sm777 Privacy Policy

This Privacy Policy describes how sm777 ("we", "us", "our") collects, processes, stores, and protects the personal data of individuals ("you", "Player", "Member") who access or use the sm777 online casino and sportsbook platform, available at sm777.vu.

sm777 is the data controller in respect of all personal data processed under this policy. As data controller, sm777 determines the purposes for which and the means by which personal data is processed. All data processing activities are conducted in accordance with internationally recognised data protection principles, including lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality.

This policy should be read together with the sm777 Terms & Conditions, which govern your use of the platform as a whole. For responsible gaming data handling, please also refer to our Responsible Gaming page.

sm777 collects personal data through several channels: directly from you when you register, deposit, or contact support; automatically as you interact with the platform; and, in limited circumstances, from third-party verification and fraud-prevention services.

2.1 Information You Provide Directly

2.2 Information Collected Automatically

When you access and use the sm777 platform, certain technical data is collected automatically by our systems and third-party analytics providers:

• Device & Technical Data: IP address, device type, operating system, browser type and version, screen resolution, and device identifiers.
• Usage Data: Pages visited, games played, bet amounts, session duration, click-stream data, error logs, and feature interaction patterns.
• Location Data: Approximate geographic location derived from your IP address (used for access control and fraud prevention — we do not collect precise GPS coordinates).
• Cookie & Tracking Data: First-party session cookies, preference cookies, and analytics identifiers. See Clause 6 for full details.

2.3 Information Received from Third Parties

In certain circumstances, sm777 may receive personal data about you from third-party sources to supplement our own records:

• Identity Verification Partners: Third-party KYC service providers may return verification status, watchlist screening results, and document authenticity signals.
• Fraud Prevention Services: Risk-scoring data and device fingerprint assessments from fraud-detection partners.
• Payment Processors: Transaction confirmation data, payment success or failure codes, and chargeback notifications from our banking and e-wallet partners.

sm777 processes your personal data only for specific, documented purposes. The table below maps each processing activity to its purpose and legal basis:

Every processing activity conducted by sm777 rests on one of the following recognised legal bases:

• Contractual Necessity: Processing required to perform the contract between you and sm777 — including account management, transaction processing, game delivery, and customer support. Without this processing, sm777 cannot provide its services.
• Legal Obligation: Processing required to comply with applicable laws and regulatory requirements — including KYC identity verification, AML record-keeping, sanctions screening, and responses to lawful authority requests.
• Legitimate Interests: Processing necessary for sm777's legitimate business interests — including fraud prevention, platform security, responsible gaming monitoring, and internal analytics — provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for which you have provided a clear, specific, and freely given consent — primarily direct marketing communications. You may withdraw consent at any time by updating your communication preferences in the Account portal or contacting support.

5.1 Service Providers

sm777 engages carefully selected third-party service providers who process personal data on our behalf and strictly under our instructions. These include:

• Payment processors (local Indonesian banks, e-wallet operators) — to execute deposit and withdrawal transactions
• KYC and identity verification providers — to perform document authentication and sanctions screening
• Fraud prevention and risk management platforms — to detect and prevent financial crime
• Cloud infrastructure and hosting providers — to store and serve platform data securely
• Customer support software providers — to manage live chat and ticket-based support interactions
• Analytics platforms — to measure platform performance and user engagement (data is pseudonymised where possible)
• Game content studios — Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft, and others — who may receive anonymised session tokens to facilitate gameplay but do not receive your personal identity data

All service providers are bound by data processing agreements that prohibit use of your data for their own commercial purposes and require them to maintain appropriate technical and organisational security measures.

5.2 Legal and Regulatory Disclosures

sm777 may disclose personal data to governmental authorities, law enforcement agencies, financial intelligence units, or courts where required to do so by applicable law, court order, or regulatory instruction. In such cases, sm777 discloses only the minimum information necessary to satisfy the legal requirement and, where legally permitted, will notify the affected Player of such disclosure.

5.3 Business Transfers

In the event of a merger, acquisition, asset sale, or restructuring involving sm777, your personal data may be transferred to the successor entity as part of that transaction. You will be notified of any such transfer and the identity of the new data controller in advance of any change in how your data is processed.

5.4 No Sale of Data

sm777 does not sell, rent, auction, or otherwise transfer your personal data to third parties for their own marketing or commercial purposes. Any data shared with affiliates or partners is limited to what is operationally necessary and is always governed by a binding data protection agreement.

