Privacy Policy

rafa77 ("rafa77", "the Platform", "we", "us", "our"), operating the website located at rafa77.cam, is committed to protecting the privacy and personal data of every individual who visits, registers on, or interacts with our platform. This Privacy Policy ("Policy") sets out, in clear and accessible terms, the categories of personal data we collect, the purposes for which that data is used, the parties with whom it may be shared, the safeguards we apply to protect it, and the rights available to you in relation to your own data.

This Policy applies to all players registered on rafa77, visitors to the rafa77.cam website, and any individual who contacts our customer support team. It should be read alongside our Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference.

By registering an account, accessing the platform, or otherwise interacting with rafa77's services, you acknowledge that you have read and understood this Policy. If you do not agree with the practices described herein, please do not use the platform.

The following capitalised terms carry the meanings assigned to them in this clause throughout this Policy:

rafa77 collects Personal Data across several categories, depending on how you interact with the platform. The table below summarises the main data types we collect and the primary source of each:

We do not intentionally collect sensitive categories of Personal Data (such as racial or ethnic origin, political opinions, religious beliefs, or health data) unless this is strictly required to fulfil a responsible gaming or legal obligation, in which case your explicit consent will be sought.

rafa77 uses the Personal Data we collect exclusively for the following purposes:

• Account Management: To create, verify, maintain, and administer your rafa77 account, including processing your registration, authenticating your identity, and managing your account settings.
• Transaction Processing: To process deposits and withdrawals via your chosen Indonesian payment method, including BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja, and to maintain accurate transaction records.
• KYC & Compliance: To verify your identity and age (21+), confirm ownership of payment methods, and fulfil our anti-money laundering (AML) and fraud prevention obligations.
• Platform Operations: To deliver, maintain, and improve the functionality, security, and performance of the rafa77 platform and all associated games and services.
• Customer Support: To respond to your enquiries, resolve disputes, and provide assistance with account-related matters through our support channels.
• Responsible Gaming: To monitor player behaviour for indicators of problem gambling, enforce self-exclusion and deposit limit settings, and fulfil our duty of care obligations.
• Promotions & Bonuses: To administer promotional offers, verify bonus eligibility, track wagering requirements, and communicate relevant promotional updates to your registered email address.
• Security & Fraud Prevention: To detect, investigate, and prevent fraudulent activity, money laundering, multi-accounting, bonus abuse, and other prohibited conduct as defined in our Terms & Conditions.
• Legal Obligations: To comply with applicable laws, respond to lawful requests from regulatory or law enforcement authorities, and enforce our Terms & Conditions.
• Analytics & Improvement: To analyse aggregated, anonymised usage data for the purpose of improving platform design, game selection, and user experience.

For each category of data processing activity, rafa77 relies on one or more of the following legal bases:

• Contractual Necessity: Processing required to perform our contract with you — specifically, to operate your account, process transactions, and deliver the platform's core services.
• Legal Obligation: Processing required to comply with applicable law, including KYC identity verification, AML reporting obligations, and responsible gaming duties.
• Legitimate Interests: Processing carried out for rafa77's legitimate business interests — such as fraud prevention, platform security, and analytics — where those interests are not overridden by your privacy rights.
• Consent: Processing carried out on the basis of your explicit, freely given consent — specifically, the sending of optional marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

rafa77 does not sell, rent, or trade your Personal Data to third parties for their own marketing purposes. We may share your data only in the following limited and controlled circumstances:

• Payment Processors: Your financial data is shared with the relevant Indonesian bank or e-wallet provider (BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, LinkAja) solely to the extent necessary to process your deposit or withdrawal transaction.
• KYC & Identity Verification Partners: Identity documents and personal details are shared with our contracted KYC verification service providers for the purpose of confirming your identity and age. These providers operate under strict data processing agreements.
• Game Software Providers: Technical session data (such as player session tokens) may be shared with game studio partners (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft) to the extent required for game delivery and RTP auditing.
• IT & Security Service Providers: Hosting, cybersecurity, and platform infrastructure providers may process certain technical and usage data as part of their service delivery. All such providers are bound by contractual confidentiality obligations.
• Legal & Regulatory Authorities: rafa77 will disclose Personal Data to government bodies, law enforcement agencies, or regulatory authorities where required to do so by applicable law or a lawful order, or where disclosure is necessary to protect the rights, property, or safety of rafa77, its players, or third parties.
• Business Transfers: In the event of a merger, acquisition, or sale of assets involving rafa77, player data may be transferred to the acquiring entity, subject to equivalent privacy protections. Affected players will be notified of any such transfer.

