Privacy Policy — dna77 Platform

This Privacy Policy applies to all personal data collected, processed, and stored by dna77 in connection with your use of the dna77 online gaming platform, accessible at https://dna77.app, including all sub-pages, products, services, and support channels operated under the dna77 brand.

For the purposes of this Privacy Policy, dna77 ("we", "us", "our") acts as the data controller — meaning we determine the purposes and means of processing your personal data. Our platform is operated for the benefit of Indonesian players aged 21 and above, and all data practices described herein are designed with the security and privacy of that player base in mind.

This Privacy Policy should be read alongside our Terms & Conditions and our Responsible Gaming policy, both of which inform the context in which personal data is used on the dna77 platform.

dna77 collects personal data through several distinct channels. The categories of personal data we collect, and the context in which each is gathered, are set out in the table below.

The majority of personal data we hold is provided directly by you during account registration, KYC verification, payment transactions, and support interactions. Providing accurate and complete data is a condition of holding a dna77 account — see our Terms & Conditions for the full accuracy obligations.

When you access the dna77 platform, our servers and analytics tools automatically record Technical Data and Gaming Activity Data. This data is collected passively and does not require any action on your part. It is used primarily for platform security, fraud prevention, responsible gaming monitoring, and service improvement purposes.

dna77 does not collect or store full payment card numbers (dna77 does not support Visa or Mastercard direct card payments — all transactions use Indonesian bank transfers and e-wallets). We do not collect biometric data beyond the selfie verification photograph required for KYC, and we do not collect data relating to race, religion, political opinion, or health status.

dna77 processes your personal data only where a valid legal basis exists for doing so. The primary legal bases on which we rely are as follows:

• Contractual Necessity: Processing your identity, contact, and financial data is necessary to open and maintain your dna77 account, process deposits and withdrawals in IDR, verify your eligibility to use the platform, and fulfill the obligations set out in our Terms & Conditions.
• Legitimate Interests: dna77 processes Technical Data and Gaming Activity Data on the basis of our legitimate interests in operating a secure platform, detecting fraud and bonus abuse, monitoring for problem gambling behaviors, and improving the quality of our services for all Indonesian players.
• Legal Obligation: Processing KYC and financial transaction data is in part required to comply with applicable anti-money laundering (AML) obligations and to respond to lawful requests from regulatory or law enforcement authorities.
• Consent: Where we send you direct marketing communications (promotional emails, bonus notifications), we do so on the basis of your consent, which you provide during registration by opting in to marketing. You may withdraw marketing consent at any time by contacting [email protected] or updating your account preferences.

dna77 uses the personal data we collect for the following specific purposes. We do not use your data for any purpose that is incompatible with these stated purposes without first notifying you and, where required, obtaining your consent.

Your identity and contact data are used to create, maintain, and administer your dna77 account — including processing login requests, enabling account settings changes, and communicating account-related notifications (balance alerts, KYC status updates, withdrawal confirmations).

Financial data is used to process IDR deposits via BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, and Bank Permata, and e-wallet transactions via OVO, DANA, GoPay, ShopeePay, and LinkAja. We match your registered payment method name to your account name as part of our fraud prevention and KYC compliance obligations.

Identity documents and selfie verification images are used solely for the purpose of verifying that you are who you claim to be, that you are at least 21 years of age, and that your payment methods belong to you. KYC data is not used for marketing purposes.

Technical Data and Gaming Activity Data are analyzed by our fraud prevention systems to detect unusual patterns, including suspected bonus abuse, multi-accounting, money laundering behavior, and unauthorized access attempts. Where a security threat is identified, dna77 may take protective action on your account and notify you accordingly.

Gaming Activity Data — including session lengths, wagering frequency, and deposit patterns — is monitored by dna77's responsible gaming systems to identify players who may be showing signs of problem gambling. Where such signals are detected, our team may proactively reach out with responsible gaming resources. For more information, see our Responsible Gaming page.

Where you have opted in to marketing, your contact data is used to send you promotional offers, bonus notifications, and seasonal campaign information (for example, during Ramadhan, Idul Fitri, and Indonesian Independence Day promotions). You can opt out at any time without affecting your account status.

Communications data from your live chat and email interactions is used to resolve your queries, investigate complaints, and improve the quality of dna77's customer support. Support transcripts may be reviewed by our quality assurance team for training purposes.

dna77 does not sell your personal data to any third party. We share personal data only in the limited circumstances described below, and only to the extent necessary for each stated purpose.

We share data with carefully vetted third-party service providers who assist us in operating the dna77 platform, including:

• Payment processors and banking partners (for routing IDR transactions to and from BCA, BRI, BNI, Mandiri, and e-wallet providers)
• KYC and identity verification platforms (for document and selfie verification processing)
• Cloud hosting and infrastructure providers (for secure data storage and platform availability)
• Customer support software providers (for live chat and ticketing system operation)
• Fraud detection and analytics service providers (for platform security and responsible gaming monitoring)

All service providers are bound by contractual data processing agreements that restrict them from using your data for any purpose beyond delivering their designated service to dna77.

dna77 may disclose personal data to law enforcement agencies, regulatory bodies, or courts of competent jurisdiction where we are legally required to do so, or where disclosure is necessary to protect the safety of our players or the security of the platform. We will, where lawfully permitted, notify affected players of any such disclosure.

