ape77 Privacy Policy

1 Introduction

ape77 ("we", "us", "our") operates the online casino and sportsbook platform accessible at ape77.one (the "Platform"). In the course of providing our services to players across Indonesia — including Jakarta, Surabaya, Bandung, Medan, Bali, and beyond — we necessarily collect and process certain personal data. We take this responsibility seriously.

This Privacy Policy sets out, in clear and accessible language, the categories of personal data we collect, the purposes for which that data is processed, the legal basis for that processing, the parties with whom data may be shared, the security measures we employ to protect it, and the rights available to you as a data subject. This Policy applies to all users of the Platform, including registered Account holders and anonymous visitors.

ape77 is the data controller in respect of personal data collected through the Platform. All enquiries relating to this Policy or to the exercise of your data rights should be directed to our support team as detailed in Section 15.

2 Definitions

The following definitions apply throughout this Privacy Policy:

• "Personal Data" means any information that identifies or could reasonably be used to identify a living individual, either directly or indirectly.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Subject" means the individual to whom Personal Data relates — in the context of this Policy, this is you, the Player.
• "Data Controller" means the entity that determines the purposes and means of Processing Personal Data — in this case, ape77.
• "Third Party" means any individual, company, or entity other than ape77 and the Data Subject.
• "KYC" means Know Your Customer — the identity and age verification process required of all registered Players prior to processing withdrawals.
• "Cookies" means small text files placed on your device by the Platform to facilitate session management, analytics, and personalization.
• "IDR" means Indonesian Rupiah, the primary currency used on the Platform.

3 Data We Collect

ape77 collects the following categories of Personal Data from Players and Platform visitors:

4 How We Collect Data

ape77 collects Personal Data through the following channels:

• Direct Interactions: Data you provide when registering an Account, completing KYC verification, submitting a deposit or withdrawal request, contacting customer support, or participating in a promotion.
• Automated Technologies: Technical and Usage Data collected automatically when you access the Platform via cookies, web beacons, server logs, and similar tracking technologies. See Section 9 for full details on our cookie practices.
• Third-Party Sources: Identity verification data received from KYC and fraud screening service providers; transaction data received from payment processors including local Indonesian banks and e-wallet operators; device fingerprinting data from fraud prevention partners.
• Publicly Available Sources: In limited circumstances, ape77 may cross-reference publicly available information to verify the accuracy of data you have provided or to conduct required anti-money-laundering (AML) screening.

5 Purpose & Legal Basis for Processing

ape77 processes your Personal Data only for defined, legitimate purposes. The primary purposes and the corresponding legal basis for each are described below:

• Account Creation and Management: Processing Identity and Contact Data is necessary to fulfill the contract between you and ape77 (i.e., to provide you with access to the Platform and its services).
• Identity Verification (KYC) and Age Confirmation: Processing Identity and Financial Data for KYC purposes is a legal obligation. ape77 is required to verify that all Players are at least 21 years of age and are who they claim to be before processing any withdrawal.
• Payment Processing: Processing Financial and Identity Data to facilitate deposits and withdrawals in IDR is necessary for the performance of the contract and to comply with anti-money-laundering legal obligations.
• Fraud Prevention and Platform Security: Processing Technical, Usage, and Financial Data for fraud detection and account security purposes constitutes a legitimate interest of ape77 and is necessary to protect both the Platform and its Players.
• Responsible Gaming Monitoring: Processing Usage and Responsible Gaming Data to identify and act on patterns of potentially harmful gambling behavior is a legal obligation and a legitimate interest, consistent with ape77's duty of care to its Players.
• Customer Support: Processing Communications Data to respond to enquiries, complaints, and disputes is necessary for the performance of the contract.
• Marketing Communications: Sending promotional emails, bonus notifications, and personalized offers is conducted on the basis of your consent. You may withdraw consent at any time by unsubscribing via the link in any marketing email or by contacting support.
• Platform Analytics and Improvement: Processing Technical and Usage Data in aggregated or anonymized form to understand how the Platform is used and to improve our services constitutes a legitimate interest of ape77.
• Legal Compliance: Processing data to comply with applicable laws, regulatory requirements, court orders, or requests from competent authorities constitutes a legal obligation.

