Privacy Policy

This Privacy Policy ("Policy") describes how oyo77 ("oyo77", "we", "us", "our") collects, uses, stores, shares, and protects the personal data of individuals ("you", "your", "Member") who access or use the oyo77 Platform at oyo77.bio, including all associated sub-pages, services, games, and customer support channels.

oyo77 is Indonesia's premier internationally licensed online casino and sports betting platform, serving players across Jakarta, Surabaya, Medan, Bandung, Bali, Yogyakarta, and beyond. As a responsible international gaming operator, we are firmly committed to protecting the privacy and personal data of every Member and visitor to our Platform.

This Policy should be read alongside our Terms & Conditions and our Responsible Gaming Policy, both of which are incorporated by reference. By registering an account, making a deposit, or otherwise using the oyo77 Platform, you confirm that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein.

If you do not agree with any part of this Policy, you must cease using the oyo77 Platform and contact our support team to close your Account.

For the purposes of this Privacy Policy, the following terms have the meanings set out below:

• " Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, date of birth, email address, phone number, postal address, financial account details, device identifiers, and IP addresses.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, erasure, or destruction, whether by automated or manual means.
• "Platform" means the oyo77 website at oyo77.bio, its sub-pages, mobile-optimised versions, and any associated application or service operated by oyo77.
• "Account" means the registered member account created by you on the Platform, through which you access oyo77's gaming and betting services.
• "KYC" means Know Your Customer — the identity and age verification process required before withdrawal of funds or at any point deemed necessary by oyo77 for compliance purposes.
• "Third-Party Service Providers" means companies or individuals engaged by oyo77 to perform specific functions on our behalf, such as payment processors, fraud detection firms, KYC verification vendors, game software providers, and customer support platforms.
• "Cookies" means small data files placed on your device by the Platform to remember preferences, maintain session state, and support analytics and fraud-prevention functions.

oyo77 collects the following categories of personal data, depending on how you interact with the Platform:

oyo77 does not intentionally collect sensitive personal data beyond what is required for identity verification (such as a copy of your Indonesian National Identity Card / KTP), and we handle any such documents with elevated security protocols consistent with our KYC obligations.

We collect your personal data through the following channels:

• Direct interactions: Information you provide when registering an Account, completing KYC verification, making deposits or withdrawals, contacting our support team, or updating your account profile.
• Automated technologies: Technical Data collected automatically when you visit the Platform, including via Cookies, server logs, pixel tags, and similar tracking technologies, as described further in Clause 10.
• Third-party sources: Information received from KYC and fraud-prevention service providers who verify your identity against public and proprietary databases; and from payment processors who confirm the status of your transactions via BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, or LinkAja.
• Publicly available sources: In rare circumstances where fraud or suspicious activity is suspected, oyo77 may supplement its records with information from publicly available sources to support an investigation.

oyo77 processes your personal data for the following specific and legitimate purposes:

• Account Management: To create, maintain, and administer your Member Account, including authentication, password recovery, and account preference settings.
• Identity Verification (KYC): To confirm your identity, age (21+ requirement), and residence in compliance with our international gaming licence and anti-money laundering obligations.
• Payment Processing: To process deposits and withdrawals denominated in Indonesian Rupiah (IDR / Rp) via supported local banks and e-wallets, and to reconcile your Account balance accurately.
• Service Delivery: To provide access to all oyo77 gaming products, including live dealer games, slot games, sports betting, virtual sports, and togel (Indonesia's traditional numbers lottery).
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, money laundering, collusion, bonus abuse, and other prohibited conduct on the Platform.
• Responsible Gaming: To monitor gaming behaviour for indicators of problem gambling, to administer deposit limits, loss limits, cooling-off periods, and self-exclusion requests, and to comply with our duty of care to Members.
• Customer Support: To respond to your enquiries, complaints, and support requests via live chat and email, and to maintain records of our correspondence for quality assurance.
• Legal and Regulatory Compliance: To meet our obligations under applicable laws and regulations, including the requirements of our international gaming licence, and to cooperate with lawful requests from competent authorities.
• Marketing Communications (where consented): To send you promotional offers, bonus notifications, seasonal promotions (such as Idul Fitri bonuses, Chinese New Year / Imlek specials, and Independence Day offers), and product updates — only where you have given express consent.
• Platform Improvement: To analyse aggregated usage data to improve the Platform's performance, content, and user experience for Members across Indonesia.

