Privacy Policy — novo77

Introduction

This Privacy Policy is issued by novo77 ("we", "us", "our", "the Platform") and applies to all personal data processed in connection with the novo77 online betting and gaming platform accessible at novo77.app and its associated sub-domains. It covers Members who have registered an account, visitors who browse the Platform without registering, and individuals who contact the Platform's support team.

By accessing the Platform and completing account registration, you acknowledge that you have read, understood, and consented to the data practices described in this Privacy Policy. This Policy should be read together with the novo77 Terms & Conditions, which govern the contractual relationship between novo77 and its Members. If you do not agree with any part of this Privacy Policy, you should discontinue use of the Platform and contact support to arrange account closure.

novo77 is committed to transparent, lawful, and fair processing of personal data. We operate in accordance with internationally recognized data protection principles including purpose limitation, data minimization, storage limitation, integrity and confidentiality, and accountability. These principles underpin every data processing activity described in this Policy.

Data Controller

novo77 acts as the data controller in respect of all personal data collected and processed through the Platform. As data controller, novo77 determines the purposes for which personal data is collected and the manner in which it is processed. All data processing activities conducted by third-party service providers on behalf of novo77 are governed by data processing agreements that impose obligations equivalent to those set out in this Policy.

For all privacy-related inquiries, data subject rights requests, or concerns regarding the processing of your personal data, please contact the novo77 Data Protection team at [email protected] with the subject line "Privacy Inquiry". Requests will be acknowledged within two business days and resolved within fourteen business days.

Data We Collect

The following categories of personal data may be collected and processed by novo77 in connection with your use of the Platform. The specific data points collected in each category depend on the features you use and the actions you take on the Platform.

How We Collect Your Data

novo77 collects personal data through the following channels and mechanisms. In all cases, collection is limited to what is necessary for the stated purpose.

• Direct Collection — Registration: When you create a novo77 account, you provide Identity Data and Contact Data directly via the registration form. You choose your own username and password at this stage.
• Direct Collection — KYC Verification: When you submit documents to complete identity and age verification prior to your first withdrawal, you provide Identity Data and KYC Verification Data directly.
• Direct Collection — Transactions: When you make a deposit or request a withdrawal, you provide Financial Data relating to the payment method used. Transaction records are generated automatically by the Platform's payment processing systems.
• Direct Collection — Support Interactions: When you contact our support team via live chat, email, or WhatsApp, Communications Data is recorded and stored for quality assurance and dispute resolution purposes.
• Automated Collection — Platform Usage: Technical Data and Betting & Gaming Data are collected automatically as you browse and interact with the Platform. This includes server logs, session data, and game event records generated by the Platform's backend systems.
• Automated Collection — Cookies and Tracking Technologies: The Platform uses cookies and similar technologies to collect certain Technical Data. Please refer to Section 10 (Cookies) for full details of the cookies we use and your options for managing cookie preferences.
• Third-Party Sources: In limited circumstances, we may receive data from third-party identity verification providers engaged for KYC purposes, fraud detection service providers, and payment processing partners. Data received from third parties is used solely in connection with the purpose for which it was shared.

Purposes of Processing

novo77 processes your personal data for the specific purposes listed below. We do not use your personal data for any purpose that is incompatible with the purposes for which it was originally collected. Where we intend to use personal data for a new purpose, we will update this Privacy Policy and, where required, seek fresh consent.

• Account Creation and Management: To register your account, verify your identity and age (21+ requirement), maintain your account settings, and provide you with access to the Platform's Services.
• Transaction Processing: To process deposits and withdrawal requests in IDR, reconcile account balances, and maintain accurate financial records of all transactions associated with your account.
• KYC and Fraud Prevention: To verify the accuracy of identity information provided at registration, detect and prevent fraudulent activity, money laundering, and unauthorized account access.
• Customer Support: To respond to account queries, resolve disputes, and assist with technical issues reported through live chat, email, or WhatsApp. Support interactions are logged to maintain service continuity and quality.
• Responsible Gaming Compliance: To administer self-exclusion requests, deposit and loss limits, session reminders, and cool-off periods set by Members through the Responsible Gaming Tools. To monitor account activity for early indicators of problematic gambling patterns where relevant responsible gaming obligations apply.
• Legal and Regulatory Compliance: To fulfil obligations under applicable anti-money laundering (AML) regulations, financial record-keeping requirements, and any lawful requests from competent authorities. Financial transaction records are retained for the minimum periods required by applicable law.
• Platform Security: To monitor for unauthorized access attempts, detect suspicious activity, investigate security incidents, and enforce the Platform's Terms & Conditions.
• Service Improvement: To analyze aggregated, anonymized usage data in order to improve Platform performance, user experience, and product offerings. No individual profiling is conducted for service improvement purposes — only aggregated trend analysis.
• Marketing Communications: Where you have explicitly opted in to receive promotional communications, to send you information about novo77 bonuses, seasonal promotions (e.g., Idul Fitri offers, Ramadhan specials), and new product launches. You may opt out of marketing communications at any time by contacting support or using the unsubscribe link in any marketing email.

