oyo88 Privacy Policy

In this Privacy Policy, the following terms carry the meanings assigned to them below:

oyo88 acts as the Data Controller in respect of all personal data collected from Members through the Platform. As Data Controller, oyo88 is responsible for determining the purposes and means of processing your personal data and for ensuring that such processing is carried out in accordance with applicable data protection principles.

Where oyo88 engages Third-Party Partners to process personal data on its behalf, those partners act as Data Processors and are bound by contractual data processing agreements that require them to process personal data only on oyo88's documented instructions, to implement appropriate technical and organisational security measures, and to delete or return personal data upon the conclusion of the service relationship.

For all data protection enquiries, subject access requests, or complaints, please contact the oyo88 data protection team at [email protected] (plain text — not a clickable link), marking your correspondence "Data Protection Request" in the subject line.

oyo88 collects personal data across the following categories, depending on the nature of your interaction with the Platform:

3.1 Registration & Account Data

• Full legal name, date of birth, and gender.
• Indonesian residential address (street, city, province, postal code).
• Email address and contact telephone number.
• Username and encrypted password hash.
• Account preferences and communication opt-in status.

3.2 Identity Verification (KYC) Data

• Copies of government-issued photo identification: KTP (Kartu Tanda Penduduk), passport, or SIM (Indonesian driving licence).
• Proof of address documents: recent utility bills, bank statements, or official correspondence issued within the last three months and confirming your registered Indonesian residential address.
• Proof of payment method ownership: screenshots or statements from BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI, OCBC NISP, OVO, DANA, GoPay, ShopeePay, or LinkAja accounts confirming that the account is registered in your own name.

3.3 Financial & Transaction Data

• Bank account numbers and e-wallet identifiers used for deposits and withdrawals (stored in masked form wherever technically feasible).
• Deposit and withdrawal transaction records, including amounts denominated in Indonesian Rupiah (IDR), timestamps, and payment method references.
• Bonus redemption history and wagering activity records required for bonus term compliance monitoring.

3.4 Betting & Gaming Activity Data

• Bet placement records: product category (sportsbook, live casino, slots, Bola Tangkas, Mahjong), selection details, stake amounts, odds, and settlement outcomes.
• Game session data: session start and end times, game titles accessed, round outcomes, and cumulative session wagering totals.
• Responsible gaming indicators: self-imposed limits, cooling-off activations, and any self-exclusion requests.

3.5 Technical & Device Data

• IP address, device type, operating system version, and browser type.
• Geolocation data (country and city level) derived from IP address.
• Session identifiers, login timestamps, and access logs.
• Cookie identifiers and analytics event data (where consented).

3.6 Communications Data

• Records of your communications with oyo88 customer support, including live chat transcripts and email correspondence.
• Records of promotional communications sent to you and your engagement with them (open rates, click-through events), where consent has been given.

oyo88 collects personal data through the following channels:

• Directly from you when you complete the oyo88 registration form, submit KYC documentation, make a deposit or withdrawal request, place a bet, contact support, or update your account settings.
• Automatically through the Platform's technical infrastructure — including server logs, session management systems, and analytics tools — as you navigate and interact with the oyo88 website and gaming interfaces.
• From Third-Party Partners where those partners are engaged specifically to provide data to oyo88 for a defined purpose — for example, identity verification providers that confirm the authenticity of a KTP document, or fraud-prevention services that provide a risk signal based on device fingerprint data.
• From payment infrastructure — Indonesian banking systems (including BCA, BRI, BNI, Mandiri) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) transmit transaction confirmation data to oyo88 to enable deposit crediting and withdrawal reconciliation.

oyo88 does not purchase personal data lists from data brokers, and does not collect personal data from social media platforms except where you have explicitly initiated a connection between your social account and your oyo88 account.

oyo88 processes personal data only where a valid legal basis exists for doing so. The legal bases applicable to oyo88's processing activities are as follows:

oyo88 uses the personal data it collects for the following specific purposes:

• Account Administration: Creating and maintaining your oyo88 Member account; authenticating your identity at login; applying and enforcing account preferences, deposit limits, and self-exclusion settings.
• Identity & Age Verification: Confirming that you are at least 21 years of age and that the identity you have provided matches your registered account details, as required before processing your first withdrawal or upon reaching specified transaction thresholds.
• Payment Processing: Crediting deposit transactions to your oyo88 Balance; initiating withdrawal transfers to your verified Indonesian bank account or e-wallet; reconciling transaction records against your account history.
• Betting & Gaming Services: Accepting and settling bets across all oyo88 product verticals, including sportsbook markets (BRI Liga 1, EPL, La Liga, Champions League, AFF Cup), live casino tables, slots from studios including Pragmatic Play and Evolution Gaming, Bola Tangkas, and Mahjong; maintaining auditable records of all gaming activity.
• Responsible Gaming: Monitoring account activity for indicators of problem gambling behaviour; enforcing Member-requested deposit limits, cooling-off periods, and self-exclusion orders; intervening proactively where oyo88's responsible gaming monitoring systems identify a Member who may require support.
• Fraud Prevention & Security: Detecting and preventing account takeover, payment fraud, duplicate account registration, bonus abuse, and any activity that may constitute a violation of oyo88's Terms & Conditions.
• Customer Support: Responding to your enquiries, resolving disputes, investigating complaints, and maintaining a record of all support interactions for quality assurance and audit purposes.
• Regulatory Compliance: Maintaining records required under oyo88's international operating licence; cooperating with lawful requests from competent regulatory or law enforcement authorities.
• Marketing Communications (consent only): Sending you personalised promotional offers, bonus notifications, and seasonal promotions (including Idul Fitri, BRI Liga 1 season kick-off, and Champions League final promotions) where you have explicitly opted in to receive marketing communications from oyo88.
• Platform Improvement: Using aggregated and anonymised analytics data to identify technical issues, optimise platform performance, and improve the oyo88 user experience across all device types.

oyo88 does not use personal data for any purpose that is incompatible with the purposes listed above without providing prior notice and, where required, obtaining your additional consent.

oyo88 shares personal data with third parties only in the following defined circumstances:

• Payment Processors: Indonesian banking partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI, OCBC NISP) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the minimum account and transaction data required to process your deposit or withdrawal instruction. oyo88 does not share your full KYC identity documents with payment processors unless specifically required to resolve a disputed transaction.
• Identity Verification Providers: Where oyo88 uses a third-party KYC verification service to authenticate identity documents (such as KTP or passport), your identification documents and biometric data (if applicable) are transmitted to that provider solely for the purpose of verification and are retained by the provider only for the minimum period required to complete the verification process.
• Game Studios & Technology Providers: Licensed game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive a session token and anonymised player identifier to enable game delivery and round-result recording. These providers do not receive your full name, KYC documents, or financial details.
• Fraud Prevention & Security Services: oyo88 may share device fingerprint data, IP addresses, and behavioural signals with specialist fraud prevention partners to detect and prevent account abuse, payment fraud, and money laundering.
• Legal & Regulatory Authorities: oyo88 will disclose personal data to competent regulatory authorities, law enforcement agencies, or courts where required to do so by applicable law, a valid court order, or the conditions of oyo88's international operating licence. oyo88 will, where legally permissible, notify the affected Member of any such disclosure.
• Business Transfers: In the event of a merger, acquisition, or sale of all or a substantial part of oyo88's business, personal data held by oyo88 may be transferred to the acquiring entity as part of the transaction. In such circumstances, oyo88 will notify all affected Members in advance and ensure that the acquiring entity is bound by data protection obligations at least as protective as those in this Policy.

oyo88 operates under an international licence and its technical infrastructure — including server hosting, content delivery networks, and some Third-Party Partners — may be located outside of Indonesia. As a consequence, your personal data may be transferred to and processed in countries other than Indonesia.

