Privacy Policy

cmd77 ("we", "us", "our") operates the online casino and sportsbook platform accessible at https://cmd77.club (the "Platform"). We are committed to safeguarding the privacy and personal data of every individual who accesses or uses our Platform, including registered players, prospective players who browse without registering, and anyone who contacts our support team.

This Privacy Policy ("Policy") describes in detail the categories of personal data we collect, the purposes for which that data is used, the conditions under which it may be shared, the security measures we employ to protect it, and the rights available to you as a data subject. This Policy applies to all users of the Platform, with particular reference to players accessing cmd77 from Indonesia, including those in Jakarta, Surabaya, Medan, Bandung, Yogyakarta, Bali, and other cities across the archipelago.

By registering an account on cmd77 or by continuing to use the Platform after this Policy has been published or updated, you acknowledge that you have read and understood its contents and you consent to the collection and processing of your personal data as described herein. If you do not agree with any provision of this Policy, you must discontinue use of the Platform.

This Policy is incorporated by reference into our Terms & Conditions. In the event of any conflict between this Policy and the Terms & Conditions regarding data privacy matters, this Policy takes precedence.

cmd77 collects personal data through a number of channels: directly from you when you register an account or interact with the Platform; automatically through technical systems as you use the Platform; and, in limited circumstances, from trusted third-party sources for the purpose of identity verification and fraud prevention.

The categories of personal data we collect include, but are not limited to, the following:

cmd77 processes your personal data for clearly defined and legitimate purposes only. We do not process personal data in ways that are incompatible with the purposes for which it was originally collected. The primary purposes for which we use your data are as follows:

• Account Management. To create, maintain, and administer your cmd77 account, authenticate your identity at login, and manage your Wallet balance, transaction history, and account settings.
• Transaction Processing. To process deposits and withdrawals via local Indonesian payment channels including BCA, BRI, BNI, Mandiri, BSI, OVO, DANA, GoPay, ShopeePay, and LinkAja; to reconcile financial records; and to detect and prevent fraudulent transactions.
• Identity Verification & KYC Compliance. To verify your identity in accordance with our anti-money-laundering (AML) and Know Your Customer (KYC) obligations before processing withdrawal requests or when triggered by risk-based monitoring.
• Platform Operation & Improvement. To deliver, maintain, troubleshoot, and improve the cmd77 platform, including game performance, sportsbook functionality, and the overall player experience.
• Responsible Gaming. To monitor gameplay patterns and enforce responsible gaming tools such as deposit limits, loss limits, cool-off periods, and self-exclusion, in accordance with our Responsible Gaming Policy.
• Customer Support. To respond to your support enquiries, resolve disputes, and provide 24/7 assistance in both English and Indonesian.
• Marketing & Promotions. Where you have provided consent, to send you promotional offers, bonus notifications, and personalised marketing communications relevant to your playing preferences. You may withdraw marketing consent at any time through your account settings or by contacting our support team.
• Legal & Regulatory Compliance. To comply with applicable legal obligations, respond to lawful requests from regulatory or law enforcement authorities, and enforce our Terms & Conditions.
• Security & Fraud Prevention. To detect, investigate, and prevent unauthorised access, account takeover attempts, bonus abuse, multi-accounting, and other forms of fraudulent or prohibited conduct on the Platform.

cmd77 processes personal data on one or more of the following legal bases, depending on the specific processing activity involved:

• Contractual Necessity. Processing is necessary to perform the contract between cmd77 and you as a registered player — specifically, to operate your account, process transactions, and deliver the services described in our Terms & Conditions.
• Consent. For optional processing activities such as direct marketing communications, personalised promotions, and the use of non-essential cookies, we rely on your freely given, specific, and informed consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Legitimate Interests. For certain processing activities — such as fraud prevention, platform security, internal analytics, and product improvement — where our legitimate business interests do not override your fundamental rights and freedoms.
• Legal Obligation. Where processing is required to comply with applicable law, including AML/KYC regulations, record-keeping requirements, and responses to lawful government or regulatory requests.

