Privacy Policy — opa89

This Privacy Policy ("Policy") describes how opa89 ("we", "us", "our", or "the Company") collects, uses, stores, shares, and protects the personal data of individuals ("you", "your", or "User") who access or use the opa89 platform at opa89.cam ("Platform"). It applies to all services offered through the Platform, including sports betting, live casino, togel (Indonesia's traditional numbers lottery), slots, and all associated account, payment, and support functions.

By creating an account or otherwise using the Platform, you acknowledge that you have read and understood this Policy and consent to the data practices described herein. If you do not agree with this Policy, you must discontinue use of the Platform immediately. This Policy should be read alongside our Terms & Conditions.

The following defined terms apply throughout this Policy:

• "Personal Data" means any information that identifies or could reasonably identify a natural person, directly or indirectly, including name, identification number, location data, online identifier, or factors specific to the physical, economic, or social identity of that person.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, or deletion.
• "Data Controller" means the entity that determines the purposes and means of Processing Personal Data — in this context, opa89.
• "Data Processor" means any third party that processes Personal Data on behalf of opa89 under a contractual obligation (e.g., payment processors, KYC verification providers, cloud hosting services).
• "KYC" means Know Your Customer — the identity and age verification process required before withdrawals are processed.
• "AML" means Anti-Money Laundering — compliance procedures designed to detect and prevent the use of the Platform for financial crime.
• "Cookies" means small text files placed on your device by the Platform to enable session management, security, and analytics functions.

This Policy applies to all Personal Data collected through:

• The opa89 website at opa89.cam and all sub-domains operated by opa89.
• Any mobile-optimized versions of the Platform.
• Communications between you and opa89's customer support team via email or live chat.
• Participation in any promotional, bonus, or loyalty program offered by opa89.

opa89 acts as the Data Controller for all Personal Data collected through the Platform. We are an internationally operated entity serving English-preference players across Indonesia. Where we engage third-party Data Processors, we do so under written data processing agreements that require those processors to apply data protection standards consistent with this Policy.

opa89 collects Personal Data in the following categories, depending on how you interact with the Platform:

3.1 Registration Data

• Full legal name
• Date of birth (to verify the 21+ age requirement)
• Residential address in Indonesia
• Email address
• Chosen username and hashed password
• Mobile phone number (where provided for two-factor authentication)

3.2 Identity Verification (KYC) Data

• Government-issued photo identification (e.g., Indonesian KTP — Kartu Tanda Penduduk — or passport)
• Proof of residential address (utility bill, bank statement, or official correspondence)
• Proof of payment method ownership (e.g., screenshot of BCA, BRI, BNI, Mandiri, CIMB Niaga, or BSI account screen showing name and account number)
• Selfie photograph or video verification image, where required by the compliance team

3.3 Financial & Transaction Data

• Deposit and withdrawal amounts in Indonesian Rupiah (IDR / Rp)
• Bank account numbers and e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja) used for transactions
• International card details (Visa, Mastercard) processed via PCI-DSS compliant payment gateways — opa89 does not store full card numbers
• Transaction history and timestamps
• Source-of-funds documentation where requested under AML procedures

3.4 Betting & Gaming Activity Data

• Wager history, stake amounts, and settlement outcomes
• Games and sports markets accessed
• Bonus and promotion usage records
• Session durations and login timestamps
• Responsible gaming tool configurations (deposit limits, self-exclusion status)

3.5 Technical & Device Data

• IP address and inferred geolocation
• Browser type, version, and operating system
• Device identifiers (where applicable)
• Referring URL and pages visited within the Platform
• Cookie data (see Clause 7)

3.6 Communications Data

• Email correspondence with the support team
• Live chat transcripts
• Complaints and feedback submissions

opa89 processes your Personal Data for the following specific purposes:

opa89 does not use your Personal Data for automated individual decision-making that produces legal or similarly significant effects without human oversight, except where required by fraud prevention or AML compliance obligations.

opa89 relies on the following legal bases when processing your Personal Data:

• Contractual Necessity: Processing is necessary to perform our contract with you — specifically, to create and maintain your account, process deposits and withdrawals, settle wagers, and deliver the services described in our Terms & Conditions.
• Legal Obligation: Processing is required to comply with applicable legal obligations, including KYC identity verification, AML reporting, and fraud prevention requirements imposed by the jurisdiction in which opa89 holds its operating license.
• Legitimate Interests: Processing is necessary for opa89's legitimate business interests, including fraud detection, platform security, abuse prevention, responsible gaming monitoring, and service improvement — provided those interests do not override your fundamental rights.
• Consent: For certain non-essential processing activities (such as sending promotional communications about new bonuses or seasonal offers tied to Indonesian events like Idul Fitri or Ramadhan), we rely on your explicit consent. You may withdraw this consent at any time by contacting support.

opa89 does not sell your Personal Data. We share data only in the following limited circumstances:

• Payment Processors: Transaction data is shared with payment gateway providers facilitating deposits and withdrawals via BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, OVO, DANA, GoPay, ShopeePay, LinkAja, Visa, and Mastercard. These processors are bound by their own data security obligations (including PCI-DSS for card processing).
• KYC / Identity Verification Providers: Where opa89 uses a third-party identity verification service, KYC documents are transmitted to that provider under a data processing agreement. Providers are required to process documents solely for verification purposes and to delete them after the retention period.
• Game Software Providers: Wager and session data may be shared with licensed game studios (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Pocket Games Soft, and Spribe) to the minimum extent required for game delivery, fairness auditing, and dispute resolution.
• Cloud Infrastructure Providers: opa89 uses third-party cloud hosting and content delivery services. These providers process data on our behalf and are contractually restricted from using that data for their own purposes.
• Legal Authorities: We may disclose Personal Data to law enforcement, regulatory bodies, or courts when required to do so by law, court order, or in connection with the prevention of fraud, money laundering, or other illegal activity.
• Corporate Transactions: In the event of a merger, acquisition, or sale of assets, Personal Data may be transferred to the acquiring entity, subject to the same privacy protections described in this Policy.