rafa77 uses cookies and similar tracking technologies on the rafa77.cam website. Cookies are small text files stored on your device that allow the platform to recognise your browser across sessions, maintain your preferences, and collect usage analytics.

The cookies deployed by rafa77 fall into the following categories:

• Essential Cookies: Strictly necessary for the platform to function. These include session authentication cookies that keep you logged in, security tokens, and load-balancing identifiers. Essential cookies cannot be disabled without impairing core platform functionality.
• Functional Cookies: Used to remember your preferences — such as your preferred language display, currency format, and game lobby layout — so that these settings persist between visits.
• Analytics Cookies: Used to collect aggregated, anonymised data on how players interact with the platform — which pages are visited most frequently, where users drop off, and how game sessions progress. This data is used exclusively to improve platform performance and user experience.
• Security Cookies: Used to detect and prevent fraudulent activity, multi-accounting, and automated bot access. These cookies are part of rafa77's fraud prevention infrastructure.

rafa77 does not use third-party advertising or behavioural targeting cookies. No cookie data is sold or shared with advertising networks or social media platforms.

rafa77 implements a layered security architecture to protect your Personal Data against unauthorised access, loss, alteration, and disclosure. Our security measures include, but are not limited to:

• 256-Bit SSL Encryption: All data transmitted between your device and rafa77's servers is encrypted in transit using industry-standard TLS/SSL protocols, ensuring that your login credentials, financial details, and personal information cannot be intercepted.
• Encrypted Storage: Sensitive data — including KYC documents, national identity numbers, and financial account references — is stored in encrypted form at rest on our servers.
• Access Controls: Access to Personal Data is restricted to authorised rafa77 staff on a strict need-to-know basis. All staff with data access are subject to confidentiality obligations and regular security training.
• Intrusion Detection: Our platform is monitored continuously for suspicious activity, unauthorised access attempts, and anomalous data patterns using automated detection systems.
• Password Security: Player passwords are stored using industry-standard one-way hashing algorithms. rafa77 staff cannot view or retrieve your password; if lost, it must be reset via the verified email address on your account.
• Secure Payment Processing: Financial transactions are processed through PCI-DSS compliant payment channels. rafa77 does not store complete bank account numbers or e-wallet credentials on its own servers.

Despite these measures, no system connected to the internet is entirely immune to security threats. rafa77 cannot guarantee absolute security, but we are committed to promptly investigating and mitigating any security incidents that may occur, and to notifying affected players in accordance with applicable notification obligations.

You also play a role in keeping your account secure. We strongly encourage you to use a unique, strong password for your rafa77 account, to enable any available two-factor authentication options, and to log out after each session — particularly when using shared or public devices.

rafa77 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligations. The following retention guidelines apply:

• Active Account Data: Personal Data associated with an active player account is retained for the lifetime of the account plus a minimum of five (5) years following permanent account closure, to meet AML record-keeping requirements.
• KYC Documents: Identity verification documents are retained for a minimum of five (5) years from the date of verification or account closure, whichever is later, in compliance with applicable AML and financial record-keeping regulations.
• Transaction Records: Deposit and withdrawal records, including associated payment method references, are retained for a minimum of five (5) years from the date of each transaction.
• Customer Support Records: Communications with our support team are retained for three (3) years from the date of the last interaction, to facilitate dispute resolution and service quality monitoring.
• Marketing Consent Records: Records of your marketing consent or opt-out are retained for the duration of your account plus five (5) years, to demonstrate compliance in the event of a regulatory enquiry.
• Analytics Data: Aggregated, anonymised analytics data that cannot be linked back to an individual may be retained indefinitely for platform improvement purposes.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised so that it can no longer be linked to any individual. Where deletion is technically constrained by backup systems, the data is isolated and protected from further processing until it can be permanently removed.

