Privacy Policy

The following definitions apply throughout this Privacy Policy:

• "oyo288" — the online gambling and sports betting platform accessible at oyo288.club, including all associated interfaces, applications, and digital services operated under the oyo288 brand.
• "Member" — any individual who has registered and maintains an active account on oyo288.
• "Visitor" — any individual who accesses the oyo288 website without having completed account registration.
• "Personal Data" — any information that identifies or can be used to identify a natural person directly or indirectly, including but not limited to name, email address, phone number, date of birth, payment details, and device identifiers.
• "Processing" — any operation performed on Personal Data, including collection, storage, use, transfer, and deletion.
• "Controller" — the entity that determines the purposes and means of processing Personal Data. For oyo288 Members, the Controller is the oyo288 operating entity holding the applicable international gaming licence.
• "Processor" — a third party that processes Personal Data on behalf of oyo288, such as payment processors, KYC verification providers, and cloud hosting services.

This Privacy Policy applies to all Personal Data collected by oyo288 in connection with the operation of the oyo288 platform, including data collected during account registration, identity verification, payment processing, gameplay activity, customer support interactions, and general browsing of the oyo288 website.

By registering an account on oyo288, depositing funds, placing a wager, or otherwise using any oyo288 service, you confirm that you have read this Privacy Policy and consent to the collection, use, and processing of your Personal Data as described herein. If you do not agree to this Policy, you must cease using oyo288 immediately and contact us to request account closure.

This Policy is to be read in conjunction with the oyo288 Terms & Conditions and Responsible Gaming Policy, both of which form part of the Member agreement.

oyo288 collects the following categories of Personal Data, depending on your level of engagement with the platform:

oyo288 does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, biometric data, or health information, except where such data is voluntarily provided in a support communication and is strictly necessary to resolve the relevant matter.

oyo288 collects Personal Data through the following channels:

• Direct submission: Data you provide when completing the registration form, uploading KYC documents, initiating a deposit or withdrawal, completing a responsible gaming questionnaire, or contacting our support team.
• Automated technologies: Data collected automatically when you access the oyo288 platform, including cookies, web beacons, server logs, and session tracking technologies that record Technical Data and Activity Data.
• Third-party sources: Data received from identity verification providers, payment processors (e.g., your bank's transaction confirmation), fraud prevention agencies, and responsible gaming registries, used to validate your identity and protect the integrity of the platform.
• Referral and affiliate channels: If you arrived at oyo288 via a promotional affiliate link, the referring affiliate may share basic referral metadata (not your personal details) with oyo288 for commission tracking purposes.

oyo288 processes your Personal Data only for clearly defined, legitimate purposes. The primary purposes are:

• Account management: Creating, maintaining, and closing your oyo288 account; verifying your identity; enforcing the single-account policy.
• Service delivery: Processing deposits and withdrawals in Indonesian Rupiah (IDR); settling wagers; crediting and tracking bonuses; providing access to sports betting, togel (Indonesia's traditional numbers lottery) markets, live casino, slot games, and crash games.
• KYC & AML compliance: Fulfilling anti-money laundering obligations, detecting and preventing fraud, verifying the source of funds, and meeting the requirements of our international gaming licence.
• Responsible gaming: Monitoring patterns of play for signs of problem gambling; administering self-exclusion requests and deposit limits; age-verification enforcement (21+ requirement).
• Customer support: Responding to enquiries, processing complaints, and maintaining support records.
• Platform security: Detecting and preventing unauthorised access, bot activity, collusion, and technical abuse of the oyo288 platform.
• Marketing communications: Sending promotional offers, bonus notifications, and seasonal campaign messages to Members who have opted in to marketing. You may withdraw consent at any time by updating your account notification preferences or contacting support.
• Analytics and improvement: Analysing aggregated, anonymised usage data to improve platform performance, user experience, and product offerings.

oyo288 processes Personal Data under one or more of the following legal bases:

