vr77 Privacy Policy

1. Introduction and Scope

This Privacy Policy ("Policy") describes how vr77 ("vr77," "we," "us," "our") collects, uses, stores, discloses, and otherwise processes personal data relating to individuals ("Members," "Users," "you") who access or use the vr77 website at vr77.win and all associated services, including the vr77 Sportsbook, vr77 Casino, Slots, Poker, and promotional features.

This Policy applies to all personal data collected through the vr77 platform, whether provided directly by you during registration, generated through your use of the platform, or collected automatically via technical means. By registering an account with vr77 or using any part of the platform, you acknowledge that you have read and understood this Policy.

This Policy should be read alongside the vr77 Terms & Conditions, which govern the overall contractual relationship between vr77 and its members. Defined terms used in this Policy carry the same meaning as in the Terms & Conditions unless otherwise specified.

2. Data Controller

vr77 is the data controller responsible for the personal data described in this Policy. As data controller, vr77 determines the purposes and means of processing your personal data in connection with the operation of the vr77 platform.

For all data-related queries, correction requests, deletion requests, or complaints, members may contact vr77 using the contact information provided in Section 15 of this Policy.

3. Personal Data We Collect

vr77 collects the following categories of personal data from members:

3.1 Identity Data: Full legal name, date of birth, nationality, and government-issued identification number (e.g., Malaysian IC number or passport number) as provided during registration and KYC verification.

3.2 Contact Data: Email address, mobile phone number, and residential address (including postcode and state, relevant for members in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, and other Malaysian locations).

3.3 Financial Data: Bank account details, eWallet identifiers (such as Touch 'n Go eWallet or Boost account references), deposit and withdrawal history, and transaction amounts. vr77 does not store full card numbers; card processing is handled by certified third-party payment processors.

3.4 Account Data: Username, account preferences, account settings, bonus opt-in history, and session preferences.

3.5 Transaction and Gaming Data: Records of all bets placed (sportsbook wagers on EPL, Malaysia Super League, AFF Cup, and other markets), casino game sessions, slot play records, poker hand histories, deposit and withdrawal timestamps, and bonus activity.

3.6 Technical Data: IP address, device type, browser type and version, operating system, screen resolution, time zone, and connection type collected automatically when you access vr77.

3.7 Usage Data: Pages visited, features accessed, time spent on each section of the platform, navigation paths, and search queries within the platform.

3.8 Communications Data: Records of correspondence between you and the vr77 support team, including live chat transcripts, support ticket content, and email correspondence.

3.9 KYC Documentation: Copies of identity documents submitted for verification (government-issued photo ID and proof of address), processed in accordance with anti-money laundering regulatory requirements.

4. How We Collect Your Data

vr77 collects personal data through the following means:

• Direct provision: Data you submit during account registration, KYC verification, deposit and withdrawal requests, support interactions, and promotional opt-ins
• Automated collection: Technical and usage data collected automatically via server logs, cookies, and analytics tools as you use the vr77 platform
• Third-party verification: Identity and address verification data returned by KYC verification service providers in response to document checks
• Payment processors: Transaction confirmation data returned by payment processors handling deposits and withdrawals via Maybank, CIMB, Public Bank, Touch 'n Go eWallet, Boost, and FPX
• Fraud prevention services: Risk signals and device fingerprint data from fraud detection service providers used to protect platform integrity

5. Purposes and Legal Bases for Processing

vr77 processes your personal data for the following purposes and on the following legal bases:

• Account management and service delivery (contractual necessity): Registering and maintaining your account, processing bets and game sessions, managing deposits and withdrawals
• Identity verification and KYC compliance (legal obligation): Verifying age (21+), identity, and address in accordance with anti-money laundering and gaming licensing requirements
• Fraud prevention and security (legitimate interest): Detecting and preventing unauthorised access, bonus abuse, collusion, and money laundering
• Platform improvement and analytics (legitimate interest): Analysing usage patterns to improve platform performance, user interface, and game content offering
• Responsible gaming monitoring (legal obligation and legitimate interest): Monitoring for indicators of problem gambling behaviour to trigger responsible gaming interventions in accordance with licensing obligations
• Marketing communications (consent): Sending promotional offers, bonus notifications, and product updates where you have opted in at registration or subsequently
• Legal compliance and regulatory reporting (legal obligation): Retaining records for regulatory reporting, responding to lawful requests from authorities, and complying with applicable gaming licensing conditions

6. Disclosure of Personal Data to Third Parties

vr77 does not sell personal data. vr77 discloses personal data to third parties only in the following circumstances:

• Payment processors: Financial data is shared with certified payment service providers (Maybank, CIMB, Public Bank, Touch 'n Go, Boost, FPX) solely to process transactions
• KYC and identity verification providers: Identity and document data is shared with third-party verification services for the purpose of completing KYC checks
• Game software providers: Game session data is shared with providers such as Evolution, Pragmatic Play, PG Soft, and NetEnt solely to facilitate game play and resolve disputes
• Fraud prevention and analytics providers: Pseudonymised technical data may be shared with fraud prevention and analytics partners for platform security and performance purposes
• Regulatory and law enforcement authorities: Where required by applicable law, court order, or direction from a gaming regulatory authority, vr77 will disclose personal data as required
• Business successors: In the event of a merger, acquisition, or sale of the vr77 platform, personal data may be transferred as part of the transaction, subject to equivalent privacy protections

All third-party processors engaged by vr77 are subject to contractual obligations to process data only for the specified purpose and to maintain appropriate security standards.