Where such international transfers occur, oyo88 takes the following steps to ensure that your personal data receives an adequate level of protection:

• oyo88 enters into standard contractual data protection clauses with all Third-Party Partners who process data outside Indonesia, requiring them to apply data handling standards consistent with the principles of this Privacy Policy.
• oyo88 conducts Transfer Impact Assessments (TIAs) where transfers are made to jurisdictions that have not been recognised as providing an adequate level of data protection, and implements supplementary technical measures (such as end-to-end encryption) where a TIA identifies residual risk.
• Where a Third-Party Partner holds relevant international data protection certifications (such as ISO 27001 or SOC 2 Type II), oyo88 takes those certifications into account as evidence of appropriate safeguards.

By using the oyo88 platform, you acknowledge that your personal data may be transferred internationally in the circumstances described above. If you have questions about a specific international transfer, please contact oyo88 at [email protected].

oyo88 retains personal data for as long as is necessary to fulfil the purpose for which it was collected, to comply with applicable legal and regulatory requirements, and to resolve any disputes or enforce any agreements. The following retention schedule applies as a general guide:

Where personal data is no longer required for the purposes for which it was collected and no legal retention obligation applies, oyo88 will securely delete or irreversibly anonymise that data. Anonymised aggregated data (which cannot be used to identify any individual) may be retained indefinitely for statistical and business analysis purposes.

oyo88 uses cookies and similar tracking technologies on the Platform. The categories of cookies we use are as follows:

You may manage your cookie preferences at any time through your oyo88 account settings or via your browser's built-in cookie controls. Please note that disabling strictly necessary cookies will prevent you from logging in and using the Platform. Disabling analytics cookies will not affect your ability to place bets, make deposits or withdrawals, or access any feature of the oyo88 platform.

As an oyo88 Member, you have the following rights in respect of your personal data. These rights may be subject to limitations where competing legal obligations or legitimate interests apply, but oyo88 will always explain any such limitation clearly when responding to your request.

To exercise any of the above rights, contact the oyo88 data protection team at [email protected] with the subject line "Data Rights Request". oyo88 will acknowledge your request within 5 business days and provide a substantive response within 30 calendar days. In complex cases, this period may be extended by a further 30 days, in which case oyo88 will notify you of the extension and the reason for it before the initial 30-day period expires.

oyo88 implements the following age-related safeguards:

• All Members are required to provide their date of birth during registration. Registration is refused where the declared date of birth indicates that the applicant is under 21 years of age.
• Age verification is conducted as part of the KYC process, cross-referencing the Member's declared date of birth against the date of birth on the identity document submitted (KTP, passport, or SIM).
• Any account found to belong to an individual under 21 will be immediately closed, all balances will be returned to the verified source payment method, and any winnings will be forfeited.

If oyo88 becomes aware that it has inadvertently collected personal data from an individual under 21 years of age, it will delete all such data without delay. If you believe that oyo88 may hold data belonging to a minor, please contact support immediately at [email protected].

oyo88 implements a layered security architecture to protect your personal data against unauthorised access, accidental loss, alteration, or destruction. Key technical and organisational security measures in place include:

• Transport Layer Security: All data transmitted between your device and oyo88 servers is encrypted using TLS 1.3, the current industry standard for secure web communications. The oyo88 platform enforces HTTPS across all pages and endpoints.
• Data Encryption at Rest: Sensitive stored data — including KYC documents, financial records, and account credentials — is encrypted at rest using AES-256 encryption.
• Password Security: Member passwords are never stored in plaintext. oyo88 applies industry-standard one-way cryptographic hashing with salting to all stored password representations.
• Access Controls: Access to Member personal data within oyo88's internal systems is restricted to authorised personnel on a strict need-to-know basis. Role-based access controls and multi-factor authentication are enforced for all internal system access.
• Penetration Testing & Vulnerability Management: oyo88's Platform and infrastructure are subject to regular independent penetration testing and automated vulnerability scanning. Critical vulnerabilities are patched on an emergency basis; high-severity vulnerabilities are addressed within 30 days of identification.
• Incident Response: oyo88 maintains a documented data breach incident response plan. In the event of a confirmed breach affecting Member personal data, the incident response team is activated immediately, and affected Members are notified within 72 hours as described in this Policy.

