Privacy Policy

Introduction

This Privacy Policy (the "Policy") describes how Kopi77 (the "Company", "we", "us", or "our") collects, processes, stores, shares, and protects personal data belonging to users (the "User", "you", or "your") of the Kopi77 online gaming platform accessible at kopi77.buzz and any associated sub-domains or mobile applications (the "Platform").

We respect your privacy and are committed to maintaining the confidentiality, integrity, and security of any personal information you provide to us in connection with your use of the Platform. This Policy is intended to give you clear and transparent information about our data practices so that you can make informed decisions about sharing your information with us.

By registering an Account on the Kopi77 Platform, making a deposit, or otherwise using our Services, you acknowledge that you have read, understood, and consented to the data practices described in this Policy. If you do not agree with any aspect of this Policy, you should discontinue your use of the Platform and contact us to close your Account.

Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

Personal Data We Collect

Kopi77 collects Personal Data across several categories depending on the nature of your interaction with the Platform. The following table outlines the categories of data we collect and the context in which each category is gathered:

3.1 Registration and Account Data

• Full legal name, date of birth, and gender
• Email address and mobile phone number
• Residential address (including city, state, and postcode)
• Username and encrypted password credentials
• Security question answers and two-factor authentication data

3.2 Identity Verification (KYC) Data

• Scanned or photographed copies of valid government-issued photo identification (Malaysian MyKad, Driver's Licence, or Passport)
• Proof of residential address documents (Tenaga Nasional bills, Unifi statements, Indah Water notices, or bank statements dated within three months)
• Selfie photographs taken while holding the submitted identification document
• Where required by enhanced due diligence procedures: source of funds documentation

3.3 Financial and Transaction Data

• Deposit and withdrawal transaction records including amounts, dates, and payment method references
• Payment method identifiers (e.g., last four digits of a bank account, e-wallet phone number, partial Touch 'n Go or DuitNow reference identifiers)
• Account balance history and bonus redemption records
• Wagering history across all game types including slots, live dealer, Sic Bo, and sports betting markets

3.4 Technical and Device Data

• IP address and geolocation data derived from your connection
• Device type, operating system, browser type and version
• Session duration, login timestamps, and access frequency
• Cookies and similar tracking identifiers (see Section 10 for full details)

3.5 Communication Data

• Records of all communications between you and Kopi77 support, including live chat transcripts and email correspondence
• Feedback, complaints, and dispute records
• Marketing preference data and opt-in/opt-out records

3.6 Responsible Gambling Data

• Self-imposed deposit limits, session time restrictions, and cooling-off periods set within your Account
• Self-exclusion requests and associated supporting documentation
• Responsible gambling assessment responses where completed voluntarily

How We Collect Personal Data

Kopi77 collects Personal Data through the following channels and mechanisms:

• Direct submission: Information you voluntarily provide when registering an Account, completing the KYC verification process, making a deposit or withdrawal request, contacting customer support, or completing any on-Platform form.
• Automated collection: Technical data collected automatically when you access the Platform, including IP address, device identifiers, session data, and browsing behaviour within the Platform, captured via server logs and analytics systems.
• Cookies and tracking technologies: Data collected via first-party cookies placed on your device during Platform use. See Section 10 for a detailed explanation of our cookie practices.
• Third-party payment processors: Transaction confirmation data shared with us by payment service providers including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX-connected banks, Maybank, CIMB, Public Bank, Hong Leong Bank, and cryptocurrency network confirmations for USDT TRC20 transactions.
• Identity verification providers: Confirmation data returned by our KYC processing partners following identity document validation.
• Fraud detection systems: Risk signals and device fingerprint data generated by our anti-fraud systems during Account activity monitoring.

Data Processing & Use

Kopi77 processes your Personal Data for the following specific purposes. We process only what is necessary for each stated purpose:

Kopi77 does not use your Personal Data for automated decision-making that produces legal or similarly significant effects without human review, except where required by anti-fraud systems and subject to manual override procedures.

