cr717 Privacy Policy

cr717 is an internationally licensed online betting and casino platform serving Indonesian players across sportsbook, live casino, slot, and traditional card game verticals. As part of delivering these services, cr717 necessarily processes personal data relating to registered members. We take this responsibility seriously and are committed to handling your data with the highest standards of security, transparency, and integrity.

This Policy applies to all personal data collected through the cr717 website at https://cr717.pro, including data submitted during account registration, identity verification, payment transactions, customer support interactions, and general platform use. It applies regardless of whether you access the platform via desktop browser or mobile browser.

This Policy should be read in conjunction with the cr717 Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference. In the event of any conflict between this Policy and those documents in relation to personal data matters, this Privacy Policy takes precedence.

cr717 primarily serves members accessing the platform from Indonesia. Where Indonesian data-protection conventions or expectations differ from international standards, cr717 will apply the more protective standard.

The following definitions apply throughout this Privacy Policy:

cr717 collects Personal Data across several categories depending on the nature of your interaction with the platform. The table below summarises the categories and specific data points collected:

cr717 collects Personal Data through the following channels:

• Account Registration: When you complete the cr717 registration form, you directly provide your name, date of birth, email address, and phone number. This data is required to open and maintain your account.
• KYC Verification: When requested as part of our identity verification process, you submit copies of government-issued documents and, where applicable, proof of payment method ownership. This data is collected directly from you.
• Deposit & Withdrawal Transactions: Financial data is collected automatically when you initiate a deposit or withdrawal through the cr717 cashier, including the payment method used, the amount in IDR, and the transaction timestamp.
• Platform Use: Technical Data and Betting & Gaming Data are generated automatically as you navigate and interact with the cr717 platform. This includes page views, game sessions, bet placements, and cashier interactions.
• Customer Support: When you contact cr717 via live chat or email, the content of that communication is recorded and associated with your account for quality assurance and dispute resolution purposes.
• Cookies & Tracking Technologies: Technical Data is collected automatically via cookies and similar technologies as described in detail in Clause 10 of this Policy.
• Third-Party Verification Providers: In some cases, cr717 may verify identity information against data held by third-party KYC or fraud-prevention service providers. This is done solely to confirm the accuracy of information you have provided to us.

cr717 uses the Personal Data collected from you for the following specific, documented purposes. We do not use your data for any purpose not listed here without first obtaining your explicit consent or updating this Policy:

1. Account Management: To create, maintain, verify, and administer your cr717 account, and to authenticate your identity at login.
2. Service Delivery: To process your bets and wagers, settle winnings, and provide access to sportsbook markets, live casino tables, slot titles, and card games.
3. Payment Processing: To execute deposit and withdrawal transactions via your chosen Indonesian bank (BCA, BRI, BNI, Mandiri, and others) or e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja), and to maintain an accurate transaction history.
4. Identity Verification (KYC): To confirm that you meet cr717's minimum age requirement of 21 years and to comply with international anti-money-laundering and counter-terrorism-financing obligations.
5. Fraud Prevention & Security: To detect, investigate, and prevent unauthorised access, duplicate accounts, bonus abuse, match-fixing activity, and financial fraud.
6. Responsible Gaming: To monitor wagering patterns for signs of problem gambling behaviour, to enforce self-exclusion and deposit limits at your request, and to provide reality-check notifications where configured.
7. Customer Support: To respond to your enquiries, process complaints, and maintain records of communications for quality assurance purposes.
8. Legal Compliance: To fulfil cr717's obligations under applicable international gaming regulations, AML laws, and data-protection frameworks, and to respond to lawful requests from competent authorities.
9. Platform Improvement: To analyse aggregated and anonymised usage data in order to improve platform performance, game selection, and user experience.
10. Marketing Communications: Where you have opted in, to send you information about promotions, bonuses, and new product features relevant to your interests. You may withdraw consent for marketing communications at any time via your account settings or by contacting support.

cr717 processes your Personal Data on the following legal bases, consistent with internationally recognised data-protection principles:

• Contractual Necessity: Processing required to perform our contract with you — specifically, to operate your account, accept wagers, process payments, and settle winnings.
• Legal Obligation: Processing required to comply with applicable law, including KYC identity verification, AML transaction monitoring, and responding to lawful regulatory requests.
• Legitimate Interests: Processing that serves cr717's legitimate business interests — such as fraud detection, platform security, responsible gaming monitoring, and service improvement — where such interests are not overridden by your rights and interests.
• Consent: Processing carried out on the basis of your freely given, specific, and informed consent — in particular, the sending of marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

cr717 does not sell, rent, or trade your Personal Data to third parties. We share your data only in the following limited and controlled circumstances:

• Service Providers (Processors): Third-party companies that provide technical, operational, or support services necessary to run the cr717 platform — including payment gateway operators, KYC verification platforms, cloud hosting providers, and customer support software vendors. All Processors are bound by data-processing agreements that restrict them to processing your data solely on our documented instructions.
• Game Content Providers: Licensed game studios — such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft — may receive anonymised session data (e.g., game-round results, RTP calculations) to ensure game integrity. No personally identifiable information is shared with game studios.
• Financial Institutions: Your bank or e-wallet provider (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, etc.) will receive the transaction details necessary to process your deposit or withdrawal. This is inherent to the operation of any payment transaction.
• Regulatory & Law Enforcement Authorities: cr717 may be required by law to disclose Personal Data to competent governmental, regulatory, or law enforcement authorities. Such disclosures are made only to the extent strictly required by law and, where permitted, we will notify you before complying.
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of cr717's assets, your Personal Data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and any material change to this Policy that results from it.

As an internationally licensed platform, cr717 may process or store your Personal Data on servers located outside Indonesia. Where such transfers occur, cr717 ensures that appropriate safeguards are in place to protect your data to a standard at least equivalent to that required under this Policy.

Safeguards used for international transfers include contractual clauses in data-processing agreements with our service providers that require them to maintain data-protection standards consistent with internationally recognised frameworks. cr717 conducts due diligence on all Processors to confirm that adequate technical and organisational measures are in place before any transfer occurs.

If you have any concerns about the international transfer of your Personal Data, you may contact cr717's data protection contact at support@cr717.pro for further information.

cr717 retains your Personal Data for the periods set out below, after which data is securely deleted or irreversibly anonymised:

Where cr717 is required by applicable law to retain data beyond the periods stated above, the legally mandated retention period will apply. Following expiry of the relevant retention period, data is deleted in accordance with cr717's secure data disposal procedures.

cr717 uses cookies and similar technologies (collectively "Cookies") to maintain the security and functionality of your account session, prevent fraud, and generate anonymised analytics about platform usage. The following Cookie categories are in use on the cr717 platform:

cr717 does not deploy advertising cookies, behavioural profiling cookies, or any Cookie that shares your activity data with third-party advertising networks. You may manage Cookie preferences through your browser settings; however, disabling Strictly Necessary cookies will impair your ability to use the platform.

As a cr717 member, you have the following rights in relation to the Personal Data we hold about you. Requests relating to any of these rights should be submitted to support@cr717.pro with the subject line "Privacy Rights Request" and will be actioned within 30 calendar days of receipt:

• Right of Access: You may request a copy of all Personal Data cr717 holds about you, along with information about the purposes for which it is processed, the categories of data held, and the recipients with whom it has been shared.
• Right of Rectification: You may request correction of any Personal Data that is inaccurate or incomplete. Minor account details (e.g., contact number, email address) may be updated directly through your account settings.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where processing is unlawful. This right is subject to cr717's legal obligation to retain certain data categories as described in Clause 9.
• Right to Restriction: You may request that cr717 restrict the processing of your Personal Data in certain circumstances — for example, where you contest the accuracy of the data while we verify it, or where you have objected to processing pending a determination of cr717's legitimate grounds.
• Right to Object: You have the right to object at any time to processing carried out on the basis of cr717's legitimate interests, including profiling for responsible gaming purposes. You may also object at any time to the processing of your data for direct marketing purposes.
• Right to Data Portability: Where processing is based on your consent or a contract, and is carried out by automated means, you may request a copy of your Personal Data in a structured, commonly used, machine-readable format.
• Right to Withdraw Consent: Where cr717 processes your data on the basis of consent (e.g., for marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

cr717 implements a layered set of technical and organisational security measures designed to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure. Key measures in place include:

