Privacy Policy — Borneo77

Borneo77 ("the Company", "we", "us", "our") operates the online casino and sports betting platform accessible at https://borneo77.cam ("the Platform"). We are committed to protecting the privacy and personal data of all individuals who access and use our services, including registered players, prospective players, and visitors to our website.

This Privacy Policy ("Policy") describes the categories of personal data we collect, the purposes for which that data is processed, the legal bases on which we rely to do so, and the rights available to you in respect of your personal data. It should be read together with our Terms and Conditions and our Responsible Gambling Policy, both of which are published on this Platform.

By accessing the Platform, registering an account, or providing your personal data to Borneo77 in any form, you acknowledge that you have read and understood this Policy and consent to the collection and use of your personal data as described herein.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person — including name, identification number, contact details, financial data, and online identifiers such as IP address and device ID.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, erasure, and destruction.
• "Data Controller" means Borneo77, the entity that determines the purposes and means of processing your personal data.
• "Data Processor" means any third party that processes personal data on Borneo77's behalf and under its instructions.
• "Cookies" means small text files placed on your device by the Platform for the purposes of session management, preference retention, and analytics.
• "KYC" means Know Your Customer — the identity verification process required before processing your first withdrawal.
• "Player" means any registered user of the Platform aged 21 years and above.
• "Platform" means the Borneo77 online casino and sports betting service accessible at https://borneo77.cam.

Borneo77 collects personal data through several channels: directly from you at registration and during account use, automatically through your interaction with the Platform, and from third parties where necessary for verification and compliance purposes.

3.1 Data You Provide Directly

• Full legal name and date of birth;
• Email address and contact phone number;
• Residential address (including Malaysian city and postcode);
• Government-issued identification documents provided during KYC (e.g., Malaysian MyKAD, passport);
• Payment method details (e.g., registered e-wallet account, bank account number for FPX or DuitNow transfers);
• Communications submitted to our customer support team via live chat or email.

3.2 Data Collected Automatically

• IP address, device type, operating system, and browser type;
• Session data including login timestamps, pages visited, and features accessed;
• Betting and gaming activity records, including wager amounts, game selections, and transaction history;
• Geolocation data (country and city level) inferred from IP address;
• Cookie and tracking technology data as described in Section 7.

3.3 Data from Third Parties

• Identity verification data from KYC and anti-fraud service providers;
• Payment confirmation and fraud screening data from payment processors (including Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and Hong Leong Bank);
• Responsible gambling data shared by self-exclusion registries where applicable.

Borneo77 processes your personal data for the following purposes:

We do not use your personal data for automated profiling that produces legal or significantly adverse effects, nor do we sell your personal data to third-party marketing organisations.

Borneo77 relies on the following legal bases to process your personal data:

• Contractual Necessity: Processing required to provide the gaming and betting services you have registered for, including account management, deposit and withdrawal processing, and customer support.
• Legal Obligation: Processing required to comply with applicable anti-money laundering regulations, age verification requirements, KYC obligations, and data retention mandates under applicable law.
• Legitimate Interests: Processing necessary for fraud prevention, Platform security, responsible gambling monitoring, and improvement of our services — where these interests are not overridden by your privacy rights.
• Consent: Where we rely on your consent for a specific processing activity (such as optional marketing communications), you may withdraw that consent at any time by contacting our support team or updating your account preferences. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

Borneo77 does not sell, rent, or trade your personal data. We share personal data only in the following circumstances and only to the extent necessary for the stated purpose:

6.1 Service Providers and Data Processors

We engage trusted third-party service providers who process data on our behalf under strict contractual data protection obligations. These include:

• Payment processors: Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank, and selected cryptocurrency processors — for transaction processing and fraud screening;
• KYC and identity verification providers: for document verification and age confirmation prior to first withdrawal;
• Fraud prevention and anti-money laundering (AML) services: for real-time transaction monitoring and risk assessment;
• Cloud infrastructure and data hosting providers: for secure storage of Platform data;
• Customer support platform providers: for management of live chat and email support communications.

6.2 Legal and Regulatory Disclosure

We may disclose your personal data to competent authorities, regulators, or law enforcement agencies where required by applicable law, court order, or regulatory direction. In such cases, Borneo77 will disclose only the minimum data required to comply with the legal obligation.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of Borneo77's assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and the Privacy Policy of the successor entity will apply to your data from the effective date of transfer.

Borneo77 uses cookies and similar technologies to operate the Platform effectively, maintain your session state, and generate anonymised analytics data that helps us improve the player experience.

7.1 Types of Cookies We Use

• Strictly Necessary Cookies: Required for Platform functionality including session authentication, security token management, and account login state maintenance. These cannot be disabled without affecting core Platform functionality.
• Functional Cookies: Used to remember your preferences such as language settings, game lobby filters, and notification preferences across sessions.
• Analytics Cookies: Used to collect anonymised data about how players interact with the Platform — including pages visited, time spent, and features used — to help us improve the overall experience. This data does not identify you personally.

