Privacy Policy — oke27

Throughout this Privacy Policy the following terms carry the meanings defined below:

2.1 Registration Data. When you create an oke27 account, we collect the personal information you provide during the registration process, which includes:

• Full legal name (as it appears on your Indonesian identity document).
• Date of birth (used to verify the 21-year minimum age requirement).
• Email address (used for account communications and security alerts).
• Indonesian mobile telephone number (used for SMS verification and security notifications).
• Chosen username and encrypted password.
• City and province of residence within Indonesia.

2.2 KYC and Identity Verification Data. To comply with anti-money laundering obligations and to process withdrawals above defined thresholds, oke27 may request:

• A copy of your Indonesian National Identity Card (KTP) or valid passport.
• A selfie photograph alongside your identity document.
• Proof of residential address (utility bill, bank statement, or official correspondence dated within 90 days, addressed to your registered Indonesian address).
• Proof of ownership of the payment method used for deposits or withdrawal requests (e.g., bank account statement displaying your name and account number for BCA, BRI, BNI, Mandiri, or other supported Indonesian banks; or e-wallet account confirmation for OVO, DANA, GoPay, ShopeePay, or LinkAja).

2.3 Financial Transaction Data. We collect details of every deposit and withdrawal transaction processed through your oke27 account, including transaction amounts (denominated in Indonesian Rupiah), timestamps, payment channel used, and transaction reference numbers. We do not store full card numbers or complete bank account credentials — payment processing is handled by our certified third-party payment service providers.

2.4 Gaming Activity Data. We maintain records of your gaming activity on the platform, including bets placed, games played, session durations, game outcomes, and bonus usage history. This data is used for account management, dispute resolution, responsible gaming monitoring, and regulatory compliance.

2.5 Technical and Device Data. When you access oke27, our servers and analytics systems automatically collect:

• IP address and approximate geographic location (city/province level within Indonesia).
• Browser type, version, and operating system.
• Device type (desktop, mobile, tablet) and screen resolution.
• Referring URL and on-platform navigation path.
• Session duration and pages visited.
• Cookie identifiers and local storage data (see Section 6).

2.6 Communications Data. We retain records of communications between you and oke27's support team — including live chat transcripts, support ticket contents, and email correspondence — for quality assurance, dispute resolution, and staff training purposes.

2.7 Data You Choose to Provide. If you respond to surveys, participate in promotions, or otherwise voluntarily provide additional personal information through the platform, that data is collected and processed in accordance with this Privacy Policy.

oke27 processes your Personal Data for the following purposes:

4.1 Contractual Necessity. The majority of Personal Data processing by oke27 is necessary to perform the contract between oke27 and you as a registered Member — specifically, to operate your account, process transactions, verify your identity, and deliver the gaming services you have signed up for. Without this processing, oke27 cannot provide its services.

4.2 Legal Obligation. Certain processing activities — primarily KYC identity verification, transaction record retention, and fraud reporting — are required by applicable anti-money laundering law and financial crime prevention obligations. oke27 has no discretion to waive these requirements.

4.3 Legitimate Interests. oke27 processes some categories of Personal Data on the basis of its legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and aggregated analytics for platform improvement. In each case, oke27 has assessed that its legitimate interest does not override the privacy rights of Members.

4.4 Consent. Marketing communications are sent only on the basis of your explicit opt-in consent. The use of non-essential cookies and tracking technologies is also subject to consent where required. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

5.1 Service Providers. oke27 shares Personal Data with carefully selected third-party service providers who process data on oke27's behalf under binding data processing agreements. These providers are permitted to use your data only for the specific purpose for which they were engaged and may not use it for their own commercial purposes. Current categories of service providers include:

• Payment processors — Indonesian banking partners and e-wallet infrastructure providers (including third-party payment aggregators that facilitate bank transfers to BCA, BRI, BNI, Mandiri, and e-wallet payments via OVO, DANA, GoPay, ShopeePay, and LinkAja).
• KYC and identity verification providers — third-party identity verification platforms that authenticate government-issued Indonesian identity documents.
• Game software providers — studios such as Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft receive session data necessary to run games, resolve game-round disputes, and provide RNG certification. These providers operate under contractual data processing terms.
• Fraud prevention and security services — platforms that analyse device fingerprints, IP addresses, and behavioural signals to detect multi-account usage and payment fraud.
• Analytics platforms — services that process aggregated, pseudonymised usage data to help oke27 understand platform performance and user experience.
• Cloud infrastructure and hosting providers — services that store oke27's databases and serve platform content.

5.2 Legal Disclosure. oke27 may disclose Personal Data to governmental authorities, law enforcement agencies, or regulatory bodies where required to do so by applicable law, court order, or lawful regulatory demand. oke27 will notify affected Members of such disclosures where legally permitted to do so.

5.3 No Sale of Personal Data. oke27 does not sell, rent, or otherwise commercially transfer your Personal Data to any third party for that party's own marketing, advertising, or commercial purposes. This prohibition is unconditional and applies regardless of the value of the data or the nature of the third party.

5.4 Business Transfers. In the event of a merger, acquisition, restructuring, or sale of oke27's business or assets, Personal Data held by oke27 may be transferred to the acquiring entity as part of that transaction, subject to the acquiring entity assuming the obligations of this Privacy Policy with respect to your data.

6.1 What Are Cookies. Cookies are small text files stored on your device by your web browser when you visit a website. oke27 uses cookies and similar tracking technologies (including local storage, session storage, and device fingerprinting) to operate the platform, maintain your logged-in session, remember your preferences, and analyse platform usage.

