Privacy Policy — mlb77

In this Privacy Policy, the following terms carry the meanings set out below unless context dictates otherwise:

• "Platform" means the mlb77 website at mlb77.pro, together with all sub-pages, mobile interfaces, APIs, and digital services operated under the mlb77 brand.
• "mlb77", "we", "us", or "our" means the operator of the Platform, an internationally licensed gaming operator.
• "Member", "you", or "your" means any individual who has registered a player account on the Platform or who browses the Platform as a guest.
• "Personal Data" means any information that relates to an identified or identifiable natural person, including but not limited to name, date of birth, national identity number, address, email address, phone number, IP address, and payment details.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, or deletion.
• "Data Controller" means mlb77 in its capacity as the entity that determines the purposes and means of Processing your Personal Data.
• "KYC" (Know Your Customer) means the identity and age verification process mlb77 uses to confirm that Members meet the eligibility requirements set out in the Terms & Conditions.
• "Cookies" means small text files placed on your device by the Platform to store preferences, session identifiers, and analytics data.
• "Third-Party Processors" means service providers engaged by mlb77 to process Personal Data on mlb77's behalf under binding data processing agreements, such as payment processors and game content suppliers.
• "Sensitive Data" means Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, health or biometric data, and any other category of data treated as sensitive under applicable data protection law.

When you register an account, complete a KYC verification, make a deposit or withdrawal, contact support, or otherwise interact with the Platform, you may provide us with Personal Data including:

• Identity Data: Full legal name, date of birth, gender, national identity number (NIK from your KTP), and copies of government-issued photo identification such as your National Identity Card (KTP) or passport.
• Contact Data: Email address, mobile phone number (including WhatsApp number if provided), and residential address, including city (e.g., Jakarta, Surabaya, Bali) and province within Indonesia.
• Financial Data: Bank account details for supported Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OCBC NISP) and e-wallet identifiers for OVO, DANA, GoPay, ShopeePay, and LinkAja, used exclusively to process deposits and withdrawals.
• Account Data: Your chosen username, password hash (we never store plain-text passwords), security questions, and two-factor authentication (2FA) configuration.
• Communications Data: The content of any messages you send to mlb77 customer support via email, live chat, or any other support channel, together with metadata such as timestamps.

When you access or use the Platform, we automatically collect certain technical and behavioural data, including:

• Device and Technical Data: IP address, browser type and version, operating system, device type (desktop, mobile, tablet), screen resolution, and language settings.
• Usage Data: Pages visited, features used, games played (including game titles, wager amounts, session duration, and outcomes), navigation paths, and click-stream data.
• Location Data: Approximate geographic location derived from your IP address, used to enforce geographic access controls and to detect access from Prohibited Jurisdictions. We do not collect precise GPS-level location data unless you explicitly grant that permission through your device.
• Session Data: Login timestamps, session duration, logout events, and failed login attempts, used for security monitoring and fraud prevention.
• Cookie and Tracker Data: Data stored via cookies and similar tracking technologies as described in Section 6 of this policy.

mlb77 does not intentionally collect the following categories of data, and our registration and KYC processes are designed to exclude them:

• Sensitive Data such as racial or ethnic origin, political opinions, religious beliefs, or health information — except where health information is voluntarily disclosed in the context of a responsible gaming self-exclusion request, in which case it is handled with enhanced confidentiality protections.
• Full payment card numbers — mlb77 does not currently accept card payments and does not store card data of any kind.
• Data relating to individuals under the age of 21 — if we become aware that a minor has provided Personal Data, we will delete that data promptly and close the associated account.

mlb77 processes your Personal Data for the following primary purposes, each of which is necessary to deliver the core services of the Platform:

mlb77 will only send you promotional emails, SMS messages, or in-platform notifications about bonuses, new game launches, seasonal promotions (such as those tied to Idul Fitri, Nyepi, or Ramadhan), and VIP Programme benefits if you have explicitly opted in to receive such communications at the time of registration or through your account preferences settings.

You may withdraw consent for marketing communications at any time by:

• Clicking the "Unsubscribe" link in any marketing email;
• Updating your notification preferences in your account settings; or
• Contacting support at [email protected] with the subject line "MARKETING OPT-OUT".