cmd77 does not sell, rent, or trade your personal data to third parties. We may, however, share your data with carefully selected third parties in the following limited circumstances:

• Payment Service Providers. To process deposits and withdrawals, we share the minimum necessary financial data with our payment processing partners, including local Indonesian bank transfer facilitators and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja). These providers are contractually bound to use your data only for the purpose of processing the relevant transaction.
• Identity Verification Providers. KYC documents and identity data may be shared with third-party identity verification and fraud-screening services for the purpose of confirming your identity and assessing risk.
• Game Content Providers. Certain gameplay session data is transmitted to our licensed game studio partners — including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft — as a technical necessity for delivering their games through the Platform. These providers act as data processors under contractual data processing agreements and may not use your data for their own independent purposes.
• IT & Hosting Infrastructure. We use third-party cloud hosting and infrastructure providers to operate the Platform. These providers have access to data stored on our servers solely in their capacity as data processors.
• Legal & Regulatory Authorities. cmd77 will disclose personal data to government bodies, law enforcement agencies, regulators, or courts where required to do so by applicable law or a valid legal order, or where we believe in good faith that disclosure is necessary to protect the rights, property, or safety of cmd77, its players, or the public.
• Business Transfers. In the event of a merger, acquisition, restructuring, or sale of all or part of cmd77's business, your personal data may be transferred to the acquiring entity as part of that transaction, subject to equivalent data protection commitments.

All third parties with whom cmd77 shares personal data are required, by contract, to maintain appropriate technical and organisational security measures and to use the shared data only for the specified purposes.

cmd77 uses cookies and similar technologies — including web beacons, pixel tags, and local storage — on the Platform. These technologies help us deliver a seamless user experience, maintain your logged-in session, understand how the Platform is used, and, where consented, present you with relevant promotional content.

The categories of cookies we use are as follows:

• Strictly Necessary Cookies. These cookies are essential for the Platform to function. They enable core features such as session authentication, security token validation, and your Wallet balance display. The Platform cannot operate properly without them, and they do not require your consent.
• Performance & Analytics Cookies. These cookies collect anonymised or aggregated data about how visitors interact with the Platform — which pages are visited most frequently, where errors occur, and how navigation flows are used. We use this information solely to improve Platform performance and user experience.
• Functional Cookies. These cookies remember your preferences — such as your display language, preferred game category, and notification settings — so that you do not need to reconfigure them on every visit.
• Marketing & Personalisation Cookies. Where you have consented, these cookies allow cmd77 to present promotional banners and bonus offers relevant to your gameplay history and preferences. They do not share your data with third-party advertisers.

You can control and manage cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of the Platform. For browsers used on mobile devices commonly used in Indonesia — including Chrome for Android and Safari for iOS — cookie management settings are accessible through the browser's privacy or site settings menu.

cmd77 retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following general retention principles apply:

• Active Account Data. Personal data associated with an active cmd77 account is retained for the duration of the account's active status plus any legally required post-closure retention period.
• KYC & Identity Documents. Identity verification documents are retained for a minimum of five (5) years from the date of account closure, in accordance with standard AML record-keeping requirements applicable to internationally licensed gaming operators.
• Financial Transaction Records. Records of deposits, withdrawals, and Wallet transactions are retained for a minimum of five (5) years from the date of each transaction.
• Support Communications. Live chat transcripts and email support records are retained for up to three (3) years from the date of the interaction, or longer where the communication relates to an unresolved dispute.
• Marketing Data. Where consent for marketing has been withdrawn, marketing preference data is retained for a sufficient period to demonstrate the withdrawal of consent and to prevent inadvertent re-contact.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be attributed to an identifiable individual.

cmd77 implements comprehensive technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include, but are not limited to:

• 256-bit SSL/TLS encryption for all data in transit between your device and our servers.
• Encryption of sensitive data at rest, including stored passwords (which are never stored in plain text — only as salted cryptographic hashes) and KYC document files.
• Strict role-based access controls ensuring that only authorised personnel can access personal data, and only to the extent required for their specific duties.
• Regular security audits, vulnerability assessments, and penetration testing of the Platform's infrastructure.
• Multi-factor authentication (MFA) requirements for administrative access to backend systems.
• Contractual data processing agreements with all third-party processors requiring equivalent security standards.

