Privacy Policy

Biru77 ("Biru77", "we", "us", "our") operates the online gaming platform accessible at biru77.asia (the "Platform"). As the data controller for the personal information you provide to us, Biru77 is committed to processing that information lawfully, transparently, and in accordance with applicable data protection principles.

This Privacy Policy ("Policy") explains what personal data Biru77 collects from users ("you", "User", "Player") of the Platform, how that data is used, with whom it may be shared, how it is protected, how long it is retained, and what rights you have in relation to it. This Policy applies to all personal data collected through: (a) account registration and maintenance; (b) identity verification (KYC) processes; (c) deposits, withdrawals, and transaction history; (d) customer support interactions; and (e) your general use of Platform features.

This Policy should be read alongside our Terms & Conditions and our Responsible Gambling Policy. By using the Platform, you confirm that you are at least 21 years of age and consent to the processing of your personal data as described herein.

The following terms, as used in this Policy, carry the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, location data, online identifiers, or factors specific to the physical, economic, cultural, or social identity of that person.
• "Processing" means any operation or set of operations performed on Personal Data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, use, disclosure, transmission, restriction, erasure, or destruction.
• "Data Controller" means Biru77, as the entity that determines the purposes and means of processing your Personal Data.
• "Data Processor" means any third party that processes Personal Data on behalf of Biru77 under a contractual agreement, including payment processors, KYC verification providers, and IT hosting providers.
• "Consent" means a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your Personal Data for a stated purpose.
• "Cookies" means small text files stored on your device by your web browser at the instruction of the Platform, used to maintain session state and collect anonymised usage data.

Biru77 collects personal data that is necessary and proportionate to the purposes described in Section 5 of this Policy. The categories of personal data we collect are as follows:

Biru77 collects personal data through the following channels:

• Direct submission: Information you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting customer support, or updating your Account profile.
• Automated technical collection: Technical and usage data collected automatically through cookies, web server logs, and analytics tools when you access and interact with the Platform. This collection occurs regardless of whether you are logged into your Account.
• Third-party sources: Identity and fraud-risk data received from licensed KYC verification providers and fraud-detection services during the account verification process. Financial data received from payment processors (including FPX, DuitNow, Maybank, CIMB, Touch 'n Go eWallet, Boost, GrabPay, Public Bank, and Hong Leong Bank) in connection with the processing of deposits and withdrawals.

Biru77 does not purchase data lists or obtain personal data from social media platforms, data brokers, or other commercial data aggregation services for profiling or marketing purposes.

Biru77 processes your personal data only for specified, explicit, and legitimate purposes. The table below sets out the primary processing activities, their purposes, and the applicable legal basis for each:

Biru77 does not sell, rent, or trade your personal data to any third party for commercial or marketing purposes. We may share your personal data with third parties only in the following limited circumstances:

• Payment processors: Personal and financial data is shared with licensed payment service providers (including FPX, DuitNow, Maybank, CIMB, Touch 'n Go eWallet, Boost, GrabPay, Public Bank, and Hong Leong Bank) solely for the purpose of processing your transactions. These providers operate under their own data protection policies and are contractually prohibited from using your data for any purpose other than processing the relevant payment.
• KYC and identity verification providers: Identity documents and personal data may be transmitted to licensed third-party verification services to conduct identity, age, and fraud checks on our behalf, as required under applicable AML regulations.
• Game studios and content providers: Anonymised session and gameplay data may be shared with our licensed game studio partners for the purpose of technical integration, RTP auditing, and game performance reporting. No personally identifiable information is included in such data.
• IT infrastructure providers: Personal data is processed on servers managed by contracted IT infrastructure providers. Such providers act as data processors under written agreements that require them to maintain security standards equivalent to those applied by Biru77.
• Regulatory and law enforcement authorities: Biru77 may disclose personal data to competent governmental, regulatory, or law enforcement authorities where required to do so by applicable law, court order, or lawful regulatory instruction. Biru77 will notify affected Users of such disclosures where permitted by law.

Biru77 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or for as long as required or permitted by applicable law. The following retention periods apply as a general guide:

• Account and identity data: Retained for the duration of the active account relationship and for a minimum of 5 years following account closure, in accordance with AML record-keeping obligations.
• Transaction and payment records: Retained for a minimum of 7 years from the date of the transaction, in compliance with applicable financial record-keeping regulations.
• KYC documents: Retained for a minimum of 5 years following the date of identity verification or the end of the customer relationship, whichever is later.
• Customer support records: Retained for 3 years following the resolution of the relevant matter, unless the matter involves an unresolved dispute or legal claim.
• Technical and usage logs: Anonymised analytics data is retained for up to 24 months. Non-anonymised technical logs (e.g., IP address logs) are retained for a maximum of 12 months.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where data is anonymised, it may be retained indefinitely for statistical or research purposes in a form that does not identify any individual.