opa89 uses cookies and similar technologies to enable core platform functionality and to protect the security of your account. We categorize our cookie use as follows:

opa89 does not deploy third-party advertising cookies, behavioral tracking pixels, or social media tracking scripts on the Platform. You can manage cookie preferences through your browser settings. Note that disabling Essential or Security cookies will prevent you from logging in to your account.

opa89 retains Personal Data only for as long as necessary to fulfill the purpose for which it was collected, or to satisfy applicable legal, regulatory, or compliance obligations. The following retention schedule applies:

Upon expiry of the relevant retention period, Personal Data is securely deleted or irreversibly anonymized. Where anonymization is not technically feasible, data is pseudonymized and access-restricted pending scheduled deletion.

As a User of the opa89 Platform, you hold the following rights in respect of your Personal Data. To exercise any of these rights, please contact us using the details in Clause 14.

• Right of Access: You may request a copy of all Personal Data that opa89 holds about you. We will respond within 30 days of receiving a verified request.
• Right to Rectification: If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request correction. For account details, many fields can be updated directly via Account Settings.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purpose it was collected. Note that this right is subject to our legal retention obligations — we cannot delete data we are required to retain for AML or regulatory compliance purposes.
• Right to Restriction of Processing: In certain circumstances (e.g., where you contest the accuracy of data, or object to processing on the basis of legitimate interests), you may request that we restrict Processing to storage only while the matter is resolved.
• Right to Data Portability: You may request that we provide your Personal Data in a structured, commonly used, machine-readable format (e.g., JSON or CSV) for transfer to another service provider where technically feasible.
• Right to Object: You may object to Processing based on legitimate interests or for direct marketing purposes at any time. Where you object to marketing, we will cease that Processing immediately.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

opa89 implements a layered set of technical and organizational measures to protect your Personal Data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• Encryption in Transit: All data transmitted between your browser/app and our servers is encrypted using TLS 1.2 or higher (256-bit SSL). This applies to registration, login, payment, KYC document upload, and all other data exchanges.
• Encryption at Rest: Sensitive data fields (passwords, KYC document files, payment identifiers) are encrypted at rest using industry-standard algorithms. Passwords are stored as salted hashes and are never readable in plain text by opa89 staff.
• Access Controls: Access to Personal Data is restricted on a strict need-to-know basis. Staff access rights are role-based, regularly reviewed, and revoked upon role change or departure.
• Two-Factor Authentication: opa89 supports two-factor authentication (2FA) for account login. Users are encouraged to enable 2FA from their Account Settings.
• Vulnerability Management: Our security team conducts regular vulnerability assessments and penetration testing. Critical patches are applied on an expedited schedule.
• Incident Response: In the event of a data breach that affects your Personal Data, opa89 will notify affected Users and relevant authorities within the timeframes required by applicable law.

While opa89 takes all reasonable precautions, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your account password and for ensuring your own device security.

The Platform may contain references to third-party game providers (such as Pragmatic Play, Evolution Gaming, or Spribe), payment networks (Visa, Mastercard), or e-wallet services (OVO, DANA, GoPay). Where interaction with these services occurs through interfaces hosted by those third parties rather than directly within the opa89 Platform, those third parties' own privacy policies will govern the handling of your data.

opa89 is not responsible for the privacy practices of third-party platforms, websites, or services. We encourage you to review the privacy policies of any third-party services you interact with in connection with your use of the Platform.

opa89 strictly enforces a minimum age requirement of 21 years for all Platform users. The Platform is not directed at, and does not knowingly collect Personal Data from, any individual under the age of 21.

If opa89 discovers or has reasonable grounds to believe that Personal Data has been collected from a person under 21, the relevant account will be immediately suspended, all wagers will be voided, and the Personal Data will be deleted or returned in accordance with our KYC and legal obligations. Parents or guardians who believe a minor has accessed the Platform should contact us immediately at [email protected]. For guidance on parental control tools and responsible gaming resources, please visit our Responsible Gaming page.

opa89 reserves the right to update or revise this Privacy Policy at any time. The most current version is always available at opa89.cam/privacy-policy, and the "Last Updated" date at the top of this document will reflect the date of any material change.

Where changes are material — for example, a new category of data collection, a new third-party sharing arrangement, or a change to retention periods — opa89 will notify you via the email address registered on your account at least 14 days before the revised Policy takes effect. Your continued use of the Platform after the effective date of any revision constitutes your acceptance of the updated Policy. If you do not accept the changes, you must discontinue use of the Platform and request account closure before the effective date.

For all privacy-related inquiries, data subject rights requests, or concerns about how opa89 handles your Personal Data, please reach our dedicated privacy team using the contact details below. All communications must be in English or Indonesian.

• Privacy & Data Requests Email (plain text — not a link): [email protected]
• Subject Line: Please include "Privacy Request — [Your Account Email]" in the subject line to ensure your message reaches the correct team.
• Support Hours: 24/7 — Indonesian-speaking agents available at all times (WIB, UTC+7).
• Response Commitment: Privacy rights requests will be acknowledged within 5 business days and resolved within 30 calendar days. General privacy inquiries are typically answered within 60 minutes during standard operating hours.
• Identity Verification for Rights Requests: To protect your data, opa89 will verify your identity before processing any data subject rights request . We may ask you to confirm details associated with your account (such as registered email address or last deposit amount) before actioning your request.