Privacy Policy — oja88

oja88 operates an online gaming platform at oja88.net that offers sports betting, live casino, slot games, and other interactive entertainment products primarily to players based in Indonesia. As a platform that handles both financial transactions and personal player data, oja88 is committed to handling all information responsibly, transparently, and in accordance with internationally recognised data protection principles.

This Privacy Policy ("Policy") describes how oja88 ("oja88", "we", "us", "our") collects, uses, stores, and shares personal data when you visit oja88.net, register a player account, interact with our games, make deposits or withdrawals, or contact our customer support team. It also sets out the rights you have in relation to the personal data we hold about you.

By registering an account on oja88 or otherwise using the platform, you acknowledge that you have read and understood this Policy and that you consent to the data processing activities described herein to the extent that consent is the applicable legal basis. Where processing is required for the performance of a contract with you or to comply with a legal obligation, your consent is not required, but we will always inform you about such processing through this Policy.

For the purposes of this Privacy Policy, the following definitions apply:

oja88 collects the following categories of personal data, depending on how you interact with the platform:

oja88 does not collect or store full credit card or debit card numbers. All payment card interactions are handled directly by our licensed payment processing partners under their own PCI-DSS compliance frameworks.

oja88 collects personal data through the following channels:

• Direct Submission. Information you enter during account registration, profile updates, KYC document upload, deposit and withdrawal requests, or support communications.
• Automated Technical Collection. When you access oja88.net, our servers and client-side scripts automatically record technical data including your IP address, device identifiers, browser fingerprint, and session behaviour. This occurs on every page visit, whether or not you are logged into an account.
• Cookies and Similar Technologies. oja88 uses cookies, web beacons, and local storage technologies to maintain session state, record preferences, and collect analytics data. See Section 8 for a full description of our cookie practices.
• Third-Party Verification Providers. When you complete KYC, our identity verification partner may return data points about your identity document's authenticity to oja88. oja88 receives only the verification outcome and the data fields required to confirm your identity — not raw copies of third-party data sources.
• Payment Processors. When you initiate a deposit or withdrawal, our payment processor confirms transaction status to oja88, including transaction reference numbers, amounts, and payment method ownership confirmation.

oja88 processes personal data under one or more of the following legal bases:

1. Performance of a Contract. Processing is necessary to create and maintain your oja88 account, process deposits and withdrawals in IDR, settle game outcomes, and deliver all services you have requested as a registered player.
2. Legal Obligation. Processing is required to comply with applicable anti-money-laundering (AML) regulations, age verification obligations, KYC requirements, fraud prevention obligations, and any regulatory reporting duties applicable to oja88 under its operating licence.
3. Legitimate Interests. Processing is necessary for oja88's legitimate business interests, including platform security, abuse and fraud prevention, customer support operations, product improvement, and responsible gaming compliance — provided those interests are not overridden by your fundamental rights and freedoms.
4. Consent. Where oja88 sends you promotional communications (bonus offers, seasonal promotions, new game notifications), we do so on the basis of your consent, which you provide at registration and may withdraw at any time via your account settings or by emailing [email protected].

oja88 uses the personal data it collects for the following specific purposes:

• Account Management. To create, maintain, and authenticate your player account, including password resets, two-factor authentication, and profile updates.
• Transaction Processing. To process deposits and withdrawals in Indonesian Rupiah (IDR) via your nominated local bank (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI, Bank Permata) or e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja), and to maintain an accurate transaction history in your account.
• Identity Verification (KYC). To verify your age (21+), identity, and payment method ownership before processing your first withdrawal, and to satisfy ongoing AML and regulatory obligations.
• Customer Support. To respond to your support queries, resolve disputes, process responsible gaming requests (deposit limits, cooling-off, self-exclusion), and communicate important account notifications.
• Platform Security & Fraud Prevention. To detect and investigate suspicious login activity, multiple-account violations, bonus abuse, payment fraud, and other conduct that breaches our Terms & Conditions or applicable law.
• Responsible Gaming Compliance. To monitor wagering patterns that may indicate problem gambling behaviour and, where appropriate, to contact players proactively with responsible gaming information or apply account restrictions in accordance with our Responsible Gaming policy.
• Product Improvement & Analytics. To analyse aggregated, anonymised usage data to improve the platform, optimise game offerings, and enhance the overall player experience. Analytics data is not used to make automated decisions that produce legal or similarly significant effects on individual players.
• Promotional Communications. To send you bonus offers, seasonal promotions (including Idul Fitri, Nyepi, Ramadhan, and other culturally relevant promotional periods), and new game announcements where you have provided consent. You may opt out at any time.
• Legal and Regulatory Compliance. To meet all obligations under applicable law, including responding to lawful requests from courts, government authorities, or our licensing regulator.

