Privacy Policy — Bromo77

Bromo77 ("we", "us", "our", "the Platform", "Bromo77") operates the online casino and sports betting services available at bromo77.cam. We are committed to protecting the personal data of every player and user who interacts with our Platform, and to being transparent about how that information is handled.

This Privacy Policy ("Policy") sets out the categories of personal data we collect, the purposes for which we process it, the legal bases on which we rely, the circumstances under which data may be shared with third parties, and the rights available to you as a data subject. It applies to all personal data collected through the Platform, our live chat support system, email correspondence, and any other interaction you have with Bromo77.

By registering an account, making a deposit, or otherwise using the Bromo77 Platform, you acknowledge that you have read and understood this Policy. This Policy should be read alongside our Terms & Conditions, which together form the full legal framework governing your relationship with Bromo77.

For the purposes of this Policy, the following terms shall bear the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, identification number, location data, or online identifier.
• "Processing" means any operation or set of operations performed on personal data, including collection, recording, storage, retrieval, use, disclosure by transmission, dissemination, restriction, erasure, or destruction.
• "Data Controller" means Bromo77, which determines the purposes and means of processing personal data collected through the Platform.
• "Data Processor" means any third party that processes personal data on behalf of Bromo77, in accordance with our instructions and this Policy.
• "KYC Data" means identity and address verification documentation submitted by a Player to satisfy the Know Your Customer requirements of our licensing obligations, including but not limited to MyKad, passport copies, and proof of address documents.
• "Cookies" means small text files placed on a user's device by a website, used to store preferences, session information, and analytics data.
• "Player" / "User" / "you" means any natural person who accesses, registers with, or uses the Bromo77 Platform.

We collect personal data across several categories depending on how you interact with the Platform. The table below summarises the main categories of data collected:

4.1 Directly From You

The majority of personal data we hold is provided directly by you in the course of: registering your Account; completing the KYC identity verification process; making deposits or withdrawal requests; contacting our customer support team via live chat or email; or configuring your Account settings, including responsible gambling tools such as deposit limits and self-exclusion preferences.

4.2 Automatically Through Platform Use

When you visit and use the Bromo77 Platform, we automatically collect certain technical data about your device and browsing behaviour through the use of cookies, server logs, and similar tracking technologies. This data includes your IP address, geographic region (at city or country level), browser version, device type, referring URLs, pages visited, and session duration. This information is collected for security monitoring, fraud prevention, and platform optimisation purposes.

4.3 From Third-Party Verification Services

In order to fulfil our regulatory KYC obligations, we may use authorised third-party identity verification service providers to cross-reference information you submit during account verification. These providers process your data only to the extent required for verification purposes, in accordance with their own data processing agreements with Bromo77.

4.4 From Payment Service Providers

When you make a deposit or withdrawal using Malaysian payment methods — including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, or Hong Leong — our payment processing partners may share transaction reference data and confirmation statuses with us for the purposes of reconciling your Account balance and detecting fraudulent transactions.

Bromo77 processes personal data only where a valid legal basis exists under applicable data protection law. The principal purposes for which we process your data and the corresponding legal bases are set out below:

Where processing is based on your consent — for example, to receive promotional emails about Bromo77 bonuses and new game releases — you retain the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.

Bromo77 does not sell, rent, or trade your personal data to any third party for commercial purposes. We may, however, share your personal data with the following categories of recipients where necessary and permitted by law:

6.1 Regulatory Authorities

We are required by our gaming licence and applicable anti-money laundering legislation to report certain information — including suspicious financial activity — to the relevant gaming regulatory authority and financial intelligence authorities. Such disclosures are made only to the extent required by law.

6.2 Payment Service Providers

In order to process deposits and withdrawals in Malaysian Ringgit, we share necessary transaction data with authorised payment service providers including operators of Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX-connected banks, and cryptocurrency processing services. These providers are contractually bound to use your data solely for the purpose of processing the relevant transaction.

6.3 Identity Verification Service Providers

We may share identity documentation submitted during KYC with authorised third-party verification providers to confirm the authenticity of documents and cross-reference against relevant databases. These service providers act as data processors under written data processing agreements.

6.4 Platform Technology Providers

Certain operational functions of the Bromo77 Platform — including game software delivery, customer support tools, and fraud detection systems — are provided by specialist technology vendors. These vendors may access limited categories of personal data solely to the extent required to perform their contracted services, and are prohibited from using that data for any other purpose.

6.5 Law Enforcement

We may disclose personal data to law enforcement agencies, courts, or other governmental authorities where we are under a legal obligation to do so, or where disclosure is necessary to protect the rights, property, or safety of Bromo77, our players, or the public.

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and our regulatory obligations. The principal retention periods applied by Bromo77 are as follows:

• Account and identity data: Retained for the duration of the active account relationship, plus a minimum of five (5) years following account closure, in accordance with anti-money laundering record-keeping requirements;
• KYC documentation: Retained for a minimum of five (5) years from the date of submission, or longer if required by the applicable regulatory authority;
• Transaction and financial records: Retained for a minimum of five (5) years from the date of the transaction;
• Customer support communications: Retained for a minimum of two (2) years from the date of the last interaction, or longer where relevant to an unresolved dispute;
• Technical and log data: Retained for a maximum of twelve (12) months, unless retained for longer in connection with an active fraud investigation or security incident;
• Marketing preference records: Retained for the duration of your account, or until you withdraw your consent to receive marketing communications, whichever is earlier.

