Privacy Policy — atom77
Data Protection Statement

1 Introduction

atom77 ("we", "us", "our", or "the Company") operates the online betting platform accessible at https://atom77.app (the "Platform"). This Privacy Policy constitutes a binding statement of how atom77 collects, processes, stores, shares, and protects the personal data of every individual ("you", "User") who registers, browses, or otherwise interacts with the Platform.

We are committed to processing personal data in a manner that is lawful, transparent, and proportionate to the purposes for which it was collected. Our data practices are aligned with internationally recognised data protection principles including purpose limitation, data minimisation, storage limitation, integrity, and confidentiality. Where those principles intersect with Indonesia's Electronic Information and Transactions Law (UU ITE) and Government Regulation No. 71 of 2019 on Electronic Systems and Transactions (PP 71/2019), we apply the higher standard.

By creating an Account on atom77, depositing funds, placing any Wager, or simply navigating the Platform, you acknowledge that you have read, understood, and agreed to the data practices described in this Privacy Policy. If you do not agree, you must cease using the Platform immediately and may request Account closure in accordance with our Terms & Conditions.

2 Definitions

In this Privacy Policy, the following terms carry the meanings assigned below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to names, identification numbers, location data, email addresses, IP addresses, and financial account details.
• "Processing" means any operation performed on Personal Data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, use, disclosure, transmission, restriction, erasure, or destruction.
• "Data Controller" means atom77, which determines the purposes and means by which Personal Data is processed on the Platform.
• "Data Processor" means any third party that processes Personal Data on behalf of atom77 under a contractual data processing agreement, including payment gateways and KYC verification service providers.
• "Sensitive Data" means a subset of Personal Data warranting a higher level of protection, including government-issued identification numbers (e.g., KTP numbers), financial account details, and device biometric identifiers.
• "Consent" means a freely given, specific, informed, and unambiguous indication of a User's agreement to the processing of their Personal Data for one or more stated purposes.
• "Cookie" means a small text file placed on a User's device by the Platform's web server, used to maintain session state, personalise content, and collect analytical data.
• "KYC" means Know Your Customer — the mandatory identity verification process required before the Company processes withdrawal requests or activates full Account functionality.

3 Data We Collect

atom77 collects only the minimum data necessary to deliver a safe, compliant, and personalised betting experience. The categories of Personal Data we collect are set out in the table below:

4 How We Collect Data

atom77 collects Personal Data through the following channels:

• Direct Submission: Data you actively provide when registering an Account, completing KYC verification, submitting a deposit or withdrawal request, or contacting our customer support team.
• Automated Technologies: Technical Data collected automatically by our web servers and analytics infrastructure each time you access the Platform, including server log files, session cookies, and pixel tags.
• Third-Party KYC Providers: Identity verification results and fraud-risk scores returned by our contracted KYC and AML screening service providers following document submission.
• Payment Processors: Transaction confirmation data and partial account identifiers returned by Indonesian payment gateways and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) upon processing a deposit or withdrawal instruction.
• Game Studio Integrations: Game session result data, RNG outcome logs, and RTP reporting data transmitted by integrated game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft.
• Responsible Gaming Interactions: Limit and exclusion preferences you configure within the Account dashboard, which are stored and applied to your profile to honour your self-management choices.

5 Purpose of Processing

atom77 processes your Personal Data only for clearly defined, legitimate purposes. The table below maps each processing purpose to the relevant data categories:

atom77 does not sell your Personal Data to third-party marketers, data brokers, or advertising networks. Your data is never monetised for purposes unrelated to the operation, security, and improvement of the Platform.

6 Legal Basis for Processing

For each processing activity, atom77 relies on one or more of the following legal bases:

• Contractual Necessity: Processing required to perform the contract between atom77 and the User — principally the operation of the IDR wallet, settlement of Wagers, and delivery of Platform features described in the Terms & Conditions.
• Legal Obligation: Processing required to comply with applicable AML, KYC, data retention, and electronic transaction regulations under international licensing requirements and Indonesian law (UU ITE, PP 71/2019).
• Legitimate Interests: Processing necessary for atom77's legitimate business interests, including fraud detection, platform security, responsible gaming monitoring, and service analytics, provided those interests are not overridden by your fundamental data rights.
• Consent: Processing for optional activities such as marketing communications or enhanced personalisation, where you have given an explicit, freely withdrawable consent. You may withdraw consent at any time by adjusting your Account communication preferences or by contacting [email protected].