The sm777 platform uses cookies and similar tracking technologies to operate core platform functionality, maintain your session, remember your preferences, and analyse usage patterns. The following types of cookies are used:

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will prevent the platform from functioning correctly. Disabling analytics or preference cookies will not affect your ability to place bets, make deposits, or access games, but may result in a less personalised experience.

sm777 retains personal data for no longer than is necessary for the purpose for which it was collected, subject to any longer retention period required by law. The general retention schedule is as follows:

• Account and identity data: Retained for the duration of the account relationship and for a period of 5 years following account closure, in accordance with AML record-keeping obligations.
• Transaction records: Retained for a minimum of 5 years from the date of each transaction to satisfy financial regulatory requirements.
• KYC documents: Retained for 5 years following account closure or the last transaction date, whichever is later.
• Customer support records: Retained for 3 years from the date of the interaction, unless the matter relates to an ongoing dispute or legal proceeding.
• Marketing consent records: Retained for as long as you hold an active account, plus 3 years following the withdrawal of consent or account closure.
• Session and analytics data: Retained in pseudonymised form for up to 24 months for platform improvement purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be associated with any identifiable individual.

sm777 maintains a comprehensive information security programme that includes the following technical and organisational measures:

• Transport Security: All data in transit between your device and sm777 servers is encrypted using TLS 1.2 or higher (256-bit). HTTP connections are automatically redirected to HTTPS.
• Data at Rest: Sensitive data fields — including identity document images, bank account numbers, and KYC records — are encrypted at rest using AES-256 encryption on dedicated secure storage infrastructure.
• Access Controls: Access to personal data is restricted to authorised sm777 personnel and service providers on a strict need-to-know basis. Role-based access controls, multi-factor authentication, and access logging are enforced across all internal systems.
• Network Security: The sm777 platform is protected by enterprise-grade firewalls, distributed denial-of-service (DDoS) mitigation systems, and intrusion detection and prevention systems (IDS/IPS).
• Penetration Testing: The platform undergoes regular third-party penetration testing and vulnerability assessments to identify and remediate security weaknesses before they can be exploited.
• Incident Response: sm777 maintains a documented data breach incident response plan. In the event of a breach materially affecting your personal data, you will be notified without undue delay and advised of the steps you should take to protect yourself.

While sm777 employs industry-leading security practices, no system can guarantee absolute immunity from all threats. You are responsible for maintaining the security of your own account credentials and should notify sm777 immediately if you suspect that your account has been compromised.

As a Player on the sm777 platform, you hold the following rights in respect of your personal data. To exercise any of these rights, contact us at [email protected] — we will respond within 30 calendar days of receiving a verifiable request.

sm777 operates globally and some of our service providers — including cloud infrastructure partners, KYC verification services, and analytics platforms — may process personal data in jurisdictions outside Indonesia. Where data is transferred internationally, sm777 ensures that appropriate safeguards are in place, which may include:

• Standard contractual clauses approved by recognised data protection authorities
• Binding corporate rules where the recipient is part of the same corporate group
• Adequacy decisions recognising the recipient country's data protection framework as equivalent to an appropriate international standard
• Recipient certification under an approved data protection framework

You may request information about the specific safeguards applied to any international transfer of your personal data by contacting [email protected].

The sm777 platform is strictly intended for adults aged 21 years or older. sm777 does not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory step in the account registration and KYC process, and any account found to have been created by a person under 21 will be closed immediately and all associated personal data deleted, except where retention is required by applicable law.

If you are a parent or guardian and believe that a minor has registered an account on the sm777 platform using false information, please contact us immediately at [email protected]. We will investigate and take all necessary action, including account closure and data deletion, within 72 hours of a verified report.

The sm777 platform may reference third-party services — such as game studios, payment networks, or sports data providers — in the context of delivering its services. sm777 does not control the privacy practices of these third parties and is not responsible for their data collection or processing activities.

sm777 does not embed third-party social media plugins, advertising trackers, or cross-site marketing pixels on its platform. Any analytics tools used are configured to collect data in a privacy-respecting manner, with IP anonymisation enabled where technically feasible.

sm777 reviews this Privacy Policy at least annually and whenever there is a material change to our data processing activities. When we make significant changes, we will:

• Post the updated policy at sm777.vu/privacy-policy with a revised effective date
• Send a notification email to all registered Players at least 7 calendar days before the changes take effect
• Display an in-platform notification for Players who log in during the notice period

Your continued use of the sm777 platform after the effective date of any revision constitutes your acceptance of the updated Privacy Policy. If you do not agree with the revised policy, you should cease using the platform and request account closure before the effective date.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to report a privacy concern, please reach out to the sm777 privacy team through the following channels:

• Email: [email protected] (plain text — not a clickable link)
• Subject Line: Please use "Privacy Request — [Your Account Username]" so that your message is routed to the correct team
• Live Chat: Available 24/7 via the sm777 platform interface — request to speak with the Data Privacy team
• Response Time: We aim to acknowledge all privacy-related enquiries within 48 hours and to resolve them fully within 30 calendar days