Privacy Policy — opa89

Throughout this Privacy Policy, the following terms carry the meanings set out below:

• "opa89," "We," "Us," or "the Company" refers to the legal entity that owns and operates the online gaming platform at https://opa89.bet.
• "You" or "Member" refers to any individual who visits, registers with, or otherwise uses the opa89 platform.
• "Personal Data" means any information relating to an identified or identifiable natural person — including name, date of birth, Indonesian national identity number (NIK), contact details, financial information, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, modification, or deletion.
• "KYC" (Know Your Customer) refers to the identity verification process through which opa89 confirms a member's identity, age, and eligibility to use the platform.
• "Cookies" means small data files placed on your device by the opa89 platform that allow us to recognize your browser session and preferences across visits.
• "Third-Party Processors" means external companies engaged by opa89 to process data on our behalf — including payment processors, KYC verification providers, and game software studios — who are bound by data protection agreements.
• "Platform" refers to the opa89 website at https://opa89.bet, including all pages, subdomains, and mobile-optimized views.

opa89 collects only the Personal Data that is necessary to provide our services, maintain security, satisfy legal obligations, and improve the member experience. The categories of data we collect include:

We do not collect sensitive personal data beyond what is necessary for age and identity verification. We do not store full payment card numbers; card transactions are processed directly by our PCI-DSS-compliant payment partners.

opa89 collects Personal Data through the following channels:

• Account Registration: When you create an opa89 account, you provide your name, email address, Indonesian mobile number, date of birth, and preferred currency (IDR). This information forms the core of your member profile.
• KYC Verification: When you submit identity documents during the Know Your Customer process, we collect the data contained in those documents — including your full legal name, date of birth, identity number, and document images — to verify your eligibility to use the platform.
• Deposits and Withdrawals: Every time you make a financial transaction on opa89, we record the transaction amount, payment method (e.g., BCA transfer, GoPay), timestamp, and associated account identifiers to maintain an accurate financial ledger and comply with anti-money-laundering obligations.
• Platform Usage: We automatically collect Technical Data — including your IP address, device information, browser fingerprint, and session timestamps — each time you access the opa89 platform. This data is collected via server logs and first-party analytics tools.
• Cookies and Tracking Technologies: We place cookies and similar tracking technologies on your browser to maintain session state, remember your preferences, and analyze platform usage. See Section 9 for full details.
• Customer Support Interactions: When you contact opa89 via live chat, email ([email protected]), or WhatsApp, we retain a record of that communication to resolve your query, improve service quality, and maintain an audit trail for dispute resolution.
• Responsible Gaming Tools: If you set deposit limits, activate a cooling-off period, or request self-exclusion, we record those preferences as part of your account data to ensure they are enforced accurately and consistently.
• Promotions and Surveys: If you participate in an opa89 promotion or voluntary feedback survey, we may collect additional information you provide in that context, such as preferred game types or satisfaction ratings.

opa89 processes your Personal Data only for specified, explicit, and legitimate purposes. The table below maps each processing purpose to the data categories involved:

opa89 does not use your Personal Data for automated decision-making that produces legal or similarly significant effects without human oversight. Gaming outcomes are determined by certified RNG or live dealer mechanics — not by any profiling of your personal data.

opa89 relies on the following legal bases when processing your Personal Data:

• Contractual Necessity: The majority of processing we carry out is necessary to perform the contract we have with you as a registered member — including creating your account, processing transactions, and delivering gaming services. Without this processing, we cannot provide the platform.
• Legal Obligation: Certain processing activities — particularly KYC verification, AML record-keeping, and financial transaction logging — are required by applicable laws and regulations governing online gaming and financial services. We are obligated to conduct this processing regardless of individual consent.
• Legitimate Interests: We process Technical Data, Gaming Activity Data, and Communications Data to detect fraud, ensure platform security, improve our services, and resolve disputes. These legitimate business interests do not override your fundamental privacy rights.
• Consent: Where we send you optional promotional communications via email, WhatsApp, or SMS — including bonus offers, seasonal promotions tied to Indonesian holidays such as Idul Fitri or Imlek, and new game announcements — we rely on your explicit consent, which you may withdraw at any time by contacting support or updating your notification preferences in your account dashboard.

opa89 does not sell, rent, or trade your Personal Data to any third party for marketing or commercial purposes. We share your data only in the limited circumstances described below, and only to the minimum extent necessary:

• Payment Processors: To execute your deposit and withdrawal requests, we share your financial identifiers and transaction details with our Indonesian banking and e-wallet partners, including BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, OVO, DANA, GoPay, ShopeePay, and LinkAja. These institutions are subject to their own privacy and data security obligations under Indonesian financial services law.
• KYC Verification Partners: Identity documents and biometric selfie images submitted during KYC verification are processed by our certified third-party identity verification provider. This provider operates under a strict data processing agreement with opa89 and is prohibited from using your data for any purpose other than verification on our behalf.
• Game Software Providers: To deliver live casino, slots, togel, and other gaming content, limited technical identifiers (such as your session token and bet data) are shared with our licensed game studios including Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Pocket Games Soft, and Spribe. These studios are not provided with your full identity or financial data.
• Fraud Prevention and Security Services: We may share IP addresses, device fingerprints, and behavioral data with specialist fraud detection services to identify and prevent unauthorized access, bonus abuse, and money laundering activity.
• Legal and Regulatory Authorities: If required by a valid legal order, court ruling, or regulatory directive from a competent authority, opa89 may disclose Personal Data. We will notify you of any such disclosure to the extent permitted by applicable law.
• Corporate Transactions: In the event of a merger, acquisition, or sale of substantially all of opa89's business assets, member data may be transferred to the successor entity, subject to equivalent privacy protections. Affected members will be notified in advance of any such transfer.

opa89 retains Personal Data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. Our standard retention periods are as follows:

• Active Account Data: Retained for the full duration of your membership on opa89, plus a minimum period of five (5) years following account closure to satisfy anti-money-laundering record-keeping obligations.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction in accordance with applicable financial regulations.
• KYC Documents: Retained for a minimum of five (5) years following account closure. During this period, documents are stored in encrypted form with access restricted to compliance personnel only.
• Customer Support Communications: Retained for three (3) years from the date of the interaction. Communications related to a formal dispute or regulatory inquiry may be retained for longer.
• Technical and Session Data: Server logs and session-level Technical Data are retained for twelve (12) months, after which they are anonymized or deleted.
• Marketing Consent Records: Retained for the duration of your membership. If you withdraw consent for promotional communications, the record of your withdrawal is retained indefinitely to prevent accidental re-enrollment.
• Self-Exclusion Records: Records of self-exclusion requests are retained permanently to prevent the re-registration of a self-excluded member.

When Personal Data is no longer required, opa89 will securely delete or anonymize it in accordance with our internal data lifecycle management procedures.

Protecting your Personal Data is a core operational priority at opa89. We implement a layered security architecture that includes both technical and organizational safeguards:

• 256-Bit SSL Encryption: All data transmitted between your browser or device and the opa89 platform is encrypted using 256-bit SSL/TLS protocols. This applies to every page of the platform — login, deposit, withdrawal, live chat, and game sessions.
• Encrypted Data Storage: Sensitive Personal Data — including KYC document images, financial identifiers, and account credentials — is stored in encrypted form at rest on access-controlled servers. Encryption keys are managed separately from the data they protect.
• Access Controls: Internal access to member Personal Data is restricted on a strict need-to-know basis. Staff with authorized access are subject to confidentiality obligations and regular security training. Access logs are maintained and reviewed.
• Two-Factor Authentication: opa89 offers two-factor authentication (2FA) for member accounts. We strongly encourage all members to enable 2FA to add an additional layer of protection against unauthorized account access.
• Intrusion Detection: Our platform is monitored around the clock for suspicious activity, unauthorized access attempts, and anomalous betting patterns that may indicate account compromise or fraud.
• Penetration Testing: opa89 conducts regular independent security assessments and penetration tests to identify and remediate vulnerabilities before they can be exploited.

opa89 uses cookies and similar client-side technologies to operate the platform effectively and deliver a consistent member experience. By using the opa89 platform, you consent to the placement of cookies in accordance with this policy.

9.1 Types of Cookies We Use

• Strictly Necessary Cookies: These cookies are essential for the platform to function. They maintain your login session, remember your Wallet balance state, and enable core security features such as CSRF protection. You cannot opt out of strictly necessary cookies without ceasing to use the platform.
• Functional Cookies: These cookies remember your preferences — such as your preferred language setting, game lobby view, and notification settings — so you do not need to reconfigure them on each visit.
• Analytics Cookies: We use first-party analytics cookies to understand how members navigate the platform, which game categories attract the most engagement, and where technical friction points occur. This data is aggregated and anonymized; it is not linked back to individual member identities for marketing purposes.
• Security Cookies: These cookies help us detect and prevent fraudulent activity, including bot-driven account creation, automated bet placement, and session hijacking attempts.