6 Data Sharing & Disclosure

ape77 does not sell, rent, or trade your Personal Data to any third party for their own marketing purposes. Personal Data is shared only in the following specific and controlled circumstances:

• Payment Processors: Financial Data is shared with Indonesian bank partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) solely to process deposits and withdrawals on your behalf. These providers are contractually bound to process your data only for the stated purpose and to apply appropriate security measures.
• KYC and Identity Verification Providers: Identity Data and supporting documents submitted during KYC verification are shared with licensed third-party identity verification services for the sole purpose of confirming your identity and age.
• Fraud Prevention and AML Screening Services: Technical, Usage, and Financial Data may be shared with fraud prevention and anti-money-laundering screening partners to detect, investigate, and prevent fraudulent or criminal activity on the Platform.
• Game Content Providers: Limited Usage Data (e.g., game session identifiers, RTP data) is shared with third-party game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft solely for the purpose of game delivery, technical support, and regulatory compliance by those studios.
• Legal and Regulatory Authorities: ape77 may disclose Personal Data to competent legal, regulatory, tax, or law enforcement authorities where required to do so by applicable law, court order, or binding regulatory direction. ape77 will inform you of any such disclosure to the extent legally permissible.
• Corporate Transactions: In the event of a merger, acquisition, asset sale, or restructuring involving ape77, Personal Data held by ape77 may be transferred to the relevant successor entity. You will be notified of any such transfer and of any material change to how your data is processed as a result.

7 Data Retention

ape77 retains Personal Data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Active Account Data: Identity, Contact, and Financial Data associated with an active Account is retained for the duration of the account relationship and for a minimum of five (5) years following account closure, to comply with anti-money-laundering and financial record-keeping obligations.
• KYC Documentation: Identity documents submitted for KYC verification are retained for a minimum of five years following the end of the business relationship, in line with international AML standards.
• Transaction Records: All deposit, withdrawal, and betting transaction records are retained for a minimum of five years following the date of the transaction.
• Communications Data: Customer support correspondence and live chat transcripts are retained for a minimum of two years from the date of the interaction.
• Technical and Usage Data: Server logs and session data are retained for a maximum of 13 months from collection, after which they are aggregated or deleted.
• Marketing Consent Records: Records of your marketing consent (or withdrawal of consent) are retained for the full duration of your Account and for five years thereafter as evidence of compliance.

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymized. Where deletion is not immediately practicable (e.g., due to backup system constraints), data is isolated from active processing until it can be permanently erased.

8 Data Security

ape77 applies industry-standard technical and organizational security measures to protect your Personal Data against unauthorized access, accidental loss, alteration, disclosure, or destruction. Key security measures in place include:

• 256-Bit SSL/TLS Encryption: All data transmitted between your device and ape77's servers is encrypted using 256-bit TLS encryption — the same standard applied by international financial institutions and leading e-commerce platforms.
• Encrypted Data Storage: Sensitive Personal Data stored on ape77's infrastructure — including identity documents, financial records, and authentication credentials — is encrypted at rest using AES-256 encryption.
• Access Controls: Access to Personal Data within ape77's organization is restricted on a strict need-to-know basis. Staff members are granted the minimum level of access required to perform their role. All access is logged and subject to regular audit.
• Two-Factor Authentication (2FA): ape77 offers 2FA for all Player Accounts and mandates 2FA for all internal staff access to systems containing Personal Data.
• Penetration Testing and Security Audits: ape77's platform infrastructure is subject to regular independent penetration testing and security audits to identify and remediate vulnerabilities proactively.
• Data Breach Response: In the event of a personal data breach that poses a risk to your rights and freedoms, ape77 will notify affected Players without undue delay and will take immediate steps to contain and remediate the breach.

9 Cookies & Tracking Technologies

ape77 uses cookies and similar tracking technologies to operate the Platform, maintain your session, analyze usage patterns, and where applicable, deliver personalized content. The following categories of cookies are used:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function and cannot be disabled. They include session cookies that keep you logged in during a gaming session and security cookies that help prevent fraudulent activity. No consent is required for these cookies as they are required for the service to operate.
• Performance and Analytics Cookies: These cookies collect aggregated, anonymized information about how Players use the Platform — such as which pages are visited most frequently and where errors occur — to help us improve the Platform's performance and usability. These cookies are activated on the basis of your consent.
• Functionality Cookies: These cookies remember your preferences (such as your preferred language or deposit method) to provide a more personalized experience. These cookies are activated on the basis of your consent.
• Targeting and Marketing Cookies: ape77 does not deploy third-party advertising cookies on its Platform. Any marketing personalization is conducted using first-party data only, based on your Account history and preferences, and only where you have consented to receive marketing communications.

Most web browsers accept cookies by default. You can configure your browser to refuse cookies or to alert you when cookies are being sent. Please note that disabling strictly necessary cookies will impair the functionality of the Platform and may prevent you from accessing your Account. Disabling performance or functionality cookies will not prevent Platform access but may reduce the quality of your experience.

