Privacy Policy
vm778 Betting Platform

Section 1

Overview

vm778 operates https://vm778.net as an English-language online sports betting and casino platform serving registered members in Indonesia. In the course of providing our Services — which include sports betting (covering BRI Liga 1, EPL, Champions League, and other competitions), live casino games, premium slots, live roulette, and bola tangkas (a traditional Indonesian card game) — we necessarily collect and process personal data about our members.

We take our data protection obligations seriously. vm778 is committed to collecting only the data that is strictly necessary to deliver a safe, personalised, and compliant betting experience. We do not sell your data, we do not use it for undisclosed purposes, and we apply industry-standard technical and organisational security measures to keep it safe.

This Policy is written in plain English and structured so that any member can understand their rights and our obligations. If any section is unclear, please contact us at the address in Section 15 and we will be happy to explain further.

Section 2

Definitions

The following terms have the meanings set out below throughout this Privacy Policy:

Section 3

Data We Collect

vm778 collects Personal Data across several categories. The table below sets out each category, specific data points within it, and the reason each item is collected:

Section 4

How We Collect Your Data

vm778 collects Personal Data through the following channels:

• Direct Registration: When you create an account on the Platform, you provide your identity, contact, and payment details directly via the registration form.
• Account Activity: Every deposit, withdrawal, bet, and game session automatically generates transactional and gaming data associated with your account.
• KYC Document Submission: When you submit identity documents (KTP, selfie, proof of payment method) for verification, those documents and the data they contain are collected and processed.
• Customer Support Interactions: When you contact our support team via email, any information you provide — including account details, dispute descriptions, and attached files — is collected and stored.
• Automated Technologies: Cookies, web beacons, and server-side logging automatically collect Technical Data and Usage Data when you browse the Platform. See Section 10 for full details on our cookie practices.
• Third-Party Payment Processors: When you complete a deposit or withdrawal via a local bank or e-wallet, the payment provider shares transaction confirmation data with vm778 to enable crediting of your IDR Balance.
• Identity Verification Partners: vm778 may use third-party KYC service providers to assist with document authenticity checks. These providers share their verification outcome (pass/fail) and relevant identity data with vm778 under a data-processing agreement.

Section 5

Purposes of Processing

We process your Personal Data for the following specific purposes. Each purpose is linked to at least one lawful legal basis described in Section 6:

• Account Management: Creating, maintaining, and securing your vm778 account, including authentication, password resets, and multi-device login monitoring.
• Service Delivery: Accepting and settling bets, crediting game wins, processing deposits and withdrawals in IDR via Indonesian banks and e-wallets, and displaying personalised odds and game recommendations.
• Identity and Age Verification: Confirming that you are a resident of Indonesia and at least 21 years of age, in compliance with our platform's responsible gaming commitments and licensing obligations.
• Financial Compliance and AML: Monitoring transactions for signs of money laundering, fraud, or the use of funds derived from criminal activity, and reporting to relevant authorities where legally required.
• Responsible Gaming: Monitoring betting patterns and session data to identify signs of problem gambling, enabling deposit-limit and self-exclusion tools, and contacting members where usage patterns suggest potential harm.
• Customer Support: Responding to queries, resolving disputes, and providing account assistance via email ([email protected]).
• Marketing and Promotions: Sending promotional offers, bonus announcements (welcome bonus, reload promotions, seasonal campaigns tied to Idul Fitri, Independence Day, and other Indonesian occasions), and platform updates to members who have consented to receive such communications.
• Platform Security and Fraud Prevention: Detecting and responding to unauthorised access attempts, account takeovers, collusive betting, and other security threats.
• Legal and Regulatory Compliance: Retaining records as required by our licensing authority, responding to lawful requests from regulatory bodies, and enforcing these Terms & Conditions and this Privacy Policy.
• Platform Improvement: Analysing aggregated usage data to improve site performance, game selection, betting market depth, and the overall member experience.

