spiv7 Privacy Policy

Definitions

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

• "Personal Data" means any information that can be used to identify a natural person, directly or indirectly, including but not limited to full name, date of birth, email address, telephone number, national identity number, IP address, device identifiers, and financial account details.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, transmission, deletion, or destruction.
• "Data Controller" means spiv7, the entity that determines the purposes and means of processing Personal Data collected through the platform.
• "Data Processor" means any third-party service provider that processes Personal Data on behalf of spiv7 under a contractual data processing agreement.
• "User" or "Player" means any natural person who has registered an account with spiv7 or who accesses the platform in an unregistered capacity.
• "Platform" means the spiv7 website at https://spiv7.net, its mobile-optimised interface, and any associated services operated by spiv7.
• "Sensitive Data" means a subset of Personal Data that warrants heightened protection, including national identity numbers, financial account details, and health-related information provided in the context of responsible gaming interactions.

Data We Collect

spiv7 collects the following categories of Personal Data from users of the platform:

2.1 Registration & Identity Data

• Full legal name as it appears on a government-issued identity document
• Date of birth (for age verification — all users must be 21 or older)
• Email address and mobile telephone number
• Username and hashed account password
• Residential address (city, province, postal code) within Indonesia

2.2 Identity Verification (KYC) Data

• Scanned or photographed copies of government-issued identity documents (KTP, passport, or driver's licence)
• Proof of address documents issued within the preceding three months
• Selfie images submitted for liveness verification where required

2.3 Financial & Transaction Data

• Bank account numbers and bank names (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI) used for deposits and withdrawals
• E-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja) used for transactions
• Transaction history including deposit amounts, withdrawal amounts, dates, and reference numbers — all in Indonesian Rupiah (IDR)

2.4 Usage & Behavioural Data

• Session logs including login timestamps, session durations, and logout events
• Game activity records including game titles played, wager amounts, outcomes, and session lengths
• Sportsbook betting history including markets selected, stake amounts, and settlement outcomes
• Navigation paths, page views, and feature interactions within the platform
• Bonus and promotion redemption records

2.5 Technical & Device Data

• IP address and approximate geographic location derived from IP lookup
• Device type, operating system, browser type and version
• Device identifiers and screen resolution
• Referring URL and search terms used to reach the platform (where applicable)

2.6 Communication Data

• Live chat transcripts and email correspondence with the spiv7 support team
• Records of responsible gaming interactions, including self-exclusion requests and deposit limit adjustments
• Survey responses and feedback submitted voluntarily by users

How We Collect Data

spiv7 collects Personal Data through the following channels and mechanisms:

• Directly from you when you complete the registration form, submit KYC documents, initiate a deposit or withdrawal, contact the support team, or participate in a promotion.
• Automatically through cookies, web beacons, server-side logging, and analytics tools as you navigate and interact with the platform. See Clause 9 for full details of cookie usage.
• From third-party identity verification providers engaged to conduct KYC and anti-money-laundering (AML) checks, who may supplement the data you provide with information from public databases or commercially licensed identity data sources.
• From payment processors and banking partners (including local Indonesian banks BCA, BRI, BNI, and Mandiri, and e-wallet providers OVO, DANA, and GoPay) to confirm transaction status and resolve payment disputes.
• From fraud detection and risk management partners who provide device fingerprinting and behavioural analytics signals to protect the platform and its users from fraudulent activity.

Purposes of Processing

spiv7 processes Personal Data only for specified, explicit, and legitimate purposes. The table below summarises those purposes alongside the data categories used:

spiv7 does not use Personal Data for automated individual decision-making that produces legal or similarly significant effects without human review, except where required by law or expressly disclosed to the user prior to the relevant processing activity.

Legal Basis for Processing

spiv7 relies on one or more of the following legal bases when processing your Personal Data:

• Contractual necessity: Processing that is required to perform the contract between you and spiv7, including account creation, transaction processing, and delivery of gaming services.
• Legal obligation: Processing required to comply with applicable law, including KYC and AML obligations under the Company's international gaming licence and applicable financial crime prevention regulations.
• Legitimate interests: Processing that serves a genuine business interest of spiv7 — such as fraud prevention, platform security, responsible gaming monitoring, and platform analytics — provided that interest is not overridden by your fundamental privacy rights. Where we rely on legitimate interests, we conduct a balancing assessment to confirm that the processing is proportionate.
• Consent: Processing for purposes that are not strictly necessary for the contract or required by law, most notably the sending of promotional communications and the use of non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Data Sharing & Disclosure

6.1 Third-Party Service Providers. spiv7 shares Personal Data with carefully selected third-party service providers who process data solely on our behalf and under binding contractual data processing agreements. These providers include identity verification and KYC partners, payment processors and local banking partners in Indonesia, game software providers (including Pragmatic Play, Evolution Gaming, Spribe, and others), cloud hosting and infrastructure providers, and customer support platform operators.

