player-protection requirements, and mandatory reporting to the licensing authority.
• Legitimate interests: Processing for fraud detection, platform security, abuse prevention, service improvement analytics, and internal reporting — where these interests are not overridden by your privacy rights.
• Consent: Processing for optional communications such as promotional emails or SMS notifications. You may withdraw consent at any time by updating your communication preferences in the account dashboard or by contacting support.

We do not use your Personal Data for automated decision-making that produces legal or similarly significant effects without human oversight. Where automated screening flags a potential issue (such as an AML risk score), a trained compliance officer reviews the case before any account action is taken.

two777 does not sell, rent, or share your Personal Data with third parties for their own commercial purposes. We share data only in the following limited and controlled circumstances:

• Service providers (Data Processors): We engage third-party vendors — including KYC verification providers, payment processors, cloud hosting providers, customer-support platform operators, and fraud-detection services — who process data solely on our behalf under binding data-processing agreements. These agreements require them to maintain confidentiality, implement appropriate security measures, and process data only as instructed by us.
• Licensing authority: Our international gaming regulator may require us to submit player transaction data, KYC documentation, or responsible-gaming records as part of regulatory oversight. We comply with such requests as a licensing obligation.
• Law enforcement and legal proceedings: We will disclose Personal Data to law enforcement agencies, courts, or regulatory bodies when required to do so by a lawful order, warrant, or subpoena, or where we believe disclosure is necessary to prevent fraud, money laundering, or harm to any person.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of the Company's assets, Personal Data may be transferred to the acquiring entity, subject to equivalent data-protection obligations.
• Self-exclusion registries: Where required by our licensing conditions, we may share a player's self-exclusion status with affiliated platforms or multi-operator exclusion registries to give effect to the player's self-exclusion request across participating sites.

As an internationally operated platform serving players primarily in Indonesia, two777 processes and stores Personal Data on servers located outside Indonesia. When Personal Data is transferred to jurisdictions that may not offer the same level of data protection as your home country, we implement the following safeguards:

• Standard contractual clauses (SCCs) or equivalent contractual obligations with all Data Processors in those jurisdictions, requiring them to handle data to a standard equivalent to applicable data-protection law.
• Restriction of data transfers to jurisdictions recognised as offering adequate protection by relevant international data-protection frameworks where feasible.
• Technical controls (encryption in transit and at rest) that protect data regardless of the jurisdiction in which it is stored.

By using the two777 Platform, you acknowledge and consent to the transfer of your Personal Data outside Indonesia for the purposes described in this Policy.

two777 retains Personal Data for as long as necessary to fulfil the purposes set out in this Policy, to comply with legal and regulatory obligations, and to resolve disputes or enforce agreements. The following general retention periods apply:

• Active Player Account data (identity, contact, financial): retained for the lifetime of the account plus a minimum of 5 years following account closure, in compliance with AML and licensing record-keeping obligations.
• KYC documents (ID scans, selfies, proof of address): retained for 5 years post-account closure or post-transaction, whichever is later.
• Transaction records (deposit/withdrawal history, bet history): retained for 5 years from the date of the transaction.
• Customer support communications: retained for 3 years from the date of the last interaction.
• Technical and usage logs (IP logs, session logs): retained for 12 months for security and fraud-investigation purposes, then deleted or anonymized.
• Marketing consent records: retained for the duration of the consent period plus 2 years as evidence of consent.

At the end of the applicable retention period, Personal Data is securely deleted or irreversibly anonymized so that it can no longer be attributed to an individual.

two777 implements a layered security architecture to protect your Personal Data against unauthorised access, loss, alteration, or disclosure. Key measures include:

• Encryption: AES-256 encryption for data at rest; TLS 1.3 (256-bit SSL) for all data in transit. HTTPS is enforced site-wide with HSTS headers.
• Access controls: Role-based access control (RBAC) limits internal staff access to Personal Data strictly on a need-to-know basis. All access is logged and audited.
• Two-factor authentication (2FA): Available and strongly recommended for all Player Accounts. All internal administrative systems require 2FA for staff access.
• Penetration testing: The Platform undergoes regular third-party penetration tests and vulnerability assessments. Critical findings are remediated within 48 hours; non-critical findings within 30 days.
• Incident response: two777 maintains a documented data-breach response plan. In the event of a breach that poses a risk to your rights and freedoms, we will notify affected players and relevant authorities within the timeframes required by applicable law.
• Staff training: All staff with access to Personal Data receive mandatory data-protection and security training upon onboarding and annually thereafter.