• Contractual necessity: Processing required to fulfil our obligations under the Member agreement — including account operation, transaction processing, and bet settlement.
• Legal obligation: Processing required to comply with applicable anti-money laundering regulations, responsible gaming requirements, and the conditions of our international gaming licence.
• Legitimate interests: Processing undertaken to protect the security and integrity of the oyo288 platform, prevent fraud and abuse, and conduct internal analytics — where these interests are not overridden by your fundamental privacy rights.
• Consent: Processing for marketing communications and optional analytics cookies, which you may withdraw at any time without affecting the lawfulness of prior processing.

oyo288 does not sell, rent, or trade your Personal Data to third parties for their own commercial or marketing purposes. We share Personal Data only in the following limited circumstances:

• Payment processors and banking partners: We share the minimum financial data necessary to process your deposits and withdrawals via BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, and LinkAja. These parties act as independent data controllers subject to their own privacy obligations.
• KYC and identity verification providers: Specialist third-party providers process identity documents and address verification data on our behalf to fulfil our KYC obligations. These providers operate under strict data processing agreements with oyo288.
• Game content providers: Game studios integrated into the oyo288 platform — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Pocket Games Soft, and Spribe — may receive a anonymised session token to authenticate your game session. They do not receive your name, contact details, or financial data.
• Fraud prevention and security services: We share Technical Data and Activity Data with fraud detection and cybersecurity partners to protect Members and the platform from unauthorised access and financial crime.
• Responsible gaming registries: Where a Member applies for self-exclusion, oyo288 may report that exclusion to applicable responsible gaming registries to prevent re-registration across participating platforms.
• Legal and regulatory authorities: oyo288 will disclose Personal Data to law enforcement, regulators, or courts where required to do so by applicable law or valid legal process, or where disclosure is necessary to protect the rights, property, or safety of oyo288, its Members, or the public.
• Corporate transactions: In the event of a merger, acquisition, or sale of substantially all assets of oyo288, Personal Data held about Members may be transferred to the acquiring entity, subject to equivalent privacy protections.

oyo288 operates internationally and may transfer Personal Data to countries outside of Indonesia for processing and storage. This includes transfers to the jurisdiction in which oyo288's gaming licence is held, as well as to the data centres and servers of our cloud infrastructure and technology partners.

Where Personal Data is transferred outside Indonesia, oyo288 takes reasonable steps to ensure that an adequate level of data protection is maintained, including the use of contractual safeguards equivalent to internationally recognised data transfer frameworks. By using oyo288, you acknowledge and consent to such international transfers of your Personal Data.

oyo288 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and our licensing obligations. The general retention schedule is as follows:

• Account and identity data: Retained for the duration of your active membership and for a minimum of five (5) years following account closure, in accordance with anti-money laundering record-keeping requirements.
• Transaction and financial data: Retained for a minimum of five (5) years from the date of each transaction.
• Activity and gameplay data: Retained for up to three (3) years from the date of activity, or longer if required for dispute resolution or regulatory purposes.
• Customer support records: Retained for up to three (3) years from the date of the support interaction.
• Marketing consent records: Retained for the duration of your active membership plus one (1) year following withdrawal of consent, to demonstrate compliance with consent obligations.
• Self-exclusion records: Retained indefinitely to prevent circumvention of a self-exclusion through re-registration.

Following the expiry of the applicable retention period, Personal Data will be securely deleted or anonymised so that it can no longer be associated with you as an identifiable individual.

oyo288 implements a comprehensive set of technical and organisational security measures designed to protect your Personal Data against unauthorised access, disclosure, alteration, and destruction. These measures include:

• SSL 256-bit encryption applied to all data transmitted between your device and the oyo288 platform.
• One-way cryptographic password hashing — oyo288 staff cannot read your password in plain text.
• Role-based access controls limiting internal access to Personal Data to staff who require it to perform their specific job functions.
• Regular penetration testing and security audits conducted by independent third-party security professionals.
• Anomaly detection systems that flag unusual login patterns, atypical transaction volumes, and suspected account takeover attempts in real time.
• Data centre physical security at the facilities hosting oyo288 infrastructure, including biometric access controls, surveillance, and redundant power systems.