oja88 does not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes. We share personal data only in the following limited circumstances:

1. Payment Processors. Your financial data is shared with our licensed payment processing partners solely to complete deposit and withdrawal transactions. These partners operate under strict contractual data processing agreements and are bound by applicable financial regulation.
2. KYC & Identity Verification Providers. Your identity documents and personal details are transmitted to our contracted KYC verification partner to confirm your identity and age. This partner processes data only as instructed by oja88 and may not use it for any independent purpose.
3. Cloud Infrastructure & Hosting Providers. oja88 stores player data on secure cloud servers provided by contracted infrastructure partners. These providers have no independent access to or use of your data beyond providing hosting services to oja88.
4. Fraud Prevention & Security Services. Technical data (IP addresses, device fingerprints, session metadata) may be shared with contracted security services for the purpose of identifying and preventing fraudulent activity on the platform.
5. Legal and Regulatory Authorities. oja88 will disclose personal data to courts, law enforcement agencies, government bodies, or our licensing regulator where required to do so by law, by court order, or where we have a good-faith belief that disclosure is necessary to protect the rights, property, or safety of oja88, its players, or the public.
6. Business Transfers. In the event of a merger, acquisition, restructuring, or sale of all or part of oja88's business, player data may be transferred to the successor entity, subject to the same privacy protections as set out in this Policy. Affected players will be notified of any such transfer via their registered email address.

oja88 uses cookies and similar browser-based technologies to operate the platform, maintain your session, and understand how players use our services. The following categories of cookies are in use:

• Essential Cookies. These are strictly necessary for the platform to function. They maintain your login session, remember your language and display preferences, and ensure that security features such as CSRF protection operate correctly. These cookies cannot be disabled without affecting platform functionality.
• Analytics Cookies. oja88 uses first-party analytics to understand aggregated player behaviour — page visit frequency, feature usage, game popularity, and navigation paths. This data is collected in anonymised or pseudonymised form and is used solely to improve the platform experience. No individual player is identified from analytics data.
• Functional Cookies. These cookies remember preferences you have set, such as your preferred deposit method or display settings, so that you do not need to re-enter them on each visit.
• Security Cookies. Short-lived cookies used to detect and prevent fraudulent login attempts, session hijacking, and other security threats.

You can manage cookie preferences through your browser settings. Most modern browsers allow you to block or delete cookies. Please note that disabling essential cookies will impair your ability to log in and use core platform features. oja88 does not use any third-party advertising or retargeting cookies.

oja88 retains personal data for only as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law and regulation. The following retention periods apply as a general guide:

• Active Account Data. Personal data associated with an active player account is retained for the lifetime of the account and for a period of five (5) years after the account is closed, to satisfy AML and regulatory record-keeping obligations.
• Transaction Records. Deposit, withdrawal, and wagering history records are retained for a minimum of five (5) years from the date of each transaction, in line with standard financial record-keeping requirements.
• KYC Documents. Identity documents submitted for KYC verification are retained for five (5) years following the closure of the associated account, unless a longer retention period is required by law.
• Customer Support Communications. Support ticket content and correspondence is retained for three (3) years from the date of the last communication in a given support case.
• Technical and Usage Data. Server logs and session data are retained for ninety (90) days from the date of collection, unless a longer period is required for an active security investigation.
• Marketing Consent Records. Records of your marketing consent (or withdrawal thereof) are retained for as long as the account is active and for five (5) years thereafter, to demonstrate compliance with consent obligations.

