Privacy Policy — cog77 Data Commitment

1.1 cog77 ("we", "us", "our") is committed to protecting the privacy and personal data of all individuals who interact with our platform. This Privacy Policy describes the types of personal information we collect, the purposes for which we process it, how we protect it, how long we keep it, and the rights you hold in relation to it.

1.2 cog77 is operated as an internationally licensed online gaming platform. Our primary market is Indonesia — we serve Indonesian players who access our services in English and transact in Indonesian Rupiah (IDR / Rp). This Policy is written to be compliant with internationally recognised data-protection standards, including the principles of the European Union General Data Protection Regulation (GDPR) and Indonesia's Personal Data Protection Law (Undang-Undang Perlindungan Data Pribadi / UU PDP).

1.3 By registering an account on cog77 or by using any part of our platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree, please discontinue use of the platform.

2.1 For the purposes of applicable data-protection law, cog77 acts as the Data Controller in respect of personal data collected through the platform at https://cog77.cam.

2.2 Questions or requests relating to your personal data should be directed to our Data Protection contact at: [email protected] (plain text — not a clickable link).

2.3 Where cog77 engages third-party service providers who process personal data on our behalf (e.g., payment processors, KYC verification platforms), those providers act as Data Processors under binding data-processing agreements that impose equivalent data-protection obligations.

3.1 The categories of personal data we collect vary depending on your relationship with cog77 and the features you use. The table below summarises the main categories:

3.2 We do not intentionally collect sensitive personal data (e.g., race, ethnicity, religious belief, health data, political opinions) except where required by regulatory obligations (e.g., enhanced due diligence for AML purposes) and only with your explicit consent where legally required.

4.1 cog77 collects personal data through the following channels:

• Direct submission: Information you provide when registering an account, completing KYC, making a deposit or withdrawal, contacting customer support, or participating in a promotion.
• Automated technical collection: Data collected automatically when you access the platform, including IP address, device identifiers, browser characteristics, page-visit logs, and session duration — typically via server logs and first-party analytics tools.
• Cookies and similar technologies: Cookies and session tokens used for authentication, platform functionality, and aggregate analytics (see Clause 8 for full details).
• Third-party verification services: Identity and address data returned by our KYC provider following document verification, and fraud-screening data from our anti-money-laundering (AML) provider.
• Payment processors: Confirmation data (transaction reference, masked bank account details) returned by BCA, BRI, BNI, Mandiri, OVO, DANA, and GoPay upon processing a deposit or withdrawal.

5.1 cog77 processes your personal data on one or more of the following legal bases:

6.1 cog77 uses your personal data for the following purposes:

• Creating, verifying, and managing your player account;
• Processing deposits from and withdrawals to your linked BCA, BRI, BNI, Mandiri, OVO, DANA, or GoPay accounts;
• Verifying your identity and age (21+) as required by our licensing obligations and responsible gaming commitments;
• Settling bets, crediting winnings, and applying bonus funds in accordance with promotion terms;
• Detecting and preventing fraud, money laundering, underage gambling, and other prohibited conduct;
• Providing customer support via live chat, email, and phone — including Indonesian-speaking agents during WIB business hours;
• Administering responsible gaming tools at your request (deposit limits, loss limits, self-exclusion);
• Complying with requests from competent regulatory or law-enforcement authorities;
• Sending transactional communications (account confirmations, deposit receipts, withdrawal notifications, security alerts);
• Sending promotional communications where you have opted in (bonus offers, seasonal promotions tied to Indonesian events such as Idul Fitri or Indonesian Independence Day on 17 August);
• Improving the platform through aggregated, anonymised analytics of user behaviour and game performance.

6.2 cog77 will not use your personal data for any purpose that is incompatible with the purposes listed above without first notifying you and, where required, obtaining your consent.

7.1 cog77 does not sell, rent, or share your personal data with third parties for their own marketing purposes. We share personal data only in the following limited circumstances:

• KYC and AML service providers: Your identity documents and personal details are shared with our licensed identity-verification and anti-money-laundering screening providers solely to fulfil our regulatory compliance obligations. These providers are bound by strict data-processing agreements.
• Payment processors: Financial transaction data is shared with BCA, BRI, BNI, Mandiri, OVO, DANA, and GoPay solely to process your deposit and withdrawal instructions.
• Game studios and content providers: Your player ID and session data (not your full identity data) may be shared with game studios such as Pragmatic Play, Evolution Gaming, Microgaming, and NetEnt to manage game sessions, settle outcomes, and generate certified random number outputs.
• Platform infrastructure providers: Anonymised or pseudonymised technical data (server logs, error logs) is shared with our cloud infrastructure and security monitoring partners operating under confidentiality agreements.
• Legal and regulatory authorities: We will disclose personal data to government bodies, courts, or law-enforcement agencies when required to do so by applicable law, court order, or valid regulatory request. Where legally permitted, we will notify you of such requests.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of our assets, your personal data may be transferred to the acquiring entity, subject to the same data-protection obligations set out in this Policy.

