Privacy Policy

This Privacy Policy ("Policy") describes the data practices of oyo89 ("we", "us", "oyo89", "the Platform") in relation to personal information collected from individuals ("you", "Player", "User") who access or use the oyo89 online casino and sportsbook platform at oyo89.pro.

oyo89 operates as an internationally licensed online gaming platform serving players primarily in Indonesia. We take our obligations with respect to personal data seriously. This Policy is written in plain, professional English to ensure that every Player understands how their data is handled — without ambiguity or unnecessary legal complexity.

By creating an oyo89 Account or accessing any part of the Platform, you acknowledge that you have read and understood this Policy and consent to the collection and use of your personal data as described herein. This Policy forms part of, and must be read together with, our Terms & Conditions.

For the purposes of this Policy, the following terms carry the meanings set out below:

oyo89 collects Personal Data across several categories depending on how you interact with the Platform. We collect only what is necessary for the purposes described in this Policy.

2.1 Registration Data. When you create an oyo89 Account, we collect your full legal name, date of birth, email address, mobile phone number, and residential address. This data is required to open your Account and verify your eligibility to play.

2.2 Identity Verification (KYC) Data. Prior to processing withdrawals or when our compliance systems flag a review, we may request copies of a government-issued photo ID (such as a national identity card, KTP, or passport), a proof-of-address document (such as a utility bill or bank statement issued within the past 90 days), and, where applicable, a selfie or liveness-check image for biometric comparison. These documents are processed by our KYC partner and are retained only for as long as required by our anti-money-laundering obligations.

2.3 Financial Data. We collect transaction records associated with your Account, including deposit amounts, withdrawal requests, bank account numbers or e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja), and the names of the Indonesian banks you use (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, BSI). We do not store full card numbers or bank passwords — payment credentials are handled directly by PCI-DSS-compliant payment processors.

2.4 Technical and Device Data. When you access the Platform, our servers automatically log your IP address, browser type and version, operating system, device model, screen resolution, time zone (WIB by default), session start and end timestamps, pages visited, and in-game actions. This data is used for security monitoring, fraud detection, and performance optimisation.

2.5 Communications Data. If you contact our support team via live chat, email ([email protected]), or WhatsApp (+62 811 0890 89), we retain a record of the conversation — including the content of your messages and any attachments — for quality assurance, dispute resolution, and regulatory compliance purposes.

2.6 Responsible Gaming Data. Any deposit limits, loss limits, session reminders, or self-exclusion preferences you set within your Account dashboard are stored and treated as sensitive operational data, accessible only to compliance and responsible gaming staff.

oyo89 processes your Personal Data for the following purposes and under the following legal bases:

oyo89 does not use your Personal Data for automated decision-making or profiling that produces legal or similarly significant effects without providing you with a meaningful opportunity to contest the outcome.

oyo89 uses cookies and similar client-side tracking technologies to deliver a secure, personalised, and high-performance experience. The categories of cookies in use are as follows:

• Strictly Necessary Cookies: Essential for session management, authentication token storage, load balancing, and security. These cookies cannot be disabled without rendering core Platform functionality inoperable.
• Functional Cookies: Used to remember your preferences such as language settings, display options, and responsible gaming limits. Disabling these may degrade your experience but will not prevent access to the Platform.
• Analytics Cookies: Used to understand how Players navigate the Platform, which game categories attract the most engagement, and where technical errors occur. Data is aggregated and anonymised before analysis. oyo89 uses privacy-respecting analytics tools configured to not transmit full IP addresses to third-party servers.
• Security and Fraud-Prevention Cookies: Used to detect bot activity, credential-stuffing attempts, and unusual login patterns. These cookies are critical to protecting every Player's Account and cannot be disabled.

You can manage cookie preferences via your browser settings. Note that clearing cookies will log you out of your oyo89 Account and reset any locally stored display preferences. oyo89 does not use third-party advertising or retargeting cookies.

oyo89 does not sell, rent, or trade your Personal Data to any third party for marketing or commercial purposes. We share Personal Data only in the circumstances described below, and only to the minimum extent necessary:

5.1 Payment Processors. To facilitate deposits and withdrawals in IDR, oyo89 shares transaction data with Indonesian payment service providers and bank gateway operators. These include the processing networks connected to BCA, BRI, BNI, Mandiri, and e-wallet providers OVO, DANA, GoPay, ShopeePay, and LinkAja. Each provider operates under its own privacy policy and is contractually required to handle your data in accordance with applicable data protection standards.

5.2 KYC and Compliance Providers. To fulfil our age verification and anti-money-laundering obligations, oyo89 engages accredited third-party KYC providers who process identity documents and conduct liveness checks on our behalf. These providers are subject to strict contractual data processing agreements and may not use your data for any purpose beyond the specific KYC function.

5.3 Game Technology Providers. Game session data (such as bet amounts, spin outcomes, and game duration) is shared with the respective game studios — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft — solely for the purpose of game delivery, result verification, and technical support. These providers do not receive your full identity or financial records.

5.4 Legal and Regulatory Authorities. oyo89 may disclose Personal Data to law enforcement agencies, financial intelligence units, or other regulatory bodies where required to do so by applicable law, a court order, or a binding regulatory direction. oyo89 will use reasonable efforts to notify you of such a disclosure unless prohibited by law from doing so.

