rafa77 Privacy Policy

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "rafa77", "we", "us", or "our" refers to the operator of the Platform at rafa77.club and all associated subdomains.
• "Platform" means the rafa77 website, mobile browser interface, and all products and services accessible through it.
• "Player", "you", or "your" refers to any individual who accesses, registers on, or uses the Platform.
• "Personal Data" means any information that identifies or could reasonably be used to identify a natural person, directly or indirectly.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.
• "Account" means a registered rafa77 user account created in accordance with the rafa77 Terms & Conditions.
• "KYC" means Know Your Customer identity verification procedures used to confirm a Player's identity, age, and eligibility.
• "Cookie" means a small text file placed on your device by the Platform when you visit, used to remember preferences and support analytics.

rafa77 is the data controller responsible for Personal Data collected through the Platform. As data controller, rafa77 determines the purposes for which and the means by which Personal Data is processed. If you have any questions about how rafa77 handles your Personal Data, please refer to the contact details in Section 15 of this Privacy Policy.

rafa77 collects the following categories of Personal Data in the course of operating the Platform and delivering services to Players:

rafa77 does not collect sensitive categories of Personal Data (such as racial or ethnic origin, political opinions, religious beliefs, or health data) unless specifically required by applicable law or regulatory guidance.

rafa77 collects Personal Data through the following channels:

• Direct submission: Information you provide during Account registration, KYC verification, deposit and withdrawal requests, support interactions, and promotional opt-ins.
• Automated collection: Technical and Usage Data collected automatically when you access the Platform, through server logs, session management systems, and analytics tools.
• Cookies and similar technologies: First-party cookies and similar tracking technologies placed on your device when you visit the Platform. See Section 8 for full details.
• Third-party sources: Identity and fraud-screening data received from licensed KYC verification partners and payment processors as part of our compliance obligations.

rafa77 processes your Personal Data on the following legal grounds:

1. Contractual necessity: Processing required to open your Account, process deposits and withdrawals, and provide the gaming services you have requested under the rafa77 Terms & Conditions.
2. Legal obligation: Processing required to comply with applicable anti-money laundering (AML) regulations, KYC requirements, age verification obligations, and other legal duties.
3. Legitimate interests: Processing necessary for rafa77's legitimate interests in operating a secure and fraud-free platform, improving product quality, and maintaining business records, where these interests are not overridden by your rights.
4. Consent: Processing based on your freely given, specific, and informed consent — for example, sending promotional communications about bonuses and special offers. You may withdraw consent at any time by contacting rafa77 support.

rafa77 uses the Personal Data it collects for the following purposes:

• Creating, maintaining, and securing your rafa77 Account.
• Processing deposits in Indonesian Rupiah via BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, and LinkAja, and processing withdrawals to those same methods.
• Verifying your identity and age in compliance with KYC requirements to ensure the Platform is not accessed by individuals under 21 years of age.
• Detecting, investigating, and preventing fraud, money laundering, account abuse, and other prohibited conduct as described in the rafa77 Terms & Conditions.
• Monitoring gameplay for responsible gaming indicators and triggering appropriate interventions where problem gambling risk is detected.
• Sending transactional communications related to your Account, including deposit confirmations, withdrawal notifications, and security alerts.
• Sending promotional communications about bonuses, special offers, and seasonal events — only where you have opted in to receive such communications.
• Improving the Platform's design, performance, and product range based on aggregate usage analytics.
• Maintaining records required by our operating licence and applicable legal obligations.

rafa77 does not use your Personal Data for automated decision-making that produces legal effects without human oversight, with the exception of automated fraud and AML screening tools which flag accounts for human review.

rafa77 may share your Personal Data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• Payment processors and banks: BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, and LinkAja — to process your deposits and withdrawals in Indonesian Rupiah.
• KYC verification partners: Licensed identity verification service providers engaged to confirm the authenticity of documents submitted during KYC review.
• Fraud prevention and AML screening services: Third-party compliance tools used to screen transactions and accounts against sanctions lists and known fraud patterns.
• Game software providers: Studios such as Evolution Gaming, Pragmatic Play, PG Soft, and Habanero receive limited technical session data required to deliver their game products within the rafa77 Platform.
• Legal and regulatory authorities: rafa77 will disclose Personal Data to law enforcement agencies, regulators, or courts when legally required to do so or when necessary to protect the rights, property, or safety of rafa77, its Players, or the public.

The rafa77 Platform uses cookies and similar tracking technologies to deliver a functional, personalised, and secure user experience. rafa77 uses the following categories of cookies:

rafa77 does not use third-party advertising or behavioural targeting cookies. The analytics tools used by rafa77 operate under data processing agreements that prohibit the use of Platform data for any purpose beyond improving rafa77's own services.