Legal Basis for Processing

Where applicable data protection law requires a lawful basis for Processing Personal Data, Kopi77 relies on one or more of the following grounds:

• Contract Performance: Processing is necessary to perform our contractual obligations to you under our Terms and Conditions, including delivering gaming services, processing payments, and managing your Account.
• Legal Obligation: Processing is required to comply with applicable laws including anti-money laundering (AML) regulations, counter-terrorist financing (CTF) requirements, age verification obligations, and regulatory reporting duties.
• Legitimate Interest: Processing is necessary for the pursuit of Kopi77's legitimate business interests — specifically fraud prevention, platform security, and service improvement — provided these interests do not override your fundamental rights and freedoms.
• Consent: Where you have given your explicit, freely given, informed, and unambiguous consent to specific Processing activities — primarily marketing communications. You may withdraw this consent at any time without penalty.

Data Sharing & Disclosure

Kopi77 does not sell, rent, or trade your Personal Data to third parties for their own marketing or commercial purposes. We share Personal Data only in the following limited circumstances:

7.1 Payment Service Providers

We share transaction-related data with licensed payment processors — including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX-connected financial institutions, Maybank, CIMB, Public Bank, and Hong Leong Bank — solely for the purpose of processing your deposits and withdrawals. These processors are contractually bound to protect your data and use it only for payment execution purposes.

7.2 Identity Verification Partners

KYC documentation is shared with our contracted identity verification service providers for the sole purpose of validating the authenticity of your submitted documents. These providers operate under data processing agreements and are prohibited from using your data for any purpose beyond verification.

7.3 Regulatory and Law Enforcement Authorities

Kopi77 is required by applicable law to disclose certain Personal Data and transaction records to regulatory authorities, financial intelligence units, and law enforcement agencies when requested through lawful process. We will notify affected Members of such disclosures where legally permitted to do so.

7.4 Technical Service Providers

We engage third-party technology partners for cloud hosting, cybersecurity monitoring, analytics, and customer support tooling. These providers access Personal Data only to the extent necessary to perform their contracted services and are bound by confidentiality obligations and data processing agreements.

Data Retention

Kopi77 retains Personal Data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law. Our standard retention periods are as follows:

• Account and registration data: Retained for the duration of your Account plus a minimum of five (5) years following Account closure, as required by applicable AML and regulatory record-keeping obligations.
• KYC and identity verification documents: Retained for a minimum of five (5) years from the date of verification, in accordance with anti-money laundering regulations. In certain circumstances, regulatory authorities may require longer retention.
• Financial transaction records: Retained for a minimum of seven (7) years from the date of each transaction in compliance with financial record-keeping requirements.
• Customer support communications: Retained for three (3) years from the date of the last interaction unless the subject matter is related to an ongoing dispute or regulatory matter.
• Marketing preference data: Retained until you withdraw consent or close your Account, whichever is earlier.
• Technical and device data (logs): Retained for a rolling period of twelve (12) months unless flagged as part of a security investigation.

Upon expiry of the applicable retention period, Personal Data is either securely deleted or anonymised such that it can no longer be linked to any individual.

Data Security

Kopi77 implements a comprehensive set of technical and organisational security measures designed to protect your Personal Data against unauthorised access, accidental loss, disclosure, alteration, or destruction. Our security framework includes:

• Encryption in transit: All data transmitted between your device and the Kopi77 Platform is protected using 256-bit Transport Layer Security (TLS) encryption. Look for the padlock symbol and "https://" in your browser's address bar when accessing kopi77.buzz.
• Encryption at rest: Sensitive Personal Data and financial records stored on our servers are encrypted using AES-256 encryption.
• Access controls: Internal access to Personal Data is restricted on a strict need-to-know basis. All staff with access to Personal Data undergo background screening and are bound by confidentiality obligations.
• Two-factor authentication: Two-factor authentication (2FA) is available to all Members and is mandatory for all internal administrative access to Member data.
• Continuous monitoring: Our security operations team monitors the Platform around the clock for anomalous activity, intrusion attempts, and data exfiltration signals.
• Third-party audits: Our security infrastructure is subject to periodic independent security assessments and penetration testing by qualified cybersecurity professionals.

Cookies & Tracking Technologies

Kopi77 uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files placed on your device when you access the Platform. We use the following categories of cookies:

10.1 Strictly Necessary Cookies

These cookies are essential for the Platform to function correctly. They enable core features such as Account authentication, session management, load balancing, and security controls. These cookies cannot be disabled without significantly impairing Platform functionality.