Withdrawal of marketing consent does not affect the lawfulness of processing that occurred prior to withdrawal, and it does not affect transactional communications (such as deposit confirmations, withdrawal notices, and security alerts), which are sent regardless of marketing preferences as they are necessary for the operation of your account.

mlb77 processes your Personal Data on one or more of the following legal grounds, depending on the specific processing activity:

• Contract Performance: Processing is necessary to perform the agreement between you and mlb77 — specifically, to operate your account, process your financial transactions, and deliver gaming services. Without this processing, mlb77 cannot provide the services you have signed up for.
• Legal Obligation: Processing is required to comply with applicable legal requirements, including anti-money-laundering regulations, responsible gaming obligations, and data retention requirements under international licensing conditions.
• Legitimate Interests: Processing is necessary for mlb77's legitimate interests in operating a secure, fair, and sustainable gaming platform — including fraud prevention, security monitoring, platform improvement, and abuse detection — provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: For processing activities that are not strictly necessary (such as marketing communications and optional personalisation features), mlb77 relies on your freely given, specific, informed, and unambiguous consent. You may withdraw consent at any time without penalty.

mlb77 shares your Personal Data with carefully selected Third-Party Processors who assist in delivering our services. All such processors are bound by data processing agreements that require them to process your data only on mlb77's documented instructions, to implement appropriate security measures, and to delete or return data upon termination of the service relationship. Categories of processors include:

• Payment Processors: Indonesian bank transfer partners and e-wallet platforms (OVO, DANA, GoPay, ShopeePay, LinkAja) that facilitate deposits and withdrawals in IDR.
• Game Content Suppliers: Licensed game studios including Pragmatic Play, Evolution Gaming, Pocket Games Soft (PG Soft), NetEnt, Microgaming, and Spribe, whose platforms may receive anonymised session data to enable game delivery.
• KYC and Identity Verification Providers: Third-party identity verification services that assist in document authentication and sanctions-list screening.
• Cloud Infrastructure and Hosting Providers: Data centre and cloud service providers that store Platform data in secure, access-controlled environments.
• Customer Support Technology Providers: Live chat, ticketing, and CRM platform providers that facilitate communication between mlb77 and its members.
• Fraud and AML Detection Providers: Risk intelligence platforms that analyse transactional patterns to identify and prevent financial crime.

mlb77 may be required by law, court order, or regulatory direction to disclose your Personal Data to governmental, regulatory, or law enforcement authorities. In such circumstances, mlb77 will disclose only the minimum data necessary to satisfy the legal obligation and, where permitted by law, will notify the affected Member prior to disclosure. mlb77 will not comply with requests that it believes to be unlawful, overbroad, or inconsistent with its legal obligations.

mlb77 does not sell, rent, lease, or otherwise transfer your Personal Data to third parties for their own independent commercial purposes. Any data sharing described in this policy is strictly limited to what is necessary to operate the Platform, comply with legal requirements, or protect the safety and integrity of the gaming environment.

mlb77 uses the following categories of cookies and similar tracking technologies on the Platform:

You may manage or disable non-essential cookies at any time through your browser settings. Please note that disabling certain functional cookies may impair the usability of the Platform, particularly features that rely on remembered preferences. Strictly necessary and fraud prevention cookies cannot be disabled without preventing the Platform from functioning correctly.

mlb77 retains your Personal Data only for as long as is necessary for the purposes for which it was collected, having regard to our legal and regulatory obligations. The following retention schedules apply:

Upon expiry of the applicable retention period, Personal Data will be securely deleted or anonymised so that it can no longer be linked to you as an individual. Where anonymisation is technically and practically feasible, anonymised data may be retained indefinitely for aggregate statistical analysis.

mlb77 has implemented a comprehensive set of technical and organisational security measures designed to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• TLS/SSL Encryption: All data transmitted between your browser or device and mlb77 servers is encrypted in transit using industry-standard TLS 1.2 or higher protocols.
• Encryption at Rest: Sensitive data fields (including identity document scans and financial account references) are encrypted at rest using AES-256 or equivalent standards.
• Password Security: Member passwords are stored exclusively as salted cryptographic hashes. mlb77 staff cannot view your plain-text password under any circumstances.
• Two-Factor Authentication (2FA): 2FA is mandatory for Diamond and Black Diamond VIP tier members and strongly recommended for all other members, providing an additional layer of account security beyond the password.
• Access Controls: Internal access to Personal Data is restricted to mlb77 staff who have a legitimate operational need. Access is logged, audited, and reviewed regularly.
• Penetration Testing: The Platform undergoes regular independent security assessments and penetration testing to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: mlb77 maintains a documented data breach response procedure. In the event of a breach that is likely to result in risk to your rights and freedoms, mlb77 will notify affected Members without undue delay and will report to relevant supervisory authorities as required by applicable law.