10 Your Data Rights

As a Data Subject, you have the following rights in respect of your Personal Data held by ape77. To exercise any of these rights, please contact us using the details in Section 15:

• Right of Access: You have the right to request confirmation of whether ape77 holds Personal Data about you and, if so, to receive a copy of that data along with information about how it is processed. Requests are responded to within 30 days.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete Personal Data held about you. Minor updates (such as a change of email address or contact number) can typically be made directly from your Account dashboard.
• Right to Erasure: You have the right to request deletion of your Personal Data in certain circumstances — for example, where the data is no longer necessary for the purpose for which it was collected, or where you withdraw consent and no other legal basis applies. Please note that ape77 may be required to retain certain data for legal compliance purposes (see Section 7) even following an erasure request.
• Right to Restriction of Processing: You have the right to request that ape77 restricts the processing of your Personal Data in certain circumstances, such as where you contest the accuracy of the data or where processing is unlawful but you do not want the data erased.
• Right to Data Portability: You have the right to receive your Personal Data in a structured, commonly used, machine-readable format and to transmit that data to another controller, where technically feasible and where processing is based on consent or contract.
• Right to Object: You have the right to object at any time to the processing of your Personal Data for direct marketing purposes. You also have the right to object to processing based on legitimate interests, although ape77 may be able to demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

11 Minors

The ape77 Platform is strictly intended for adults aged 21 years and older. ape77 does not knowingly collect Personal Data from individuals under the age of 21. All Accounts are subject to mandatory KYC age verification before withdrawal privileges are activated.

If ape77 discovers or has reason to believe that an Account belongs to a person under the age of 21, the Account will be immediately suspended, all associated Personal Data will be scheduled for deletion in accordance with applicable legal obligations, and any deposited funds will be returned to the originating payment method following verification of the account holder's identity.

If you are a parent or guardian and believe that your child has registered on the Platform or provided Personal Data to ape77 without your consent, please contact us immediately at support@ape77.one. We will investigate promptly and take all necessary steps to address the situation.

12 Third-Party Services & Links

The ape77 Platform integrates with a number of third-party service providers to deliver the full range of casino and sportsbook functionality. These include game content providers (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft), payment processors, and KYC verification services. When you interact with third-party game content embedded within the Platform, limited session and gameplay data is transmitted to the relevant studio for game delivery purposes. Each of these providers operates under its own privacy framework and is subject to contractual data processing obligations imposed by ape77.

The ape77 Platform does not contain links to external third-party websites for general browsing purposes. Should any such links appear in future communications or promotional materials, ape77 accepts no responsibility for the privacy practices of those external sites, and we encourage you to read their privacy policies independently before submitting any personal information.

13 International Data Transfers

ape77 operates internationally, and your Personal Data may be processed by ape77 or by third-party service providers on servers located in jurisdictions outside of Indonesia. Where Personal Data is transferred to a country that does not provide a level of data protection equivalent to that applicable in your jurisdiction, ape77 will implement appropriate safeguards to ensure that your data remains adequately protected. These safeguards may include standard contractual clauses, binding corporate rules, or other legally recognized transfer mechanisms.

By using the Platform, you acknowledge and consent to the transfer of your Personal Data to jurisdictions outside Indonesia as described in this section, subject always to the protections and purposes set out in this Privacy Policy.

14 Policy Amendments

ape77 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or the services we provide. The date of the most recent revision is displayed at the top of this page. Where amendments are material — for example, where we introduce a new purpose for processing or a new category of data sharing — we will notify you by email to the address registered to your Account and will publish a prominent notice on the Platform for a minimum of 30 days following the change.

Your continued use of the Platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised terms. If you disagree with any amendment, you should discontinue use of the Platform and may request account closure by contacting our support team.

15 Contact Us

For any questions, requests, or complaints regarding this Privacy Policy or the processing of your Personal Data by ape77, please contact our dedicated support team through the following channel:

• Email: support@ape77.one (plain text — not a clickable link)
• Live Chat: Available 24 hours a day, 7 days a week, from within your Account dashboard. Indonesian-speaking agents are on duty at all times (WIB, UTC+7).
• Subject Line: For data rights requests, please use the subject line "Data Rights Request – [Your Username]" to ensure your request is routed to the appropriate team promptly.

ape77 will acknowledge all privacy-related enquiries within 48 hours and will provide a substantive response within 30 calendar days. For complex requests, the response period may be extended as described in Section 10. We are committed to resolving all privacy concerns fairly and transparently.