vm787 Privacy Policy

This Privacy Policy applies to all personal data processed by vm787 in connection with the operation of the vm787 online casino and sportsbook platform, accessible at https://vm787.net ("the Platform"). It covers data collected through the website, any associated mobile-optimised interfaces, customer support channels, and all marketing communications sent by vm787.

The data controller responsible for the personal data of Users is the Company that owns and operates vm787, as identified in the international gaming licence under which the Platform is authorised to operate. Where this Policy refers to "vm787", "we", "us", or "our", it refers to that data controller entity.

This Privacy Policy should be read in conjunction with the vm787 Terms & Conditions, which govern the overall legal relationship between vm787 and its registered Users. By creating an Account on vm787 or by continuing to use the Platform, you confirm that you have read, understood, and consent to the data practices described in this Policy.

vm787 collects the following categories of personal data from Users, depending on the nature of their interaction with the Platform:

vm787 does not collect any special categories of sensitive personal data (such as racial or ethnic origin, political opinions, religious or philosophical beliefs, or health data) except where a User voluntarily discloses such information in a support communication — in which case it is used solely to respond to that inquiry and is not stored in any profile system.

vm787 collects personal data through the following channels and mechanisms:

• Direct Submission: Data you actively provide when completing the Account registration form, submitting KYC documents, making a deposit or withdrawal request, contacting customer support, or participating in a promotion.
• Automated Technical Collection: Data collected automatically when you access the Platform, including your IP address, device identifiers, browser characteristics, and session activity, via server logs, cookies, and similar tracking technologies (see Clause 8 for full cookie details).
• Payment Processors: Confirmation data received from Indonesian bank transfer gateways and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) when a deposit or withdrawal transaction is completed. vm787 receives confirmation data and transaction reference numbers — we do not receive or store full bank account PIN codes or e-wallet passwords.
• KYC Verification Partners: Data returned by third-party identity verification services that cross-reference the documents you submit against authoritative identity databases, for the purpose of age and identity confirmation.
• Publicly Available Sources: In limited circumstances related to fraud prevention or AML compliance, vm787 may cross-reference data against publicly available sanctions lists or fraud databases.

vm787 processes personal data only where a valid lawful basis exists. The following table summarises the primary purposes for which we process your data and the corresponding legal basis for each purpose:

vm787 does not sell, rent, or share your personal data with third parties for their own independent commercial or marketing purposes. We share personal data with third parties only in the following limited circumstances:

• Payment Service Providers: We share the minimum necessary financial data with Indonesian bank transfer gateways and e-wallet providers (including OVO, DANA, GoPay, ShopeePay, and LinkAja) solely to process your deposit and withdrawal transactions. These providers operate under their own privacy policies and are contractually prohibited from using your data for any purpose beyond transaction processing.
• KYC and Identity Verification Providers: We share identity document data with our licensed KYC verification partners to fulfil our age and identity verification obligations. All such partners are bound by strict data processing agreements and are required to maintain security standards equivalent to those applied by vm787.
• Game Content Providers: When you play a game hosted on the vm787 Platform, certain session data (such as your Account ID and session token) is shared with the relevant game studio (e.g., Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, Pocket Games Soft) solely to enable game delivery, fair-play certification, and technical support. These studios do not receive your full identity or financial data.
• Analytics Providers: Aggregated, anonymised usage data is shared with analytics service providers to help vm787 understand Platform performance and improve the User experience. No personally identifiable information is included in these analytics reports.
• Legal and Regulatory Authorities: vm787 will disclose personal data to law enforcement agencies, regulatory bodies, or courts of competent jurisdiction where required to do so by applicable law, court order, or the requirements of vm787's international gaming licence. vm787 will notify affected Users of such disclosure where legally permitted to do so.
• Business Transfers: In the event of a merger, acquisition, or sale of all or a substantial part of vm787's business assets, personal data held by vm787 may form part of the transferred assets, subject to the acquiring entity maintaining the same privacy standards described in this Policy.

As an internationally operated platform, vm787 may process and store personal data on servers located outside of Indonesia. Where your personal data is transferred to a jurisdiction that may not provide a level of data protection equivalent to that applicable in your home country, vm787 puts in place appropriate safeguards to protect that transfer, including:

• Data Processing Agreements: All third-party processors and sub-processors who receive personal data from vm787 are required to sign data processing agreements that impose binding data protection obligations consistent with the standards applied by vm787.
• Security Standards: All international data transfers are conducted over encrypted channels. Data at rest on vm787's servers is encrypted using AES-256 encryption, regardless of the server's physical location.
• Necessity Principle: International transfers of personal data are limited strictly to what is necessary for the purpose described — no speculative or bulk transfers of User data occur outside the operational requirements of the Platform.