8.1 cog77 uses cookies and similar technologies on the platform. A cookie is a small text file stored on your device by your browser.

8.2 We use the following categories of cookies:

• Essential cookies: Required for core platform functionality — session authentication, security tokens, and remembering your login state. These cannot be disabled without affecting your ability to use the platform.
• Functional cookies: Remember your preferences (e.g., language settings, responsible gaming tool configurations) to improve your experience on return visits.
• Analytics cookies: First-party analytics only, used to understand aggregate traffic patterns, page performance, and feature usage. Data is anonymised and never sold. Third-party analytics scripts from external domains are not deployed.

8.3 cog77 does not deploy third-party advertising cookies, retargeting pixels, or social-media tracking scripts on the platform.

8.4 You can control cookie settings via your browser preferences. Disabling essential cookies will impair your ability to log in and use the platform. Disabling analytics cookies has no effect on your ability to play.

9.1 We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law and our gaming licence obligations.

9.2 Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with any individual.

10.1 As an internationally licensed platform serving Indonesian players from offshore infrastructure, cog77 processes and stores personal data on servers located outside Indonesia. Data may be transferred to, stored in, or processed by service providers in jurisdictions that have data-protection laws that differ from those in Indonesia.

10.2 Where such transfers occur, cog77 takes reasonable steps to ensure an adequate level of protection through contractual safeguards, including standard contractual clauses (SCCs) consistent with internationally recognised data-transfer frameworks, and through our selection of service providers who maintain internationally certified security programmes (e.g., ISO 27001).

10.3 For information about specific data-transfer mechanisms applicable to your data, please contact us at [email protected].

11.1 Subject to applicable law, you have the following rights in relation to the personal data cog77 holds about you:

11.2 To exercise any of the rights above, submit a written request to [email protected]. We will respond within 30 calendar days and may require identity verification before processing your request.

11.3 Where requests are manifestly unfounded or excessive, cog77 reserves the right to charge a reasonable administrative fee or decline to act on the request, providing written reasons in either case.

12.1 cog77 enforces a strict 21+ age requirement in line with Indonesian responsible gambling standards. All accounts are subject to mandatory KYC age verification. Where we discover or suspect that personal data has been collected from an individual under 21, we will take immediate steps to verify the situation, close the account, return any deposits, and delete the associated personal data.

12.2 If you are a parent or guardian and believe your child has registered an account on cog77, please contact us immediately at [email protected]. We will investigate and act promptly.

13.1 cog77 implements a layered data-security programme that includes the following technical and organisational measures:

• 256-bit TLS (Transport Layer Security) encryption for all data in transit between your browser and our servers;
• AES-256 encryption for sensitive data stored in our databases where technically feasible;
• Two-factor authentication (2FA) available to all players for account login protection;
• Role-based access controls limiting internal access to personal data to those staff members who require it to perform their job functions;
• Regular third-party penetration testing and vulnerability assessments of our platform infrastructure;
• ISO 27001-aligned information security management practices across our hosting infrastructure partners;
• Documented incident-response procedures to detect, contain, investigate, and notify affected parties of data breaches.

13.2 Notwithstanding the above, no internet-based system can be guaranteed as completely secure. cog77 is not liable for breaches of security that result from actions or omissions on your part — including sharing your login credentials, using unsecured networks, or failing to keep your device software updated.

13.3 In the event of a personal data breach that is likely to result in risk to your rights or freedoms, cog77 will notify you without undue delay and, where required, will report the breach to the relevant supervisory authority within the timeframe required by applicable law.

14.1 The cog77 platform does not contain links to external third-party websites. All navigation is internal and confined to pages within https://cog77.cam. This Policy does not, therefore, cover any third-party websites or services.

14.2 If you access cog77 through a referral link, affiliate banner, or search-engine result from a third-party website, the privacy practices of that third-party site are entirely outside cog77's control and responsibility. You should consult that site's own privacy policy.

15.1 cog77 reserves the right to update this Privacy Policy at any time. When we make material changes, we will update the "Last Updated" date shown at the top of this page and, where we hold your email address and the change is significant, we will notify you by email no fewer than 7 calendar days before the change takes effect.

15.2 Minor changes (e.g., clarifications of existing practices, corrections of typographical errors) may be made without advance notice, and the updated Policy will be effective immediately upon posting.

15.3 We recommend bookmarking this page and reviewing it periodically. Your continued use of the platform after the effective date of any updated Policy constitutes your acceptance of the revised terms.

16.1 For all privacy-related queries, data-subject requests, or complaints, please contact our Data Protection team using the details below. We aim to respond to all requests within 30 calendar days.

16.2 If you are not satisfied with our response to a privacy complaint, you have the right to lodge a complaint with the competent data-protection supervisory authority in your jurisdiction. In Indonesia, the relevant authority for personal data protection matters is the Ministry of Communication and Information Technology (Kementerian Komunikasi dan Informatika / Kominfo) under the Personal Data Protection Law (UU PDP).

16.3 For matters related to responsible gaming and player protection, please visit our dedicated Responsible Gaming page.