Privacy & Management of Personal Data

Scope and application

This Privacy & Personal Data Management Policy explains how Hm77 collects, processes, stores, and discloses Personal Data in relation to its online gaming and related services. It applies to all websites, applications, products, and services operated by Hm77 that link to this policy or that do not have a separate privacy policy, and to all current and prospective customers, players, and visitors.

Data Controller and data processing

Hm77 acts as the data controller for Personal Data processed in connection with its services. We may engage data processors under written contractual arrangements to process Personal Data on our behalf. Processors perform processing only on our documented instructions and implement appropriate technical and organizational measures to protect the data.

Definitions

• Personal Data: any information relating to an identified or identifiable natural person.
• Data Controller: the natural or legal person who determines the purposes and means of the processing of Personal Data.
• Data Processor: a natural or legal person who processes Personal Data on behalf of the Data Controller.
• Profiling: any form of automated processing of Personal Data to evaluate certain personal aspects about a person, including risk assessment or fraud detection.

Categories of Personal Data We Collect

• Contact and identity data: name, address, email, telephone number, date of birth, and identity verification documents as required.
• Account data: login credentials, user IDs, account status, and verification results.
• Activity data: activity on the Service, betting history, deposits and withdrawals, bonuses, interactions with support, and communications with the Service.
• Technical data: device type, browser, IP address, geolocation (where permitted), and other information collected through your device when accessing the Service.
• Financial data: payment method details and transaction records necessary for processing payments and anti-fraud controls.
• Marketing data: consent preferences, subscription status, and responses to marketing communications.

How We Collect Personal Data

• Data you provide directly when creating an account, placing bets, making deposits or withdrawals, or communicating with us.
• Automatic data collection through your use of the Service (e.g., logs, device information, cookies, analytics) to maintain security, improve services, and tailor user experience.
• Data from third parties or publicly available sources where required by law or to fulfill regulatory obligations.

Purposes and Legal Bases for Processing

• Account creation and administration – to establish and manage your customer account. Legal basis: contractual necessity.
• Identity verification and fraud prevention – to prevent impersonation and unlawful use. Legal basis: legitimate interests and compliance with AML/KYC requirements.
• Security for payments and data – to protect credit and personal data during transactions. Legal basis: contractual necessity and legitimate interests.
• Customer service and relationship management – to respond to requests and maintain ongoing service. Legal basis: contractual necessity and legitimate interests.
• Personalisation and responsible gaming – to tailor experiences and promote responsible gaming. Legal basis: legitimate interests, consent where required (e.g., targeted marketing).
• Marketing and communications – to provide information about services, events, and promotions. Legal basis: consent for direct marketing or legitimate interests where consent is not required.
• Profiling for AML and fraud detection – automated checks to identify risk patterns. Legal basis: legitimate interests and regulatory obligations. Final decisions are reviewed by human personnel.

Data Retention

We retain Personal Data only as long as necessary to fulfill the purposes described and to comply with legal and regulatory obligations. As a baseline, transactional data (including records of bets and payments) will be retained for at least five (5) years from the date of the last activity. Other data will be retained for periods dictated by applicable laws, contractual obligations, or until the purpose of processing is satisfied. When data is no longer required, it will be securely deleted or anonymised.

Data Sharing and Recipients

We may disclose Personal Data to:

• Affiliates and service providers who process data on our behalf (e.g., payment processing, IT services, customer support) under contractual obligations to protect data.
• Regulators, authorities, or law enforcement bodies where required by applicable law or to protect our rights and comply with regulatory obligations.
• Auditors and legal advisors as required to ensure compliance and governance.

We do not sell Personal Data to third parties for marketing purposes. Any transfers to recipients outside the country of operation will be conducted only in accordance with applicable data protection laws and with appropriate safeguards.

Cross-Border Data Transfers

Where necessary, Personal Data may be transferred to recipients located outside the country of operation. Such transfers are performed only if the recipient provides adequate data protection or safeguards are in place, in line with applicable Data Protection Laws. We implement contractual mechanisms to protect data and ensure equivalent data protection standards is maintained.

Data Security

Hm77 employs state-of-the-art security measures appropriate to the nature of the Personal Data processed, including:

• Encryption of Personal Data in transit using TLS 1.2 or higher;
• Encryption of data at rest on secure storage systems;
• Access controls, authentication, and authorization procedures;
• Regular security assessments, monitoring, and incident response protocols;
• Secure development and change-management practices.

Profiling and Automated Decision-Making

We may engage in profiling and automated processing to assess risk, detect fraudulent activity, and personalise experiences. No decision with legal or similarly significant effects is made solely by automated processing. Where profiling influences a decision, a human reviewer will retain the authority to intervene and determine the outcome.

Rights of Data Subjects

You may exercise the following rights by contacting our privacy team at privacy@hm77. We will respond in a timely manner in accordance with applicable laws.

• Right of access: obtain confirmation whether we process your Personal Data and request a copy.
• Right to rectification: correct inaccurate or incomplete data.
• Right to erasure: request deletion of Personal Data when processing is no longer necessary or unlawful, subject to legal obligations.
• Right to restriction of processing: limit processing under certain circumstances.
• Right to objection: object to processing based on legitimate interests or for direct marketing, subject to legal bases.
• Right to data portability: receive your Personal Data in a structured, commonly used format and transmit to another controller where feasible.
• Right to withdraw consent: withdraw consent for processing where consent is the basis for processing, without affecting lawful processing before withdrawal.

Marketing Permissions

Where we rely on consent for marketing purposes, you may withdraw consent at any time by following the unsubscribe instructions in communications or by contacting privacy@hm77. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.

Cookies and Similar Technologies

We use cookies and related technologies to operate the Service, remember preferences, and analyse use. You may manage cookie preferences through your browser and within the Service settings. When required by law, we will obtain your consent before placing non-essential cookies.

Children

Our services are intended for adults. We do not knowingly collect Personal Data from individuals under the applicable legal age. If we become aware of such data without proper age verification, we will delete it without undue delay and take steps to prevent further processing.

Changes to this Policy

We may update this Policy from time to time. We will provide notice of material changes and obtain any required consents under applicable law. Continued use of the Service after such changes constitutes acceptance of the revised policy.