oyo90 Privacy Policy

1. Definitions

For clarity throughout this Privacy Policy, the following terms carry the meanings set out below:

• "oyo90," "we," "us," or "our" — the oyo90 online gaming platform accessible at https://oyo90.cam.
• "You" or "your" — any individual who visits, registers with, or uses the oyo90 platform.
• "Personal Data" — any information that identifies you or could reasonably be used to identify you, including your name, email address, phone number, national identity number (NIK on your KTP/e-KTP), bank account details, IP address, and device identifiers.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, use, disclosure, or deletion.
• "Services" — all gaming products, payment processing, customer support, and related features offered by oyo90.
• "Third Party" — any natural or legal person other than you and oyo90, including payment providers, identity-verification services, and regulatory authorities.

2. Information We Collect

oyo90 collects Personal Data in the following categories. We collect only what is necessary for the purpose described.

2.1 Identity and Contact Data

• Full legal name (as it appears on your KTP or passport)
• Date of birth (to verify you are at least 21 years of age)
• Indonesian national identity number (NIK, from KTP/e-KTP)
• Email address and mobile phone number
• Residential address in Indonesia (city, province, postal code)

2.2 Financial Data

• Bank account number and name of bank (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata, or other supported institutions)
• E-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja account linked to your mobile number)
• Transaction history — deposits, withdrawals, bets placed, bonuses received

2.3 Technical and Usage Data

• IP address and approximate geolocation
• Device type, operating system, and browser version
• Login timestamps, session duration, and pages visited
• Game activity logs, including game titles played, bet amounts, and outcomes

2.4 Communications Data

• Records of live-chat conversations and email correspondence with our customer support team
• Responses to surveys, promotions, or feedback requests

2.5 Identity Verification Documents (KYC)

As part of our Know Your Customer (KYC) and anti-money laundering (AML) obligations, we may collect scanned or photographed copies of:

• Indonesian national identity card (KTP / e-KTP)
• Passport (for foreign nationals where applicable)
• Proof of address (utility bill or bank statement not older than three months)
• Proof of payment method ownership (screenshot of registered bank account or e-wallet)

3. How We Collect Your Information

We collect Personal Data through the following means:

• Directly from you — when you register an account, complete your profile, deposit funds, request a withdrawal, contact customer support, or respond to a promotion.
• Automatically — through cookies, web beacons, and server logs when you visit our website or use our platform. See Section 9 for details.
• From third parties — identity-verification providers, payment processors (e.g., your bank or e-wallet operator), fraud-detection services, and publicly available sources where permitted by law.

4. How We Use Your Information

We do not use automated decision-making that produces legal or similarly significant effects on you without human review.

5. Legal Basis for Processing

oyo90 processes your Personal Data on one or more of the following legal bases:

• Contractual necessity — processing required to create and maintain your account, process payments, and deliver gaming services under our Terms & Conditions.
• Legal obligation — processing required to comply with KYC/AML regulations, tax obligations, and court or regulatory orders.
• Legitimate interests — fraud prevention, security monitoring, platform improvement, and responsible gaming oversight, where these interests are not overridden by your privacy rights.
• Consent — direct marketing communications. You may withdraw consent at any time by contacting our support team.

6. Data Sharing and Disclosure

oyo90 does not sell, rent, or trade your Personal Data to third parties for commercial purposes. We may share your data in the following limited circumstances:

6.1 Service Providers

We engage carefully vetted third-party service providers to assist in operating our platform, including payment processors (banks and e-wallet operators in Indonesia), identity-verification and KYC services, fraud-detection and cybersecurity providers, and cloud hosting and IT infrastructure providers. These providers process your data only on our instructions and are contractually prohibited from using it for their own purposes.

6.2 Legal and Regulatory Disclosure

We may disclose Personal Data to law enforcement agencies, regulatory bodies, or courts when required by applicable law, a v alid legal order, or to protect the rights, property, or safety of oyo90, our players, or the public.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of all or part of our business assets, your Personal Data may be transferred to the acquiring entity. We will notify you via email or a prominent notice on our website before your data becomes subject to a different privacy policy.

6.4 With Your Consent

We may share your data with third parties not covered above when you have given us explicit consent to do so. You may withdraw such consent at any time by contacting our support team.