By registering an Account on vm787 and accepting these Terms, you consent to the international transfer of your personal data as described in this Clause, subject to the protections outlined above.

vm787 retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, subject to any longer retention period required by law or by the conditions of our international gaming licence. The following retention periods apply as a general guideline:

When the applicable retention period expires, personal data is either securely and permanently deleted from vm787's systems or anonymised in such a way that it can no longer be associated with an identifiable individual. Anonymised aggregate data may be retained indefinitely for statistical and analytical purposes.

vm787 uses cookies and similar tracking technologies on the Platform to deliver core functionality, enhance User experience, and gather anonymised analytics data. The following categories of cookies are used:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function. They maintain your login session, store your language and currency preferences, and enable secure navigation between pages. These cookies cannot be disabled without significantly impairing your ability to use the Platform.
• Performance Cookies: These cookies collect anonymised information about how Users interact with the Platform — for example, which pages are visited most frequently and whether any error messages are encountered. This data is used solely to improve Platform performance and is never linked to individual identity data.
• Functionality Cookies: These cookies remember choices you make on the Platform (such as your preferred game category or notification settings) to provide a more personalised experience. They do not track your activity on websites outside of vm787.
• Analytics Cookies: vm787 uses analytics tools to measure overall Platform engagement in aggregate. Data collected by these cookies is anonymised and does not identify individual Users. No data from analytics cookies is shared with advertising networks.

You may manage cookie preferences through your browser settings. Most modern browsers allow you to block or delete cookies at the browser level. Note that disabling strictly necessary cookies will impair Platform functionality, including your ability to remain logged in across page navigations.

vm787 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Key security controls include:

• Transport Layer Security (TLS): All data in transit between your browser and vm787's servers is protected by TLS 1.3, the current gold standard for transport encryption. The padlock icon visible in your browser's address bar confirms an active TLS connection.
• Data Encryption at Rest: Sensitive personal data stored on vm787's servers — including KYC documents and financial data — is encrypted at rest using AES-256 encryption. Encryption keys are stored separately from the encrypted data and are rotated on a scheduled basis.
• Password Security: User passwords are never stored in plain text. They are hashed using a secure, salted one-way hashing algorithm. vm787 staff cannot retrieve your password — only a password reset process can restore Account access if credentials are lost.
• Access Controls: Access to personal data within vm787's systems is restricted on a strict need-to-know basis. Customer support staff can view only the minimum data necessary to resolve a User inquiry. Senior management and data protection staff are the only personnel with access to KYC document archives.
• Penetration Testing: vm787's Platform undergoes regular independent security assessments, including penetration testing by qualified information security professionals, to identify and remediate any vulnerabilities before they can be exploited.
• Incident Response: vm787 maintains a documented data breach response plan. In the event of a confirmed breach affecting User personal data, affected Users will be notified within 72 hours of the breach being confirmed, via the email address registered on their Account.

As a User of the vm787 Platform, you hold the following rights with respect to the personal data we process about you. To exercise any of these rights, contact our data protection team at [email protected] with the subject line "Data Rights Request" and a description of the right you wish to exercise.

• Right of Access: You have the right to request a copy of the personal data vm787 holds about you, along with information about why it is held and how it is used. We will respond to verified access requests within 30 days.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request correction. For straightforward corrections (such as updating a contact email address), you may also make changes directly through your Account settings panel.
• Right to Erasure: In certain circumstances, you have the right to request that vm787 delete your personal data. This right is subject to important exceptions — for example, we are required to retain financial transaction records and KYC documents for the regulatory retention periods described in Clause 7, and these cannot be deleted on request. We will inform you of any applicable exceptions when responding to your request.
• Right to Restriction: You may request that vm787 restrict the processing of your personal data in certain circumstances, such as when you have contested the accuracy of the data and a verification period is pending.
• Right to Data Portability: Where processing is based on your consent or on the performance of a contract, and where processing is carried out by automated means, you have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to vm787's processing of your personal data where that processing is based on legitimate interests, including profiling for fraud detection purposes. vm787 will cease processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., for marketing communications), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

vm787 will respond to all data rights requests within 30 days of receipt. In complex cases, the response period may be extended by up to a further 60 days, in which case you will be notified of the extension and the reason for it within the initial 30-day period.

