max77 is committed to protecting the privacy and personal data of every Member. This Privacy Policy explains what data we collect, why we collect it, how it is stored and secured, who it may be shared with, and the rights you hold over your own information as an Indonesian player on our platform.
Effective Date: 1 January 2026 · Last Revised: 1 January 2026Every connection to max77 is secured with 256-bit SSL/TLS encryption. Data transmitted between your device and the max77 Platform — including login credentials, payment details, and personal information — is protected from interception at all times.
Personal data is stored on access-controlled servers. Passwords are stored exclusively as bcrypt-hashed values — never in plain text. Payment information is tokenised and processed through certified payment processors; max77 does not store raw card or bank account numbers.
max77 does not sell, rent, or license your personal data to unaffiliated third parties for commercial marketing purposes. Data sharing with third parties is limited strictly to operational necessity — payment processors, KYC verification providers, and regulatory compliance obligations.
max77 conducts Know Your Customer (KYC) verification to confirm the identity and age of all Members. Documents submitted for KYC purposes — including copies of Indonesian KTP, passports, or driving licences — are handled with strict confidentiality and used solely for verification.
You have the right to access, correct, and request deletion of your personal data held by max77, subject to legal retention obligations. You may also withdraw consent for optional data processing (such as marketing communications) at any time through your Account settings.
max77 will notify you of any material changes to this Privacy Policy by email to your registered address before the changes take effect. Marketing communications are opt-in only and can be unsubscribed from at any time through your Account settings or by contacting support.
In this Privacy Policy, the following terms carry the meanings set out below unless the context requires otherwise:
max77 acts as the data controller with respect to the Personal Data of all Members and visitors to the Platform. This means max77 determines the purposes for which, and the manner in which, your Personal Data is processed.
Any questions, requests, or concerns relating to this Privacy Policy or the processing of your Personal Data should be directed to the max77 Data Protection team via the contact details set out in Section 14 of this Policy.
Scope: This Privacy Policy applies to all Personal Data collected by max77 through the Platform, including data collected during account registration, KYC verification, deposits and withdrawals, customer support interactions, and general use of the Platform's gambling products.
max77 collects Personal Data through multiple touchpoints on the Platform. The categories of data collected, and the context in which they are collected, are set out in the table below.
| Category | Examples | When Collected |
|---|---|---|
| Identity Data | Full legal name, date of birth, nationality, KTP / passport number | Account registration; KYC verification |
| Contact Data | Email address, Indonesian mobile number, residential address | Account registration; Account updates |
| Financial Data | Bank account details (BCA, BRI, BNI, Mandiri, etc.), e-wallet identifiers (OVO, DANA, GoPay), deposit and withdrawal history, transaction amounts in IDR | Deposits; Withdrawals; KYC verification |
| Account & Gaming Data | Account ID, login history, game session history, betting records, bonus activity, responsible gaming tool settings | Platform use; Gameplay; Bonus claims |
| Technical Data | IP address, device type and operating system, browser type, session timestamps, geolocation (country/region level) | Automatic collection upon Platform access |
| Communications Data | Live chat transcripts, email correspondence, support ticket records | Customer support interactions |
| KYC Documentation | Copies of Indonesian KTP, passport, SIM (driving licence), selfie verification images, proof of address documents | KYC verification process |
This includes information you actively submit during registration, KYC verification, payment transactions, customer support enquiries, and when updating your Account profile.
When you access the Platform, max77 automatically collects certain Technical Data through server logs, cookies, and analytics tools. This data is primarily used for Platform security, fraud prevention, and performance optimisation. See Section 9 for details on cookies and tracking technology.
max77 may receive data about you from third-party sources in limited circumstances, including from KYC identity verification providers who confirm the authenticity of documents you submit, and from payment processors who confirm transaction status. Such data is used solely in conjunction with the purpose for which it was obtained.
max77 processes Personal Data only for specified, explicit, and legitimate purposes. The primary purposes for which we use your data are set out below.
Your Identity Data and Contact Data are used to create and manage your max77 Account, process password resets, and communicate essential account-related notifications such as deposit confirmations, withdrawal approvals, and security alerts.
We are required to verify your identity and confirm that you are at least 21 years of age before processing withdrawals. KYC Documentation is used solely for this verification purpose and is not used for any other form of profiling or marketing activity.