Strictly necessary cookies cannot be disabled without impairing core Platform functionality. You may manage functional and analytics cookie preferences through your browser settings. Note that disabling certain cookies may affect your Platform experience.

rafa77 retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply as a general guide:

• Account and Identity Data: Retained for the duration of the Account and for a minimum of five (5) years following permanent Account closure, in compliance with applicable AML record-keeping requirements.
• Financial transaction records: Retained for a minimum of five (5) years from the date of the transaction, in line with financial record-keeping standards.
• KYC documents: Retained for a minimum of five (5) years from the date of verification or Account closure, whichever is later.
• Support communications: Retained for up to three (3) years from the date of the interaction, or longer if the communication relates to an open dispute or regulatory inquiry.
• Analytics and usage data: Retained in aggregate, anonymised form indefinitely; identifiable usage data is deleted or anonymised within twelve (12) months.
• Marketing preferences: Retained until you withdraw consent or close your Account, at which point marketing data is deleted within thirty (30) days.

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised. Where deletion is not immediately possible due to technical constraints (for example, data held in backup archives), rafa77 will isolate the data and prevent further processing until deletion is completed.

rafa77 implements a layered security framework to protect your Personal Data against unauthorised access, loss, alteration, or disclosure. Security measures in place include:

• 256-bit SSL/TLS encryption on all data transmissions between your device and the rafa77 Platform — the same encryption standard used by major Indonesian banks including BCA and BRI for internet banking.
• At-rest encryption for all Personal Data and financial records stored on rafa77's servers.
• Access controls: Role-based access management ensures that only authorised rafa77 personnel with a legitimate business need can access Player Personal Data.
• Two-factor authentication (2FA) available for all Player Accounts and mandatory for all rafa77 internal administrative systems.
• Intrusion detection and monitoring: rafa77's security infrastructure continuously monitors for anomalous access patterns, known attack signatures, and data exfiltration attempts.
• Regular security audits: rafa77's Platform and data infrastructure undergo periodic independent security assessments.

Despite these measures, no internet-based system can guarantee absolute security. In the event of a data breach that poses a risk to your rights and freedoms, rafa77 will notify affected Players without undue delay and take all reasonable steps to contain and remediate the breach.

As a Player whose Personal Data is processed by rafa77, you have the following rights with respect to your data. To exercise any of these rights, please contact rafa77 support via live chat or email as set out in Section 15.

1. Right of Access: You may request a copy of the Personal Data rafa77 holds about you, along with information about how it is being used.
2. Right to Rectification: You may request that rafa77 correct any Personal Data that is inaccurate or incomplete.
3. Right to Erasure: You may request that rafa77 delete your Personal Data, subject to rafa77's legal obligation to retain certain records. Erasure requests will be assessed on a case-by-case basis.
4. Right to Restrict Processing: You may request that rafa77 temporarily restrict the processing of your Personal Data while a rectification or objection request is being assessed.
5. Right to Data Portability: You may request that rafa77 provide your Personal Data in a structured, commonly used, machine-readable format.
6. Right to Object: You may object to the processing of your Personal Data where rafa77 is relying on legitimate interests as the legal basis, including objecting to direct marketing at any time.
7. Right to Withdraw Consent: Where processing is based on your consent (for example, marketing communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing.

rafa77 will respond to all substantiated data rights requests within thirty (30) calendar days of receipt. If the request is complex or numerous, rafa77 may extend this period by a further sixty (60) days, in which case you will be notified of the extension and the reason for it.

If rafa77 discovers or is notified that an Account has been registered by an individual under 21 years of age, the Account will be immediately suspended, all associated Personal Data will be deleted in accordance with applicable requirements, and any balance will be returned via the registered payment method following verification.

If you believe that an individual under 21 has registered an Account on the rafa77 Platform, please contact rafa77 support immediately at [email protected].

The rafa77 Platform may contain references to or integrations with third-party services, including game software providers, payment processors, and support tools. This Privacy Policy applies solely to Personal Data collected and processed by rafa77 directly. rafa77 is not responsible for the privacy practices of third-party service providers, and Players are encouraged to review the privacy policies of any third-party services they interact with independently of the rafa77 Platform.

rafa77 reserves the right to update this Privacy Policy at any time to reflect changes in data processing practices, legal obligations, or Platform functionality. Material changes to this Privacy Policy will be communicated to Players via a notice on the Platform homepage or via the email address registered to the Account, with a minimum of seven (7) days' advance notice before the changes take effect.

The "Last Reviewed" date at the top of this Privacy Policy will be updated whenever a revision is made. Your continued use of the Platform following the effective date of a revised Privacy Policy constitutes your acceptance of the changes. If you do not agree to the revised Privacy Policy, you must close your Account before the effective date of the change.

If you have any questions, concerns, or complaints regarding this Privacy Policy or rafa77's data processing practices, or if you wish to exercise any of the rights described in Section 11, please contact the rafa77 Data Protection team through either of the following channels:

• Live Chat: Available 24 hours a day, 7 days a week, via the chat widget on the rafa77 Platform. Indonesian-speaking agents are available at all times and can escalate data-related enquiries to the Data Protection team.
• Email: [email protected] — please include "Privacy Request" in the subject line. Responses are typically provided within two (2) business days for general queries and within thirty (30) days for formal data rights requests.

rafa77 takes all privacy complaints seriously and will acknowledge receipt of your complaint within five (5) business days. If your complaint is not resolved to your satisfaction through the rafa77 internal process, you retain the right to escalate the matter to the relevant data protection authority or through the dispute resolution mechanism described in the rafa77 Terms & Conditions.