No security measure is completely infallible. mlb77 therefore strongly encourages all Members to use strong, unique passwords, to enable 2FA, and to notify support immediately at [email protected] if they suspect any unauthorised access to their account.

The mlb77 Platform is strictly intended for adults aged 21 years and above. mlb77 does not knowingly collect Personal Data from individuals under the age of 21 and does not permit minors to register accounts or participate in any real-money gaming activity on the Platform.

As part of the KYC process, every Member is required to submit government-issued identification confirming that they meet the minimum age requirement. Accounts for which age cannot be verified will be suspended pending successful verification and will not be permitted to make deposits, place wagers, or request withdrawals during the suspension period.

If mlb77 becomes aware — through the KYC process, a report from a third party, or any other means — that a Member is under the age of 21, mlb77 will:

• Immediately suspend the account;
• Delete all Personal Data associated with the account as promptly as technically feasible, subject to any overriding legal retention obligations;
• Return any real-money balance held in the account Wallet to the payment source from which it originated, where technically and practically possible; and
• Report the matter to relevant authorities where required by law.

If you are a parent or guardian and you believe your child has registered an account on mlb77, please contact us immediately at [email protected] with the subject line "MINOR ACCOUNT REPORT" and we will investigate and act without delay.

As an internationally licensed gaming operator, mlb77 may process and store your Personal Data on servers and through service providers located outside Indonesia. These transfers may include data processed by game studios such as Pragmatic Play, Evolution Gaming, and Pocket Games Soft, whose technical infrastructure operates across multiple international jurisdictions.

Where Personal Data is transferred outside your country of residence, mlb77 takes the following measures to ensure that your data continues to receive an adequate level of protection:

• Data Processing Agreements: All international Third-Party Processors are required to enter into data processing agreements with mlb77 that include binding obligations regarding data security, confidentiality, and processing limitations consistent with internationally recognised data protection standards.
• Standard Contractual Clauses: Where applicable, mlb77 relies on internationally recognised contractual mechanisms (including clauses modelled on Standard Contractual Clauses used in comparable regulatory frameworks) to legitimise transfers to jurisdictions that have not received an adequacy decision.
• Security Requirements: All international processors must implement technical and organisational security measures that meet or exceed those described in Section 8 of this policy.

By registering a mlb77 account, you acknowledge that your Personal Data may be transferred to and processed in jurisdictions outside Indonesia in the manner described in this section.

mlb77 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, our data processing practices, or the services we offer. The effective date displayed in the hero section of this page will be updated each time a revision is published.

For material changes — meaning changes that significantly affect your rights or the way your Personal Data is used — mlb77 will provide at least seven (7) days' advance notice via email to your registered address before the changes take effect. For non-material changes (such as corrections of typographical errors or clarifications that do not alter the substance of the policy), the updated policy will take effect immediately upon publication to the Platform.

Your continued use of the Platform following the effective date of any revised Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the revised terms, you should discontinue use of the Platform and may request account closure in accordance with the procedure described in the Terms & Conditions.

For all privacy-related enquiries, data rights requests, or concerns about how mlb77 handles your Personal Data, please contact us through the following channel:

• Email: [email protected] — please use one of the following subject line prefixes to ensure your message reaches the correct team promptly:
  • "DATA RIGHTS REQUEST" — for access, rectification, erasure, portability, or objection requests.
  • "PRIVACY ENQUIRY" — for general questions about this policy or our data practices.
  • "MARKETING OPT-OUT" — to withdraw consent for marketing communications.
  • "MINOR ACCOUNT REPORT" — to report suspected underage account activity.
  • "DATA BREACH REPORT" — to report suspected unauthorised access to your account or Personal Data.

Our support team operates 24 hours a day, 7 days a week, with Indonesian-speaking agents available throughout. Privacy and data rights requests will receive an acknowledgement within 72 hours and a substantive response within 30 calendar days, as described in Section 9.

mlb77 is committed to resolving all privacy concerns promptly, fairly, and in full compliance with our obligations under applicable international data protection standards. Where you are not satisfied with mlb77's handling of your complaint, you may have the right to escalate the matter to a relevant data protection supervisory authority, depending on the laws applicable in your jurisdiction.