Legal Basis for Processing

novo77 processes personal data on the following legal grounds. Each processing activity is anchored to at least one lawful basis, and we document those bases internally as part of our data governance obligations.

Sharing Your Data

novo77 does not sell personal data to third parties. We share personal data only in the limited circumstances described below, and only to the extent necessary for the stated purpose. All third-party recipients of personal data are bound by contractual obligations requiring them to maintain appropriate security standards and to use the data solely for the purpose for which it was shared.

• Payment Processing Partners: Financial Data is shared with payment processors and banking partners (including but not limited to intermediaries facilitating transfers via BCA, BRI, BNI, Mandiri, and e-wallets such as OVO, DANA, GoPay) solely to execute deposit and withdrawal transactions. These partners process data as data processors acting on novo77's instructions.
• KYC and Identity Verification Providers: Identity Data and KYC Verification Data may be shared with third-party identity verification service providers for the purpose of age and identity confirmation. These providers operate under data processing agreements and are prohibited from using the data for any other purpose.
• Game Studio Providers: Certain Technical Data and Betting & Gaming Data may be transmitted to game studio providers (such as Pragmatic Play, Evolution Gaming, Pocket Games Soft, and Spribe) in the course of delivering live casino and slot games. This data sharing is limited to what is technically necessary for game delivery and session management.
• Fraud Detection and Security Providers: Technical Data including IP addresses, device identifiers, and session patterns may be shared with fraud detection service providers to identify and prevent unauthorized account access and financial crime.
• Legal and Regulatory Authorities: In response to a lawful request from a competent authority — including financial intelligence units, law enforcement agencies, or regulatory bodies — we may disclose personal data to the extent required by law. We will notify you of any such disclosure where we are legally permitted to do so.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of novo77's business assets, personal data held by the Platform may be transferred to the acquiring entity as part of the transaction. Members will be notified in advance of any such transfer, and the acquiring entity will be bound by the terms of this Privacy Policy or will provide equivalent protections.

Data Retention

Personal data is retained only for as long as it is necessary to fulfil the purposes for which it was collected, or as required to comply with applicable legal, regulatory, and financial record-keeping obligations. The following retention periods apply to the main categories of data processed by novo77.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized. Where deletion is technically constrained by backup systems, data is quarantined from active processing and deleted at the next scheduled backup rotation cycle.

Security

novo77 implements a comprehensive set of technical and organizational security measures to protect personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. While no system can guarantee absolute security, the measures described below represent industry-standard practice for online gaming platforms operating at our scale.

• Encryption in Transit: All data transmitted between your browser and novo77.app is protected by TLS 1.3 encryption with 256-bit AES cipher suites. HTTP connections are automatically redirected to HTTPS. HSTS (HTTP Strict Transport Security) is enforced on the Platform domain.
• Encryption at Rest: Sensitive personal data stored in our databases — including identity documents, payment details, and account credentials — is encrypted at rest using AES-256. Database access is restricted to authorized systems and personnel only.
• Password Security: Account passwords are never stored in plain text. Passwords are hashed using industry-standard one-way cryptographic algorithms with per-user salting. novo77 staff cannot retrieve your password and will never ask for it.
• Access Controls: Access to systems containing personal data is restricted on a need-to-know basis. All internal access is governed by role-based access control (RBAC), multi-factor authentication requirements for privileged accounts, and audit logging of all access events.
• Regular Security Reviews: The Platform undergoes periodic third-party penetration testing and vulnerability assessments. Critical vulnerabilities identified during these reviews are remediated within defined SLA timeframes.
• Incident Response: novo77 maintains a documented data breach response procedure. In the event of a security incident involving your personal data, affected Members will be notified in accordance with applicable notification obligations, and the incident will be reported to the relevant supervisory authority where required.

Cookies & Tracking Technologies

novo77 uses cookies and similar tracking technologies (including local storage and session storage) to operate the Platform effectively, improve user experience, maintain session continuity, and analyze aggregated usage patterns. The following cookie categories are used on the Platform.