7 Data Sharing & Third-Party Disclosure

atom77 shares Personal Data with third parties only where strictly necessary and subject to binding contractual data protection obligations. The categories of recipients are as follows:

• Payment Service Providers: Indonesian bank partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the minimum transactional data required to execute deposit and withdrawal instructions.
• KYC & AML Partners: Contracted identity verification and sanctions-screening service providers receive identity documents and personal details for the purpose of fulfilling our regulatory obligations. All such partners are bound by strict data processing agreements.
• Game Studio Providers: Integrated studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft) receive an anonymised session token and game parameters only — they do not receive your full identity or financial data.
• IT Infrastructure & Security Partners: Cloud hosting, CDN, DDoS protection, and cybersecurity monitoring providers who process Technical Data under data processor agreements and whose servers are secured to at least ISO 27001 standards.
• Regulatory & Law Enforcement Authorities: Where required by a valid legal order, court direction, or mandatory regulatory reporting obligation, atom77 will disclose the minimum Personal Data required by law. The Company will notify the affected User unless prohibited from doing so by the relevant legal authority.

8 Cookies & Tracking Technologies

atom77 uses cookies and similar technologies to maintain session integrity, deliver a personalised experience, and gather aggregated analytics that help us improve the Platform. The following cookie categories are in use:

You may manage or delete cookies at any time through your browser's privacy settings. Disabling functional or analytical cookies will not prevent you from using the Platform's core betting features, but it may reduce the quality of personalisation and session continuity. Disabling strictly necessary or security cookies will impair your ability to log in and may trigger additional security challenges.

9 Data Retention

atom77 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention schedule applies:

• Active Account Data: Retained for the lifetime of the Account and for five (5) years following permanent Account closure, in compliance with international AML record-keeping standards.
• KYC Documents: Retained for five (5) years from the date of submission or from the date of Account closure, whichever is later, in accordance with AML regulatory requirements.
• Financial Transaction Records: Retained for five (5) years from the date of each transaction, as required for AML audit trail integrity.
• Customer Support Communications: Retained for three (3) years from the date of the last communication in each support thread, or for the duration of any open dispute, whichever is longer.
• Technical & Log Data: Server access logs retained for 90 days for security diagnostics; anonymised aggregated analytics data retained for up to 24 months.
• Self-Exclusion Records: Retained indefinitely to ensure that a self-excluded User cannot inadvertently re-register and to honour the spirit of their responsible gaming election.

Upon expiry of the applicable retention period, Personal Data is securely destroyed using industry-standard data erasure protocols. Where complete deletion is not immediately feasible due to backup infrastructure constraints, the data is isolated from active processing and scheduled for deletion at the next available secure erasure cycle.

10 Data Security

atom77 employs a layered security architecture to protect your Personal Data against unauthorised access, accidental loss, alteration, or disclosure. Our security measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the atom77 Platform is encrypted in transit using industry-standard TLS 1.2 or TLS 1.3 protocols.
• Encryption at Rest: Sensitive Data fields — including identity document metadata and financial account identifiers — are encrypted at rest using AES-256 encryption within our database infrastructure.
• Access Controls: Internal access to Personal Data is restricted on a strict need-to-know basis using role-based access controls (RBAC). All internal access events are logged and auditable.
• Two-Factor Authentication (2FA): atom77 strongly encourages Users to enable 2FA on their Accounts. 2FA is mandatory for all withdrawal requests exceeding certain IDR thresholds.
• Penetration Testing: The Platform undergoes regular third-party security penetration testing. Critical vulnerabilities are remediated within 48 hours of identification; non-critical issues within 14 days.
• DDoS Protection & WAF: atom77's infrastructure is protected by enterprise-grade distributed denial-of-service mitigation and a Web Application Firewall to guard against common attack vectors.