At the expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our data destruction procedures.

Bromo77 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. Key security measures in place include:

• 256-bit SSL/TLS encryption applied to all data transmitted between your device and the Bromo77 Platform;
• Encrypted storage of all personally identifiable information and KYC documentation at rest;
• Strict access controls limiting access to personal data to authorised personnel only, on a need-to-know basis;
• Regular penetration testing and security audits conducted by qualified independent security professionals;
• Intrusion detection and monitoring systems operating continuously to identify and respond to anomalous activity;
• Segregated storage of Player funds and Player personal data, with separate access controls applied to each.

While Bromo77 takes all reasonable precautions to secure your personal data, no method of electronic transmission or storage is entirely free from risk. We encourage you to protect your own account security by using a strong, unique password and by contacting us immediately if you suspect any unauthorised access to your account.

9.1 What Are Cookies

Cookies are small text files placed on your device when you visit a website. They are widely used to make websites function correctly, to remember your preferences, and to provide website operators with analytical information about how their platforms are used.

9.2 Types of Cookies We Use

• Strictly Necessary Cookies: These are essential for the Platform to function correctly. They manage your login session, maintain your Account balance display, and enable core security features. These cookies cannot be disabled without affecting Platform functionality.
• Functional Cookies: These remember your preferences — such as your deposit limit settings, language selection, and responsible gambling tool configurations — to provide a more personalised experience.
• Analytical Cookies: These help us understand how players interact with the Platform by collecting aggregated, anonymised data on page views, session durations, and navigation paths. This data is used exclusively for internal platform improvement purposes.
• Security Cookies: These support our fraud detection systems by detecting unusual access patterns and helping to verify that login attempts originate from devices previously associated with your Account.

9.3 Managing Cookies

You may configure your browser settings to refuse non-essential cookies or to alert you when cookies are being set. Please note that disabling certain cookies may impact the functionality of the Platform, including the ability to maintain a logged-in session. Instructions for managing cookies are available in the help documentation of your browser.

Subject to applicable data protection law and our regulatory obligations, you hold the following rights in respect of the personal data that Bromo77 processes about you. To exercise any of these rights, please contact our support team using the details in Section 14.

We will respond to all verified data subject requests within 30 days of receipt. In complex or high-volume cases, this period may be extended by a further 60 days, in which case we will notify you of the extension and the reasons for it.

The Bromo77 Platform is strictly intended for use by individuals aged 21 years and above. We do not knowingly collect, process, or retain personal data from any person under the age of 21. Age verification is a mandatory step in the account registration and KYC process, and Bromo77 takes all reasonable steps to prevent underage access.

If we become aware that personal data belonging to an individual under the age of 21 has been collected — whether through a misrepresentation during registration or otherwise — we will take immediate steps to delete that data and permanently close the associated account. Any funds deposited by an underage user will be handled in accordance with our regulatory obligations.

If you have reason to believe that a person under 21 has registered an account with Bromo77, please contact our support team immediately so that we can investigate and take appropriate action.

As an internationally regulated online gaming platform, some of the data processors and technology providers used by Bromo77 may be located in jurisdictions outside of Malaysia. Where personal data is transferred to a third country, we ensure that appropriate safeguards are in place to maintain an equivalent level of data protection to that applicable in the jurisdiction from which the data originates.

Such safeguards may include: reliance on adequacy decisions by the relevant data protection authority; the use of standard contractual clauses approved by the applicable regulatory authority; or other lawful transfer mechanisms recognised under applicable data protection legislation.

Bromo77 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or our regulatory environment. The version number and effective date displayed at the top of this document will be updated accordingly each time a revision is made.

Where changes are material — for example, where we introduce a new purpose for processing personal data or engage a new category of third-party processor — we will provide reasonable advance notice by publishing a prominent notification on the Platform. For registered players, we may also send notification to the email address associated with your Account.

Your continued use of the Platform following the effective date of an updated Policy constitutes your acceptance of the revised terms. We encourage you to review this Policy periodically to stay informed of how your personal data is being handled.

If you wish to exercise any of your data subject rights, have questions about how your personal data is processed, or wish to raise a privacy-related concern, please contact us through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week via the support interface on the Bromo77 Platform. This is the fastest way to reach our team for account-related privacy queries.
• Email: [email protected] — for written data subject access requests, erasure requests, and formal privacy complaints. Please include your registered username and the nature of your request in your correspondence.

Bromo77 has designated a Data Protection Officer (DPO) responsible for overseeing compliance with this Policy and applicable data protection law. Data subject rights requests and formal privacy complaints addressed to the DPO should be submitted via the email address above, clearly marked for the attention of the Data Protection Officer.

We aim to acknowledge all data subject requests within 5 business days and to resolve them within 30 days of receipt. In cases of exceptional complexity, we may extend this period as permitted by applicable law, and will notify you promptly of any such extension.