6.2 Regulatory and Law Enforcement Disclosure. spiv7 may disclose Personal Data to competent regulatory authorities, law enforcement agencies, or courts where required to do so by applicable law, by court order, or in response to a lawful governmental request. We will notify affected users of such disclosures where we are legally permitted to do so.

6.3 Corporate Transactions. In the event of a merger, acquisition, restructuring, or sale of all or a material portion of our business assets, Personal Data held by spiv7 may be transferred to the successor entity, subject to that entity honouring the commitments set out in this Privacy Policy or providing equivalent protection.

6.4 No Sale of Personal Data. spiv7 does not sell, rent, or trade Personal Data to any third party for that party's own independent marketing or commercial purposes. Any sharing of data is limited to what is necessary to deliver the services described in this Privacy Policy.

Data Retention

7.1 Retention Periods. spiv7 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected or as required by applicable law and regulatory obligations. The following standard retention periods apply:

• Account and registration data: Retained for the duration of the active account relationship and for a minimum of five years following permanent account closure, to meet AML and financial record-keeping obligations.
• KYC and identity verification documents: Retained for a minimum of five years from the date of verification or account closure, whichever is later, in accordance with applicable anti-money-laundering regulations.
• Transaction records: Retained for a minimum of five years from the date of each transaction.
• Customer support communications: Retained for three years from the date of the interaction, except where the communication is relevant to an ongoing dispute, in which case it is retained until resolution.
• Usage and behavioural data: Retained in identifiable form for up to 24 months and thereafter stored in anonymised or aggregated form for statistical and analytics purposes without a defined deletion timeline.
• Marketing consent records: Retained for three years from the date of the last marketing interaction, to demonstrate compliance with consent obligations.

7.2 Deletion Upon Request. Where you exercise your right to erasure (see Clause 10) and no overriding legal obligation requires continued retention, spiv7 will delete or irreversibly anonymise the relevant Personal Data within 30 calendar days of receiving a valid request.

Security Measures

spiv7 implements a layered security framework to protect Personal Data from unauthorised access, disclosure, alteration, and destruction. Our technical and organisational measures include:

• 256-bit SSL/TLS encryption applied to all data in transit between your browser or device and our servers, preventing interception by third parties.
• Encrypted storage of all Personal Data and credentials at rest, using industry-standard encryption algorithms. Account passwords are stored exclusively as salted cryptographic hashes and are never stored in plain text.
• Multi-factor authentication (MFA) available to all registered users, and mandatory for staff with access to user Personal Data.
• Access controls limiting internal access to Personal Data to staff members who require it for their specific role, enforced through role-based permissions and regular access reviews.
• Continuous security monitoring including intrusion detection systems, anomaly detection on account activity, and 24/7 operations centre oversight.
• Regular penetration testing and vulnerability assessments conducted by independent third-party security specialists on at least an annual basis.
• Incident response procedures ensuring that any confirmed personal data breach is investigated promptly, affected users are notified within a reasonable timeframe where required, and root-cause remediation is implemented.

While spiv7 applies robust security measures, no internet-based system can guarantee absolute security. You are encouraged to use a strong, unique password for your spiv7 account and to enable MFA to maximise the protection of your personal information.

Cookies & Tracking Technologies

9.1 What Are Cookies. Cookies are small text files placed on your device when you visit a website. They are widely used to make websites function correctly, to remember your preferences, and to provide analytics information to site operators. spiv7 uses both session cookies (which expire when you close your browser) and persistent cookies (which remain on your device for a defined period or until manually deleted).

9.2 Categories of Cookies Used.

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication tokens and CSRF protection cookies. They cannot be disabled without rendering the platform inoperable.
• Functional Cookies: Used to remember your preferences such as language settings, currency display, and last-accessed game category. Disabling these cookies may reduce the quality of your platform experience.
• Analytics Cookies: Used to collect aggregated, anonymised data on how visitors interact with the platform, including page views, session duration, and navigation paths. This data helps spiv7 improve the platform's usability and performance.
• Fraud Prevention Cookies: Used by our security and fraud detection partners to assign a risk score to login and transaction events. These cookies are necessary for protecting your account and the integrity of the platform.

9.3 Managing Cookies. On your first visit, you will be presented with a cookie preference panel allowing you to accept or decline non-essential cookie categories. You may also manage cookies at any time through your browser settings. Note that disabling strictly necessary cookies will prevent access to the platform entirely.