11 Your Data Rights

As a User of the atom77 Platform, you hold the following rights with respect to your Personal Data. Requests may be submitted by emailing [email protected] with the subject line "Data Rights Request — [Your Account Username]":

• Right of Access: You have the right to request a copy of the Personal Data atom77 holds about you, together with information about the purposes for which it is processed and the categories of recipients to whom it has been disclosed.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete Personal Data held on your Account. Minor corrections (email address, phone number) may be made directly within Account settings; changes to identity data require KYC re-verification.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (and no other legal basis applies), or where processing is unlawful. This right is subject to overriding legal retention obligations described in Clause 9.
• Right to Restriction of Processing: You may request that atom77 restrict processing of your Personal Data in circumstances where its accuracy is contested, where processing is unlawful but you prefer restriction over erasure, or where you have objected to processing pending verification of legitimate grounds.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity, and is carried out by automated means, you have the right to receive a copy of your Personal Data in a structured, machine-readable format (CSV or JSON) for transfer to another service provider.
• Right to Object: You have the right to object at any time to processing of your Personal Data based on our legitimate interests, including direct marketing communications. Upon receipt of a valid objection, atom77 will cease the objected processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

atom77 targets a response to all data rights requests within 30 calendar days of receipt. Complex requests may be extended by a further 30 days, of which you will be notified. There is no fee for submitting a data rights request unless the request is manifestly unfounded or repetitive, in which case a reasonable administrative fee may apply.

12 Minors & Age Policy

atom77 is strictly an adults-only platform. The minimum age for registration and use of the Platform is 21 years, consistent with responsible gaming standards applied by internationally licensed operators serving the Indonesian market. We do not knowingly collect, process, or store Personal Data belonging to individuals under the age of 21.

Age verification is conducted as part of the mandatory KYC process. Any Account found to belong to an individual under the age of 21 will be immediately suspended, all balances will be frozen, and the Personal Data of the underage User will be securely deleted following completion of the investigation, except where retention is required for regulatory purposes.

13 International Data Transfers

atom77 is an internationally operated platform. Your Personal Data may be processed and stored on servers located outside of Indonesia, including in jurisdictions where the data protection framework differs from Indonesian law. In all cases, atom77 ensures that cross-border data transfers are governed by appropriate safeguards, including:

• Binding contractual clauses (Standard Contractual Clauses or equivalent) incorporated into data processing agreements with all third-party processors operating outside Indonesia.
• Transfers only to processors whose data protection practices have been assessed by atom77 as meeting a standard equivalent to or exceeding the protections afforded by applicable Indonesian electronic data regulations.
• Ongoing monitoring of the adequacy of data protection standards in recipient jurisdictions, with contractual remediation requirements triggered if a jurisdiction's standard materially deteriorates.

Regardless of where your data is processed, atom77 applies the same privacy standards and security controls described in this Privacy Policy to all Personal Data, irrespective of geographic location.

14 Policy Amendments

atom77 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or operational requirements. When material changes are made, we will notify registered Users by email to their registered address and by posting a prominent notice on the Platform, not less than 7 days before the revised policy takes effect — except where an immediate update is required by law, regulatory directive, or urgent security considerations.

The "Last Updated" date at the top of this page always reflects the most recent revision. We encourage you to review this page periodically. Continued use of the Platform after the effective date of a revision constitutes your acceptance of the updated Privacy Policy. If you do not agree with a material change, you are entitled to close your Account in accordance with the Terms & Conditions and request deletion of your Personal Data subject to applicable retention obligations.

15 Contact & Data Protection Officer

If you have any questions, concerns, or complaints regarding this Privacy Policy or atom77's handling of your Personal Data, please contact our Data Protection team through the following channels:

• Email: [email protected] — plain text address, not a clickable link. Use the subject line "Privacy Enquiry — [Your Account Username]" for the fastest routing.
• Live Chat: Available 24/7 via the chat widget in your Account dashboard after logging in. Privacy-related queries are escalated to the compliance team within 4 hours.
• Formal Data Rights Requests: Submit via email to [email protected] with the subject line "Data Rights Request — [Your Account Username]". atom77 targets an initial acknowledgement within 24 hours and a substantive response within 30 calendar days.
• Response Time: Standard privacy enquiries receive an initial response within 24 hours (WIB business hours); formal complaints and data rights requests receive a full written response within 30 calendar days.