9.2 Cookie Lifespan

Session cookies expire when you close your browser. Persistent functional and analytics cookies have a maximum lifespan of twelve (12) months, after which they expire automatically unless renewed by a return visit to the platform.

9.3 Managing Cookies

You may manage or delete cookies at any time through your browser's privacy settings. Please note that disabling functional or analytics cookies may affect the performance and personalization features of the opa89 platform. Disabling strictly necessary cookies will prevent you from logging in or using core platform features.

As an opa89 member, you hold the following rights with respect to your Personal Data. To exercise any of these rights, contact our support team via live chat, email, or WhatsApp. We will respond to all valid requests within 30 days:

• Right of Access: You may request a copy of the Personal Data opa89 holds about you at any time. We will provide this in a clear, structured format within 30 days of your request.
• Right to Rectification: If any of your Personal Data held by opa89 is inaccurate or incomplete, you have the right to request that it be corrected. Minor corrections (such as updating a phone number) can typically be made directly from your account dashboard.
• Right to Erasure: You may request the deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and no other legal basis applies. This right is subject to our legal obligation to retain certain data for a minimum of five years under financial services regulations.
• Right to Restrict Processing: You may request that we restrict our processing of your data in certain circumstances — for example, while we investigate the accuracy of data you have disputed, or while we assess a formal objection you have raised.
• Right to Data Portability: You may request that we provide your Personal Data in a structured, machine-readable format so that you can transfer it to another service provider, where technically feasible.
• Right to Object: You have the right to object to processing based on our legitimate interests at any time. Upon receipt of a valid objection, opa89 will cease the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent — in particular, promotional communications — you may withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

The opa89 platform is strictly restricted to individuals who are at least 21 years of age. We do not knowingly collect Personal Data from anyone under the age of 21. Our KYC verification process is specifically designed to detect and reject applications from individuals who do not meet this age requirement.

If opa89 becomes aware that Personal Data has been collected from a person under 21, we will immediately suspend the relevant account, delete the associated Personal Data (subject to any regulatory record-keeping obligations), and reverse any financial transactions associated with that account.

If you are a parent or guardian and you believe that a minor in your care has registered an account on opa89, please contact our support team immediately via live chat or WhatsApp. We will prioritize the investigation and closure of any account confirmed to belong to a minor.

The opa89 platform may, in certain contexts, reference or display content from third-party game studios and sports data providers as part of the gaming experience. This Privacy Policy applies solely to data collected and processed by opa89 directly. It does not govern the privacy practices of third-party software studios, payment processors, or data providers, each of which operates under its own privacy documentation.

opa89 exercises due diligence in selecting third-party partners and requires contractual commitments to data protection standards before any integration is approved. However, we cannot accept responsibility for the independent privacy practices of any third party beyond our contractual controls.

If you have concerns about how a specific third-party partner — such as a game studio or payment provider — handles your data, we recommend reviewing that party's own published privacy policy directly.

opa89 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, regulatory requirements, or the services we offer. When we make material changes — for example, introducing a new category of data collection or a new third-party processor — we will notify registered members via a platform notice and, where practicable, via email or WhatsApp at least 7 days before the change takes effect.

The "Last Updated" date displayed at the top of this page always reflects the most recent revision. Your continued use of the opa89 platform following the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree to any update, you may request account closure in accordance with the Terms & Conditions.

We encourage you to review this Privacy Policy periodically, particularly before making deposits or submitting KYC documentation, to ensure you remain comfortable with how your data is handled.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way opa89 handles your Personal Data, our dedicated support team is available around the clock through the following channels:

• Live Chat: Available 24/7 directly on the opa89 platform — the fastest channel for privacy inquiries, typically with a response time under 2 minutes.
• Email: [email protected] (plain text — not a clickable link). Email responses are provided within 24 hours.
• WhatsApp: +62 811 9889 89 — Indonesian-speaking agents available at all hours.

When contacting us about a data rights request, please include your registered email address and the nature of your request so we can verify your identity and respond efficiently. All privacy-related inquiries are handled with strict confidentiality by our compliance team.