oyo77 processes your personal data on one or more of the following legal bases:

• Contractual Necessity: Processing required to perform our contract with you (the Terms & Conditions), including account management, payment processing, and service delivery.
• Legal Obligation: Processing required to comply with applicable laws, our gaming licence conditions, KYC/AML regulations, and lawful requests from competent authorities.
• Legitimate Interests: Processing carried out in oyo77's legitimate business interests — including fraud prevention, Platform security, and service improvement — where those interests are not overridden by your rights and interests.
• Consent: Processing based on your freely given, specific, and informed consent — particularly for marketing communications and the use of non-essential Cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

oyo77 does not sell your personal data to any third party. We share personal data only in the following limited circumstances:

• KYC and Fraud-Prevention Providers: Specialist third-party vendors who assist us in verifying your identity, screening against sanctions lists, and detecting fraudulent activity. These vendors process data solely on our instructions and under strict confidentiality obligations.
• Payment Processors: Indonesian bank and e-wallet payment processors (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, LinkAja) — limited to the financial data necessary to process your transactions.
• Game Software Providers: Third-party game studios (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft) that power specific games on the Platform. These providers may receive anonymised session data necessary to deliver the game content; they do not receive your full identity or financial data.
• Customer Support Platforms: Live chat and ticketing software providers that host our customer support infrastructure. Communications data is processed on their servers under data processing agreements with oyo77.
• Legal and Regulatory Authorities: Where required by law, court order, or a legitimate request from a competent regulatory or law enforcement authority, oyo77 will disclose personal data to the extent strictly required by that obligation.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of oyo77's business, your personal data may be transferred to the acquiring entity as part of that transaction, subject to equivalent privacy protections.

All Third-Party Service Providers who process personal data on oyo77's behalf are required to do so only under oyo77's documented instructions, to maintain appropriate security standards, and to enter into data processing agreements that protect your rights.

oyo77 retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and our licensing obligations. The following retention periods apply as a general guide:

Upon expiry of the applicable retention period, personal data is securely erased or anonymised so that it can no longer be linked to an identifiable individual. Where data is anonymised rather than deleted, the resulting aggregated dataset may be retained indefinitely for statistical and analytical purposes.

oyo77 implements a comprehensive suite of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• Transport Layer Security: All data in transit between your browser or device and oyo77's servers is encrypted using TLS 1.2 or higher (256-bit SSL), ensuring that no third party can intercept your data in transit.
• Encryption at Rest: Sensitive personal data and KYC documents stored on oyo77's servers are encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. oyo77 employees and contractors may only access personal data that is necessary for their specific role, and all access is logged and audited.
• Two-Factor Authentication: Internal administrative systems that hold personal data are protected by multi-factor authentication requirements for all staff.
• Penetration Testing: oyo77's Platform and infrastructure are subject to regular independent security assessments and penetration tests to identify and remediate vulnerabilities proactively.
• Incident Response: oyo77 maintains a documented data breach response plan. In the event of a security incident that poses a high risk to your rights and freedoms, we will notify affected Members without undue delay.

The oyo77 Platform uses Cookies and similar tracking technologies to ensure the Platform functions correctly, to improve your user experience, and to support security and fraud-prevention systems. The following categories of Cookies are used:

• Strictly Necessary Cookies: Required for the Platform to operate. These include session authentication Cookies that keep you logged in, load-balancing Cookies, and security Cookies. These Cookies cannot be disabled without impairing the core functionality of the Platform.
• Functional Cookies: Used to remember your preferences, such as your language setting, preferred game categories, and notification settings. These improve the convenience of your experience but are not strictly required.
• Analytics Cookies: Used to collect aggregated, anonymised information about how Members use the Platform — for example, which pages are visited most frequently and where Members encounter errors. This data is used solely to improve the Platform.
• Security and Fraud-Prevention Cookies: Used by oyo77's risk management systems to detect suspicious activity, bot behaviour, and potential fraud patterns. These Cookies are essential to Platform integrity and the security of all Members' Accounts.

oyo77 does not use third-party advertising Cookies or tracking pixels for the purpose of serving targeted advertisements on external websites.

