Privacy Policy — bo177

1 Definitions

The following definitions apply throughout this Privacy Policy. Defined terms appear in title case.

• "bo177" / "We" / "Us" / "Our" — the operator of the Platform at https://bo177.cam, holding a valid international gaming license.
• "Platform" — the bo177 website, all associated sub-pages, mobile interfaces, APIs, and services accessible at https://bo177.cam.
• "You" / "User" — any natural person who accesses, registers on, or interacts with the Platform in any capacity.
• "Personal Data" — any information that identifies or can reasonably be used to identify a living natural person, either on its own or in combination with other data.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, retrieval, use, transmission, erasure, or destruction.
• "KYC" — Know Your Customer; the identity and age verification process required before processing withdrawal requests and as part of ongoing AML compliance.
• "Cookies" — small text files or similar technologies placed on your device by the Platform to store session state, preferences, or analytics identifiers.
• "IDR / Rp" — Indonesian Rupiah, the sole currency of the Platform.
• "AML" — Anti-Money Laundering; the suite of legal and procedural controls that bo177 operates to detect and prevent financial crime.

2 Scope & Data Controller

This Privacy Policy applies to all Personal Data collected by bo177 through the Platform, including data collected during account registration, KYC verification, payment transactions, customer support interactions, and general platform browsing.

bo177 acts as the data controller for all Personal Data described in this Policy. As data controller, bo177 determines the purposes and means by which your Personal Data is processed and bears primary responsibility for ensuring that Processing is lawful, fair, and transparent.

This Policy applies to registered account holders who are residents of Indonesia and to any person who accesses the Platform from Indonesia, regardless of their citizenship. Indonesian players may have additional rights under applicable Indonesian personal data protection legislation; where those rights are broader than those described in this Policy, the applicable statutory rights take precedence.

3 Data We Collect

bo177 collects Personal Data through three primary channels: information you provide directly, information generated automatically by your use of the Platform, and information obtained from third-party verification partners during KYC.

3.1 Data you provide directly

• Full legal name, date of birth, and Indonesian residential address.
• Valid email address and mobile phone number registered in Indonesia.
• Government-issued identity document details (KTP number, passport number, or driving license number and expiry date).
• Bank account details (account holder name, bank name, account number) for BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata, or Bank Danamon; or e-wallet identifiers for OVO, DANA, GoPay, ShopeePay, or LinkAja.
• Username and hashed password chosen at registration.
• Communications you send to our support team via live chat or email, including any attachments.
• Responsible gaming preferences, including deposit limits, loss limits, session time limits, and any self-exclusion requests.

3.2 Data collected automatically

• IP address and approximate geolocation derived from IP.
• Device type, operating system, browser type and version, screen resolution, and preferred language setting.
• Session timestamps, pages visited, click-stream data, and time spent on each page.
• Betting and gaming activity logs, including game type (sports betting, togel lottery, live casino, slots), stake amounts in IDR, outcomes, and session durations.
• Deposit and withdrawal transaction records, including timestamp, amount in Rp, payment method, and transaction reference number.
• Cookie identifiers and similar tracking technology data (see Clause 7).

3.3 Data from third-party KYC partners

• Identity verification results (pass / fail / refer) returned by our KYC service provider upon document and liveness checks.
• Politically Exposed Person (PEP) and sanctions screening results.
• Source-of-funds declarations where enhanced due diligence is triggered.

4 How We Use Your Data

The table below sets out the primary purposes for which bo177 Processes your Personal Data and the categories of data involved in each purpose.

bo177 does not use your Personal Data to make fully automated decisions that produce significant legal effects on you without human review. Automated systems may flag accounts for risk review; however, a qualified member of our compliance team always performs the final assessment before any account action is taken.

5 Legal Bases for Processing

Every Processing activity described in this Policy rests on at least one of the following legal bases:

• Contractual necessity — Processing required to perform the agreement between you and bo177, including operating your account, executing bets, and processing payments.
• Legal obligation — Processing required to comply with applicable laws and regulations, including AML obligations, licensing conditions, and mandatory record-keeping requirements.
• Legitimate interests — Processing that serves bo177's legitimate business interests (fraud prevention, platform security, analytics) and does not override your fundamental privacy rights.
• Consent — Processing that relies on your freely given, specific, and informed consent, such as receiving promotional email communications. You may withdraw consent at any time by contacting our support team or updating your account preferences, without affecting the lawfulness of Processing that occurred before withdrawal.

6 Sharing & Disclosure of Your Data

bo177 does not sell, rent, or trade your Personal Data to third parties for their own commercial use. We share Personal Data only in the limited circumstances described below, and only to the extent necessary for each stated purpose.

6.1 Service providers (data processors)

We engage trusted third-party companies to perform specific functions on our behalf. These companies Process your data only on our documented instructions and are contractually prohibited from using it for any other purpose. Current categories of processors include:

• KYC and identity verification partners — to perform document authentication and liveness checks during the KYC process.
• Payment processing intermediaries — to facilitate bank transfer and e-wallet deposit and withdrawal transactions via BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja, and other supported methods.
• Cloud infrastructure and hosting providers — to store Platform data securely in data centers with appropriate physical and logical security controls.
• Customer support platform providers — to operate the 24/7 live chat service available on the Platform.
• Fraud detection and AML screening tools — to screen transactions and accounts against sanctions lists and risk indicators.

6.2 Regulatory and legal disclosure

We may disclose your Personal Data to competent regulatory authorities, law enforcement bodies, or courts where we are legally required to do so by applicable law, court order, or the conditions of our gaming license. We will notify you of such disclosure where we are legally permitted to do so.

