oyo99 Privacy Policy

oyo99 (referred to in this document as "oyo99", "we", "us", or "our") operates the online gaming platform accessible at https://oyo99.asia (the "Platform"). This Privacy Policy sets out the basis on which personal data we collect from players, prospective players, and visitors to the Platform will be processed by us.

This Privacy Policy applies to all personal data collected through:

• The oyo99 website and any mobile-optimised version of it at oyo99.asia.
• The account registration and KYC verification process.
• All deposit, withdrawal, and payment transactions conducted via BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, LinkAja, or any other approved payment channel.
• Correspondence between you and oyo99 via live chat, email, or any other supported communication channel.
• Participation in promotions, tournaments, and loyalty programmes operated by oyo99.
• Automatic data collection technologies including cookies, session identifiers, and server-side analytics.

This Privacy Policy does not apply to third-party websites, applications, or services that may be linked from the Platform. oyo99 is not responsible for the privacy practices of any third party, and we encourage you to review the privacy policies of any third-party service you access independently.

For the purposes of this Privacy Policy, the data controller responsible for the personal data of oyo99 players and platform visitors is the operating entity behind the oyo99 brand, which holds the international gaming licence under which the Platform operates.

All data protection enquiries, subject access requests, erasure requests, and formal complaints should be directed to our dedicated privacy contact:

• Email: [email protected] (mark your subject line: "Privacy — Data Request" or "Privacy — Formal Complaint")
• Live Chat: Available 24/7 via the chat widget on the oyo99 Platform. Our Indonesian-speaking agents can assist in routing your enquiry to the appropriate team.

oyo99 collects personal data in several categories depending on your interaction with the Platform. The table below summarises the categories of data we collect and the primary context in which each category is gathered:

oyo99 does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, biometric data, or health data, except where health-related information is voluntarily provided by a player in the context of a responsible gaming self-exclusion or problem gambling support request. Such data is handled with an additional layer of confidentiality and is accessible only to the responsible gaming team.

oyo99 uses the personal data we collect for the following purposes:

• Account Management: To create, maintain, and administer your oyo99 player account, including processing your registration details, verifying your eligibility (21+ requirement), and managing your account settings and preferences.
• Transaction Processing: To process deposits and withdrawals in Indonesian Rupiah (IDR) via your chosen payment channel — including bank transfers to and from BCA, BRI, BNI, Mandiri, and the other approved banks and e-wallets listed in Clause 3 — and to maintain accurate transaction records.
• KYC & Identity Verification: To verify your identity, age, and address before processing your first withdrawal, and to perform ongoing account-level due diligence as required by our operating licence.
• Anti-Money-Laundering (AML) Compliance: To screen transactions and gaming activity against AML thresholds, to investigate suspicious activity, and to file reports with the relevant regulatory authorities where legally required.
• Customer Support: To respond to enquiries, resolve disputes, and provide assistance via live chat and email support. Support interactions are logged and may be reviewed for quality assurance and training purposes.
• Responsible Gaming: To monitor gaming behaviour for indicators of problem gambling, to enforce deposit limits, session reminders, loss limits, and self-exclusion requests you have set, and to proactively reach out to players showing signs of harmful gambling patterns.
• Platform Improvement: To analyse usage patterns, technical performance, and player feedback in order to improve the functionality, content, and user experience of the oyo99 Platform.
• Marketing & Promotions: To send you promotional offers, bonus notifications, and updates about new games and features via email or SMS, but only where you have provided your express consent to receive such communications. You may withdraw consent at any time by contacting support or by using the unsubscribe link in any marketing email.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent account activity, unauthorised access attempts, multi-accounting, VPN circumvention, and other prohibited conduct as defined in oyo99's Terms & Conditions.
• Legal Compliance: To comply with applicable law, court orders, regulatory instructions, or lawful requests from competent authorities.

oyo99 processes personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual Necessity: The majority of oyo99's data processing activities are necessary for the performance of the contract between you and oyo99 — specifically, to provide you with a functioning player account, process your deposits and withdrawals, and deliver the gaming services you have registered to use.
• Legal Obligation: Certain processing activities — in particular KYC identity verification, AML transaction monitoring, and regulatory reporting — are required by the terms of oyo99's operating licence and by the applicable laws of the jurisdiction in which oyo99 holds that licence. oyo99 cannot operate without performing these activities.
• Legitimate Interests: oyo99 processes Technical Data and Usage Data for the purposes of platform security, fraud prevention, and product improvement on the basis of its legitimate business interests, provided those interests are not overridden by your fundamental privacy rights. You have the right to object to processing on this basis — see Clause 10.
• Consent: Where oyo99 sends you direct marketing communications (email promotions, SMS bonus alerts, seasonal offers tied to events such as Idul Fitri or Indonesian Independence Day), we do so on the basis of your freely given, specific, and informed consent. You may withdraw that consent at any time with immediate effect.

