suma77 is committed to protecting your personal data with the highest standards of security and transparency. This Privacy Policy explains exactly what we collect, why we collect it, and how it is safeguarded.
All data transmitted between your device and suma77's servers is encrypted using industry-standard 256-bit SSL technology. No sensitive data travels over unencrypted channels.
suma77 does not sell, rent, or trade your personal data to unaffiliated third parties for marketing purposes. Your information is used exclusively to operate and improve your Platform experience.
Personally identifiable information stored on suma77's systems is held in encrypted form. Access to production data is restricted to authorised personnel only, subject to strict access controls.
Identity documents submitted for KYC verification — including KTP, passport, and proof-of-address documents — are processed by certified verification partners and are never stored insecurely or shared without authorisation.
You have the right to access, correct, or request deletion of your personal data held by suma77, subject to legal and regulatory retention obligations. Submit data requests to [email protected].
All IDR transactions via BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, and other supported Indonesian payment providers are routed through PCI-DSS compliant payment gateways. suma77 does not store full payment account numbers.
For the purposes of this Privacy Policy, the following terms have the meanings assigned to them below:
suma77 collects Personal Data in the following categories, depending on how you interact with the Platform:
When you create a Player Account, we collect your full legal name, date of birth, residential address in Indonesia, email address, Indonesian mobile phone number, and a username of your choosing. This information is required to establish your Account identity and to fulfil our KYC obligations.
To comply with internationally recognised anti-money-laundering standards and to verify that all Players are at least 21 years of age, we may request copies of government-issued identity documents such as your Indonesian national identity card (KTP), passport, or driving licence. Proof-of-address documents such as a recent utility bill or bank statement may also be required. These documents are processed by our certified KYC partner and are stored in encrypted form.
suma77 collects records of all deposits, withdrawals, bonuses, and wager transactions associated with your Account. For deposit and withdrawal processing, we collect payment method identifiers — such as bank account names, e-wallet account numbers registered to OVO, DANA, GoPay, ShopeePay, or LinkAja, or the last four digits of a bank account — sufficient to process and reconcile transactions. Full bank account numbers are never stored on suma77's servers beyond the minimum period required for transaction processing.
When you access the Platform, our servers automatically log your IP address, browser type and version, operating system, device type (desktop, mobile, tablet), screen resolution, referring URL, pages visited, session duration, and approximate geographic location derived from your IP address. This data is used for fraud prevention, security monitoring, and Platform performance optimisation.
suma77 records all gaming activity on the Platform, including which games were played, wager amounts, game outcomes, session times, and responsible gaming tool usage (deposit limits set, cooling-off periods requested, self-exclusion events). This data is retained for regulatory compliance, dispute resolution, and to support the Platform's responsible gaming obligations.
When you contact suma77's support team via live chat or email, we retain records of those communications including the content of your messages, timestamps, and the resolution of any support request. This data is used for quality assurance, training, and to maintain an accurate record of your relationship with the Platform.
The Platform uses Cookies and similar tracking technologies to maintain your login session, store preferences, analyse usage patterns, and deliver a consistent experience across visits. Details of the specific Cookies used are set out in Clause 7 of this Policy.
suma77 processes your Personal Data on one or more of the following legal bases, each of which is described alongside the corresponding Processing purpose:
| Processing Purpose | Legal Basis | Data Categories Involved |
|---|---|---|
| Account creation and management | Contractual necessity | Registration data, device data |
| Payment processing and reconciliation | Contractual necessity | Financial/transaction data |
| Identity and age verification (KYC) | Legal obligation / contractual necessity | KYC documents, registration data |
| Fraud prevention and security monitoring | Legitimate interests | Technical data, behavioural data |
| Responsible gaming compliance | Legal obligation / legitimate interests | Gaming data, communication data |
| Customer support and dispute resolution | Contractual necessity / legitimate interests | Communication data, gaming data |
| Promotional communications (opt-in only) | Consent | Registration data, behavioural data |
| Platform analytics and performance optimisation | Legitimate interests | Technical data, cookie data |
| Regulatory reporting and legal compliance | Legal obligation | All categories as required |
Where suma77 relies on consent as the legal basis for Processing (specifically, for promotional email and SMS communications), you have the right to withdraw that consent at any time by updating your communication preferences in Account Settings or by contacting support at [email protected]. Withdrawal of consent does not affect the lawfulness of Processing carried out prior to withdrawal.
suma77 does not sell, rent, or broker your Personal Data to unaffiliated third parties for their own commercial purposes. We may share your data only in the circumstances described below, and in each case we ensure that appropriate contractual protections are in place:
To process IDR deposits and withdrawals via BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, and LinkAja, suma77 shares the minimum transaction data necessary with our licensed payment gateway partners. These partners are contractually bound to process your data only for payment fulfilment purposes and are prohibited from using it for any other purpose.
suma77 engages certified third-party identity verification service providers to conduct KYC checks on Player Accounts. These providers receive the identity documents you submit and return a verification result to suma77. They are subject to strict data processing agreements and internationally recognised information security standards.
suma77 shares certain technical and behavioural data with fraud prevention and cybersecurity service providers to detect and prevent unauthorised access, account takeover attempts, and financial fraud. This sharing is conducted on the basis of suma77's legitimate interest in protecting Players and the integrity of the Platform.
suma77 may disclose Personal Data to regulatory authorities, law enforcement agencies, courts, or other governmental bodies where required to do so by applicable law or by a valid legal process such as a court order or regulatory investigation notice. In such cases, suma77 will disclose only the minimum data required and will notify the affected Player where legally permitted to do so.