• 256-Bit SSL/TLS Encryption: All data transmitted between your browser and the cr717 platform is encrypted using industry-standard TLS 1.2 or higher. Our SSL certificate is verified by a trusted certificate authority.
• Password Hashing: Member passwords are never stored in plain text. cr717 uses a strong cryptographic hashing algorithm with per-user salting to protect password data at rest.
• Two-Factor Authentication (2FA): cr717 offers optional 2FA for all member accounts. Members are strongly encouraged to enable this feature to add a second layer of identity verification at login.
• Access Controls: Access to Personal Data within cr717's internal systems is restricted on a strict need-to-know basis. Staff with access to Sensitive Data — including KYC documents and financial records — undergo background screening and receive mandatory data-protection training.
• Intrusion Detection & Monitoring: cr717's technical infrastructure is monitored continuously for suspicious activity, attempted intrusions, and anomalous access patterns. Security incidents are triaged and responded to according to a documented incident response procedure.
• Data Backup & Recovery: Member data is backed up regularly to geographically separate, encrypted storage. Backup integrity is tested periodically to ensure data can be recovered in the event of a system failure.

Despite these measures, no internet-based system is entirely immune to security risks. cr717 cannot guarantee absolute security of data transmitted over the internet and encourages members to use strong, unique passwords and to enable 2FA on their accounts. In the event of a data breach that is likely to result in a risk to your rights, cr717 will notify affected members without undue delay.

The cr717 platform is strictly for adults aged 21 years or older. cr717 does not knowingly collect, store, or process Personal Data relating to individuals under the age of 21. Age verification is a mandatory step in the KYC process, and cr717 reserves the right to request documentary evidence of age from any member at any time.

If cr717 becomes aware that Personal Data has been collected from a person under the age of 21 — whether through misrepresentation at registration or any other means — we will immediately suspend the relevant account, void any associated transactions, and delete all Personal Data relating to that individual in accordance with our secure data disposal procedures.

If you are a parent or guardian and believe that a minor in your care has registered an account on cr717, please contact us immediately at support@cr717.pro. We will investigate and act promptly.

The cr717 platform does not contain links to external third-party websites for commercial or advertising purposes. Any game content delivered within the platform by third-party studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft, and others) is rendered within the cr717 environment and is subject to the data-sharing provisions described in Clause 7 of this Policy.

cr717 is not responsible for the privacy practices of any third-party service provider operating behind the scenes to support platform functionality. However, all such providers are vetted and required to comply with data-protection obligations set out in their service agreements with cr717.

cr717 may update this Privacy Policy from time to time to reflect changes in our data practices, platform functionality, or applicable legal requirements. The effective date at the top of this document will be updated whenever a new version is published.

Where amendments are material — for example, where a new category of data is collected or a new purpose for processing is introduced — cr717 will provide at least 14 days' advance notice via email to your registered address or a prominent in-platform notification before the changes take effect.

Continued use of the cr717 platform after the effective date of any revised Policy constitutes your acceptance of the updated terms. If you disagree with any changes, you may request account closure by contacting customer support prior to the effective date.

If you have any questions, concerns, or requests relating to this Privacy Policy, or wish to exercise any of the privacy rights described in Clause 11, please contact the cr717 data protection team through the following channels:

• Email: support@cr717.pro — please use the subject line "Privacy Rights Request" or "Privacy Policy Enquiry" and include your registered username. We aim to respond to all privacy-related correspondence within 30 calendar days.
• Live Chat: Available 24/7 through the cr717 platform. Our Indonesian-speaking support agents can assist with general account and privacy queries around the clock, in both English and Bahasa Indonesia.