10.2 Performance and Analytics Cookies

These cookies collect anonymised information about how visitors use the Platform — such as which pages are visited most frequently, session duration, and navigation paths — to help us improve usability and performance. All data collected by these cookies is aggregated and does not identify individual users.

10.3 Functional Cookies

These cookies remember your preferences and settings — such as preferred language, display settings, and previously entered information — to provide a more personalised and convenient experience on the Platform.

10.4 Cookie Management

You may manage your cookie preferences through your browser settings. Most modern browsers allow you to view, block, or delete cookies. Please note that disabling certain cookies may affect the functionality of the Platform. For specific cookie settings, please refer to your browser's help documentation. Our Platform does not currently respond to browser "Do Not Track" signals.

Your Rights

Subject to applicable data protection law, you hold the following rights in respect of the Personal Data that Kopi77 processes about you. These rights are described in detail in the section below and are also summarised visually in our User Rights cards further down the page.

• Right of Access: You have the right to request a copy of the Personal Data that Kopi77 holds about you, along with information about how it is processed.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete Personal Data we hold about you.
• Right to Erasure: You have the right to request deletion of your Personal Data in certain circumstances, subject to our legal retention obligations. We cannot delete data that we are legally required to retain.
• Right to Restriction: You have the right to request that we restrict the Processing of your Personal Data in certain circumstances, for example while the accuracy of data is being contested.
• Right to Data Portability: Where Processing is based on consent or contract performance, you have the right to receive your Personal Data in a structured, machine-readable format and to transmit it to another controller.
• Right to Object: You have the right to object to Processing based on legitimate interests. If you object to marketing communications, we will stop sending them immediately.
• Right to Withdraw Consent: Where Processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of Processing that occurred before withdrawal.

To exercise any of these rights, please submit a written request to [email protected] (plain text — not a clickable link). We will respond to all verified requests within thirty (30) calendar days. We may request proof of identity before processing your request to ensure we are not disclosing data to an unauthorised party.

Children's Privacy

The Kopi77 Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect Personal Data from individuals under the age of 21. Our registration process includes age verification steps, and KYC verification confirms the age of all Members prior to enabling full withdrawal functionality.

If Kopi77 becomes aware that Personal Data has been collected from a person under the age of 21, we will immediately close the associated Account, void all transactions, and delete or return the applicable data in accordance with regulatory requirements. If you have reason to believe that a minor has gained access to the Platform, please contact us immediately at [email protected].

International Data Transfers

Kopi77 may transfer Personal Data to third-party service providers and infrastructure partners located outside your country of residence. Where such transfers involve the transfer of Personal Data to jurisdictions that may not provide an equivalent level of data protection to that of your home country, Kopi77 implements appropriate safeguards including:

• Standard contractual clauses approved by relevant data protection authorities;
• Data processing agreements requiring recipient organisations to maintain equivalent data security standards;
• Transfers to jurisdictions with internationally recognised adequacy determinations where applicable.

By using the Kopi77 Platform, you acknowledge that your Personal Data may be transferred to and processed in jurisdictions outside Malaysia in connection with the delivery of our services.

Policy Amendments

Kopi77 reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory requirements. We will notify registered Members of material changes via email to your registered address and through a prominent notice displayed on the Platform prior to the changes taking effect.

The effective date at the top of this Policy indicates when it was last revised. We encourage you to review this Policy periodically to stay informed of how we handle your Personal Data. Your continued use of the Platform following the publication of an amended Privacy Policy constitutes your acceptance of the revised terms.

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way Kopi77 handles your Personal Data, our Data Protection team is available to assist you. All data-related enquiries are handled with strict confidentiality.

• Email: [email protected] — displayed as plain text only; not a clickable link.
• Live Chat: Available 24/7 via the live chat widget on every page of the Platform. Please indicate that your enquiry relates to privacy or data protection to ensure it is routed to the correct team.
• Response time: We aim to acknowledge all privacy-related written enquiries within 5 business days and provide a substantive response within 30 calendar days.

If you are unsatisfied with our response to a data protection concern, you may have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction. Kopi77 encourages Members to contact us directly in the first instance so that we have the opportunity to address your concerns.