oyo99 does not sell, rent, or trade your personal data. We share personal data only in the limited circumstances described below, and only to the minimum extent necessary for each purpose:

• Payment Processors & Banking Partners: To process your deposits and withdrawals, oyo99 necessarily shares your financial identifiers (bank account number or e-wallet identifier, transaction amount in IDR, transaction reference) with the relevant payment processor or banking institution — for example, BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, or LinkAja. These institutions are independent data controllers subject to their own privacy policies and Indonesian financial services regulations.
• KYC & Identity Verification Providers: oyo99 may engage a specialist third-party identity verification service to validate KTP, passport, or driver's licence documents submitted during the KYC process. These providers operate under written data processing agreements and are prohibited from using your identity data for any purpose other than the verification task.
• Game Content Providers: Game studios whose titles are accessible on the Platform — including Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Pocket Games Soft — may receive a pseudonymous player identifier and session token to facilitate gameplay. These studios do not receive your name, contact details, financial data, or identity document information.
• IT & Infrastructure Providers: oyo99 uses third-party cloud hosting, content delivery, and security services to operate the Platform. These providers act as data processors under written agreements and handle data only on oyo99's documented instructions.
• Regulatory & Law Enforcement Authorities: oyo99 may disclose personal data to competent regulatory authorities, law enforcement agencies, or courts where required to do so by law, by court order, or by a lawful regulatory instruction. oyo99 will, where legally permitted, notify the affected player before making such a disclosure.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of oyo99's business, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and of any change in data controller at least 30 days before the transfer takes effect.

The oyo99 Platform uses cookies and similar tracking technologies to deliver a functional, personalised, and secure gaming experience. The following categories of cookies are used:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function and cannot be disabled. They include session authentication cookies that keep you logged in to your oyo99 account, security tokens that protect against cross-site request forgery, and load-balancing cookies that route your requests to the correct server. No personal data collected by strictly necessary cookies is used for any purpose other than platform operation.
• Functional Cookies: These cookies remember your preferences — such as your preferred language, time zone (WIB/WITA/WIT), and game lobby display settings — to provide a more personalised experience on return visits. They are set only on the basis of your use of the relevant preference features.
• Analytics Cookies: oyo99 uses server-side analytics tools to collect aggregated, pseudonymised usage data including pages visited, session duration, device type, and referral source. This data helps us understand how players use the Platform and identify areas for improvement. Analytics cookies do not identify you personally.
• Marketing Cookies: If you have consented to marketing communications, oyo99 may use cookies to track the effectiveness of promotional campaigns — for example, to determine whether a player who clicked a promotional banner subsequently registered an account. You may withdraw consent for marketing cookies at any time via the cookie preference centre accessible from the Platform.

Most web browsers accept cookies by default. You may configure your browser to refuse or delete cookies, but doing so may impair the functionality of certain Platform features, including the ability to remain logged in to your account. For detailed guidance on managing cookies in your specific browser, please refer to your browser's help documentation.

oyo99 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, subject to mandatory legal and regulatory retention obligations. The following retention periods apply as a general guide:

At the end of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where data has been anonymised, the resulting anonymised dataset is no longer personal data and may be retained indefinitely for aggregated statistical and research purposes without further notice to you.

As an internationally licensed online gaming operator, oyo99 may store and process your personal data on servers located outside of Indonesia. When personal data is transferred to a jurisdiction that does not provide a level of data protection equivalent to that applicable in Indonesia, oyo99 implements appropriate safeguards to protect that data, including:

• Contractual data protection clauses incorporated into agreements with all data processors operating outside Indonesia, which impose obligations on those processors equivalent to oyo99's own data protection commitments under this Privacy Policy.
• Requiring all overseas data processors handling oyo99 player data to implement technical security measures equivalent to those described in Clause 12 of this Privacy Policy.
• Conducting data protection impact assessments before engaging any new overseas processor that will handle player identity, financial, or KYC data.

As a player whose personal data is processed by oyo99, you hold the following rights in respect of that data. To exercise any of these rights, contact us via the channels listed in Clause 14.

