Privacy Policy — spiv7

In this Privacy Policy, the following terms carry the meanings set out below unless the context expressly indicates otherwise:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to full legal name, date of birth, residential address, email address, mobile number, payment account details, identity document images, and IP address.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" means spiv7, the entity that determines the purposes and means of processing your Personal Data.
• "Data Processor" means any third party that processes Personal Data on behalf of spiv7 in accordance with spiv7's documented instructions.
• "Member" / "You" means any individual who has registered an account on the spiv7 platform at spiv7.cam.
• "Platform" means the spiv7 website at spiv7.cam and all associated services, interfaces, and mobile-optimised environments operated by spiv7.
• "KYC" means Know Your Customer — the identity and age verification process conducted by spiv7 prior to processing any withdrawal request.
• "Consent" means a freely given, specific, informed, and unambiguous indication of agreement by which you signify acceptance of the processing of your Personal Data for a stated purpose.

spiv7 collects the following categories of Personal Data in connection with the operation of the Platform:

When you create a member account, we collect your full legal name, date of birth, Indonesian national identity card (KTP) number, residential address (including city, province, and postal code), email address, and mobile phone number. This data is required to open and maintain your account.

Before any withdrawal is processed, spiv7 requires you to submit a copy of your KTP, a selfie photograph taken while holding your KTP, and proof of ownership of the bank account or e-wallet registered to your spiv7 account (for example, a screenshot showing your account name and number with BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, or LinkAja). These documents are stored securely in an access-controlled environment.

We record all deposit transactions, withdrawal requests, bet placements, game results, bonus activations, and balance movements associated with your account. We do not store your full bank card numbers; only the last four digits and the bank name are retained for reference purposes where applicable.

When you access the Platform, our servers automatically log your IP address, browser type and version, operating system, device model, screen resolution, referring URL, pages visited, session duration, and the date and time of each access. This data is used for security monitoring, fraud detection, and platform performance optimisation.

If you contact spiv7's customer support team by email or live chat, we retain a record of that correspondence, including the content of messages and any attachments, for quality assurance, training, and dispute-resolution purposes.

Where you use spiv7's responsible gaming tools — such as deposit limits, loss limits, session timers, or self-exclusion requests — the settings and history of those tools are retained as part of your account record to ensure that restrictions are properly enforced and cannot be circumvented.

spiv7 collects Personal Data through the following channels:

• Directly from you — when you complete the account registration form, submit KYC documents, make a deposit or withdrawal request, contact customer support, or update your account profile settings.
• Automatically through your use of the Platform — via server logs, session tracking, and cookies and similar technologies as described in Clause 6 of this policy.
• From payment processors and e-wallet providers — when a deposit or withdrawal transaction is initiated, our payment processing partners (including those facilitating transfers via BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, and LinkAja) may transmit confirmation data, including your account name, transaction reference number, and transaction amount.
• From fraud prevention and identity verification services — spiv7 may cross-reference the information you provide against third-party identity verification databases to confirm accuracy and detect fraudulent activity.
• From publicly available sources — in limited circumstances, for AML compliance purposes, spiv7 may consult publicly available databases, sanctions lists, or adverse media sources.

spiv7 processes your Personal Data only where a valid legal basis exists. The table below sets out the primary purposes for which we process Personal Data and the legal basis on which each processing activity relies:

Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal. Withdrawal of consent for marketing communications does not affect your ability to access or use the Platform.

spiv7 does not sell, rent, or trade your Personal Data to any third party for their own independent marketing or commercial purposes. We may share your data with the following categories of recipients only where necessary and proportionate:

To process deposits and withdrawals, spiv7 shares relevant transaction data with our payment processing partners and the Indonesian banks and e-wallet providers involved in the transaction (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, LinkAja). These entities act as independent data controllers in respect of the data they hold for their own regulatory purposes.