While oyo88 takes all reasonable steps to protect your data, no digital platform can guarantee absolute security. You are also responsible for maintaining the security of your own oyo88 account — please use a strong, unique password and do not share your login credentials with any third party.

oyo88 sends promotional communications — including bonus offers, seasonal promotions, and product updates — only to Members who have explicitly opted in to receive them. Your marketing preferences can be set during registration and updated at any time via your oyo88 account settings.

oyo88's marketing communications may include:

• Deposit bonus and reload bonus offer notifications.
• Seasonal promotions tied to Indonesian cultural events such as Idul Fitri, Ramadhan deposit specials, and Imlek (Chinese New Year) cashback offers.
• Sporting-event promotions tied to BRI Liga 1, EPL, Champions League, AFF Cup, FIFA World Cup qualifying, and other major competitions relevant to Indonesian sports bett ing audiences.
• Product launch announcements for new slot titles from Pragmatic Play, Evolution Gaming, and other licensed studios available on oyo88.
• Responsible gaming reminders and self-assessment prompts sent as part of oyo88's proactive member welfare programme.

You may withdraw your consent to marketing communications at any time by:

• Updating your notification preferences in your oyo88 account settings dashboard.
• Clicking the unsubscribe link included in every promotional email oyo88 sends.
• Contacting oyo88 customer support via live chat or at [email protected] and requesting removal from all marketing lists.

Withdrawal of marketing consent does not affect your ability to use the oyo88 platform, place bets, make deposits or withdrawals, or access any feature of the service. Transactional communications — such as deposit confirmations, withdrawal notifications, KYC status updates, and security alerts — are not marketing communications and will continue to be sent regardless of your marketing preference settings, as they are necessary for the operation of your account.

oyo88 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable data protection law, regulatory guidance, oyo88's data processing practices, or the products and services available on the Platform.

When oyo88 makes a material change to this Privacy Policy — meaning a change that significantly affects your rights or the way oyo88 processes your personal data — the following notification process applies:

• oyo88 will post a prominent notice on the oyo88.bio homepage and within the Platform's logged-in member dashboard for a minimum of 14 days before the revised Policy takes effect.
• oyo88 will send an email notification to all active Members at their registered email address summarising the key changes.
• The revised Policy will be published at oyo88.bio/privacy-policy with an updated "Effective Date" in the header of this document.

For non-material changes — such as formatting corrections, clarification of existing language, or updates to contact details — oyo88 will update the Policy and the "Effective Date" without prior notification. It is your responsibility to review this Policy periodically to stay informed of any updates.

Your continued use of the oyo88 platform after a revised Privacy Policy has taken effect constitutes your acceptance of the revised terms. If you do not accept the revised Policy, you must discontinue use of the Platform and may request account closure by contacting oyo88 support.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or wish to raise a complaint about oyo88's data handling practices, please contact the oyo88 data protection team using the details below:

oyo88 takes all privacy complaints seriously. Upon receipt of a complaint, oyo88 will:

• Acknowledge receipt of your complaint within 5 business days.
• Investigate the complaint thoroughly and impartially.
• Provide you with a written substantive response within 30 calendar days of receipt, either resolving the complaint or explaining why a longer investigation period is required.
• Where the complaint is upheld, take immediate remedial action and notify you of the steps taken.

If you are not satisfied with oyo88's response to your complaint, you retain the right to escalate the matter to the relevant data protection supervisory authority in your jurisdiction. oyo88 will cooperate fully with any such regulatory investigation.