• Right of Access: You may request a copy of all personal data oyo99 holds about you, including the categories of data, the purposes for which it is processed, any third parties with whom it has been shared, and the retention period applicable to each category.
• Right to Rectification: If any personal data oyo99 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. For changes to core account data (name, date of birth, email address), supporting documentation may be required.
• Right to Erasure: Subject to oyo99's mandatory legal retention obligations (particularly the 5-year AML retention requirement for KYC and transaction data), you may request the deletion of your personal data when you close your account or when the data is no longer necessary for the purpose for which it was collected.
• Right to Restriction: You may request that oyo99 restrict the processing of your personal data while a complaint or accuracy challenge is being investigated, or where you object to processing on legitimate interests grounds pending a balancing assessment.
• Right to Data Portability: For data you have provided directly to oyo99 and which is processed on the basis of contract or consent, you may request that it be provided to you in a structured, commonly used, machine-readable format.
• Right to Object: You may object at any time to oyo99 processing your personal data on the basis of legitimate interests. oyo99 will cease that processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to Withdraw Consent: Where processing is based on your consent (for example, receipt of marketing communications), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

oyo99 will not charge a fee for processing your rights request in ordinary circumstances. oyo99 reserves the right to charge a reasonable administrative fee for requests that are manifestly unfounded, repetitive, or excessive.

The oyo99 Platform is strictly intended for use by adults who are 21 years of age or older. oyo99 does not knowingly collect or process personal data belonging to any person under the age of 21.

Where oyo99 discovers or has reasonable grounds to suspect that personal data has been collected from a person under 21 years of age, the following actions will be taken immediately:

• The associated player account will be suspended without delay pending investigation.
• All personal data collected in connection with that account will be securely deleted from our active systems, subject to any minimum retention requirement imposed by AML regulations in respect of completed financial transactions.
• Any deposited funds will be returned to the originating payment source net of any transaction fees that cannot be recovered.
• Any winnings generated while the account was active will be forfeited in full.

If you are a parent or guardian and you believe that your child under 21 years of age may have registered an account on the oyo99 Platform, please contact us immediately at [email protected] or via live chat. oyo99 will investigate the report and take appropriate action within 48 hours WIB of receiving your notification.

oyo99 implements a comprehensive suite of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Key measures include:

• Encryption in Transit: All data transmitted between your device and the oyo99 Platform is encrypted using TLS 1.2 or higher (256-bit). This includes all login sessions, deposit and withdrawal requests, customer support chats, and KYC document uploads.
• Encryption at Rest: Sensitive personal data stored in oyo99's databases — including identity document images, financial account identifiers, and contact details — is encrypted at rest using AES-256 encryption.
• Password Security: Player account passwords are stored using a one-way cryptographic hashing algorithm with a unique salt per account. oyo99 staff cannot retrieve your plaintext password under any circumstances.
• Access Controls: Access to oyo99's internal systems that hold player personal data is restricted to authorised personnel on a need-to-know basis. Access rights are reviewed quarterly and are immediately revoked upon an employee's departure from the organisation.
• Penetration Testing: The oyo99 Platform undergoes regular independent penetration testing by certified cybersecurity professionals. Critical vulnerabilities identified during testing are remediated within defined SLA timeframes.
• Incident Response: oyo99 maintains a documented data breach incident response plan. In the event of a personal data breach that poses a risk to players, oyo99 will notify affected players within 72 hours of becoming aware of the incident, and will provide guidance on protective steps players should take.

While oyo99 takes all reasonable steps to protect your personal data, no internet-based system is completely immune to security threats. You are also responsible for maintaining the security of your own account — see the Account Security clause in oyo99's Terms & Conditions for your obligations in this regard.

oyo99 reserves the right to update or amend this Privacy Policy at any time. Changes may be made in response to developments in applicable data protection law, changes to oyo99's business operations, new data processing activities, or feedback from players and regulators.

When material changes are made to this Privacy Policy, oyo99 will:

• Update the "Last Updated" date at the top of this page.
• Send an email notification to the address registered on each active player account, summarising the key changes and directing players to the updated policy, at least 14 days before the changes take effect.
• Display a prominent notice on the Platform login screen and in the account settings panel for a period of at least 14 days following the update.

Your continued use of the oyo99 Platform after the effective date of any Privacy Policy update constitutes your acknowledgement of the revised policy. If you do not agree with the updated Privacy Policy, you must stop using the Platform and may request account closure by contacting our support team.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights described in Clause 10, or wish to raise a formal complaint regarding oyo99's handling of your personal data, please contact us through any of the following channels:

• Email: [email protected] — please include "Privacy Request" or "Privacy Complaint" in the subject line so your message is routed to the correct team without delay.
• Live Chat: Available 24 hours a day, 7 days a week via the chat widget on the oyo99 Platform. Indonesian-speaking agents are on hand around the clock and can escalate privacy-specific matters to the appropriate team on your behalf.
• Response Time: oyo99 targets an initial acknowledgement within 48 hours (WIB, UTC+7) and a substantive response within 30 calendar days for all privacy-related requests and complaints.

oyo99 values your trust and is committed to handling all privacy matters with the highest degree of professionalism, transparency, and care. We encourage you to reach out at any time if you have concerns about how your personal data is being managed on our platform.