Section 6

Legal Basis for Processing

vm778 relies on the following legal bases to process your Personal Data lawfully:

Section 7

Data Sharing

vm778 does not sell, rent, or trade your Personal Data to any third party for their own marketing purposes. We share your data only in the limited circumstances described below, and only to the extent necessary for each stated purpose:

• Payment Service Providers: We share the minimum transaction data necessary with Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) to process deposits and withdrawals. These providers are independent data controllers for their own payment-processing activities.
• KYC and Identity Verification Partners: We may share identity document images and personal details with third-party KYC service providers solely for the purpose of verifying your identity and age. These providers act as data Processors under a written agreement that restricts their use of your data to the verification task only.
• Game Content Providers: Third-party game studios (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft) receive a session token and, in some cases, an anonymised player ID to deliver their game content. They do not receive your full identity or financial data.
• Cloud Infrastructure and IT Service Providers: vm778 uses cloud hosting and managed IT services to operate the Platform. Providers who store or process data on our behalf are bound by data-processing agreements that require them to maintain security standards equivalent to those in this Policy.
• Regulatory and Law Enforcement Authorities: We may disclose Personal Data to competent regulatory authorities, licensing bodies, or law enforcement agencies where required by law, by a court order, or in connection with our AML and fraud-prevention obligations. We will notify you of any such disclosure where we are legally permitted to do so.
• Professional Advisors: Our legal advisors, auditors, and compliance consultants may access limited Personal Data on a strictly need-to-know basis and are bound by professional confidentiality obligations.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of vm778's business, your Personal Data may be transferred to the acquiring entity. We will notify registered members via email at least 30 days before such a transfer occurs and explain your rights in relation to it.

Section 8

Data Retention

vm778 retains Personal Data only for as long as it is necessary for the purpose for which it was collected, or as required by our licensing and legal obligations. The following retention schedule applies:

When Personal Data reaches the end of its retention period, it is securely deleted or irreversibly anonymised. Anonymised data (which can no longer identify you) may be retained indefinitely for aggregate statistical and product-improvement purposes.

Section 9

Security Measures

vm778 implements a layered set of technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, destruction, or alteration. These measures include:

• 256-bit TLS Encryption in Transit: All data transmitted between your device and the Platform is encrypted using Transport Layer Security (TLS 1.2 or higher). The padlock icon in your browser confirms this encryption is active.
• Encrypted Data at Rest: Sensitive data fields — including financial account numbers, identity document references, and hashed passwords — are encrypted at rest using AES-256 or equivalent industry-standard algorithms.
• Access Controls: Access to systems containing Personal Data is restricted to vm778 staff on a strict need-to-know basis, enforced through role-based access control (RBAC) and multi-factor authentication (MFA) for all administrative accounts.
• Intrusion Detection and Monitoring: The Platform's infrastructure is monitored 24 hours a day, 7 days a week, for anomalous activity, unauthorised access attempts, and security events. Alerts trigger an immediate response from our security team.
• Regular Security Audits: vm778 conducts periodic penetration testing and vulnerability assessments of its web infrastructure, carried out by independent security professionals.
• Password Security: Member passwords are stored as salted cryptographic hashes — never in plain text. We enforce minimum password complexity requirements at registration and recommend using a unique password for your vm778 account.
• Data Breach Response: In the event of a confirmed personal data breach that is likely to result in risk to your rights, vm778 will notify affected members via their registered email address without undue delay and will report the breach to the relevant supervisory authority within the timeframe prescribed by applicable law.

Section 10

Cookies & Tracking Technologies

vm778 uses cookies and similar tracking technologies to operate certain core Platform functions and to improve your browsing experience. The following cookie categories are used:

You can manage your cookie preferences at any time through the cookie settings panel accessible from the Platform's footer. Withdrawing consent for Analytics or Marketing cookies does not affect the functionality of your account, though some personalisation features may become unavailable.

Note: Strictly Necessary and Functional cookies cannot be disabled via the consent panel, as they are required for the Platform to operate. If you wish to block all cookies, you may do so via your browser settings, but this will prevent you from logging in to your vm778 account.