6.2 Types of Cookies Used.

6.3 Managing Cookies. You may configure your browser to block or delete cookies at any time. Note that disabling strictly necessary cookies will prevent you from logging in to your oke27 account. Disabling functional cookies will result in loss of saved preferences. Blocking analytics and fraud-prevention cookies will not affect your ability to use the platform but may reduce the effectiveness of our security monitoring.

7.1 Technical Measures. oke27 implements industry-standard technical security measures to protect your Personal Data against unauthorised access, alteration, disclosure, and destruction. These measures include:

• 256-bit TLS/SSL encryption for all data transmitted between your device and oke27's servers.
• AES-256 encryption for Personal Data and KYC documents stored at rest in oke27's databases.
• Bcrypt hashing with a per-account salt for all stored passwords — oke27 staff cannot retrieve your password in plain text.
• Two-factor authentication (2FA) available to all Members and mandatory for internal staff accounts.
• Real-time intrusion detection and automated brute-force lockout after repeated failed login attempts.
• Segregated network architecture separating public-facing servers from internal databases containing Personal Data.

7.2 Organisational Measures. Access to Personal Data within oke27 is restricted to staff members who require it to perform their specific job function. All staff with access to Member data are bound by confidentiality obligations and undergo periodic data protection training. KYC documents are handled exclusively by oke27's compliance team and are not accessible to customer-facing support agents.

7.3 Breach Notification. In the event of a Personal Data breach that poses a risk to your rights and freedoms, oke27 will notify affected Members via their registered email address within 72 hours of oke27 becoming aware of the breach, where it is feasible to do so. Notifications will describe the nature of the breach, the categories of data affected, the likely consequences, and the steps oke27 is taking to address it.

8.1 Active Accounts. Personal Data associated with an active oke27 account is retained for the duration of the account's existence and for a minimum of five years following account closure or last activity, whichever is later. This retention period is required by applicable anti-money laundering and financial record-keeping obligations.

8.2 KYC Documents. Identity verification documents submitted as part of the KYC process are retained for a minimum of five years from the date of submission. After the mandatory retention period, KYC documents are permanently and securely deleted from oke27's systems.

8.3 Support Communications. Live chat transcripts and support ticket records are retained for 24 months from the date of the interaction, after which they are deleted or anonymised for aggregated quality-assurance analysis.

8.4 Analytics Data. Pseudonymised analytics data collected via cookies and tracking tools is retained for up to 26 months before being deleted or further anonymised. This data cannot be used to re-identify individual Members once pseudonymised.

8.5 Early Deletion Requests. You may request deletion of your Personal Data before the expiry of the standard retention period by contacting oke27 support (see Section 13). oke27 will action deletion requests within 30 days, subject to any legal obligation that requires oke27 to retain specific data categories for the mandatory minimum period regardless of the deletion request.

As an oke27 Member, you have the following rights with respect to your Personal Data. To exercise any of these rights, contact oke27 support via the details in Section 13. oke27 will respond to all rights requests within 30 days of receipt.

10.1 Age Restriction. The oke27 platform is strictly for adults aged 21 years and over. oke27 does not knowingly collect Personal Data from individuals under the age of 21. The registration process requires you to confirm your date of birth, and KYC verification is used to confirm age where required.

10.2 Underage Registrations. If oke27 discovers or is notified that a registered Member is under 21 years of age, the account will be permanently closed immediately, all balances will be forfeited, and all Personal Data associated with the account will be deleted from oke27's systems within 30 days, subject only to any legal obligation to retain records of the underage registration event itself for compliance purposes.

10.3 Reporting Underage Access. If you believe that a person under 21 years of age has registered an oke27 account, please contact oke27 support immediately at [email protected].

11.1 External Content. The oke27 platform may from time to time display content or functionality provided by third-party game studios (such as Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft). When you interact with third-party game environments that are embedded within the oke27 platform, those environments may be subject to the data practices of the relevant game provider in addition to those of oke27.

11.2 oke27's Responsibility. oke27 is not responsible for the privacy practices of third-party game providers, payment networks, or any other external services. oke27 selects third-party partners that maintain data protection standards consistent with oke27's own, and all service providers are contractually required to handle Member data in accordance with applicable privacy obligations.

12.1 Right to Update. oke27 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or operational requirements. Material changes — meaning changes that affect your rights or the way we use your Personal Data in a substantive way — will be communicated to registered Members via email to their registered address a minimum of 7 calendar days before the updated policy takes effect.

12.2 Continued Use. Your continued use of the oke27 platform following the effective date of any Privacy Policy update constitutes your acknowledgment of the updated policy. If you do not accept a material change, you must cease using the platform and request account closure before the change's effective date.

12.3 Version History. The current version of this Privacy Policy, including its effective date, is always available at oke27.ws/privacy-policy. The effective date in the page header reflects the date the most recently published version came into force.

13.1 Privacy Enquiries. For any question, concern, or formal request relating to this Privacy Policy or oke27's handling of your Personal Data, please contact oke27's support team:

13.2 Complaints. If you are not satisfied with oke27's response to a privacy complaint or data rights request, you have the right to escalate the matter to the relevant data protection authority in the jurisdiction in which oke27's operating entity is registered. oke27 will cooperate fully with any such regulatory inquiry.

13.3 Indonesian-Speaking Support. oke27's support team includes native Indonesian-speaking agents available 24 hours a day, 7 days a week, including during Idul Fitri, Nyepi, Indonesian Independence Day, and all Indonesian national public holidays. While this Privacy Policy is published in English, our support team can assist Members based in Jakarta, Surabaya, Bandung, Medan, Bali, Yogyakarta, and across Indonesia in Bahasa Indonesia when requested.