tc77 Privacy Policy

§ 1 Data Controller

tc77, the operator of the platform at tc77.win, is the data controller in respect of personal data collected from Members and platform visitors. tc77 is licensed and regulated by an international gaming authority, and the obligations of that licence extend to the handling of Member personal data in accordance with applicable data protection standards.

As data controller, tc77 determines the purposes for which and the manner in which personal data is processed. Where tc77 engages third-party processors — for example, payment service providers, game content providers or identity verification services — such processors are bound by data processing agreements that require them to process personal data only on tc77's instructions and in accordance with this Policy.

For all privacy-related queries, exercise of data subject rights, or to submit a formal data protection complaint, please contact tc77 via the channels set out in Section 13 of this Policy.

§ 2 Data We Collect

tc77 collects personal data from Members and platform visitors in the following categories:

2.1 Registration and Account Data

When you create a tc77 account, we collect information including your full name, date of birth, residential address, email address, mobile phone number, and the username and password you select. This data is required to establish your account, verify your identity and communicate with you regarding your account.

2.2 Identity Verification (KYC) Data

To comply with our licensing obligations and applicable anti-money laundering regulations, tc77 requires documentary identity verification before processing withdrawals. KYC data may include scanned copies or photographs of government-issued photo identification (such as your Malaysian MyKad or passport) and proof of address documentation (such as a utility bill, bank statement, or official government letter dated within the past three months).

2.3 Financial Data

tc77 collects data relating to your deposits, withdrawals and wagering activity. This includes payment method identifiers (such as the last four digits of a payment card, or the registered mobile number associated with a Touch n Go eWallet or Boost account), transaction amounts, dates and reference numbers. tc77 does not store full payment card numbers; card processing is handled by PCI-DSS-compliant third-party payment processors.

2.4 Betting and Gaming Activity Data

tc77 records all sports bets, casino game sessions, slot spins and other wagering activity conducted through your account. This data is used for account management, dispute resolution, regulatory reporting, responsible gaming monitoring and personalisation of your platform experience.

2.5 Technical and Usage Data

When you access tc77, we automatically collect certain technical information including your IP address, browser type and version, device type and operating system, referring URL, pages visited, session duration and clickstream data. This information is collected through server logs and cookies (see Section 6) and is used for platform security, fraud prevention and service improvement.

2.6 Communications Data

tc77 retains records of communications between you and tc77 support, including live chat transcripts, email correspondence and, where applicable, voice recordings. These records are maintained for quality assurance, dispute resolution and regulatory compliance purposes.

2.7 Voluntary Data

You may choose to provide additional information voluntarily, for example when completing a survey, participating in a promotion or submitting feedback. Such data is used only for the purpose for which it was submitted.

§ 3 How We Use Your Data

tc77 uses the personal data it collects for the following purposes:

• Account management: Creating, maintaining and administering your tc77 account, processing login authentication and managing account security;
• Service delivery: Processing deposits and withdrawals, settling bets and casino game outcomes, and providing access to all platform features;
• Identity verification: Fulfilling KYC obligations as required under tc77's gaming licence and applicable anti-money laundering regulations;
• Fraud prevention and security: Detecting, investigating and preventing fraudulent activity, account abuse, money laundering and other prohibited conduct;
• Regulatory compliance: Meeting reporting obligations to tc77's licensing authority and cooperating with regulatory investigations where required by law;
• Responsible gaming: Monitoring wagering patterns to identify potential problem gambling behaviour and applying responsible gaming tools where appropriate;
• Customer support: Responding to your queries, resolving disputes and administering complaints;
• Marketing communications: Sending promotional offers, bonus notifications and platform updates to Members who have not opted out. You may withdraw consent to marketing communications at any time via account settings or by contacting support;
• Platform improvement: Analysing usage data, testing new features and optimising platform performance;
• Legal proceedings: Establishing, exercising or defending tc77's legal rights and complying with court orders or legal process.

§ 4 Legal Basis for Processing

tc77 processes personal data on one or more of the following legal bases, depending on the nature of the processing activity:

• Contractual necessity: Processing required to perform our contract with you — including account management, service delivery, and payment processing;
• Legal obligation: Processing required to comply with applicable law, including KYC obligations, AML reporting and regulatory requirements under tc77's gaming licence;
• Legitimate interests: Processing for fraud prevention, platform security, dispute resolution, service improvement and responsible gaming monitoring, where these interests are not overridden by your rights and freedoms;
• Consent: Processing for marketing communications, where you have given explicit consent. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

§ 5 Data Sharing & Third Parties

tc77 does not sell, rent or trade your personal data to third parties for their own marketing or commercial purposes. Personal data may be shared with the following categories of third parties, strictly for the purposes outlined in this Policy:

• Payment service providers: Touch n Go eWallet, Boost, Maybank, CIMB, Public Bank and card processors — to facilitate deposits and withdrawals;
• Identity verification providers: Third-party KYC and AML screening services that verify your identity and screen for sanctions or politically exposed person status;
• Game content providers: Providers such as Evolution Gaming, Pragmatic Play and others whose games are hosted on the tc77 platform — to facilitate game delivery and RNG certification;
• IT and infrastructure providers: Hosting, cloud storage and cybersecurity service providers who process data on tc77's behalf under data processing agreements;
• Regulatory authorities: tc77's licensing authority and financial intelligence units, where disclosure is required by law or regulation;
• Legal and professional advisers: Lawyers, accountants and compliance consultants, subject to professional confidentiality obligations.

