Privacy Policy Brutal77 – Our Commitment to Protecting You Your Data

This Privacy Policy explains how brutal77 ("we", "our platform") collects, stores, processes, and protects your personal information when you use our online betting platform at brutal77.site.

This policy applies to all registered members brutal77, visitors to our website, and individuals who interact with us via email, live chat, WhatsApp, or any other support channel. By registering for or using our services, you agree to the privacy practices described in this document.

Brutal77 operates in accordance with the requirements of Personal Data Protection Act 2010 (PDPA) Malaysia and all related regulations in force in Malaysia. We take this responsibility seriously and continuously strive to go beyond minimum compliance requirements.

brutal77 only collects data that is strictly necessary to deliver our services safely and effectively. The following are the categories of data we collect:

We does not collect sensitive data such as health information, religious beliefs, political opinions, or trade union membership unless you voluntarily provide it in the context of a Responsible Gaming request.

brutal77 collects your personal data through several different means, depending on how you interact with our platform:

• Direct Account Registration: When you register a new account at brutal77, you provide basic information — such as your name, email address, phone number, and date of birth — directly through our registration form.
• In-Platform Activity: Gaming activity data, including bets, deposits, and withdrawals, is automatically collected when you use the Brutal77 platform. This includes a record of every financial transaction in MYR and every gaming session covering slots, baccarat, sports betting, and lottery.
• Payment Verification: When you make a deposit or withdrawal using Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, FPX, Maybank2u, or CIMB Clicks, transaction information is shared between Brutal77 and the relevant payment processor to verify and complete the transaction.
• Cookies & Tracking Technologies: The Brutal77 website uses cookies and similar tracking technologies to help us understand how you use the platform and to improve your experience. See Section 07 for further details.
• Support Communications: When you contact the brutal77 support team via live chat, email, or WhatsApp, we retain records of those communications for service quality and issue resolution purposes.
• KYC Verification: Identity documents (MyKad or passport) submitted for the Know Your Customer (KYC) process are securely collected and stored to meet Malaysian legal compliance requirements.

brutal77 uses your personal data for specific, legitimate, and necessary purposes. We do not use your data for anything unrelated to the services you use.

• Account Management: Verifying your identity, creating and managing your Brutal77 account, processing registrations, and ensuring secure login.
• Financial Transaction Processing: Processing MYR deposits via your chosen Malaysian payment method, processing withdrawal of winnings, and maintaining accurate financial records for your account.
• Betting Service Delivery: Gives you access to all brutal77 games, including Sports Betting (EPL, Liga Super Malaysia, badminton), Live Casino (baccarat, roulette), jackpot slots, digital lottery, and esports.
• Legal Compliance (AML/KYC): Meeting anti-money laundering (AML) and Know Your Customer (KYC) requirements under applicable Malaysian law.
• Customer Support: Helping you resolve technical issues, account inquiries, and complaints relating to gameplay or financial transactions in MYR.
• Platform Security: Detecting and preventing fraud, bonus abuse, money laundering, and other security threats against the Brutal77 platform and its member community.
• Responsible Gaming: Monitoring gameplay activity patterns to identify players who may need Responsible Gaming support, and enforcing the limits you have set for yourself.
• Service Communications: Sending important notifications regarding your account, transactions, policy changes, and Brutal77 promotions you have opted in to receive.
• Platform Improvements: Analyzing platform usage data (in aggregated, non-personally identifiable form) to improve the user experience, introduce new features, and optimize the technical performance of brutal77.

brutal77 does not sell your personal data. We only share data in the limited circumstances described below, and only with parties that are contractually or legally obligated to protect it:

brutal77 implements multiple layers of technical and organizational security controls to protect your personal data against unauthorized access, disclosure, alteration, or loss.

• Data Encryption in Transit: All communication between your browser or app and Brutal77's servers is protected by TLS 1.3 encryption with 256-bit SSL certificates – ensuring no third party can intercept your data in transit.
• Data Encryption at Rest: Sensitive data stored on Brutal77's servers — including financial information, passwords (in hashed form), and KYC documents — is encrypted using AES-256 standard.
• Tiered Access Control: Access to members' personal data within Brutal77's internal systems is restricted on a strictly need-to-know basis. Each employee may only access data that is relevant to their specific role.
• Two-Factor Authentication (2FA): All brutal77 internal admin accounts are protected by two-factor authentication. Members are encouraged to enable 2FA on their personal accounts for added security.
• 24/7 Security Monitoring: brutal77's intrusion detection systems and security team continuously monitor the platform around the clock to identify and respond to security threats in real time.
• Regular Security Audits: Brutal77 conducts regular penetration testing and independent security audits carried out by qualified third parties to identify and remediate security vulnerabilities before they can be exploited.
• Incident Response Plan: In the event of a data breach affecting your personal information, brutal77 has a comprehensive incident response procedure in place and will notify you within the timeframe required under the PDPA.

Platform brutal77 uses cookies and similar tracking technologies to enhance user experience, analyse platform performance, and maintain the security of your session.