You may manage cookie preferences through your browser settings. Most modern browsers allow you to block or delete cookies, though disabling strictly necessary cookies will affect your ability to log in and use core Platform features. For detailed instructions on managing cookies in your specific browser, refer to your browser's help documentation.

novo77 does not use third-party advertising cookies or behavioral targeting cookies. No cookie data is shared with advertising networks or data brokers.

Your Data Rights

As a Member of novo77, you hold the following rights in respect of your personal data. These rights may be subject to certain limitations where processing is required for legal compliance, fraud prevention, or the performance of contractual obligations, but novo77 will always handle rights requests fairly and transparently.

• Right of Access: You have the right to request a copy of the personal data that novo77 holds about you, along with information about how it is being processed. Access requests will be fulfilled within 14 business days of verification of your identity.
• Right to Rectification: You have the right to request correction of any personal data that is inaccurate or incomplete. You may update most account details directly within your account settings. For identity documents and KYC data, corrections must be submitted via the support channel.
• Right to Erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where processing is unlawful. Erasure requests are subject to our data retention obligations under applicable law — we cannot delete financial transaction records before the minimum mandatory retention period has elapsed.
• Right to Restriction: You have the right to request that we restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data you have disputed is being verified, or where you have objected to processing pending determination of whether our legitimate interests override yours.
• Right to Data Portability: Where processing is based on your consent or on the performance of a contract, and is carried out by automated means, you have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing of your personal data where that processing is based on legitimate interests. You also have an unconditional right to object to the use of your personal data for direct marketing purposes at any time.
• Right to Withdraw Consent: Where processing is based solely on your consent (such as marketing communications), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

To exercise any of the above rights, please contact the novo77 Data Protection team at [email protected] with the subject line "Data Rights Request". You will be asked to verify your identity before the request is processed. Requests are handled free of charge in the vast majority of cases; excessive or manifestly unfounded requests may be subject to a reasonable administrative fee.

Minors

novo77 operates a strict 21+ policy. The Platform is intended exclusively for adults who are 21 years of age or older. We do not knowingly collect personal data from individuals under 21. Age verification is conducted as part of the KYC process, and accounts identified as belonging to individuals under 21 will be immediately closed, with all deposits refunded and any associated winnings forfeited.

Parents and guardians who believe a minor may have registered an account on the Platform, or may be accessing the Platform using a shared device, are encouraged to contact our support team immediately at [email protected]. We take such reports seriously and will investigate and act on them as a priority. We also recommend the use of parental control software on shared devices to prevent minors from accessing online betting platforms.

International Data Transfers

In order to deliver the Platform's Services, personal data may be transferred to and processed in countries outside Indonesia. This occurs when we use third-party service providers — such as game studios (Pragmatic Play, Evolution Gaming), cloud infrastructure providers, or KYC verification partners — whose servers or operational headquarters are located outside Indonesia.

Where personal data is transferred internationally, novo77 ensures that appropriate safeguards are in place to protect the data. These safeguards include contractual clauses binding the receiving entity to data protection standards equivalent to those described in this Privacy Policy, and — where applicable — reliance on the adequacy decisions of recognized data protection authorities covering the destination country.

If you would like further information about the international transfer s we make and the safeguards in place, please contact the novo77 Data Protection team at [email protected] with the subject line "International Transfer Inquiry".

Amendments to This Policy

novo77 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, Platform features, applicable law, or regulatory guidance. When we make material changes to this Policy, we will notify active Members via email and/or a prominent notice on the Platform at least 14 days before the changes take effect.

The "Effective Date" and "Last Reviewed" date shown at the top of this document will be updated each time a new version of the Policy is published. Your continued use of the Platform after the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. If you do not agree with any amendment, you should cease using the Platform and contact support to close your account before the revised Policy takes effect.

Previous versions of this Privacy Policy are available on request by contacting [email protected]. We maintain an internal archive of all prior versions with their respective effective dates.

Contact the Data Protection Team

If you have any questions, concerns, or requests relating to this Privacy Policy or to the processing of your personal data by novo77, please reach out to our Data Protection team using the contact details below. We are committed to responding promptly and to resolving privacy concerns fairly and transparently.

All privacy-related requests will be acknowledged within two business days (WIB, UTC+7) and resolved within fourteen business days. Complex requests involving large volumes of data or requiring coordination with third-party processors may take up to 30 days; you will be informed of any extension within the initial 14-day window.