Biru77 implements a range of technical and organisational security measures designed to protect your personal data from unauthorised access, disclosure, alteration, or destruction. These measures include, but are not limited to:

• Transport Layer Security (TLS/SSL): All data transmitted between your browser or device and the Platform is encrypted using 256-bit SSL/TLS encryption. You can verify this by the HTTPS prefix and padlock icon in your browser address bar when accessing biru77.asia.
• Data-at-rest encryption: Sensitive personal data stored in our databases (including KYC documents and payment records) is encrypted at rest using industry-standard encryption protocols.
• Access controls: Access to personal data is restricted to authorised Biru77 personnel and contracted processors on a strict need-to-know basis. All staff with access to personal data are subject to confidentiality obligations.
• Two-factor authentication: Biru77 supports two-factor authentication (2FA) for all player accounts. We strongly recommend that all Users enable 2FA to add an additional layer of security to their Account.
• Fraud and intrusion monitoring: Our platform is subject to continuous automated monitoring for suspicious activity, anomalous login patterns, and potential security incidents. Security events trigger automatic alerts and, where appropriate, temporary account restrictions pending investigation.
• Penetration testing and security audits: Biru77 conducts periodic security assessments to identify and remediate potential vulnerabilities in our platform infrastructure.

Biru77 uses cookies and similar technologies on the Platform to ensure proper functionality, maintain your session, and collect anonymised usage data to improve our services. We use only the following categories of cookies:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function. They enable core features such as secure login session management, navigation between pages, and access to secure areas of the Platform. These cookies cannot be disabled without compromising Platform functionality.
• Functional Cookies: These cookies remember your preferences (e.g., language, interface settings) to provide a more personalised experience. They do not track your activity across other websites.
• Analytics Cookies: Biru77 uses anonymised first-party analytics to understand how users interact with the Platform, including which pages are most visited, where users drop off, and how long sessions last. This data is collected in aggregate form and cannot be used to identify individual users.

Biru77 does not use third-party advertising cookies, cross-site tracking pixels, or re-targeting technologies. You may control cookie settings through your browser. Disabling strictly necessary cookies may affect your ability to use the Platform.

Subject to applicable law and any overriding legitimate interests or legal obligations of Biru77, you have the following rights in respect of your personal data:

To exercise any of the above rights, please contact us at the email address stated in Section 14. We will acknowledge your request within 72 hours and respond substantively within 30 calendar days. Complex requests may require up to an additional 60 days; we will notify you if an extension is required.

The Platform is strictly intended for individuals who are 21 years of age or older. Biru77 does not knowingly collect personal data from anyone under the age of 21. If you are under 21, you are not permitted to use the Platform or submit any personal data to Biru77.

Biru77 enforces its minimum age requirement through mandatory KYC identity verification, which requires all Users to provide a valid Malaysian government-issued identity document confirming their date of birth before any withdrawal is processed.

If Biru77 becomes aware that it has inadvertently collected personal data from a person under the age of 21, we will take immediate steps to delete that data, close the associated account, and return any deposited funds. If you are a parent or guardian and have reason to believe that a minor under your care has created a Biru77 account, please contact us immediately at the email address in Section 14.

In the course of operating the Platform and fulfilling our service obligations, your personal data may be transferred to, stored in, or processed in jurisdictions outside Malaysia. This may occur in connection with our use of contracted IT infrastructure providers, game content partners, or KYC verification services.

Biru77 ensures that any cross-border transfer of personal data is subject to appropriate safeguards, including: (a) contractual data processing agreements that impose obligations on the recipient equivalent to those applied by Biru77; (b) transfer to jurisdictions that maintain adequate data protection standards; or (c) other lawful transfer mechanisms recognised under applicable data protection law.

By using the Platform, you acknowledge and consent to the transfer, storage, and processing of your personal data in jurisdictions outside Malaysia, subject to the safeguards described in this Section.

Biru77 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory guidance, or Platform functionality. The date of the most recent revision is displayed at the top of this page.

Where amendments are material — meaning they substantively affect your rights or how your data is processed — Biru77 will provide advance notice via email to the registered address on your Account and/or by displaying a prominent notice on the Platform. We recommend checking this page periodically to stay informed of any updates.

Your continued use of the Platform following the publication of an amended Privacy Policy constitutes your acceptance of the revised terms. If you do not agree to any amendment, you must cease using the Platform and request deletion of your Account and personal data in accordance with Section 10.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by Biru77, please contact our Data Protection team using the details below. We take all privacy enquiries seriously and will respond within the timeframes indicated in Section 10.