While cmd77 takes all reasonable precautions to secure your data, no internet-based platform can guarantee absolute security. In the event of a data breach that is likely to pose a risk to your rights and freedoms, cmd77 will notify affected players in a timely manner in accordance with applicable data breach notification obligations.

As a data subject, you hold the following rights with respect to the personal data cmd77 holds about you. These rights may be exercised at any time by contacting our support team through live chat or by emailing [email protected]. cmd77 will respond to all valid data subject requests within thirty (30) days of receipt.

cmd77 may request proof of identity before processing a data subject request to ensure that data is not disclosed to an unauthorised party. Where a request is manifestly unfounded or excessive, cmd77 reserves the right to charge a reasonable administrative fee or to decline to act on the request, with written reasons provided.

The cmd77 Platform integrates third-party services — including game content providers, payment processors, and analytics tools — that may independently collect or process certain technical data about your device and interaction with the Platform. These third-party services operate under their own privacy policies and data practices, and cmd77 is not responsible for those policies.

Game content delivered through providers such as Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft is delivered via iFrame or API integration. These studios may collect session metadata necessary to render their games; they do not receive your full personal profile and are bound by data processing agreements with cmd77 that restrict the use of any data they receive to the sole purpose of delivering their content.

The Platform does not embed third-party advertising networks or social media tracking pixels. cmd77 does not share your data with social media platforms for retargeting or audience-building purposes without your explicit, separately obtained consent.

The cmd77 Platform is strictly intended for adults aged 21 and over. We do not knowingly collect, process, or retain personal data from individuals under the age of 21. Our registration process requires users to confirm their date of birth, and KYC verification is used to validate age where required.

If cmd77 becomes aware that an account has been registered by or on behalf of a minor, that account will be immediately suspended and all associated personal data will be deleted in accordance with our data retention practices, subject to any legally required retention period. Any funds held in the account will be handled in accordance with our Terms & Conditions and applicable legal obligations.

If you are a parent or guardian and believe that a minor in your care has registered an account on cmd77, please contact our support team immediately at [email protected] so that we can take prompt action.

cmd77 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform functionality. The date of the most recent revision is displayed at the top of this page.

Where a change is material — meaning it significantly affects the way we collect or use your personal data, or the rights you hold — we will notify registered players by displaying a notice upon their next login, by email to the address registered on their account, or both, at least seven (7) days before the change takes effect.

Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Policy. If you do not agree with the revised Policy, you must cease using the Platform and may request account closure in accordance with the Terms & Conditions.

We encourage you to review this Privacy Policy periodically to remain informed about how cmd77 protects your personal data.

If you have any questions, concerns, or requests relating to this Privacy Policy or cmd77's data protection practices, please contact our team through any of the following channels:

• Live Chat: Available 24/7 directly on the cmd77 Platform, staffed by native Indonesian-speaking agents fluent in English — covering WIB (UTC+7), WITA (UTC+8), and WIT (UTC+9) time zones at all hours.
• Email: [email protected] (plain text — not a clickable link). Please use the subject line "Privacy Request — [Your Full Name] — [Account Username]" to ensure prompt routing to our data protection team.

For formal data subject requests (access, rectification, erasure, portability, objection), we will acknowledge receipt of your request within five (5) business days and aim to provide a full response within thirty (30) days. Where a request is particularly complex or we have received a high volume of requests, we may extend this period by a further thirty (30) days, in which case we will notify you of the extension and the reason for it.