When personal data reaches the end of its applicable retention period, oja88 will securely delete or anonymise it so that it can no longer be linked to an identifiable individual.

oja88 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, and disclosure. These measures include:

• TLS/SSL Encryption. All data transmitted between your browser or device and the oja88 platform is encrypted using 256-bit Transport Layer Security (TLS). This ensures that your login credentials, personal details, and financial data cannot be intercepted in transit.
• Encrypted Data Storage. Sensitive data fields — including identity document information and financial account details — are stored in encrypted form at rest. Encryption keys are managed separately from the data they protect.
• Access Controls. Access to systems that hold personal data is restricted to authorised oja88 personnel on a strict need-to-know basis. All internal access is logged and subject to periodic review.
• Two-Factor Authentication. oja88 offers two-factor authentication (2FA) for player accounts. We strongly encourage all players to enable 2FA to add an additional layer of protection beyond the standard username and password.
• Penetration Testing & Audits. oja88 conducts periodic security assessments and penetration tests on its platform infrastructure to identify and remediate vulnerabilities before they can be exploited.
• Incident Response. In the event of a personal data breach that is likely to result in a risk to your rights or freedoms, oja88 will notify you via your registered email address without undue delay, and will take all reasonable steps to contain and remediate the breach.

As a data subject, you hold the following rights in relation to the personal data oja88 holds about you. To exercise any of these rights, contact us at [email protected] with the subject line "Privacy Rights Request":

1. Right of Access. You may request a copy of all personal data oja88 holds about you. We will respond within 30 days of a verified request and provide the data in a structured, commonly used format.
2. Right to Rectification. If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it. For straightforward corrections (e.g., a misspelled name or outdated phone number), you may also update your details directly in your account settings.
3. Right to Erasure. You may request that oja88 delete your personal data. This right is subject to limitations — where oja88 is required by law to retain data (e.g., AML record-keeping obligations), we cannot erase it until the mandatory retention period expires. We will inform you of any such limitation when responding to your request.
4. Right to Restrict Processing. You may request that oja88 restrict the processing of your data in certain circumstances — for example, while a dispute about data accuracy is being resolved, or while a deletion request is being assessed.
5. Right to Data Portability. Where processing is based on your consent or the performance of a contract, you may request that oja88 provide your personal data in a machine-readable format so that you can transfer it to another service provider.
6. Right to Withdraw Consent. Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.
7. Right to Object. You have the right to object to processing carried out on the basis of oja88's legitimate interests. oja88 will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

oja88 is strictly an adults-only platform. The minimum age requirement to register and use any oja88 service is 21 years. oja88 does not knowingly collect, process, or store personal data relating to any individual under the age of 21.

If oja88 discovers or is notified that an account has been registered by, or on behalf of, a person under the age of 21, the account will be suspended immediately, all personal data associated with that account will be securely deleted (subject to any mandatory retention obligations), and any deposited funds will be returned to the originating payment method.

If you are a parent or guardian and believe that a minor in your care has accessed or registered on the oja88 platform, please contact us immediately at [email protected]. We will investigate and act on the report promptly.

The oja88 platform may contain informational references to third-party services — for example, references to BCA, BRI, or OVO as supported payment methods. oja88 does not embed or maintain direct hyperlinks to third-party websites within the platform's navigational structure.

To the extent that any third-party service is referenced or integrated into the platform (such as a payment gateway interface), that service operates under its own privacy policy. oja88 is not responsible for the privacy practices, data handling, or content of any third-party service. We encourage you to review the privacy policies of any third-party payment provider or service you interact with in connection with your oja88 account.

oja88 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory requirements, or platform features. The revised Policy will be published on this page with an updated "Last Updated" date.

Where changes are material — meaning they substantively affect your rights or oja88's data processing obligations toward you — we will provide at least 7 calendar days' advance notice via the platform's in-app notification system or by email to your registered address before the changes take effect.

Your continued use of the oja88 platform after the effective date of a revised Policy constitutes your acknowledgement of the changes. If you do not agree to the revised Policy, you should stop using the platform and may request account closure as described in our Terms & Conditions.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the personal data oja88 holds about you, please reach out using the contact details below:

• Privacy Inquiries Email: [email protected] (plain text — not a clickable link). Include the subject line "Privacy Rights Request" for the fastest routing to the relevant team.
• Customer Support Hours: 07:00 – 23:00 WIB, seven days a week
• Response Target: oja88 aims to acknowledge all privacy-related inquiries within 48 hours and to provide a substantive response within 30 calendar days

For questions about responsible gaming, deposit limits, or self-exclusion, please visit the Responsible Gaming page. For general platform questions, visit our FAQ.