Section 11

Your Rights

As a registered member whose Personal Data is processed by vm778, you hold the following rights. To exercise any of these rights, please submit a written request to [email protected] with the subject line "Data Rights Request" and include your registered username and a brief description of your request. vm778 will respond within 30 calendar days:

• Right of Access: You may request a copy of the Personal Data vm778 holds about you, together with an explanation of how it is being used. We will provide this in a clear, structured format.
• Right to Rectification: If any of your Personal Data is inaccurate or incomplete, you may request that it be corrected. For data that you can update directly within your account settings (such as email address or mobile number), please do so via the account panel rather than submitting a formal request.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data where: (a) it is no longer necessary for the purpose for which it was collected; (b) you withdraw consent and there is no other lawful basis; or (c) you object to processing based on legitimate interests and there are no overriding legitimate grounds. Note that vm778 may be legally required to retain certain data (e.g., financial transaction records) beyond your erasure request — in those cases, we will explain the specific legal obligation that prevents full deletion.
• Right to Restriction: You may request that vm778 restrict (pause) the processing of your Personal Data in certain circumstances, such as while the accuracy of the data is being contested or while an objection to processing is being assessed.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity and is carried out by automated means, you may request a copy of your data in a structured, commonly used, machine-readable format (e.g., JSON or CSV).
• Right to Object: You may object at any time to processing based on vm778's legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds that override your rights. You have an unconditional right to object to processing of your data for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based solely on your consent (e.g., marketing emails, analytics cookies), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.
• Right Not to be Subject to Automated Decisions: vm778 does not make decisions with significant legal or similarly significant effects on members based solely on automated processing without human oversight. If any automated system flags your account for review (e.g., fraud or responsible gaming alerts), a member of our team reviews the flag before any account-level action is taken.

Section 12

Minors — Under-21 Policy

vm778 strictly prohibits use of the Platform by any person under 21 years of age. We do not knowingly collect, store, or process Personal Data belonging to persons under 21.

At registration, all applicants are required to confirm that they are at least 21 years of age and to provide a date of birth consistent with that confirmation. vm778 may request identity verification documents at any time to confirm a member's age. Where an account is found to belong to a person under 21, the account will be immediately closed, all associated balances will be returned to the verified deposit source, and all Personal Data will be deleted from our systems within 30 days, except to the extent that retention is required by law.

If you are a parent or guardian and believe that a person under 21 in your household has registered on the Platform, please contact us immediately at [email protected]. We will investigate and take appropriate action within 2 business days of your notification.

Section 13

International Data Transfers

The vm778 Platform serves members in Indonesia. However, some of the third-party service providers we use (including cloud infrastructure providers, KYC verification partners, and game content studios) may store or process data in data centres located outside Indonesia.

Where Personal Data is transferred internationally, vm778 takes steps to ensure that adequate safeguards are in place, including:

• Data Processing Agreements: All third-party Processors are required to sign a data-processing agreement that imposes data protection obligations at least equivalent to those in this Policy.
• Standard Contractual Clauses: For transfers to service providers in jurisdictions without a formal adequacy determination, vm778 uses internationally recognised standard contractual clauses or equivalent legal mechanisms to protect the data in transit and at rest.
• Minimisation on Transfer: Where data must cross borders, we transfer only the minimum data set necessary for the specific service being provided. Full identity data and financial records are not transferred unless strictly required (e.g., for KYC verification).

If you wish to obtain more information about the specific safeguards applied to international transfers of your Personal Data, please contact us at [email protected].

Section 14

Policy Amendments

vm778 reserves the right to update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or the Services we offer. The following process applies to all amendments:

• Material Changes: Any amendment that materially affects your rights or the way we process your Personal Data will be communicated to all registered members via the email address on file at least 14 calendar days before the new version takes effect. The notification will summarise the key changes and link to the full revised Policy.
• Minor Changes: Minor amendments — such as typographical corrections, clarifications of existing practices, or updated Processor names — may be made without advance notice. The "Last Updated" date at the top of this page will always reflect the most recent revision.
• Continued Use as Acceptance: Your continued use of the Platform after the effective date of an amended Policy constitutes your acceptance of the revised terms. If you do not accept the changes, you must stop using the Platform and contact us to request account closure before the effective date.
• Version Archive: Previous versions of this Privacy Policy are available on request by contacting [email protected]. Please specify the date range of the version you require.

Section 15

Contact Us

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or need to report a data-related concern, please contact our Data Protection team using the details below. All enquiries are handled by staff who are fluent in both English and Indonesian (Bahasa Indonesia):

Please remember: vm778 will never contact you to request your account password, full payment card or bank account number, or one-time passcodes (OTP). Any message claiming to be from vm778 that requests such information should be treated as fraudulent and reported to [email protected] immediately.