Privacy Policy

1 Definitions

In this Privacy Policy, the following terms carry the meanings set out below unless context requires otherwise:

• "opo99", "we", "us", "our" — refers to the opo99 platform, its owners, operators, and authorised representatives.
• "Platform" — means the opo99 website at https://opo99.bet, together with all associated products, services, and features.
• "Member", "you", "your" — means any natural person who has registered an account on the Platform or who browses the Platform without registering.
• "Personal Data" — means any information relating to an identified or identifiable natural person, including name, identification number, contact details, financial data, IP address, and device identifiers.
• "Sensitive Personal Data" — means Personal Data revealing racial or ethnic origin, religious beliefs, health data, or financial account details, which requires a higher standard of protection.
• "Processing" — means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, erasure, or destruction.
• "Data Controller" — means the entity that determines the purposes and means of Processing Personal Data, which in this context is opo99.
• "Third Party" — means any natural or legal person other than the Member or opo99 who is authorised to process Personal Data under a written data processing agreement with opo99.
• "KYC" — means Know Your Customer identity verification procedures conducted to confirm a Member's identity and payment method ownership.
• "Cookies" — means small text files placed on a Member's device by the Platform for the purposes described in Clause 11.

2 Data Controller

opo99 acts as the Data Controller for all Personal Data collected through the Platform. As Data Controller, opo99 is responsible for ensuring that Personal Data is processed lawfully, fairly, and transparently, and that appropriate technical and organisational measures are in place to protect it against unauthorised access, loss, or disclosure.

opo99 operates the Platform with the Indonesian market as its primary audience and is committed to handling personal data of Indonesian residents in a manner consistent with applicable international privacy standards. All enquiries regarding this Policy or the processing of your Personal Data should be directed to the opo99 support team using the contact details set out in Clause 15.

3 Personal Data We Collect

opo99 collects the following categories of Personal Data depending on how you interact with the Platform:

3.1 Registration Data

When you create an opo99 account, we collect:

• Full legal name;
• Date of birth (to verify you are 21 years of age or older);
• Indonesian residential address;
• Email address;
• Mobile phone number;
• Username and hashed password;
• Preferred currency (Indonesian Rupiah — IDR).

3.2 Identity Verification (KYC) Data

To comply with our anti-money laundering obligations and to process withdrawal requests, we collect:

• Government-issued photo ID (e.g., KTP, SIM, or passport — front and back images);
• Proof of address (e.g., a recent utility bill or bank statement issued to your registered address);
• Proof of ownership of your nominated payment method (e.g., a screenshot or statement confirming the account belongs to you) — applicable for BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI, OVO, DANA, GoPay, ShopeePay, and LinkAja accounts.

3.3 Financial Transaction Data

When you make deposits or request withdrawals, we record:

• Transaction amounts in IDR;
• Payment method type and partially masked account identifiers;
• Transaction timestamps and reference numbers;
• Account balance history.

3.4 Gaming and Betting Activity Data

• Bet placement and settlement records across sportsbook, live casino, and slot products;
• Game session durations, wager amounts, and win/loss outcomes;
• Bonus and promotion usage history;
• Responsible gaming limit settings and self-exclusion records.

3.5 Technical and Device Data

• IP address and approximate geolocation derived from it;
• Device type, operating system, and browser version;
• Unique device identifiers;
• Session logs, access timestamps, and page interaction data;
• Cookie and tracking pixel data (see Clause 11).

3.6 Communications Data

• Records of your interactions with our customer support team via live chat and email;
• Feedback, complaints, and survey responses you submit to opo99;
• Marketing communication preferences and opt-in/opt-out records.

4 How We Collect Personal Data

opo99 collects Personal Data through the following channels:

• Direct provision: Information you actively supply when registering, completing KYC, making deposits, contacting support, or responding to surveys;
• Automated collection: Technical and device data collected automatically as you navigate the Platform, via cookies, server logs, and analytics tools;
• Third-party sources: Identity and fraud-check data received from KYC verification providers and payment processors to supplement information you have provided directly;
• Publicly available sources: Publicly accessible information used to verify the accuracy of data you have provided or to meet regulatory obligations.

5 Purposes of Processing

opo99 processes your Personal Data for the following purposes:

6 Legal Basis for Processing

opo99 processes Personal Data on the following legal bases:

• Contractual necessity: Processing required to perform the contract between opo99 and the Member, including account management, payment processing, and service delivery;
• Legal obligation: Processing required to comply with applicable laws, including KYC/AML regulations and lawful authority requests;
• Legitimate interests: Processing carried out in pursuance of opo99's legitimate business interests, including fraud prevention, platform security, and analytics, provided those interests are not overridden by the Member's fundamental rights;
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — particularly for marketing communications and non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

7 Data Sharing and Disclosure

7.1 Authorised Service Providers

opo99 shares Personal Data with the following categories of third-party service providers under written data processing agreements that bind those providers to confidentiality and appropriate security obligations:

• Payment processors: Banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) to facilitate deposits and withdrawals;
• KYC verification providers: Identity verification specialists who authenticate government-issued documents and confirm age eligibility;
• Game studios: Software providers including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Pocket Games Soft, and Spribe, who receive limited session data necessary to deliver their games;
• IT infrastructure providers: Cloud hosting and content delivery network providers responsible for platform availability and performance;
• Fraud detection specialists: Third-party analytics providers that assist opo99 in identifying and preventing fraudulent activity and bonus abuse.

7.2 Regulatory and Law Enforcement Authorities

opo99 may disclose Personal Data to governmental or regulatory authorities, law enforcement agencies, or courts of competent jurisdiction where required to do so by applicable law, regulation, or a binding court order. opo99 will, where legally permitted, notify the affected Member of such a disclosure request prior to complying.

7.3 Business Transfers

In the event that opo99 undergoes a merger, acquisition, restructuring, or sale of all or substantially all of its assets, Personal Data held by opo99 may be transferred to the acquiring entity as part of that transaction. Members will be notified of any such transfer and of any material change to this Privacy Policy that results from it.

7.4 No Sale of Personal Data

opo99 does not sell, rent, or otherwise commercially exploit your Personal Data to external advertisers, data brokers, or any other third party for their own marketing or commercial purposes.

8 International Data Transfers

The opo99 platform serves Members primarily located in Indonesia, and the majority of data processing takes place within secure data centre environments. Certain service providers engaged by opo99 — particularly game studios and cloud infrastructure providers — may be located in jurisdictions outside Indonesia. Where Personal Data is transferred internationally, opo99 takes reasonable steps to ensure that the receiving entity provides an adequate level of protection for that data, including through contractual data protection obligations consistent with recognised international standards.

By using the opo99 Platform, you acknowledge that your Personal Data may be transferred to and processed in jurisdictions outside Indonesia for the purposes described in this Policy.

9 Data Retention

opo99 retains Personal Data for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply as a general guide:

• Active account data: Retained for the duration of your account and for a minimum of 5 years following account closure, to meet AML record-keeping obligations;
• Transaction records: Retained for a minimum of 5 years from the date of the transaction in accordance with financial record-keeping requirements;
• KYC documents: Retained for a minimum of 5 years following the date of verification or account closure, whichever is later;
• Customer support records: Retained for 3 years from the date of the relevant interaction;
• Marketing consent records: Retained until consent is withdrawn, plus 1 year following withdrawal as evidence of the consent history;
• Technical and log data: Retained for up to 12 months from collection, unless required for an ongoing investigation.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in a manner that prevents reconstruction of the original data.

10 Your Data Rights

As a Member of the opo99 Platform, you hold the following rights in relation to your Personal Data. To exercise any of these rights, please contact the opo99 support team via live chat or at the email address set out in Clause 15.

• Right of access: You may request a copy of the Personal Data opo99 holds about you, along with information about how it is being processed;
• Right to rectification: You may request correction of any inaccurate or incomplete Personal Data held about you;
• Right to erasure: You may request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, subject to opo99's legal retention obligations;
• Right to restriction: You may request that opo99 restrict the processing of your Personal Data in certain circumstances, for example while a rectification request is being resolved;
• Right to data portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you may request that your Personal Data be provided in a structured, commonly used, machine-readable format;
• Right to object: You may object to processing based on legitimate interests or for direct marketing purposes at any time;
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

opo99 will respond to all verified data rights requests within 30 days of receipt. Where a request is complex or numerous, we may extend this period by a further 60 days, in which case we will notify you of the extension and the reasons for it.

11 Cookies & Tracking Technologies

11.1 What Are Cookies?

Cookies are small text files stored on your device when you visit the opo99 Platform. They allow the Platform to recognise your device on subsequent visits, remember your preferences, and provide a more personalised experience. Similar technologies include pixel tags, web beacons, and local storage objects, which function in a comparable manner.

11.2 Types of Cookies We Use

• Strictly necessary cookies: Essential for the Platform to function. These include session authentication cookies that keep you logged into your account. These cookies cannot be disabled without rendering the Platform non-functional;
• Performance and analytics cookies: Used to collect anonymous data on how Members navigate the Platform, which pages are most visited, and where errors occur. This information is used to improve Platform performance;
• Functional cookies: Used to remember your preferences, such as your language or display settings, to provide a more consistent experience across sessions;
• Marketing cookies: Used, subject to your consent, to track your browsing behaviour and deliver relevant promotional content. These cookies may be set by opo99 or by third-party analytics partners.

11.3 Managing Cookies

You may control non-essential cookies through your browser settings at any time. Most modern browsers allow you to view, disable, or delete cookies stored on your device. Please note that disabling certain cookies may affect the functionality of the Platform and your ability to access some features. For detailed guidance on managing cookies in your specific browser, refer to your browser's help documentation.

12 Minors

The opo99 Platform is strictly intended for adults aged 21 years and older. 21+ opo99 does not knowingly collect Personal Data from any person under the age of 21. If we become aware that Personal Data has been collected from a person under 21 years of age, we will promptly delete that data and close the associated account. If you believe that a person under 21 has registered an account on the opo99 Platform, please notify us immediately using the contact details in Clause 15.

Age verification forms a core part of our KYC process, and all accounts are required to pass age verification before they may deposit funds or access real-money gaming products.

13 Security Measures

opo99 implements a comprehensive range of technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Platform;
• Encrypted storage of Personal Data and KYC documents at rest on secured servers;
• Role-based access controls ensuring that only authorised personnel can access sensitive Member data, and only to the extent required for their specific function;
• Multi-factor authentication for internal systems access by opo99 staff;
• Regular security assessments and penetration testing conducted by qualified third-party security specialists;
• Incident response procedures designed to contain, investigate, and remediate any security breach promptly, and to notify affected Members and relevant authorities where required by law.

While opo99 takes all reasonable steps to protect your Personal Data, no data transmission over the internet or method of electronic storage can be guaranteed to be 100% secure. You are responsible for maintaining the confidentiality of your account credentials and for notifying opo99 immediately if you suspect any unauthorised use of your account.

14 Amendments to This Policy

opo99 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform functionality. When material changes are made, we will update the "Last Reviewed" date at the top of this page and, where practicable, notify registered Members via their registered email address or through an in-platform notification.

Your continued use of the opo99 Platform following publication of an amended Privacy Policy constitutes your acceptance of the revised terms. We encourage you to review this page periodically to stay informed about how opo99 protects your personal information. If you do not agree with any amendment to this Policy, you should cease using the Platform and contact us to request account closure as described in the Terms & Conditions.

15 Contact

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data by opo99, please contact our support team through any of the following channels:

• Live Chat: Available 24 hours a day, 7 days a week through the support widget on the Platform — typical response time is under 2 minutes;
• Email: [email protected] — responses provided within 24 hours on business days (Monday to Friday, 08:00–22:00 WIB);
• Data Rights Requests: Address your request to the opo99 Data Privacy team via the same email address, clearly stating your registered username and the nature of your request.

opo99 is committed to resolving all privacy-related enquiries promptly and transparently. If you are not satisfied with our response to a privacy concern, you may have the right to lodge a complaint with the relevant data protection authority in your jurisdiction.