You can manage Cookie preferences through your browser settings. Please note that disabling Strictly Necessary or Security Cookies may result in reduced Platform functionality, inability to log in, or complete loss of access to the Platform.

Subject to applicable law and any overriding legal obligations (such as our KYC/AML retention requirements), you have the following rights in respect of your personal data held by oyo77:

• Right of Access: You may request a copy of all personal data that oyo77 holds about you. We will provide this within 30 days of receiving a verified request.
• Right to Rectification: You may request that inaccurate or incomplete personal data be corrected. Minor corrections (such as updating your phone number) can be made directly in your Account settings; changes to core identity data require support team verification.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, and where no overriding legal obligation requires us to retain it. Note that our KYC and AML obligations mean that certain data must be retained for up to 5 years after Account closure.
• Right to Restriction: You may request that oyo77 temporarily stop processing your personal data where you dispute its accuracy, or where processing is unlawful but you prefer restriction to erasure.
• Right to Data Portability: Where processing is based on your consent or our contract with you, and is carried out by automated means, you may request a machine-readable copy of your personal data for transfer to another service provider.
• Right to Object: You may object to processing based on oyo77's legitimate interests, including profiling for fraud-prevention purposes, and to direct marketing at any time.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of the above rights, please contact our support team via live chat (available 24/7) or by email at [email protected] with the subject line "Data Rights Request." We will acknowledge your request within 5 business days and provide a substantive response within 30 calendar days.

The oyo77 Platform is strictly intended for adults aged 21 years and over. oyo77 does not knowingly collect or process the personal data of individuals under the age of 21. If you are under 21 years of age, you must not use the Platform, create an Account, or submit any personal data to oyo77.

oyo77 employs mandatory age-verification checks as part of the Account registration and KYC process. Any Account found to belong to an individual under 21 years of age will be immediately suspended, all winnings will be forfeited, and all deposited funds will be returned to the verified payment source after deducting any applicable processing costs.

If you are a parent or guardian and believe that a minor in your care has registered an Account on oyo77 or submitted personal data to the Platform without your consent, please contact us immediately at [email protected]. We will investigate and take appropriate action without delay.

oyo77 operates as an internationally licensed online gaming platform. As a result, your personal data may be transferred to, stored on, and processed by systems located outside of Indonesia — for example, on servers in the jurisdiction in which oyo77 holds its gaming licence, or in the jurisdictions where our Third-Party Service Providers operate.

Whenever your personal data is transferred internationally, oyo77 takes all reasonable steps to ensure that it receives an equivalent level of protection to that which it receives within Indonesia. These steps include:

• Entering into data processing agreements with Third-Party Service Providers that include contractual data protection obligations equivalent to those described in this Policy.
• Selecting service providers in jurisdictions that are recognised as offering adequate data protection standards.
• Applying technical safeguards — including encryption in transit and at rest — regardless of where data is physically stored.

By using the oyo77 Platform and submitting your personal data, you acknowledge and consent to the transfer of your personal data to jurisdictions outside Indonesia as described in this clause.

oyo77 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory requirements, or the services we offer. The most current version of the Policy will always be available on this page, with the "Last Updated" date revised accordingly.

Where a change to this Policy is material — meaning it significantly affects how we process your personal data or the rights available to you — oyo77 will notify active Members by email and/or via a notice displayed upon login prior to the change taking effect. For minor clarifications or non-material updates, we may update the Policy without prior notification.

Your continued use of the oyo77 Platform following the publication of any updated Privacy Policy constitutes your acknowledgement and acceptance of the revised terms. If you object to any change, you must cease using the Platform and contact our support team to request Account closure and data handling in accordance with your applicable rights.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way oyo77 handles your personal data, please contact our Data Protection team through any of the following channels:

• Live Chat: Available 24/7 directly on the oyo77 Platform. Indonesian-speaking agents are on standby at all times. Support hours are aligned with WIB (UTC+7), with coverage across WITA (UTC+8) and WIT (UTC+9) time zones as well.
• Email: [email protected] (plain text — not a clickable link). Use the subject line "Privacy Enquiry" or "Data Rights Request" for fastest routing. We aim to respond within 24 hours and to resolve data rights requests within 30 calendar days.

oyo77 takes all privacy enquiries seriously. If you are not satisfied with our response, you have the right to escalate your complaint to the relevant data protection authority or the dispute resolution body associated with our gaming licence.