In the event of a merger, acquisition, restructuring, or sale of all or part of suma77's business, Personal Data held by suma77 may be transferred to the relevant successor entity as part of that transaction. Players will be notified of any such transfer and of any material changes to the applicable privacy terms within a reasonable timeframe prior to the transfer taking effect.
suma77 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention schedule applies:
| Data Category | Retention Period | Basis for Retention |
|---|---|---|
| Account registration data | Duration of Account + 5 years post-closure | Legal obligation / contractual |
| KYC identity documents | Duration of Account + 5 years post-closure | AML / legal obligation |
| Financial transaction records | Duration of Account + 7 years post-closure | Financial regulatory obligation |
| Gaming activity logs | Duration of Account + 3 years post-closure | Dispute resolution / compliance |
| Support communication records | 3 years from date of communication | Legitimate interests / legal |
| Technical / device / IP logs | 12 months from collection date | Security / fraud prevention |
| Marketing preferences (opted-in) | Until consent withdrawn + 1 year | Consent |
Upon expiry of the applicable retention period, suma77 will securely delete or anonymise the relevant Personal Data in accordance with our internal data destruction procedures. Anonymised or aggregated data that can no longer be linked to an individual may be retained indefinitely for statistical and analytical purposes.
suma77 respects your rights over your Personal Data. Depending on the applicable legal framework, you may be entitled to exercise the following rights by contacting [email protected]:
suma77 will respond to all data rights requests within 30 days of receipt. Where a request is complex or voluminous, this period may be extended by a further 60 days with prior notification to you. suma77 reserves the right to request proof of identity before actioning any data rights request to prevent unauthorised access to another Player's data.
The suma77 Platform uses Cookies and similar technologies including local storage and session tokens to provide core functionality, improve performance, and gather analytics. The following categories of Cookies are used:
| Cookie Category | Purpose | Can Be Disabled? |
|---|---|---|
| Strictly Necessary | Session management, login authentication, security tokens, load balancing | No — required for Platform function |
| Functional / Preference | Language preferences, display settings, responsible gaming tool states | Yes — via Account Settings |
| Analytics | Aggregated page-view statistics, session duration, device type breakdowns used to optimise Platform performance | Yes — via browser settings |
| Fraud Prevention | Device fingerprinting, bot detection, suspicious-session identification | No — required for security |
suma77 does not use third-party advertising or retargeting Cookies. You may manage Cookie preferences through your browser settings; however, disabling strictly necessary or fraud-prevention Cookies may prevent you from accessing certain features of the Platform. All Cookies set by suma77 are first-party Cookies scoped to the suma77.app domain.
suma77 implements a layered information security programme to protect Personal Data from unauthorised access, alteration, disclosure, or destruction. Key measures include:
The suma77 Platform is strictly intended for adults aged 21 years and older. suma77 does not knowingly collect Personal Data from persons under 21 years of age. Age verification is a mandatory step in the Account registration process, and suma77 may request documentary proof of age at any point during the Account lifecycle.
If suma77 becomes aware that Personal Data has been collected from a person under 21 years of age, it will immediately suspend the relevant Account, delete the associated Personal Data to the extent permitted by applicable legal obligations, and notify relevant authorities where required. Parents and guardians who believe that a minor in their care has created a suma77 Account are urged to contact [email protected] immediately. Parental control software solutions are recommended for households where minors have access to internet-connected devices.
suma77 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform functionality. Material changes — those that significantly affect your rights or how your data is used — will be communicated to registered Players via the email address associated with their Account and/or via a prominent notice on the Platform, with a minimum of seven (7) days' advance notice before the updated Policy takes effect.
The current version of this Policy, along with its effective date and version number, will always be accessible on this page. We encourage you to review this Policy periodically. Your continued use of the Platform following the effective date of any revision constitutes your acceptance of the updated Policy. If you do not accept a revised Policy, you must cease using the Platform and may request Account closure by contacting [email protected].
For all privacy-related queries, data rights requests, or concerns regarding this Policy, please contact suma77 through the following channel:
All formal data rights requests and privacy complaints must be submitted in writing to the email address above. Please include your registered Account email address and a clear description of your request or concern to enable efficient handling. suma77 may request proof of identity before actioning data rights requests to protect your Account from unauthorised third-party access.
suma77 protects your privacy so you can focus on what matters — exploring 500+ certified games, zero-fee IDR withdrawals, and world-class live casino action.