Where you play games powered by third-party studios — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft — a unique anonymised player identifier and session data may be shared with those studios for the purpose of game delivery, RNG certification, and responsible gaming monitoring. These providers do not receive your full name, KTP details, or payment account information.

spiv7 may share registration data and KYC documents with licensed identity verification service providers to validate your identity and confirm your age eligibility. These providers operate under confidentiality agreements and are permitted to use the data only for the verification purpose.

spiv7 may be required to disclose Personal Data to competent governmental, regulatory, or law enforcement authorities where required by applicable law, court order, or lawful regulatory instruction. In such cases, spiv7 will disclose only the minimum data necessary to comply with the legal obligation.

spiv7 may share Personal Data with external legal counsel, auditors, or compliance consultants on a strictly need-to-know basis and subject to professional confidentiality obligations, where necessary for the conduct of legal proceedings, regulatory audits, or compliance reviews.

In the event that spiv7 undergoes a merger, acquisition, restructuring, or sale of all or a material portion of its assets, your Personal Data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and the privacy terms that will apply to your data going forward.

spiv7 uses cookies and similar tracking technologies on the Platform. A cookie is a small text file stored on your device by your web browser when you visit a website. Cookies help us deliver a functional and personalised experience.

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication tokens, CSRF protection tokens, and load-balancing cookies. These cannot be disabled without breaking core Platform functionality.
• Performance & Analytics Cookies: Used to collect aggregated, anonymised data about how Members use the Platform — including pages visited, session duration, and click paths — to help us improve performance and usability.
• Functional Cookies: Used to remember your preferences — such as your preferred language, time-zone display settings, and responsible gaming reminders — so that these are applied consistently across sessions.
• Marketing & Retargeting Cookies: Where you have given consent, we may use cookies to identify your visit for the purpose of serving relevant promotional content. These cookies are only activated with your explicit consent.

You may configure your browser to refuse all or certain categories of cookies, or to alert you when cookies are being set. Please note that disabling strictly necessary cookies will impair your ability to log in and use the Platform. Instructions for managing cookies are available through your browser's help documentation. Your cookie preferences can also be updated through the Platform settings at any time.

spiv7 retains Personal Data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law and regulatory obligations. The following general retention periods apply:

Following the expiry of the applicable retention period, Personal Data is securely deleted or anonymised so that it can no longer be attributed to any individual. Where data has been anonymised, it may be retained indefinitely for statistical and platform improvement purposes.

spiv7 implements a layered information security programme designed to protect your Personal Data against unauthorised access, accidental loss, unlawful destruction, and disclosure. Our security measures include:

• TLS/SSL Encryption in Transit: All data exchanged between your device and the spiv7 Platform is encrypted using current TLS protocols, preventing interception during transmission.
• AES-256 Encryption at Rest: Sensitive stored data — including KYC documents, payment account details, and identity records — is encrypted using AES-256 at the storage layer.
• Access Controls: Access to Personal Data is restricted on a strict need-to-know basis. Staff with access to sensitive data categories undergo background screening and regular security training. Access is logged and audited.
• Multi-Factor Authentication: Administrative access to systems holding Personal Data requires multi-factor authentication (MFA). Members are strongly encouraged to enable MFA on their own accounts.
• Intrusion Detection & Monitoring: spiv7 operates 24/7 infrastructure monitoring and intrusion detection systems to identify and respond to anomalous activity in real time.
• Penetration Testing: spiv7 commissions periodic penetration testing of its platform infrastructure by independent security specialists to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: In the event of a data breach that is likely to result in risk to your rights or freedoms, spiv7 will notify affected Members without undue delay and will take immediate steps to contain and remediate the breach.

spiv7 operates infrastructure in multiple geographic locations, and some of the third-party service providers and Data Processors we engage (including game studios, cloud hosting providers, and fraud prevention services) may process data in jurisdictions outside Indonesia.