As a Data Subject, you hold the following rights in relation to the Personal Data that rafa77 holds about you. To exercise any of these rights, please contact our support team using the details in Clause 14.

• Right of Access: You may request a copy of the Personal Data that rafa77 holds about you, along with information about how it is used and with whom it has been shared.
• Right to Rectification: If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or updated. You may also update certain details directly through your account settings.
• Right to Erasure: You may request the deletion of your Personal Data in circumstances where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where processing is unlawful. Note that erasure requests may be subject to overriding legal retention obligations (see Clause 9).
• Right to Restrict Processing: You may request that rafa77 temporarily pause the processing of your Personal Data in certain circumstances — for example, while the accuracy of data is being contested.
• Right to Data Portability: Where processing is based on your consent or contractual necessity, you may request that we provide your Personal Data in a structured, commonly used, machine-readable format suitable for transfer to another service provider.
• Right to Object: You have the right to object to processing carried out on the basis of legitimate interests, including profiling, and to opt out of marketing communications at any time.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

rafa77 will respond to all valid privacy rights requests within thirty (30) calendar days of receipt. In cases of complexity or high volume, we may extend this period by a further thirty (30) days, in which case you will be notified of the extension and the reason for it.

rafa77's platform integrates services from a number of third-party providers. Each provider has its own privacy practices, and while rafa77 contracts each provider to maintain appropriate data protection standards, we encourage you to review their policies independently where relevant. The categories of third-party providers we work with include:

• Game Studios: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft supply the games available on rafa77. Game session data (session tokens, bet amounts, game outcomes) is transmitted to these studios for game delivery and integrity auditing.
• Payment Partners: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) process financial transactions. These providers are regulated financial institutions subject to their own data protection obligations.
• KYC Verification Services: Contracted identity verification partners process identity documents on rafa77's behalf under strict data processing agreements, storing data only for the duration required to complete verification.
• Hosting & Infrastructure: rafa77's servers and network infrastructure are operated by enterprise cloud hosting providers with industry-standard security certifications. These providers may process technical and usage data as part of infrastructure operations.

rafa77 does not integrate social media sign-on, third-party advertising networks, or behavioural targeting systems. No Personal Data is transmitted to social media platforms as part of normal platform operation.

rafa77 strictly prohibits the use of its platform by individuals under the age of 21. We do not knowingly collect Personal Data from minors. Age verification is a mandatory component of the account registration and KYC process, and any account found to belong to an individual under the age of 21 will be immediately suspended and permanently closed.

If you are a parent or guardian and believe that a minor in your care has registered an account or provided Personal Data to rafa77 without your knowledge, please contact our support team immediately at support@rafa77.cam. We will take prompt action to investigate and, where confirmed, delete all associated data and close the account.

rafa77 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or platform functionality. When material changes are made, we will notify registered players via the email address associated with their account, or via a prominent notice displayed on the platform, prior to the changes taking effect.

The "Last updated" date displayed at the top of this Policy indicates when the most recent revision was made. We encourage you to review this Policy periodically. Your continued use of the rafa77 platform following the effective date of any update constitutes your acceptance of the revised Policy.

If you have concerns about any proposed changes to this Policy, you are encouraged to contact our support team before the effective date. If you do not accept the revised Policy, you should discontinue use of the platform and contact support to arrange account closure.

If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your Personal Data, please reach out to the rafa77 data protection team using the details below.

For responsible gaming support, self-exclusion requests, or concerns about gambling behaviour, please visit our Responsible Gaming page. For answers to common questions about account setup, deposits via BCA, BRI, BNI, Mandiri, OVO, DANA, and other local methods, bonuses, and KYC requirements, please visit our FAQ page.