Financial Data is used to process deposits and withdrawals via your chosen Indonesian payment method — whether bank transfer (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI) or e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja). All transactions are denominated in Indonesian Rupiah (IDR).
Technical Data, Financial Data, and Account Data are used to detect and prevent fraudulent activity, money laundering, bonus abuse, and unauthorised access to Member accounts. This includes automated monitoring systems that flag unusual transaction patterns for manual review.
Account and Gaming Data are used to support the Platform's responsible gaming programme, including monitoring for patterns that may indicate problem gambling behaviour and ensuring that self-exclusion and cooling-off period requests are honoured across all Platform products.
Communications Data and Account Data are used by the max77 support team to respond to your enquiries, resolve disputes, and provide the 24/7 Indonesian-speaking support service. Support interactions may be recorded and retained for quality assurance and dispute resolution purposes.
Aggregated and anonymised Technical Data and Gaming Data are used to analyse Platform performance, identify areas for product improvement, and optimise the user experience. This analytics processing does not identify individual users.
Where you have provided explicit consent, max77 may use your Contact Data to send promotional communications about new products, bonus offers, seasonal promotions (including events aligned with Indonesian occasions such as Idul Fitri and Ramadhan), and platform updates. You may withdraw this consent at any time through your Account settings or by contacting support.
max77 processes Personal Data on the following lawful bases:
max77 does not sell your Personal Data to third parties. We share Personal Data only in the following limited circumstances:
Financial Data is shared with our certified payment processing partners — including bank gateway providers and e-wallet platforms such as OVO, DANA, and GoPay — solely for the purpose of processing deposits and withdrawals. Each payment processor is contractually bound to process data only for the stated purpose and in compliance with applicable data protection standards.
Identity Data and KYC Documentation are shared with third-party identity verification service providers to conduct age verification and document authentication. These providers act as processors on behalf of max77 and do not use your data for any purpose other than the verification task assigned.
In connection with your use of casino and sportsbook products, limited Account Data (such as anonymised player identifiers and session data) may be shared with game studios including Evolution Gaming, Pragmatic Play, Microgaming, NetEnt, SA Gaming, Pocket Games Soft, and Spribe. This is necessary for game session management, RNG integrity, and dispute resolution. These providers do not receive your full personal profile.
max77 may disclose Personal Data to regulatory authorities, law enforcement agencies, or courts where required to do so by applicable law, a court order, or regulatory direction. In such cases, max77 will disclose only the minimum information required.
In the event of a merger, acquisition, or sale of all or part of max77's business, Personal Data held by max77 may be transferred to the successor entity. We will notify affected Members of any such transfer and the applicable data protection terms before the transfer takes effect.
No Sale of Data: max77 does not sell, rent, or license your Personal Data to unaffiliated third parties for their own commercial marketing purposes. Any third parties with whom data is shared are subject to binding data processing agreements.
max77 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The general retention periods applicable to the main categories of Personal Data are as follows:
| Data Category | Retention Period | Basis |
|---|---|---|
| Identity & Contact Data | Duration of active Account + 5 years post-closure | Legal obligation (AML/KYC regulatory requirements) |
| Financial & Transaction Data | Duration of active Account + 5 years post-closure | Legal obligation (financial record-keeping) |
| KYC Documentation | Duration of active Account + 5 years post-closure | Legal obligation (identity verification compliance) |
| Gaming & Betting Records | Duration of active Account + 2 years post-closure | Legitimate interest (dispute resolution) |
| Support Communications | 3 years from last interaction | Legitimate interest (quality assurance, dispute evidence) |
| Technical / Log Data | 90 days from collection | Legitimate interest (security monitoring) |
| Marketing Consent Records | Until consent is withdrawn + 1 year | Legal obligation (demonstrating lawful consent) |
Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in accordance with max77's data destruction procedures.
max77 employs a layered approach to data security designed to protect Personal Data against unauthorised access, accidental loss, alteration, or disclosure. The primary security measures in place include:
While max77 maintains robust security practices, no system is entirely immune to risk. You should keep your Account credentials confidential, use a strong unique password for your max77 Account, and notify max77 support immediately if you suspect unauthorised access to your Account.