While we implement robust technical and organisational safeguards, no internet-based platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for promptly reporting any suspected unauthorised access to support.

two777 uses cookies and similar tracking technologies (session tokens, local storage, pixel tags) on the Platform. These technologies serve the following purposes:

• Essential / Functional cookies: Required for the Platform to operate correctly — maintaining your login session, storing language and display preferences, and enabling the bet-slip functionality. These cannot be disabled without breaking core Platform features.
• Analytics cookies: Used to understand aggregate user behaviour on the Platform — which pages are visited most, where sessions typically end, and how navigation flows perform. Data is collected in anonymized or pseudonymized form and is not linked to individual player identities without consent.
• Security cookies: Used to detect and prevent fraudulent sessions, bot traffic, and account takeover attempts. These are essential to platform integrity and player protection.

two777 does not use third-party advertising or retargeting cookies. No data collected via cookies on this Platform is shared with advertising networks.

You can manage or delete cookies via your browser settings at any time. Disabling essential cookies will impair your ability to use the Platform. Disabling analytics cookies will not affect your gameplay experience.

Subject to applicable law and our overriding legal obligations (such as AML record-keeping requirements), you have the following rights with respect to your Personal Data:

To exercise any of these rights, contact our compliance team at the address provided in Section 14. We will respond to all valid requests within 30 calendar days. In complex cases, this period may be extended by a further 30 days, with notice provided to you. Identity verification may be required before we action any request, to ensure we are responding to the correct individual.

The two777 Platform is strictly restricted to individuals aged 21 years and over. We do not knowingly collect Personal Data from persons under the age of 21. If we become aware that a Player Account has been registered by or on behalf of a minor, we will immediately suspend the account, delete all associated personal data to the extent not required for regulatory record-keeping, and take appropriate remedial action.

Parents and legal guardians are advised to implement parental-control software on shared devices to prevent minors from accessing online gambling platforms. If you believe a minor in your care has registered on two777, please contact our support team immediately so we can act without delay.

two777 reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, our business operations, or our data-processing practices. When we make material changes — changes that significantly affect how we process your Personal Data or your rights — we will:

• Post the updated Policy on this page with a revised "Last updated" date;
• Send a notification to your registered email address at least 14 days before the changes take effect; and
• Display a prominent in-platform notice when you next log in during the notice period.

Your continued use of the Platform after the effective date of a Policy update constitutes acceptance of the revised terms. If you do not agree with the changes, you should cease using the Platform and request account closure before the effective date.

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your Personal Data, please contact the two777 Data Protection team through the following channels. All contact details are provided as plain text only and are not clickable links.

• Email: [email protected] — mark the subject line "Privacy Request" for priority routing. Responses within 4 business hours for general enquiries (WIB, Monday–Friday); data rights requests are acknowledged within 3 business days and fully resolved within 30 days.
• Live Chat: Available within the account dashboard during WIB business hours (07:00–23:00 WIB). For data rights requests, live chat agents will escalate to the compliance team and provide you with a written response by email.
• Formal written correspondence: Available on request from the compliance team — contact us by email to obtain the Company's registered address for formal legal notices.

If you are not satisfied with our response to a privacy complaint, you have the right to escalate the matter to the data-protection supervisory authority in the jurisdiction under which our gaming licence is issued, or to seek independent legal advice.

This Policy was last reviewed and updated on 1 January 2026. The version published on this page at any given time is the current operative version governing all data processing by two777.