6.3 Business transfers

In the event of a merger, acquisition, restructuring, or sale of substantially all of our assets, your Personal Data may be transferred to the acquiring entity as part of that transaction, subject to the acquiring entity maintaining equivalent data protection standards. You will be notified of any such transfer and any material change to this Privacy Policy that results from it.

7 Cookies & Tracking Technologies

bo177 uses cookies and similar technologies (local storage, session storage, pixel tags) on the Platform. The table below summarizes the types of cookies we use and their purposes.

bo177 does not deploy third-party advertising cookies, retargeting pixels, or social media tracking tags on the Platform. Your browsing activity on bo177 is not shared with advertising networks.

You can manage or delete cookies through your browser settings at any time. Note that disabling strictly necessary cookies will prevent the Platform from functioning correctly and may result in you being unable to log in or place bets. Disabling other cookie types will not affect core Platform functionality.

8 Data Retention

bo177 retains Personal Data for as long as necessary to fulfil the purposes described in this Policy, and in any case for the minimum periods required by applicable law and our licensing obligations. The following retention schedule applies:

• Account and KYC data — retained for the lifetime of your account and for a minimum of five (5) years following permanent account closure, in accordance with AML and gaming license record-keeping requirements.
• Transaction records (deposits, withdrawals, bets) — retained for a minimum of five (5) years from the date of the transaction.
• Customer support communications — retained for three (3) years from the date of last interaction, or longer if the communication relates to an active dispute or regulatory inquiry.
• Analytical and session data — aggregated and anonymized within 24 months; anonymized data may be retained indefinitely for statistical purposes.
• Marketing preferences and email opt-in records — retained for the duration of your active player status and for one (1) year following account closure or opt-out, to evidence consent history.

When Personal Data is no longer required and no legal obligation mandates its retention, bo177 will securely delete or irreversibly anonymize it. Where deletion is not immediately practicable due to technical constraints (e.g., backup media), the data is isolated from active Processing until it can be deleted.

9 Security Measures

bo177 implements a layered security architecture to protect your Personal Data against unauthorized access, accidental loss, alteration, or disclosure. Our current security controls include, but are not limited to:

• Encryption in transit: all data exchanged between your device and our servers is protected by TLS 1.2 or higher with strong cipher suites. HTTP connections are automatically redirected to HTTPS.
• Encryption at rest: sensitive data fields — including identity document references, payment account details, and KYC result records — are encrypted at rest using AES-256.
• Access controls: access to Personal Data is limited to personnel who require it to perform their job functions (principle of least privilege). All access is logged, and privileged access requires multi-factor authentication.
• Network security: our infrastructure is protected by firewalls, intrusion detection systems, and DDoS mitigation services.
• Vulnerability management: we perform regular penetration testing and security audits. Critical vulnerabilities are patched on a defined SLA timeline.
• Incident response: bo177 maintains a documented data breach response plan. In the event of a breach that poses a risk to your rights, we will notify affected users without undue delay and in accordance with applicable regulatory requirements.

10 Your Privacy Rights

As a bo177 account holder and a resident of Indonesia, you hold the following rights with respect to your Personal Data. To exercise any of these rights, contact us using the details in Clause 13. We will respond within 30 calendar days; complex requests may require up to 60 days, in which case we will inform you of the extension.

Please note that certain rights are subject to limitations. For example, we cannot delete data that we are legally required to retain under AML or gaming license obligations. Where we decline a request, we will provide a written explanation of the specific legal basis for doing so.

11 Children & Minors

The Platform is strictly intended for adults aged 21 years and over. bo177 does not knowingly collect Personal Data from persons under the age of 21. Age verification is a mandatory step in the KYC process and is performed before any withdrawal is processed.

If we become aware that Personal Data has been collected from a person under the age of 21 — whether through our own detection or through a report from a parent or guardian — we will immediately suspend the relevant account, void all open bets, return deposited funds (less any withdrawals already processed), and permanently delete the Personal Data associated with the account.

Parents and guardians who are concerned that a minor may have accessed or registered on the Platform should contact our support team immediately at the email address listed in Clause 13.

12 Updates to This Privacy Policy

bo177 reviews this Privacy Policy at least annually and whenever there is a material change to our data Processing practices, a change in applicable law, or a significant update to the Platform's features. The "Last Updated" date at the top of this page reflects the most recent revision.

Where an update is material — for example, a change to the categories of data we collect, a new category of third-party sharing, or a new legal basis for Processing — we will notify registered account holders by email at the address on file and display a prominent notice on the Platform for a minimum of 14 calendar days before the change takes effect.

For non-material updates (such as clarifications to existing text or corrections of typographical errors), we will update the Policy without prior notice beyond the revised "Last Updated" date. Your continued use of the Platform after any update constitutes acceptance of the revised Policy. We recommend bookmarking this page and checking it periodically.

Prior versions of this Privacy Policy are available on request by contacting the Privacy team using the details in Clause 13.

13 Contact & Complaints

For any questions, concerns, or requests relating to this Privacy Policy or your Personal Data rights, please contact us through the following channels:

When submitting a data rights request by email, please include your registered username, the email address on your account, and a description of your request. We may need to verify your identity before processing the request.

If you are not satisfied with our response to a complaint or data rights request, you have the right to escalate the matter to the competent data protection supervisory authority in the jurisdiction in which bo177 holds its operating license. Contact details for the relevant authority will be provided in our response to your formal complaint.

For matters relating to our Terms & Conditions or our Responsible Gaming program, please refer to the respective dedicated pages.