Where Personal Data is transferred to a country that does not provide a level of data protection equivalent to international standards, spiv7 ensures that appropriate safeguards are in place prior to the transfer. These safeguards may include:

• Standard contractual clauses approved by the relevant regulatory authority, binding the recipient to apply equivalent data protection standards;
• Certification by the recipient under a recognised international data protection framework; or
• A binding corporate rules arrangement covering intra-group transfers within the spiv7 corporate group.

You may request further information about the specific safeguards applicable to international transfers of your Personal Data by contacting us using the details in Clause 14 of this policy.

Subject to applicable law and certain limited exceptions, you have the following rights in relation to the Personal Data spiv7 holds about you:

• Right of Access: You may request a copy of the Personal Data spiv7 holds about you, together with information about how it is used and on what legal basis.
• Right to Rectification: If any Personal Data we hold about you is inaccurate or incomplete, you may request that it be corrected. Where the inaccuracy affects your account functionality, we will prioritise the correction.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn your consent (and no other legal basis applies), or where the data has been unlawfully processed. This right is subject to our legal retention obligations — for example, we cannot delete transaction records during the mandatory regulatory retention period.
• Right to Restriction of Processing: You may request that we restrict the processing of your Personal Data in certain circumstances — for example, while the accuracy of the data is under dispute, or where you have objected to processing and a decision is pending.
• Right to Data Portability: Where processing is based on your consent or contractual necessity, and is carried out by automated means, you may request that your data be provided to you in a structured, commonly used, machine-readable format.
• Right to Object: You may object at any time to the processing of your Personal Data where that processing is based on legitimate interests. spiv7 will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is necessary for the establishment, exercise, or defence of legal claims.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of prior processing.

To exercise any of the above rights, please submit your request in writing to [email protected]. We will acknowledge your request within 3 business days (WIB) and provide a full response within 30 calendar days. We reserve the right to verify your identity before actioning any request in order to protect against fraudulent data access attempts. Exercising your data rights is free of charge.

The spiv7 Platform is strictly intended for adults aged 21 years or older. spiv7 does not knowingly collect Personal Data from individuals under the age of 21. If you are under 21, you must not register an account or use this Platform in any capacity.

If spiv7 becomes aware that Personal Data has been collected from an individual under the age of 21 — whether through a misrepresentation of age at registration or any other means — that account will be immediately suspended, any pending balance will be frozen pending review, and all associated Personal Data will be deleted as quickly as is consistent with our applicable legal obligations.

If you are a parent or guardian and believe that a minor in your care has registered an account with spiv7, please contact us immediately at [email protected] so that we may investigate and take appropriate action without delay.

spiv7 may send you promotional communications — including information about bonuses, seasonal promotions aligned with events such as Idul Fitri, Chinese New Year (Imlek), Nyepi, and major sporting tournaments including BRI Liga 1 and the Piala AFF — only where you have explicitly opted in at the time of registration or through your account settings.

Marketing communications may be delivered by email or SMS to the contact details registered on your account. Each marketing communication will include a clearly visible and functional unsubscribe link or instruction. You may also update your marketing preferences at any time through your account settings.

Opting out of marketing communications does not affect your ability to access or use the Platform, and will not affect the delivery of transactional communications that are necessary for the operation of your account — such as deposit confirmation notices, withdrawal status updates, and security alerts.

spiv7 does not sell, share, or otherwise transfer your contact details to third parties for their own marketing purposes.

spiv7 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or the services we offer. All amendments will be published on this page with a revised "Last updated" date at the top of the document.

Where an amendment is material — meaning it significantly affects the way in which we process your Personal Data or materially reduces your rights — spiv7 will notify active Members by email to their registered address at least 7 days before the amendment takes effect. Continued use of the Platform after the effective date of any amendment constitutes your acknowledgement of the revised policy.

We encourage you to review this page periodically to stay informed about how spiv7 protects your Personal Data. The current version is always the definitive version and supersedes all prior versions of this policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or the way in which spiv7 processes your Personal Data, please contact our Data Protection team using the details below. All privacy-related enquiries are handled confidentially and with priority.