7. Data Retention

We retain your Personal Data for as long as your account remains active and for a period thereafter as required by our legal and regulatory obligations. Specific retention periods are as follows:

• Account and identity data — retained for the duration of your account plus five (5) years following account closure, in line with standard AML record-keeping requirements.
• Financial transaction records — retained for five (5) years from the date of each transaction.
• KYC documents — retained for five (5) years following account closure or the completion of the relevant business relationship.
• Customer support communications — retained for three (3) years from the date of each interaction.
• Technical and usage logs — retained for twelve (12) months on a rolling basis for security and fraud-detection purposes.
• Marketing consent records — retained until consent is withdrawn, plus one (1) year thereafter as evidence of compliance.

Once a retention period expires, we securely delete or anonymize the relevant data so that it can no longer be linked to any individual.

8. Security Measures

oyo90 implements technical and organizational security measures appropriate to the risk level of our data processing activities. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your browser and our servers.
• Encrypted databases — all stored Personal Data is encrypted at rest using industry-standard algorithms.
• Access controls — strict role-based access ensures that only authorized personnel can access Personal Data, and only to the extent required for their job function.
• Two-factor authentication (2FA) — available for all player accounts and mandatory for administrative access to our systems.
• Regular security audits — we conduct periodic penetration testing and vulnerability assessments of our platform infrastructure.
• Fraud monitoring — automated systems monitor transactions and login activity around the clock to detect and respond to suspicious behavior.

While we apply rigorous security standards, no system is entirely immune to risk. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay and take all reasonable steps to mitigate the impact.

9. Cookies and Tracking Technologies

oyo90 uses cookies and similar tracking technologies to operate our platform, remember your preferences, and analyze how our services are used. The cookies we deploy fall into the following categories:

9.1 Strictly Necessary Cookies

These cookies are essential for the platform to function. They maintain your login session, remember items in your bet slip, and protect against cross-site request forgery. You cannot opt out of these cookies without affecting core platform functionality.

9.2 Performance and Analytics Cookies

We use analytics cookies to understand how players navigate our platform, which pages are most visited, and where technical errors occur. This data is aggregated and anonymized — it is used solely to improve our service quality.

9.3 Functional Cookies

Functional cookies remember your preferences such as language settings, display options, and recently viewed games. Disabling them may reduce the personalization of your experience but will not prevent access to core features.

9.4 Managing Cookies

You can manage or delete cookies through your browser settings at any time. Please note that disabling certain cookies may affect the performance and features available to you on the oyo90 platform. For full instructions on managing cookies in your specific browser, refer to your browser provider's help documentation.

10. Your Rights

As a user of oyo90 services, you have the following rights in relation to your Personal Data:

• Right of Access — you may request a copy of the Personal Data we hold about you at any time.
• Right to Rectification — if any of your Personal Data is inaccurate or incomplete, you may ask us to correct it. You can update basic profile details directly within your account settings.
• Right to Erasure — you may request deletion of your Personal Data where it is no longer necessary for the purposes it was collected, subject to our legal retention obligations described in Section 7.
• Right to Restriction — you may ask us to restrict processing of your Personal Data in certain circumstances, for example while a dispute is under investigation.
• Right to Data Portability — you may request your Personal Data in a structured, commonly used, machine-readable format where technically feasible.
• Right to Object — you may object to processing based on legitimate interests, including profiling for marketing purposes. We will cease such processing unless we can demonstrate compelling legitimate grounds.
• Right to Withdraw Consent — where processing is based on your consent (e.g., marketing emails), you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact our support team at [email protected]. We will respond within 30 calendar days. Identity verification may be required before we act on your request to ensure we do not disclose your data to an unauthorized party.

11. Protection of Minors

oyo90 does not knowingly collect Personal Data from individuals under the age of 21. Our platform is strictly intended for adults aged 21 and above. During registration, we require date-of-birth confirmation and conduct identity verification against KTP/e-KTP documents to enforce this requirement.

If we discover that Personal Data has been collected from a person under 21 without verifiable parental or guardian consent, we will delete that data promptly and close the associated account. If you believe a minor has registered on our platform, please notify us immediately at [email protected].

12. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our services, legal requirements, or industry best practices. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page.
• Display a prominent notice on the oyo90 platform for at least 14 days after the change takes effect.
• Send a notification to the email address registered on your account for significant changes that affect your rights.

Your continued use of oyo90 services after the effective date of any updated Privacy Policy constitutes your acknowledgment of the changes. We encourage you to review this policy regularly.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the way oyo90 handles your Personal Data, please reach out to our Data Protection team:

• Email: [email protected]
• Live Chat: Available 24/7 within your oyo90 account dashboard
• Response Time: We aim to respond to all privacy-related inquiries within 5 business days (WIB business hours).

For formal data subject access requests or complaints, please send a written request to our support email with the subject line "Privacy Request" and include your registered account email address and a description of your request. We may ask you to verify your identity before processing the request.