While oyo288 takes all reasonable measures to protect your data, no online platform can guarantee absolute security. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, oyo288 will notify affected Members without undue delay and take all reasonable steps to mitigate the breach.

oyo288 uses cookies and similar tracking technologies to operate, secure, and improve the platform. A cookie is a small text file stored on your device when you visit a website. oyo288 uses the following categories of cookies:

• Strictly necessary cookies: Essential for the operation of the oyo288 platform. These cookies enable core functionality such as maintaining your logged-in session, remembering your account preferences, and securing your connection. These cookies cannot be disabled without impairing your ability to use oyo288.
• Functional cookies: Used to remember your preferences, such as language settings, preferred game category, and deposit method, to personalise your experience on return visits.
• Analytics cookies: Used to collect aggregated, anonymised data about how Visitors and Members use the oyo288 platform, including which pages are visited most frequently and how long sessions last. This data helps us improve the platform experience. Analytics cookies are only set with your consent.
• Marketing and affiliate cookies: Used to attribute registrations and deposits to affiliate partners who referred you to oyo288, and — where you have opted in — to deliver relevant promotional content. These cookies are only set with your consent.

You can manage or withdraw your consent to non-essential cookies at any time through your browser settings. Note that disabling certain cookies may affect the functionality of the oyo288 platform.

As a Member of oyo288, you hold the following rights with respect to your Personal Data. To exercise any of these rights, contact our support team at [email protected] with the subject line "Data Rights Request":

• Right of access: You may request a copy of all Personal Data oyo288 holds about you, along with information about how it is processed.
• Right to rectification: You may request the correction of any inaccurate or incomplete Personal Data held in your account.
• Right to erasure: You may request the deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to our legal and regulatory retention obligations.
• Right to restriction: You may request that oyo288 restrict the processing of your Personal Data in certain circumstances, such as while a dispute regarding data accuracy is being resolved.
• Right to data portability: You may request a structured, machine-readable copy of the Personal Data you provided to oyo288, where technically feasible.
• Right to object: You may object to the processing of your Personal Data for direct marketing purposes at any time, with immediate effect.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

oyo288 will respond to all verified data rights requests within 30 calendar days of receipt. We may require proof of identity before processing your request to prevent unauthorised disclosure of Personal Data to third parties.

oyo288 does not knowingly collect Personal Data from any individual under the age of 21. The oyo288 platform is strictly for adults aged 21 and above. Age verification is conducted during the KYC process, and any account found to belong to a person under 21 will be immediately suspended, with any balance held pending investigation and returned to the source payment method upon confirmation.

If you are a parent or guardian and believe that a minor has registered on oyo288 without your knowledge, please contact us immediately at [email protected] and we will take prompt action to close the account and delete the associated Personal Data.

The oyo288 platform may contain references to third-party game studios, payment providers, and sporting bodies. This Privacy Policy applies exclusively to Personal Data collected and processed by oyo288. oyo288 is not responsible for the privacy practices of any third-party entity, and we encourage you to review the privacy policies of any third-party service you access independently of oyo288.

oyo288 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. The date of the most recent revision is displayed at the top of this page. Where changes are material, oyo288 will notify registered Members by email or via an in-platform notification prior to the changes taking effect.

Your continued use of any oyo288 service following publication of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with any amendment, you must cease using oyo288 and contact us to request account closure and deletion of your Personal Data, subject to our legal retention obligations.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data by oyo288, please contact our Data Protection team using the details below. Our support team includes both English-language and native Indonesian-speaking agents available 24 hours a day, 7 days a week.

Email: [email protected] (subject line: "Privacy Enquiry" or "Data Rights Request")

Response time: We aim to acknowledge all privacy-related enquiries within 24 hours (WIB) and to provide a substantive response within 7 business days.