7.2 Cookies We Do Not Use

Borneo77 does not deploy third-party advertising cookies, cross-site tracking pixels, social media tracking tags, or any cookies that track your activity beyond the Borneo77 Platform. We do not participate in real-time bidding or programmatic advertising networks that rely on personal data.

7.3 Managing Cookies

You may adjust your browser settings to refuse or delete cookies at any time. However, disabling strictly necessary cookies will impair your ability to log in and use the Platform. Instructions for managing cookies vary by browser and are typically found under your browser's Privacy or Settings menu.

Borneo77 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Active Account Data: Retained for the full duration of your active relationship with Borneo77.
• Post-Closure Account Data: Following account closure, core account and transaction records are retained for a minimum of five (5) years to satisfy anti-money laundering, KYC, and regulatory record-keeping obligations.
• Customer Support Records: Communications and support tickets are retained for up to three (3) years from the date of the most recent interaction, or longer where required in connection with an unresolved dispute or regulatory matter.
• Marketing Consent Records: Records of consent for marketing communications are retained for the duration of the relationship and for one (1) year following withdrawal of consent or account closure.
• Anonymised Analytics Data: Aggregated, anonymised analytics data that cannot be attributed to any individual may be retained indefinitely for business intelligence purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our internal data destruction procedures.

Borneo77 implements a layered security architecture to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Our security measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and our servers;
• Encryption at rest for sensitive personal data and financial records stored on our servers;
• Multi-factor authentication options for account login;
• Role-based access controls limiting internal employee access to personal data on a strict need-to-know basis;
• Continuous monitoring and intrusion detection systems to identify and respond to suspicious activity;
• Regular penetration testing and security audits conducted by independent third-party security specialists;
• Physical and logical data centre security controls at all infrastructure hosting locations.

Notwithstanding these measures, no data transmission over the internet or electronic storage system can be guaranteed as entirely secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, Borneo77 will notify affected players in accordance with applicable regulatory requirements and take immediate steps to contain and remediate the breach.

Subject to applicable law and certain conditions, you hold the following rights in respect of your personal data held by Borneo77. To exercise any of these rights, please submit a written request to our support team as described in Section 14.

Borneo77 will respond to verified data rights requests within 14 business days of receipt. Where requests are complex or numerous, this period may be extended by a further 14 business days with prior notification. We reserve the right to refuse requests that are manifestly unfounded, excessive, or that conflict with our legal obligations to retain certain data.

The Borneo77 Platform is strictly intended for individuals aged 21 and above. We do not knowingly collect, process, or retain personal data from any person under the age of 21.

Age confirmation is required at account registration, and age verification via KYC document submission is conducted prior to the processing of any withdrawal. Where Borneo77 becomes aware that an account has been registered by or on behalf of a person under the age of 21, the account will be immediately suspended, all winnings will be forfeited, and any deposited funds will be returned less applicable processing costs.

We encourage parents and guardians to use parental control software to restrict access to gambling websites and to have open conversations with young people about the risks associated with gambling.

As an online Platform, Borneo77 may transfer personal data to servers, service providers, or processors located in jurisdictions outside Malaysia. Where such transfers occur, Borneo77 takes reasonable steps to ensure that your personal data is afforded a level of protection equivalent to that which would apply in Malaysia, including by implementing appropriate contractual safeguards with overseas processors.

The primary categories of cross-border data transfers involve cloud infrastructure providers and KYC verification services. All such providers are required by contract to process personal data solely for the purposes instructed by Borneo77 and in compliance with applicable data protection standards.

By using the Platform and providing your personal data to Borneo77, you acknowledge that your data may be transferred, processed, and stored in jurisdictions outside Malaysia in the circumstances described above.

Borneo77 reviews and updates this Privacy Policy periodically to reflect changes in our data practices, applicable law, regulatory guidance, or Platform functionality. The date of the most recent update is indicated at the top of this page.

Where a material change is made to this Policy, we will notify registered Players by posting a notice on the Platform or via registered email at least seven (7) days prior to the change taking effect. Minor updates that do not materially alter your rights or our obligations may be published without prior notification.

Your continued use of the Platform following the effective date of any Policy update constitutes your acceptance of the revised terms. We encourage you to review this page periodically to remain informed of how your data is being handled.

If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact Borneo77 through the following channels:

• 24/7 Live Chat: Available directly on the Platform — the most efficient channel for time-sensitive matters including account security concerns.
• Email: [email protected] — for formal data rights requests, privacy complaints, or written correspondence relating to this Policy. Please include your registered account email and a description of your request.

We will acknowledge receipt of your request within 2 business days and aim to resolve all data-related queries within 14 business days. For complex data rights requests, we will inform you if an extension to this timeframe is required.

For matters relating to responsible gambling, self-exclusion, or deposit limit controls, please visit our Responsible Gambling page.