5.5 Business Transfers. In the event of a merger, acquisition, restructuring, or sale of all or substantially all of oyo89's assets, your Personal Data may be transferred to the successor entity, subject to the same protections described in this Policy.

oyo89 retains Personal Data only for as long as necessary to fulfil the purpose for which it was collected and to comply with applicable legal, regulatory, and audit obligations. The following retention periods apply:

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised. Where anonymisation is used, the resulting data set may be retained indefinitely for statistical and analytical purposes.

As a data subject, you have the following rights in relation to your Personal Data held by oyo89. To exercise any of these rights, please contact us at [email protected] or via live chat. We will respond within 30 calendar days of receiving a valid request.

• Right of Access: You may request a copy of the Personal Data oyo89 holds about you, along with information about how it is used and with whom it is shared.
• Right to Rectification: If you believe any Personal Data we hold about you is inaccurate or incomplete, you may request that we correct or update it. For identity-related data, correction may require submission of an updated identity document.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where processing is unlawful. This right is subject to our overriding legal obligations — for example, we cannot delete transaction records we are legally required to retain.
• Right to Restriction: You may request that we restrict the processing of your Personal Data while a dispute about its accuracy or the lawfulness of its use is being resolved.
• Right to Data Portability: Where processing is based on your consent or the performance of a contract, you may request that we provide your Personal Data in a structured, commonly used, machine-readable format so that you may transfer it to another service provider.
• Right to Object: You may object at any time to the processing of your Personal Data for direct marketing purposes. You may also object to processing based on legitimate interests, in which case oyo89 will cease processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. To withdraw consent for marketing communications, click "unsubscribe" in any oyo89 email or contact support directly.

oyo89 implements a comprehensive set of technical and organisational security measures to protect your Personal Data against unauthorised access, disclosure, alteration, and destruction. These measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your browser or app and the oyo89 servers is encrypted in transit using TLS 1.2 or higher — the same standard applied by major Indonesian financial institutions including BCA and BRI.
• Bcrypt Password Hashing: Account passwords are never stored in plaintext. They are one-way hashed using bcrypt with a computational cost factor designed to resist brute-force attacks, even in the event of a database breach.
• Two-Factor Authentication (2FA): Players are encouraged to enable 2FA on their oyo89 Account for an additional layer of login security. 2FA is mandatory for staff and administrator access.
• Real-Time Anomaly Detection: Our systems continuously monitor login attempts, transaction patterns, and session behaviour. Unusual activity triggers automatic alerts and, where the risk threshold is exceeded, temporary account suspension pending review.
• Role-Based Access Controls: Access to Player Personal Data within oyo89's internal systems is restricted on a strict need-to-know basis. Staff with access to sensitive data undergo regular security awareness training.
• Penetration Testing: oyo89 conducts regular third-party penetration tests and vulnerability assessments across its infrastructure to identify and remediate security weaknesses before they can be exploited.

Despite these measures, no method of data transmission or storage over the internet can be guaranteed as completely secure. oyo89 cannot warrant absolute security against all possible threats. In the event of a data breach that poses a significant risk to your rights and freedoms, oyo89 will notify you without undue delay in accordance with applicable data breach notification obligations.

The oyo89 Platform is strictly intended for adults aged 21 and above. oyo89 does not knowingly collect Personal Data from individuals under the age of 21. If you are a parent or guardian and believe that a minor has created an oyo89 Account or submitted Personal Data through the Platform, please contact us immediately at [email protected]. Upon confirmation, we will suspend the Account, delete all associated Personal Data, and forfeit any balances held in accordance with our Terms & Conditions.

With your explicit consent, oyo89 may send you promotional communications by email or WhatsApp regarding bonuses, seasonal promotions (including Idul Fitri, Ramadhan, and Indonesian Independence Day offers), new game launches from studios such as Pragmatic Play and Evolution Gaming, and major sporting events such as BRI Liga 1, the AFF Cup, and the Champions League.

You can withdraw your consent at any time by:

• Clicking the "Unsubscribe" link in any promotional email from oyo89;
• Updating your communication preferences in the Account Settings section of your oyo89 dashboard; or
• Contacting our support team at [email protected] and requesting removal from our marketing list.

Withdrawing marketing consent will not affect the delivery of transactional messages — such as deposit confirmations, withdrawal status updates, account security alerts, and KYC requests — which are required for the operation of your Account and are sent regardless of marketing preferences.

oyo89 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, operational requirements, or applicable law. Revised versions will be published on this page with an updated "Last Updated" date visible in the page header and in the Document Info sidebar.

Where updates are material — for example, where we introduce a new purpose for which Personal Data is processed, or engage a new category of Third-Party Processor — oyo89 will use reasonable efforts to notify active Players via the email address on file at least 14 days before the change takes effect. Continued use of the Platform following notification constitutes acceptance of the updated Policy.

We encourage you to review this Policy periodically. The current version always supersedes all prior versions.

For any questions, concerns, or formal requests relating to this Privacy Policy or your Personal Data, please contact oyo89 using the details below. All contact details are provided as plain text — they are not clickable links:

• Email: [email protected]
• WhatsApp: +62 811 0890 89
• Live Chat: Available 24 hours a day, 7 days a week via the Platform, in English and Bahasa Indonesia
• Response Time: oyo89 aims to acknowledge all data-related written enquiries within 2 business days and to provide a substantive response within 30 calendar days

When submitting a data rights request, please include your registered Account email address and a brief description of your request so we can process it efficiently. We may ask you to verify your identity before acting on any request that involves accessing or modifying your Personal Data.

Here is a quick summary of the six core commitments oyo89 makes to every Player regarding the handling of their personal information: