oja68 Privacy Policy

Introduction

oja68 ("we", "us", "our", "the Platform") operates the online casino and sportsbook available at https://oja68.net, serving members primarily located in Indonesia. We are committed to handling your personal information with the highest standards of transparency, security, and respect for your individual rights.

This Privacy Policy describes in full how oja 68 collects, stores, uses, shares, and protects the personal data of its members and website visitors. It also explains the choices and rights available to you regarding your personal information, and how to exercise those rights.

This policy should be read alongside our Terms & Conditions, which govern your use of the oja68 platform more broadly. In the event of any conflict between this Privacy Policy and the Terms & Conditions on a privacy-related matter, this Privacy Policy takes precedence.

Who is the Data Controller? For the purposes of this Privacy Policy, oja68 acts as the data controller — meaning we determine the purposes and means by which your personal data is processed. All inquiries regarding your personal data should be directed to our support team at [email protected].

Definitions

The following terms have specific meanings throughout this Privacy Policy:

Data We Collect

oja68 collects only the personal data that is necessary to provide, operate, and improve the platform. The categories of personal data we collect include:

3.1 Registration & Identity Data

• Full legal name (as it appears on your government-issued identification)
• Date of birth (to verify you are 21 years of age or older)
• Email address and mobile phone number
• Username and encrypted password
• City and province of residence within Indonesia (e.g., Jakarta, Surabaya, Bandung, Bali, Medan)

3.2 Identity Verification (KYC) Data

• Copies of government-issued identification documents: Indonesian National Identity Card (KTP), Passport, or Driver's Licence (SIM)
• Selfie or liveness-check photograph taken during the verification process
• Proof of payment method ownership (e.g., bank statement showing name and account number)

3.3 Financial & Transaction Data

• Bank account details (account number and bank name — e.g., BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) used for deposits and withdrawals
• E-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja) used for transactions
• Transaction history, including deposit amounts, withdrawal requests, and transaction timestamps (all denominated in Indonesian Rupiah, IDR)
• Records of bonus credits, wagering activity, and balance adjustments

3.4 Gameplay & Betting Data

• Game session logs, including games played, bet amounts, win/loss outcomes, and session duration
• Sportsbook wager history, including markets selected, odds accepted, and settlement results
• Bonus usage and promotional participation records

3.5 Technical & Device Data

• IP address and approximate geolocation derived from IP
• Device type, operating system, and browser version
• Session identifiers, cookies, and analytics data (see Section 9)
• Login timestamps and access logs

3.6 Communications Data

• Records of all communications between you and oja68 customer support, including live chat transcripts, email correspondence, and support ticket histories
• Survey responses and feedback submissions, where voluntarily provided

How Data Is Collected

oja68 collects personal data through the following means:

• Directly from you — when you complete the registration form, submit KYC documents, make a deposit or withdrawal request, contact customer support, or participate in a promotional offer.
• Automatically — when you visit https://oja68.net, our servers automatically log your IP address, browser type, device information, referring URL, and pages visited. Cookies and similar tracking technologies also collect data automatically (see Section 9).
• From third-party service providers — our KYC verification partners may return identity confirmation results to us following document checks. Payment processors return transaction status notifications to our systems to update your account balance.
• From game studios — providers such as Pragmatic Play, Evolution Gaming, PG Soft (Pocket Games Soft), NetEnt, Microgaming, and Spribe transmit game session outcomes and RTP audit data to oja68's systems for settlement and record-keeping purposes.

Purpose & Legal Basis for Processing

oja68 processes your personal data for specific, documented purposes. The table below outlines each purpose alongside the legal basis on which we rely:

Sharing & Disclosure of Personal Data

6.1 We Do Not Sell Your Data. oja68 does not sell, rent, or trade your personal data to any third party for their own commercial purposes. Any sharing of your personal data is strictly limited to what is necessary for the operation of the platform and your account.

6.2 Payment Processors. To process your deposits and withdrawals in IDR, oja68 shares the minimum necessary financial and identity data with our partner payment providers, including banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja). These providers operate under strict confidentiality obligations and are prohibited from using your data for any purpose other than processing the relevant transaction.

6.3 KYC Verification Partners. To satisfy age verification (21+) and identity verification requirements, oja68 may share copies of your identification documents with accredited third-party KYC verification service providers. These partners process your documents solely for verification purposes and are bound by data protection agreements.

6.4 Game Studio Providers. Game session data is transmitted to and from game studios (including Pragmatic Play, Evolution Gaming, PG Soft, NetEnt, Microgaming, and Spribe) as a technical necessity to deliver game content and settle outcomes. The studios receive only the data required for game operation — typically a pseudonymous member identifier and bet/outcome values — and do not receive your full identity or payment details.

6.5 Legal and Regulatory Disclosure. oja68 may disclose your personal data to law enforcement agencies, regulatory authorities, or other competent bodies when required to do so by applicable law, court order, or in connection with the investigation of suspected fraud, money laundering, or other criminal activity. In such cases, we will disclose only the minimum data legally required and will inform you of such disclosure where we are legally permitted to do so.

6.6 Business Transfers. In the event that oja68 undergoes a merger, acquisition, restructuring, or sale of all or part of its assets, your personal data may be transferred to the successor entity as part of that transaction. You will be notified via your registered email address prior to any such transfer taking effect, and your rights under this Privacy Policy will be maintained by the successor entity.

Data Retention

7.1 Retention Periods. oja68 retains personal data for as long as your account is active and for a defined period following account closure, as set out below:

7.2 Secure Deletion. Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with industry-standard data destruction protocols. Anonymised aggregate data (from which no individual can be identified) may be retained indefinitely for statistical and analytical purposes.

7.3 Legal Hold. Where personal data is subject to an active legal dispute, regulatory investigation, or law enforcement inquiry, oja68 will retain that data for as long as required to resolve the matter, regardless of the standard retention period.

Security Measures

oja68 takes the security of your personal data seriously and maintains a comprehensive set of technical and organisational safeguards designed to protect against unauthorised access, disclosure, alteration, or destruction of your information.

8.1 Encryption. All data transmitted between your device and the oja68 platform is protected by 256-bit TLS/SSL encryption. Sensitive data stored at rest — including KYC documents and financial details — is encrypted using AES-256 standards.

8.2 Access Controls. Access to systems that store personal data is restricted to authorised oja68 personnel and verified third-party service providers on a strict need-to-know basis. All staff with data access are required to complete data protection training and are bound by confidentiality obligations.

8.3 Infrastructure Security. oja68's platform infrastructure is hosted in secure, access-controlled data centres with physical security measures including CCTV surveillance, biometric access controls, and 24/7 on-site security. Regular penetration testing and vulnerability assessments are conducted by independent security firms.

8.4 Password Security. Member passwords are never stored in plain text. Passwords are hashed using industry-standard one-way hashing algorithms (bcrypt or equivalent) with appropriate salting. oja68 staff cannot retrieve your password — only a password reset is possible.

8.5 Breach Response. In the event of a confirmed data breach that poses a risk to your rights and freedoms, oja68 will notify affected members via their registered email address within 72 hours of becoming aware of the breach, and will take immediate remediation steps to contain and address the incident.

8.6 Your Responsibility. While oja68 employs robust security measures on our end, the security of your account also depends on you maintaining a strong, unique password and keeping your login credentials confidential. You are responsible for any activity on your account carried out with your credentials.

Cookies & Tracking Technologies

oja68 uses cookies and similar tracking technologies to provide a functional, personalised, and secure platform experience. The following types of cookies are used:

9.1 Managing Cookies. You can control and delete cookies through your browser settings. Please note that disabling strictly necessary cookies will prevent the oja68 platform from functioning correctly and you will not be able to log in or place bets. Disabling functional or analytics cookies will not prevent platform access but may reduce the quality of your experience.

9.2 No Third-Party Advertising Cookies. oja68 does not place third-party advertising or retargeting cookies on your device. We do not participate in cross-site tracking for advertising purposes.

Your Rights Over Your Personal Data

You hold a number of rights with respect to the personal data oja68 holds about you. These rights are described below, along with the process for exercising each one:

• Right of Access: You may request a copy of all personal data oja68 holds about you. We will provide this in a structured, commonly used, machine-readable format within 30 days of a verified request.
• Right to Rectification: If any personal data we hold is inaccurate or incomplete, you may request that it be corrected. Minor corrections (such as a change of mobile number) can be made directly via your account settings. Corrections to identity data (name, date of birth) require KYC re-verification.
• Right to Erasure ("Right to Be Forgotten"): You may request that oja68 delete your personal data. This right applies where the data is no longer necessary for its original purpose, where you withdraw consent, or where processing is unlawful. This right is subject to limitations — oja68 is required by law to retain certain financial and KYC records for the periods outlined in Section 7, and erasure requests cannot override those legal obligations.
• Right to Restriction of Processing: In certain circumstances (e.g., while a rectification request is being assessed, or while a dispute is being resolved), you may request that oja68 limit its processing of your personal data to storage only.
• Right to Data Portability: Where processing is based on your consent or on a contract, you may request that oja68 provide your personal data in a portable electronic format so that you can transfer it to another service provider.
• Right to Object: You have the right to object to processing based on legitimate interest, including profiling for responsible gaming monitoring purposes. oja68 will consider your objection and cease processing unless compelling legitimate grounds override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

Minors — Under-21 Protection

11.1 Strict Age Limit. The oja68 platform is strictly intended for adults aged 21 and above. We do not knowingly collect, process, or retain personal data from any person under the age of 21. The registration form requires entry of a date of birth, and KYC verification requires submission of a government-issued identity document confirming the member's age.

11.2 Discovery of Under-Age Accounts. If oja68 becomes aware — through any means — that personal data has been collected from a person under the age of 21, we will immediately suspend the relevant account, void all bets and bonuses, initiate KYC review, and permanently close the account. Where applicable law requires, we will report the matter to the relevant authorities.

11.3 Parental Concerns. If you are a parent or guardian and have reason to believe that a minor in your care has registered an account or provided personal data to oja68, please contact us immediately at [email protected]. We will investigate and act promptly. We also recommend using filtering software to restrict minors' access to online gambling platforms. 21+ only.

International Data Transfers

12.1 Cross-Border Processing. Some of oja68's third-party service providers — including game studios, KYC verification platforms, and infrastructure providers — may be located or operate data centres outside Indonesia. As a result, your personal data may be transferred to and processed in countries other than Indonesia.

12.2 Safeguards. Where such transfers occur, oja68 ensures that appropriate safeguards are in place to protect your personal data at the same level as required under this Privacy Policy. Safeguards may include contractual data processing agreements incorporating standard data protection clauses, ensuring the recipient organisation maintains equivalent data security standards.

12.3 Provider Jurisdictions. Game content providers such as Pragmatic Play, Evolution Gaming, PG Soft, NetEnt, and Microgaming operate internationally and are subject to licensing requirements in their respective jurisdictions that impose data protection obligations. oja68 engages only with providers that have demonstrated compliance with international data security standards.

Marketing Communications

13.1 Opt-In Basis. oja68 sends promotional communications — including bonus offers, game release announcements, and seasonal promotions tied to events such as Idul Fitri, Indonesian Independence Day (17 August), and major sporting events like BRI Liga 1 and FIFA World Cup qualifying matches — only to members who have explicitly opted in to receive such communications.

13.2 Channels. Marketing communications may be sent via email to your registered email address and/or via SMS to your registered Indonesian mobile number, depending on the preferences you have selected in your account settings.

13.3 Opting Out. You may unsubscribe from marketing communications at any time by:

• Clicking the "Unsubscribe" link included in every marketing email;
• Updating your communication preferences in your account settings; or
• Contacting customer support at [email protected] with the subject line "Marketing Opt-Out".

Opting out of marketing communications will not affect the delivery of transactional messages (e.g., deposit confirmations, withdrawal notifications, KYC status updates, or security alerts), which are essential to the operation of your account and cannot be disabled.

Third-Party Links & Embedded Content

14.1 No External Links Policy. The oja68 platform does not include outbound hyperlinks to third-party websites, social media platforms, or external services that would expose you to separate privacy practices outside our control. All navigation links on the platform lead to internal pages within the oja68 domain.

14.2 Game Studio Iframes. Live casino and slot game content is delivered via embedded iframes or secure API connections from licensed game studios. While these studios operate their own data processing systems for the delivery of game content, oja68's data sharing agreements with them (see Section 6.4) ensure that only pseudonymous session data is transmitted, and the studios are contractually prohibited from using that data for purposes other than game delivery and settlement.

14.3 No Responsibility for Third Parties. In the event that any third-party content embedded within the platform links to an external site (for example, within a game's help documentation), oja68 is not responsible for the privacy practices or data handling of that external site. You access any third-party site at your own risk and are encouraged to review its privacy policy independently.

Changes to This Privacy Policy

15.1 Right to Update. oja68 reserves the right to amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, platform features, or regulatory requirements. The updated policy will be published at https://oja68.net/privacy-policy with a revised "Last Reviewed" date at the top of the document.

15.2 Notification of Material Changes. Where a proposed change materially affects how we process your personal data or reduces your rights under this policy, oja68 will notify you via your registered email address at least 14 days before the change takes effect. Continued use of the platform after the effective date of a material amendment constitutes your acceptance of the revised Privacy Policy.

15.3 Minor Updates. Non-material updates — such as typographical corrections, clarifications that do not alter the substance of data practices, or additions of newly integrated game studios to the existing provider list — may be made without advance notice. The "Last Reviewed" date will be updated accordingly.

15.4 Archived Versions. Previous versions of this Privacy Policy are retained in our internal records and are available upon request to members who require them for dispute purposes.

Contact & Complaints

If you have any questions, concerns, or complaints about this Privacy Policy or about how oja68 handles your personal data, please contact our Data Privacy team using the details below. All privacy enquiries are handled with strict confidentiality.

Email: [email protected] — please use the subject line "Privacy Enquiry" or "Data Rights Request" as appropriate.

Response Time: oja68 targets an initial response to privacy enquiries within 48 hours. Formal data rights requests (access, rectification, erasure, portability) will receive a substantive response within 30 calendar days of identity verification.

Support Hours: Our customer support team is available 24 hours a day, 7 days a week, including during Indonesian public holidays such as Idul Fitri, Nyepi, and Indonesian Independence Day. Support is provided in English, with native Indonesian-speaking agents also available.

Escalation: If you are not satisfied with oja68's response to your privacy complaint, you have the right to escalate the matter to the relevant data protection authority or regulatory body in your jurisdiction. oja68 will cooperate fully with any such investigation.