gcr77 Privacy Policy

In this Privacy Policy, the following terms carry the meanings set out below unless the context expressly requires otherwise.

gcr77 collects Personal Data through multiple channels during your interaction with the Platform. The categories of information we collect are described below.

2.1 Information You Provide Directly

When you register an Account, complete the KYC verification process, make a deposit or withdrawal, contact support, or participate in a promotion, you provide us with information that may include:

• Full legal name as it appears on your government-issued identity document.
• Indonesian National Identity Number (NIK) and date of birth.
• Residential address, city (e.g., Jakarta, Surabaya, Bandung, Bali, Medan), and postal code.
• Email address and Indonesian mobile phone number.
• Bank account details for your nominated payment method (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OCBC NISP) or e-wallet account details (OVO, DANA, GoPay, ShopeePay, LinkAja).
• KYC documents: scanned copies of KTP, passport, SIM, or proof-of-address documents.
• Communications you send to gcr77 via live chat, email, or the support portal.

2.2 Information Collected Automatically

When you visit or interact with the gcr77 Platform, our servers and third-party analytics tools automatically record certain technical data, including:

• IP address and approximate geographic location derived therefrom.
• Browser type, version, and language settings.
• Device type, operating system, and screen resolution.
• Referring URL and navigation path through the Platform.
• Pages visited, games launched, bet history, deposit and withdrawal timestamps, and session duration.
• Cookie identifiers and local storage data as described in Clause 5.

2.3 Information From Third Parties

gcr77 may receive Personal Data about you from third parties in limited circumstances, including:

• Identity verification agencies that confirm the authenticity of KYC documents you submit.
• Payment processors that communicate transaction confirmation, refund, or chargeback events linked to your Account.
• Fraud-detection and anti-money-laundering (AML) screening services that assess the risk profile of transactions associated with your Account.
• Responsible gaming databases that flag whether a Member has self-excluded through a third-party programme.

gcr77 uses the Personal Data we collect for the following purposes. Each purpose is accompanied by the primary legal basis on which we rely — these are explained in detail in Clause 4.

gcr77 does not use your Personal Data to build advertising profiles for sale to third-party marketers, nor do we share your data with social-media advertising networks for retargeting purposes.

gcr77 processes your Personal Data only where a valid legal basis exists. The principal bases on which we rely are as follows:

• Contractual Necessity: Processing is necessary to perform the contract between gcr77 and the Member — specifically, to operate the Account, process financial transactions, and deliver the products and services described in the Terms and Conditions.
• Legal Obligation: Processing is necessary for gcr77 to comply with applicable legal and regulatory requirements, including identity verification (KYC), AML/CTF screening, record-keeping, and responding to lawful authority requests.
• Legitimate Interests: Processing is carried out to pursue gcr77's legitimate business interests — including fraud prevention, platform security, responsible gaming monitoring, and analytics — where those interests are not overridden by your fundamental rights and freedoms.
• Consent: Where gcr77 relies on consent as the legal basis (for example, for optional marketing communications or non-essential cookies), you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. To withdraw consent, contact us at support@gcr77.bio or adjust your Account notification preferences.

gcr77 uses cookies and similar tracking technologies to operate the Platform efficiently, remember your preferences, and analyse usage patterns. The categories of cookies we deploy are described in the table below.

5.1 Managing Cookies

You may control cookie behaviour through your browser settings. Most modern browsers allow you to block, delete, or receive warnings before a cookie is stored. Please note that disabling strictly necessary cookies will prevent you from logging in to your gcr77 Account and accessing core Platform features.

To opt out of analytics cookies specifically, you may also send a written request to support@gcr77.bio with the subject line "Cookie Opt-Out" and we will disable analytics data collection for your Account within 5 business days.

gcr77 does not sell, rent, or trade your Personal Data to third parties for their own commercial purposes. We share your data only in the following limited and controlled circumstances:

6.1 Third-Party Processors

gcr77 engages carefully selected Third-Party Processors who act on our instructions under written data-processing agreements. These processors are permitted to use your data only for the specific purpose for which they were engaged and must implement security measures at least equivalent to those described in Clause 8. Current categories of processor include:

• Payment Processors: Entities that facilitate deposits and withdrawals via BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, OVO, DANA, GoPay, ShopeePay, and LinkAja.
• KYC Verification Services: Approved identity verification providers that authenticate the documents you submit during account verification.
• Fraud & AML Screening: Risk-intelligence platforms that cross-reference transaction data against watchlists and behavioural anomaly models.
• Platform Infrastructure: Cloud hosting, CDN, and database providers that store and serve Platform data on gcr77's behalf.
• Customer Support Tools: Live-chat and ticketing software providers through which support agents interact with Members.

6.2 Legal and Regulatory Disclosure

gcr77 may disclose your Personal Data to competent governmental, regulatory, or law enforcement authorities where required to do so by applicable law, by court order, or where gcr77 reasonably believes disclosure is necessary to prevent fraud, protect the safety of any person, or enforce its legal rights.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of gcr77's assets, your Personal Data may be transferred to the successor entity. gcr77 will notify you by email and/or by a prominent notice on the Platform at least 30 days before your data becomes subject to a materially different privacy policy as a result of such a transaction.

gcr77 retains your Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The retention periods applicable to key data categories are summarised below.

When retention periods expire, gcr77 securely erases or irreversibly anonymises the relevant Personal Data. Anonymised, aggregated data (from which no individual can be identified) may be retained indefinitely for statistical and business-planning purposes.

gcr77 implements a comprehensive suite of technical and organisational security measures designed to protect your Personal Data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Key measures include:

• TLS 1.3 Encryption in Transit: All data exchanged between your browser and gcr77's servers is encrypted using Transport Layer Security (TLS) 1.3, providing 256-bit encryption strength.
• AES-256 Encryption at Rest: Sensitive database fields — including payment account references, NIK values, and KYC document files — are stored encrypted at rest using AES-256.
• Password Hashing: Account passwords are never stored in plain text. gcr77 uses bcrypt with a sufficient work factor to hash all passwords before storage.
• Two-Factor Authentication (2FA): Optional 2FA is available to all Members via time-based one-time password (TOTP). Members are strongly encouraged to enable 2FA in their Account security settings.
• Access Controls: Internal access to Personal Data is restricted to authorised gcr77 personnel on a strict need-to-know basis. All internal data access is logged and subject to periodic review.
• Vulnerability Management: gcr77 conducts periodic penetration testing and vulnerability assessments. Critical vulnerabilities are remediated within 48 hours of identification.
• Incident Response: gcr77 maintains a documented data-breach response procedure. In the event of a breach likely to affect your rights and freedoms, you will be notified without undue delay in accordance with applicable law.

As a Member of gcr77, you have the following rights with respect to your Personal Data. To exercise any of these rights, submit a written request to support@gcr77.bio with the subject line "Data Rights Request". gcr77 will respond within 30 calendar days of receiving a verifiable request.

• Right of Access: You have the right to request a copy of the Personal Data gcr77 holds about you, including the categories of data, the purposes for which it is processed, and the categories of third parties to whom it has been disclosed.
• Right to Rectification: You have the right to request that inaccurate or incomplete Personal Data be corrected. For routine updates (name, address, email), you may update most information directly via your Account profile settings.
• Right to Erasure ("Right to Be Forgotten"): You may request that gcr77 delete your Personal Data where: (a) the data is no longer necessary for the purpose it was collected; (b) you withdraw consent (where consent was the basis); or (c) the data has been unlawfully processed. Note that gcr77 may decline erasure requests where retention is required by applicable law (see Clause 7).
• Right to Restriction: You may request that gcr77 restrict the processing of your Personal Data in certain circumstances, such as while a rectification request is under review.
• Right to Data Portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you may request that gcr77 provide your Personal Data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing carried out on the basis of gcr77's legitimate interests. gcr77 will cease processing unless compelling legitimate grounds for processing exist that override your interests, rights, and freedoms.
• Right to Withdraw Consent: Where gcr77 relies on consent for any processing activity (e.g., optional marketing emails), you may withdraw that consent at any time by contacting support or adjusting your notification settings in the Account dashboard.

gcr77 is an adults-only platform. Access is strictly restricted to individuals who are at least 21 years of age. gcr77 does not knowingly collect, process, or retain Personal Data relating to persons under the age of 21.

If gcr77 becomes aware that Personal Data has been collected from a person under the age of 21 without parental or guardian consent, we will take immediate steps to delete that data and close the relevant Account. If you are a parent or guardian and believe that your child has registered an Account with gcr77, please contact us immediately at support@gcr77.bio with the subject line "Underage Account Report".

gcr77 employs age-verification checks at registration and during the KYC process as the primary technical mechanism for preventing underage access. Members who cannot satisfactorily demonstrate they meet the 21+ age requirement will have their Account suspended and any Balance held pending identity review.

The gcr77 Platform may contain links to third-party websites or services — for example, links to game studio information pages or payment provider help centres. These links are provided for informational convenience only.

gcr77 has no control over the content, privacy practices, or data-handling policies of any third-party website. This Privacy Policy applies solely to the gcr77 Platform (gcr77.bio). gcr77 is not responsible for the privacy practices of any third party and strongly encourages you to read the privacy policy of any external website you visit via a link on the Platform before submitting Personal Data to that site.

gcr77's primary data infrastructure is hosted on servers located in jurisdictions with established data-protection frameworks. In certain circumstances, your Personal Data may be transferred to, and processed in, countries outside Indonesia — for example, where a Third-Party Processor (such as a KYC verification service or cloud infrastructure provider) operates data centres in another jurisdiction.

Whenever Personal Data is transferred internationally, gcr77 ensures that appropriate safeguards are in place, including:

• Transferring only to jurisdictions that offer an adequate level of data protection as assessed by gcr77's data governance team.
• Requiring contractual data-protection clauses in agreements with all Third-Party Processors operating outside Indonesia.
• Applying data minimisation principles so that only the minimum Personal Data necessary for the specific processing purpose is transferred.

For further information about international data transfers and the safeguards in place, please contact us at the address provided in Clause 14.

gcr77 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, platform features, or our internal data-handling practices. When we make material changes to this Policy, we will:

• Update the "Last Updated" date at the top of this page.
• Post a prominent notice on the gcr77 Platform homepage for at least 14 days following the change.
• Send an email notification to all registered Members at the address associated with their Account, where the change materially affects Member rights or how Personal Data is used.

Your continued use of the gcr77 Platform after the effective date of any amended Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the amended Policy, you must discontinue use of the Platform and may request Account closure by contacting support@gcr77.bio.

We encourage you to review this Privacy Policy periodically so that you remain informed about how gcr77 protects your data. The most current version of the Policy is always accessible at gcr77.bio/privacy-policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way gcr77 processes your Personal Data, please contact our Data Protection team using the details below. We aim to respond to all privacy-related inquiries within 5 business days (WIB, Western Indonesia Time, UTC+7).

gcr77 has designated an internal Data Protection contact responsible for overseeing compliance with this Privacy Policy and applicable data-protection obligations. All formal data rights requests will be reviewed and processed by this contact, with identity verification required before any Personal Data is disclosed or deleted.