You can manage your cookie settings through your web browser. However, disabling essential cookies may affect the functionality of the brutal77 platform. For more information on managing cookies in your browser, refer to your browser's help guide.

Given that brutal77 involves financial transactions in Malaysian Ringgit (RM), we take additional security measures to protect your financial information.

• No Full Card Information Stored: brutal77 does not store your full credit or debit card details in our systems. For card-based payments, we use PCI-DSS certified payment processors to handle this sensitive information.
• RM Transaction Records: All deposit and withdrawal history in MYR is securely stored and accessible at any time through the "Transaction History" section of your Brutal77 account.
• Malaysia E-Wallet Security: When you use Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, or DuitNow, the verification process takes place within the secure environment of the respective e-wallet provider. Brutal77 only receives transaction confirmation – not your e-wallet login credentials.
• Anti-Fraud Monitoring: Every financial transaction at brutal77 is monitored by an automated anti-fraud system that detects suspicious patterns and protects your account from unauthorised financial activity.
• Same-Origin Policy: In line with AML compliance requirements, brutal77 enforces a policy that withdrawals may only be made to the same payment method used for the original deposit — this protects you against third-party fraud.

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding the personal data that brutal77 store about you. We are committed to upholding all of these rights:

• Right of Access: You have the right to request a copy of all personal data we hold about you. This request will be fulfilled within 14 business days.
• Right to Rectification: If you find that any data we hold about you is inaccurate or out of date, you have the right to request a correction. Send your request to privacy@brutal77.site with the relevant correction details.
• Right to Erasure ("Right to be Forgotten"): Under certain circumstances, you have the right to request the deletion of your personal data. However, this right may be limited where we have a legal obligation to retain the data in question (e.g., financial transaction records for audit purposes).
• Right to Restriction of Processing: In certain circumstances, you may request that we restrict how we process your data — for example, while you are disputing the accuracy of that data.
• Right to Data Portability: You have the right to receive your personal data in a machine-readable format and transfer it to another service provider if needed.
• Right to Object: You may object to the processing of your data for direct marketing purposes at any time. Unsubscribe via promotional emails or manage your communication preferences within your brutal77 account settings.
• Right to Withdraw Consent: For processing that relies on your consent (such as marketing), you may withdraw that consent at any time without affecting the validity of any processing that took place prior to withdrawal.

To exercise any of the rights listed above, please submit a written request to privacy@brutal77.site by stating the right you wish to exercise and the information required to verify your identity. Brutal77 will respond within 14 business days.

brutal77 retains your personal data only for as long as necessary to fulfil the purposes outlined in this Privacy Policy or to meet applicable legal requirements.

Once the retention period ends, your data will be securely deleted or fully anonymised so that it can no longer be linked to you as an individual.

In managing platform operations brutal77, some data may be stored or processed on servers located outside Malaysia — for example, by game software providers or cloud infrastructure we utilise. Where this occurs, we ensure that protections equivalent to Malaysia's PDPA requirements are enforced.

• Data Processing Agreement: All third-party vendors who receive Brutal77 member data are bound by data processing agreements that enforce protection standards equivalent to or exceeding Malaysia's PDPA requirements.
• Consistent Security Standards: Regardless of the physical server location, all brutal77 member data is protected by consistent encryption standards and access controls as outlined in Section 06.
• Financial Data Stays in Malaysia: Financial transaction records in MYR and KYC documents of Malaysian members are prioritized for storage within Malaysia-based infrastructure or legal jurisdictions with equivalent levels of data protection.

brutal77 sets a minimum age of 21 years for all members. Our platform is not intended for underage individuals, and we do not knowingly collect personal data from children or anyone under 21.

If we discover that personal data belonging to an individual under the age of 21 has been inadvertently collected, we will take immediate steps to delete that data and close the account in question. If you are a parent or guardian and believe your child has registered with brutal77 while underage, please contact us immediately at privacy@brutal77.site for immediate action.

brutal77 reserves the right to amend this Privacy Policy at any time to reflect changes in our privacy practices, new Malaysian legal requirements, or changes to the services we offer.

When material amendments are made to this Privacy Policy, we will notify all affected members via their registered email and through a prominent notification in your Brutal77 account at least 14 days before those amendments take effect. The "Last Updated" date at the top of this page will always reflect the date of the most recent revision.

Continued use of the Brutal77 platform after the effective date of any amendment constitutes your acceptance of the updated Privacy Policy. If you do not agree with any amendment, you have the right to close your account before it takes effect and to request data deletion in accordance with the procedure set out in Section 09.

For any inquiries, requests, or complaints relating to this Privacy Policy or how brutal77 handles your personal data, please contact our Privacy Officer through the following channels:

Brutal77 is committed to addressing all privacy enquiries seriously and within the stipulated timeframe. If you believe we have not met our privacy obligations, you also have the right to file a complaint with Malaysia's Department of Personal Data Protection (JPDP) through their official channels.