9.4 No Cross-Site Advertising Tracking. spiv7 does not deploy third-party advertising or retargeting cookies. We do not share behavioural data with ad networks or use your Platform activity to serve targeted advertisements on external websites.

Your Rights Over Your Personal Data

Subject to applicable law and any overriding regulatory obligations, you hold the following rights in respect of your Personal Data held by spiv7:

• Right of Access: You may request a copy of the Personal Data spiv7 holds about you, along with information about how it is used, where it came from, and with whom it has been shared.
• Right to Rectification: If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. Many data fields can be updated directly within your account settings; others require a support request and supporting documentation.
• Right to Erasure ("Right to Be Forgotten"): You may request the deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where processing was unlawful. This right is subject to overriding legal retention obligations — for example, transaction records required to be retained under AML regulations cannot be deleted on request.
• Right to Restrict Processing: You may request that spiv7 restrict processing of your Personal Data in certain circumstances, such as where you contest its accuracy while verification is pending, or where processing is unlawful but you prefer restriction over erasure.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity and is carried out by automated means, you have the right to receive a copy of your data in a structured, commonly used, machine-readable format.
• Right to Object: Where spiv7 relies on legitimate interests as the legal basis for processing, you have the right to object to that processing. spiv7 will cease the processing unless it can demonstrate compelling legitimate grounds that override your interests, or unless the processing is necessary for the establishment, exercise, or defence of legal claims.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time by updating your communication preferences in your account settings or by contacting the support team. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

Minors

11.1 Age Restriction. The spiv7 platform is strictly for adults aged 21 and above. We do not knowingly collect Personal Data from any person under the age of 21. All registration submissions include a declaration of age, and age verification is enforced through the KYC process described in Clause 2.2.

11.2 Discovery of Minor's Data. If spiv7 becomes aware that it has inadvertently collected Personal Data from a person under the age of 21, it will immediately suspend the associated account, delete all Personal Data collected from that individual as promptly as permitted by applicable law, and where required, notify the relevant regulatory authority. Any funds deposited by a minor will be handled in accordance with the Company's minor account procedures.

11.3 Parental Controls. If you are a parent or guardian and believe that your child has registered an account on the spiv7 platform, please contact us immediately at [email protected]. We will investigate and, where confirmed, close the account and delete associated Personal Data without delay. We recommend that parents and guardians make use of commercially available parental control software to restrict access to age-restricted online content.

Third-Party Links & Integrations

12.1 Game Studio Integrations. The spiv7 platform integrates games developed and operated by third-party studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft. When you launch a game from one of these providers, certain technical data — including your session token, game preference settings, and wager amounts — is transmitted to that provider's servers as necessary to deliver the game. Each game studio operates under its own data processing agreement with spiv7 and is prohibited from using your data for any purpose beyond game delivery and fraud prevention.

12.2 Payment Provider Integrations. When you initiate a deposit or withdrawal using a local Indonesian bank or e-wallet (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, or LinkAja), you will interact with that provider's own platform or API. Each payment provider is an independent data controller for the data you share with them directly, and their own privacy policies govern those interactions. spiv7 only receives from payment providers the minimum data necessary to confirm transaction success or failure.

12.3 No Liability for External Policies. spiv7 is not responsible for the privacy practices of third-party game studios or payment providers. We encourage users to review the privacy policies of these providers independently.

Policy Amendments

13.1 Right to Update. spiv7 reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in our data practices, changes in applicable law, or improvements to our platform and services.

13.2 Notification of Material Changes. Where a proposed amendment materially affects the way we process your Personal Data — for example, introducing a new category of data collection or a new purpose for processing — we will notify all registered users via email to the address on file at least 14 calendar days before the amended policy takes effect. For minor or administrative amendments that do not affect your rights or our processing purposes, we will update the version number and effective date at the top of this page without individual notification.

13.3 Continued Use. Your continued use of the spiv7 platform after the effective date of any amendment constitutes acceptance of the updated Privacy Policy. If you do not agree with any material change, you should discontinue use of the platform and request account closure before the amendment takes effect.

13.4 Version Archive. The current version number and effective date of this Privacy Policy are displayed at the top of this page. Prior versions of this policy are available upon written request to the Data Protection team.

Contact & Data Protection Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data by spiv7, please contact our Data Protection team using the details below:

• Email: [email protected] (subject line: "Privacy Rights Request" or "Data Protection Enquiry")
• WhatsApp: +62 811 9999 777
• Live Chat: Available 24/7 via the spiv7 platform
• Email Response Hours: 08:00 – 22:00 WIB (Western Indonesia Time, UTC+7)

We aim to acknowledge all privacy-related enquiries within five business days and to provide a substantive response within 30 calendar days. For complex requests, we may require up to an additional 60 days; we will inform you of any such extension in advance.