§ 6 Cookies & Tracking Technologies

tc77 uses cookies and similar tracking technologies on the tc77.win platform. Cookies are small text files placed on your device by your browser when you visit the platform. tc77 uses the following categories of cookies:

• Strictly necessary cookies: Required for the platform to function. These include session authentication cookies, CSRF protection tokens and load-balancing cookies. These cannot be disabled without impairing platform functionality;
• Analytics cookies: Used to understand how Members navigate the platform, which features are used most frequently and where technical errors occur. Analytics data is aggregated and anonymised where possible;
• Preference cookies: Store your display preferences such as language settings, odds format and game lobby layout to provide a personalised experience;
• Security cookies: Assist in fraud detection and prevention by identifying unusual access patterns or suspicious device behaviour.

You can manage cookie preferences through your browser settings. Disabling cookies may impair some platform features, including persistent login and personalised content. tc77 does not use third-party advertising or behavioural tracking cookies.

§ 7 Data Retention

tc77 retains personal data for as long as necessary to fulfil the purposes described in this Policy and to comply with applicable legal and regulatory obligations. Specific retention periods include:

• Account data: Retained for the duration of the active account relationship and for a minimum of five (5) years following account closure, as required by AML regulations;
• Transaction and betting records: Retained for a minimum of five (5) years from the date of the transaction, as required by tc77's licensing authority;
• KYC documents: Retained for the duration of the account and for a minimum of five (5) years following account closure;
• Support communications: Retained for a period of three (3) years from the date of the final communication;
• Technical logs: Retained for twelve (12) months, unless required for longer periods for fraud investigation or legal proceedings.

Following the expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with an individual.

§ 8 Data Security

tc77 implements a range of technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the tc77 platform;
• Encryption at rest for all databases containing Member personal data;
• Salted hashing of passwords — tc77 never stores passwords in plain text;
• Role-based access controls — internal access to personal data is restricted to personnel with a documented operational need;
• Regular security audits and penetration testing conducted by independent third parties;
• Intrusion detection systems and real-time monitoring for suspicious activity;
• Incident response procedures to enable prompt identification, containment and notification of any personal data breach.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, tc77 will notify you and the relevant supervisory authority as required by applicable law and our licensing obligations.

§ 9 International Data Transfers

As an internationally licensed platform, tc77 may transfer personal data to countries outside Malaysia in connection with the provision of its services — for example, where game servers, payment infrastructure or KYC verification services are operated from jurisdictions outside Malaysia. Where such transfers occur, tc77 ensures that appropriate safeguards are in place, including contractual clauses that bind recipient parties to data protection standards consistent with this Policy and applicable law.

§ 10 Your Data Rights

Subject to applicable law and our regulatory obligations, you have the following rights in respect of your personal data held by tc77:

• Right of access: You may request a copy of the personal data tc77 holds about you;
• Right to rectification: You may request correction of any inaccurate or incomplete personal data we hold about you;
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to tc77's legal and regulatory retention obligations;
• Right to restriction: You may request that tc77 restrict the processing of your personal data in certain circumstances;
• Right to data portability: You may request that tc77 provide your account data in a structured, machine-readable format;
• Right to object: You may object to processing based on legitimate interests, including direct marketing;
• Right to withdraw consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact tc77 support via the channels in Section 13. tc77 will respond to verifiable requests within 30 days. Requests may be subject to identity verification before processing. Certain rights may be limited where applicable law — including AML and gaming regulatory requirements — mandates continued retention of data.

§ 11 Children's Privacy

The tc77 platform is strictly intended for persons aged 21 years and over. tc77 does not knowingly collect personal data from individuals under the age of 21. If tc77 becomes aware that personal data has been collected from a person under 21, that data will be deleted and the associated account will be closed immediately.

Parents or guardians who believe that a person under 21 may have created a tc77 account should contact tc77 support immediately via the details in Section 13.

§ 12 Amendments to This Policy

tc77 may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law or our licensing requirements. The "Last updated" date at the top of this page will be revised upon each update. Material changes to this Policy will be communicated to registered Members via the email address on file or by a prominent notice on the platform. Continued use of tc77 following publication of an updated Policy constitutes acceptance of the revised terms.

§ 13 Contact Us

For all privacy-related queries, to exercise a data subject right, or to submit a data protection complaint, please contact tc77 through the following channels:

• Email: [email protected]
• Live Chat: Available 24/7 at tc77.win — average response time 3–5 minutes
• WhatsApp: Contact details available to verified Members after login

Formal data subject rights requests should be submitted in writing (by email or through the live chat with a transcript saved) so that tc77 can maintain a record of the request and its resolution. tc77 will acknowledge all formal privacy requests within 24 hours of receipt.