7. International Data Transfers

vr77 may transfer personal data to servers or service providers located outside Malaysia. Where such transfers occur, vr77 implements appropriate safeguards — including standard contractual clauses or equivalent mechanisms — to ensure that transferred data receives a level of protection consistent with the principles set out in this Policy.

8. Data Retention

vr77 retains personal data for the following periods:

• Active account data: Retained for the duration of the account and for five (5) years following account closure, in accordance with anti-money laundering record-keeping obligations
• KYC documentation: Retained for a minimum of five (5) years following the end of the business relationship, as required by applicable licensing and AML regulations
• Transaction records: Retained for five (5) years following the date of transaction
• Support communications: Retained for two (2) years following the close of the relevant support interaction
• Technical and usage logs: Retained for up to twelve (12) months unless retention is required for fraud investigation or legal proceedings
• Marketing opt-in records: Retained until opt-out plus three (3) years for compliance demonstration purposes

Data that has reached the end of its retention period is securely deleted or anonymised so that it can no longer be linked to an identifiable individual.

9. Security Measures

vr77 implements appropriate technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• TLS/SSL encryption for all data in transit between your browser and vr77 servers
• Encryption at rest for sensitive personal and financial data stored on vr77 infrastructure
• Access controls limiting internal access to personal data on a need-to-know basis
• Regular security assessments and penetration testing by independent specialists
• Two-factor authentication (2FA) available to members for account access security
• Fraud detection and anomaly monitoring systems operating continuously across the platform

Notwithstanding these measures, no internet-based platform can guarantee absolute security. Members are encouraged to use strong, unique passwords for their vr77 accounts and to enable 2FA.

10. Cookies and Tracking Technologies

10.1 vr77 uses cookies and similar tracking technologies to operate the platform, maintain session state, and understand how members use the site.

10.2 The categories of cookies used by vr77 are:

• Essential cookies: Required for the platform to function — managing login sessions, maintaining your active game session, and processing transactions. These cannot be disabled without breaking core platform functionality.
• Performance and analytics cookies: Used to measure how different parts of the platform are used and to identify areas for improvement. Data collected is aggregated and does not identify individual members.
• Preference cookies: Store settings you have chosen, such as language preferences and display options, so that they persist across sessions.

10.3 vr77 does not use third-party advertising cookies or cross-site tracking cookies. No data is shared with advertising networks via cookies on the vr77 platform.

10.4 You may manage cookie preferences through your browser settings. Disabling essential cookies will affect the functionality of the vr77 platform, including the ability to maintain a logged-in session.

11. Your Data Subject Rights

As a vr77 member, you have the following rights in relation to your personal data:

• Right of access: You may request a copy of the personal data vr77 holds about you.
• Right to rectification: You may request correction of inaccurate or incomplete personal data.
• Right to erasure: You may request deletion of your personal data, subject to vr77's legal obligations to retain certain data (e.g., AML record-keeping requirements).
• Right to restriction of processing: You may request that vr77 restrict processing of your data in certain circumstances, such as while an accuracy dispute is being resolved.
• Right to data portability: You may request that vr77 provide your data in a structured, machine-readable format where technically feasible.
• Right to object: You may object to processing based on legitimate interests, including profiling, where your specific situation warrants it.
• Right to withdraw consent: Where processing is based on consent (e.g., marketing communications), you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact the vr77 support team via the details in Section 15. vr77 will respond to data subject requests within thirty (30) calendar days. Identity verification may be required before a request is processed to ensure data is not disclosed to unauthorised parties.

12. Children and Age Restriction

The vr77 platform is not directed at or intended for use by individuals under the age of 21. vr77 does not knowingly collect personal data from individuals under 21. If vr77 becomes aware that personal data has been collected from a person under the age of 21, that data will be deleted promptly and the associated account will be closed. If you believe vr77 may have inadvertently collected data from an underage individual, please notify the support team immediately.

13. Marketing Communications

13.1 vr77 may send promotional emails, SMS messages, or in-platform notifications relating to new promotions, bonus offers, and platform updates to members who have opted in to marketing communications at registration or subsequently through account settings.

13.2 You may opt out of marketing communications at any time by: (a) adjusting notification preferences in your vr77 account settings; or (b) contacting the support team via live chat or the support email listed in Section 15.

13.3 Opting out of marketing communications does not affect the sending of transactional messages, which include deposit confirmations, withdrawal processing notices, security alerts, and KYC status updates. These communications are necessary for account management and cannot be disabled.

14. Changes to This Privacy Policy

vr77 reserves the right to update this Privacy Policy at any time. Material changes will be communicated to registered members via email to the address on file no fewer than seven (7) calendar days before the revised Policy takes effect. The "Last updated" date at the top of this page reflects the date of the most recent revision. Continued use of the vr77 platform after the effective date of any revision constitutes acceptance of the updated Policy.

15. Contact and Data Requests

For any queries relating to this Privacy Policy, to exercise your data subject rights, or to submit a complaint regarding vr77's data handling practices, please contact the vr77 support team through the following channels:

• Live Chat: Available 24/7 via the in-site live chat widget on vr77.win
• Support Email: [email protected] (plain text — not a clickable link)

vr77 will acknowledge data-related requests within five (5) business days and provide a substantive response within thirty (30) calendar days. For complex requests, vr77 may extend this period by a further thirty (30) days with prior notification.

If you are not satisfied with vr77's response to a privacy complaint, you may have the right to lodge a complaint with a data protection supervisory authority in your jurisdiction. Malaysian members may also refer to the Personal Data Protection Act 2010 (PDPA) framework and the guidance published by the Department of Personal Data Protection Malaysia for information on their rights.