Cookies are small text files placed on your device when you visit the Platform. They allow the Platform to recognise your device, remember your preferences, maintain your login session, and gather anonymous usage statistics.
You may manage or disable non-essential cookies through your browser's settings. Please note that disabling certain cookies may affect the functionality of the Platform — in particular, disabling essential cookies will prevent you from logging in or processing payments. Consult your browser's help documentation for guidance on managing cookie preferences.
The max77 Platform serves Indonesian players primarily, and the majority of data processing occurs in connection with Indonesian payment infrastructure. However, as a platform operating internationally with technology providers headquartered in multiple jurisdictions, some processing of Personal Data may occur outside Indonesia.
Where Personal Data is transferred to, or processed by third parties in, jurisdictions outside Indonesia, max77 ensures that appropriate safeguards are in place to protect that data to a standard comparable to the protections afforded within Indonesia. These safeguards include contractual data protection clauses in agreements with all Third-Party Processors who handle Personal Data on max77's behalf.
As a Member of max77, you hold the following rights in relation to your Personal Data. To exercise any of these rights, contact the max77 Data Protection team using the contact details in Section 14.
You have the right to request a copy of the Personal Data max77 holds about you. max77 will respond to a verified access request within a reasonable timeframe and without charge for a first request within any 12-month period.
If any of your Personal Data held by max77 is inaccurate or incomplete, you have the right to request that it be corrected. Contact support or update your Account profile directly for routine changes such as email address or contact number updates.
You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where the processing was unlawful. This right is subject to max77's legal retention obligations — data required for AML/KYC compliance must be retained for the prescribed period regardless of erasure requests.
In certain circumstances — such as where you contest the accuracy of data or object to processing — you may request that max77 restrict the processing of your Personal Data while the matter is being resolved.
Where processing is based on your consent or on a contract, you have the right to receive your Personal Data in a structured, commonly used, and machine-readable format, and to have it transmitted to another controller where technically feasible.
You have the right to object to the processing of your Personal Data on the grounds of legitimate interests, or to processing for direct marketing purposes. Where you object to direct marketing processing, max77 will cease that processing immediately.
Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that occurred before the withdrawal. To withdraw consent for marketing communications, update your preferences in Account Settings or contact support directly.
How to Exercise Your Rights: All data rights requests should be submitted via live chat or email to [email protected]. max77 will verify your identity before processing any request and will respond within a reasonable timeframe. There is no charge for exercising your rights in ordinary circumstances.
The max77 Platform is strictly intended for adults aged 21 years and over. max77 does not knowingly collect Personal Data from persons under the age of 21. Age verification is conducted as part of the KYC process for all registered Members.
If max77 becomes aware that Personal Data has been collected from a person under the age of 21 without valid parental or guardian consent, we will take immediate steps to delete that data and close the associated Account. If you believe a minor may have accessed the Platform or provided their data, please contact max77 support immediately.
max77 reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, or our data processing practices. When material changes are made, max77 will notify registered Members by email to their registered address at least seven (7) days before the revised Policy takes effect.
Non-material changes — such as corrections of typographical errors or clarifications that do not alter the substance of the Policy — may be made without prior notice, and the revised date noted at the top of the Policy will be updated accordingly. We recommend reviewing this page periodically to stay informed of how max77 handles your data.
For all privacy-related enquiries, data rights requests, or concerns about how max77 processes your Personal Data, please contact the max77 Data Protection team through the following channels:
Please include "Privacy Request" in the subject line of email enquiries to ensure your message is routed to the appropriate team. max77 commits to acknowledging all privacy requests within two (2) business days and resolving them within a reasonable timeframe.
max77 customer support operates with Indonesian-speaking agents available at all times. All data protection enquiries may be submitted in English or Indonesian; responses will be provided in English by default, with Indonesian available on request.
This Privacy Policy was last reviewed and updated on 1 January 2026. By continuing to use the max77 Platform after this date, you acknowledge that you have read and understood the current version of this Privacy Policy.
If you have questions about your data or want to exercise any of your rights, our 24/7 support team is ready to help. You can also explore our full Terms & Conditions or visit our FAQ for quick answers.
Terms & Conditions Read the FAQ Sign In to max77