The vm787 Platform is strictly for adults aged 21 and above. vm787 does not knowingly collect personal data from any person under the age of 21, and the registration system is designed to prevent underage individuals from opening an Account.

• All Users are required to confirm during registration that they are at least 21 years of age. A mandatory KYC age verification process is conducted before any withdrawal is approved, and may be triggered at Account opening at vm787's discretion.
• If vm787 discovers that an Account has been registered by a person under the age of 21, that Account will be immediately and permanently closed, all personal data associated with the Account will be securely deleted (subject to any legal obligations to retain specific records), and any Balance will be handled in accordance with the regulatory requirements applicable in the circumstances.
• Parents and guardians who believe that a minor has registered an Account on vm787 should contact support immediately at [email protected]. vm787 will investigate and act on all such reports as a matter of priority.
• vm787 strongly recommends that adults who share devices with minors use the Platform's session lock feature and maintain robust password security to prevent any unauthorised Account access by younger family members.

vm787 may send promotional communications — including information about bonuses, new game releases, seasonal promotions tied to Indonesian cultural events (such as Ramadhan, Idul Fitri, and Indonesian Independence Day on 17 August), and sportsbook special offers — to Users who have opted in to receive such communications during registration or via their Account preferences panel.

• Opt-In: Marketing communications are sent only to Users who have actively opted in. No marketing messages are sent to Users who have not provided explicit consent.
• Opt-Out / Unsubscribe: You may withdraw consent for marketing communications at any time by clicking the "Unsubscribe" link in any marketing email, by updating your notification preferences in your Account settings panel, or by contacting support. Your opt-out will be processed within 5 business days. Please note that transactional communications (such as deposit confirmations, withdrawal notifications, and KYC status updates) are not marketing messages and will continue to be sent regardless of your marketing preferences.
• Communication Channels: Marketing communications may be sent via email and, where you have provided a mobile number and opted in, via SMS. vm787 does not send unsolicited push notifications or instant-message marketing without consent.
• No Third-Party Marketing: vm787 does not share your personal data with any third party for the purpose of sending you marketing communications on behalf of that third party.

The vm787 Platform does not contain links to third-party websites for general browsing purposes. All navigation on the Platform leads to internal vm787 pages. However, the game interfaces provided by third-party studios (Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, Pocket Games Soft, and others) are delivered via embedded iframes or API integrations, and these studio environments operate under their own privacy and data handling practices.

• vm787 is not responsible for the data practices of game studio providers operating within their own technical environments when you engage with a game. However, all studio partners are required to maintain data security standards consistent with those required by their respective gaming certification bodies.
• If you access vm787 via a link from a third-party website (such as an affiliate or referral site), vm787 is not responsible for any personal data collected by that third-party site before or after you land on the vm787 Platform. Those sites are governed by their own separate privacy policies.

vm787 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, operational requirements, or applicable legal obligations. When material changes are made, we will take reasonable steps to notify affected Users before the changes take effect.

• Notification of Changes: Material amendments to this Privacy Policy will be communicated to registered Users via the email address on their Account, or via a prominent notice displayed on the Platform when they next log in. The notification will summarise the key changes and the date on which the revised Policy takes effect.
• Effective Date: The updated Privacy Policy takes effect on the date specified in the notification. Continued use of the Platform after the effective date constitutes acceptance of the revised Policy. If you do not agree with the changes, you should stop using the Platform and contact support to discuss Account closure options before the effective date.
• Version History: The "Last Updated" date displayed at the top of this page reflects the most recent revision date. Previous versions of this Privacy Policy are available on request by contacting our support team.
• Minor Changes: Non-material changes — such as typographical corrections, clarifications that do not alter the substance of the Policy, or updates to contact details — may be made without prior notification. The "Last Updated" date will be revised to reflect any such changes.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the personal data vm787 holds about you, you are encouraged to contact our support team through the following channels:

• Email: Send your inquiry to [email protected] with the subject line "Privacy Inquiry" or "Data Rights Request" as appropriate. Our data protection team monitors this address and will acknowledge receipt within 24 hours, seven days a week including Indonesian public holidays.
• Live Chat: Available through your logged-in Account dashboard, 24 hours a day, 7 days a week. Indonesian-speaking agents are available alongside English-speaking staff at all times.
• Response Commitment: We are committed to responding to all privacy-related inquiries within 30 days of receipt. For complex data rights requests, the response period may be extended to a maximum of 90 days, with notification provided within the initial 30-day window.