In the event of a merger, acquisition, or sale of all or part of dna77's business operations, player data may be transferred to the acquiring entity as part of that transaction. Affected players will be notified in advance of any such transfer, and the acquiring entity will be required to honor the commitments set out in this Privacy Policy.

dna77 retains personal data only for as long as is necessary to fulfill the purposes outlined in this Privacy Policy, or as required by applicable legal and regulatory obligations. The table below summarizes our standard retention periods by data category.

Upon expiry of the applicable retention period, personal data is either permanently deleted from all dna77 systems or irreversibly anonymized such that it can no longer be linked to an identifiable individual.

dna77 uses cookies and similar technologies (including local storage and session storage) to provide a functional, secure, and optimized gaming experience. The following table describes the categories of cookies we deploy.

You can manage and disable non-essential cookies at any time through your browser's privacy or cookie settings. Please note that disabling strictly necessary cookies will prevent you from logging in to your dna77 account and using the platform. dna77 does not use advertising cookies or cross-site tracking cookies of any kind.

dna77 does not embed third-party advertising networks, retargeting pixels, or social media tracking scripts on its platform pages. The cookies present on dna77 are limited to those operated directly by dna77 and its contracted service providers as described above.

dna77 implements a multi-layered security architecture to protect your personal data against unauthorized access, disclosure, alteration, and destruction. Our security measures include, but are not limited to, the following:

• 256-bit SSL/TLS Encryption: All data in transit between your device and dna77's servers is encrypted using TLS 1.2 or higher.
• Encrypted Data at Rest: Sensitive personal data fields (including identity document scans, financial account details, and KYC photographs) are encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data within dna77's internal systems is restricted on a strict need-to-know basis. Staff members are granted only the minimum level of data access required to perform their specific role. All internal access is logged and audited.
• Two-Factor Authentication (2FA): dna77 offers and strongly encourages 2FA for all player accounts, providing an additional layer of protection against unauthorized login attempts.
• Intrusion Detection: dna77's infrastructure is monitored continuously by automated intrusion detection systems that alert our security team to anomalous access patterns in real time.
• Staff Training: All dna77 employees and contractors who handle personal data receive regular privacy and security training as a condition of their engagement.

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, dna77 will notify affected players without undue delay and in any case within 72 hours of becoming aware of the breach. The notification will describe the nature of the breach, the categories of data affected, the likely consequences, and the measures dna77 has taken or proposes to take to address it.

As a player on the dna77 platform, you hold the following rights with respect to your personal data. dna77 is committed to facilitating the exercise of these rights promptly and without unnecessary friction.

To exercise any of the rights listed above, submit your request in writing to [email protected] with the subject line "Privacy Rights Request — [Your Account Username]". dna77 will acknowledge your request within 48 hours and provide a substantive response within 30 calendar days. For complex requests, this period may be extended by up to a further 30 days, in which case you will be notified of the extension and the reason for it.

To protect your privacy, dna77 is required to verify your identity before processing a data rights request. We will ask you to confirm at least two pieces of identifying information that match your registered account details before releasing or modifying any personal data.

You may withdraw your consent to receive marketing communications from dna77 at any time by emailing [email protected] or updating the notification preferences in your account settings. Withdrawal of marketing consent will not affect the lawfulness of any marketing communications sent prior to withdrawal, and will not affect your ability to continue using the dna77 platform.

The dna77 platform is strictly for adults aged 21 and above. dna77 does not knowingly collect personal data from individuals under 21 years of age. Age verification is a mandatory step in the dna77 registration and KYC process, and any account found to belong to a person under 21 will be closed immediately.

dna77 employs automated age-detection signals and manual KYC review specifically to identify and prevent underage access. We take this obligation seriously and continuously invest in improving our age-verification controls.

The dna77 platform integrates third-party game content from licensed providers including Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Pocket Games Soft, among others. While these providers supply game content within the dna77 environment, they may process certain Technical Data (such as session identifiers and game round data) on their own infrastructure under their own privacy frameworks.

dna77 does not control the data practices of third-party game studios and is not responsible for the content of their privacy policies. We contractually require all game providers integrated into the dna77 platform to meet minimum data security standards consistent with this Privacy Policy, but we recommend that players familiarise themselves with provider-specific privacy terms for any game they play regularly.

The dna77 platform does not contain links to external third-party websites for browsing or marketing purposes. Any link visible on dna77 pages leads to another page within the dna77 platform itself.

dna77 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, platform features, or applicable legal requirements. When material changes are made, we will notify active players via email and/or an in-platform notice at least 7 calendar days before the revised policy takes effect.

The effective date displayed at the top of this page will be updated each time the policy is revised. Your continued use of the dna77 platform after the effective date of a revised Privacy Policy constitutes your acknowledgment of the updated terms. If you do not agree with any change, you may request account closure before the revised policy takes effect by contacting our support team.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way dna77 handles your personal data, please reach out through one of the following channels:

• Live Chat: Available 24 hours a day, 7 days a week directly on the dna77 platform. This is the fastest channel for privacy queries requiring immediate attention. Native Indonesian-speaking agents are available around the clock.
• Email: [email protected] — for formal privacy rights requests, data breach reports, and written inquiries. Please include "Privacy Policy" or "Privacy Rights Request" in the subject line for faster routing. Response time: within 48 hours for standard queries; within 5 business days for formal requests.

dna77 is committed to resolving all privacy-related concerns fairly, transparently, and in a timely manner. We take every inquiry seriously regardless of its complexity, and our support team is trained to handle sensitive data-related matters with the discretion they deserve.

This Privacy Policy was last reviewed and updated on January 1, 2026. The version published at https://dna77.app/privacy-policy supersedes all prior versions.