Privacy Policy — ova89

ova89 ("we", "us", "our") operates the online gaming platform accessible at https://ova89.cam and is committed to protecting and respecting the privacy of every individual ("you", "Member", "visitor") who interacts with our platform. This Privacy Policy ("Policy") sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed.

This Policy should be read alongside our Terms & Conditions, which govern the overall relationship between you and ova89. Where this Policy uses terms defined in the Terms & Conditions, those definitions apply here equally. If you have any questions about how we handle your personal data, please contact our privacy team at [email protected] before using the platform.

ova89 serves members primarily located across Indonesia — including Jakarta, Surabaya, Medan, Bandung, Yogyakarta, Bali, Semarang, Makassar, and Palembang — and processes personal data in accordance with internationally recognized data-protection principles, including purpose limitation, data minimization, accuracy, storage limitation, integrity, and confidentiality.

ova89 collects the following categories of personal data, depending on your interaction with the platform:

Identity & Contact Data:

• Full legal name, date of birth, and gender as stated on your government-issued identity document.
• Residential address, province, and postal code within Indonesia.
• Email address and Indonesian mobile phone number registered to your account.
• Username and encrypted password credentials.

Financial Data:

• Bank account name, account number, and bank name (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, or Bank Permata) linked to your account for withdrawal processing.
• E-wallet identifiers for OVO, DANA, GoPay, ShopeePay, or LinkAja where used for deposits or withdrawals.
• Transaction history including deposit amounts, withdrawal requests, bet history, and bonus activity, denominated in Indonesian Rupiah (IDR).

Identity Verification (KYC) Data:

• Copies of government-issued photo identification (National Identity Card / KTP, passport, or driver's license).
• Proof of residential address documents where required.
• Selfie or liveness-check image where required for enhanced verification.

Technical & Usage Data:

• IP address, device type, operating system, browser type, and version.
• Geolocation data (country and region level) derived from your IP address.
• Session timestamps, pages visited, features accessed, and betting activity logs in WIB (Western Indonesia Time, UTC+7).
• Referral source and marketing attribution data if you arrived via a tracked link.

ova89 collects personal data through the following channels:

• Direct Submission: Information you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting customer support, or responding to surveys and promotions.
• Automated Collection: Technical and usage data collected automatically through cookies, web server logs, and analytics tools as you navigate the platform. See Section 9 (Cookies & Tracking) for full details.
• Payment Processors: Transaction confirmation data received from Indonesian banking partners and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) when you make deposits or request withdrawals.
• Identity Verification Partners: Where ova89 uses a third-party KYC service provider to verify identity documents, that provider may return verification status data to us. The provider's own privacy policy governs their processing of your documents during the verification process.
• Fraud Prevention Services: Risk-scoring and device fingerprint data from fraud detection partners to identify and prevent account abuse, money laundering, and unauthorized access.

The table below sets out the specific purposes for which ova89 processes your personal data, along with the category of data used for each purpose.

ova89 processes your personal data only where a valid legal basis exists. The four legal bases we rely on are as follows:

• Contractual Necessity: Processing required to fulfill the services you have contracted with ova89 — including account management, bet settlement, and payment processing. Without this processing, we cannot provide the platform services.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including KYC identity verification, anti-money-laundering (AML) reporting obligations, and responsible gaming monitoring requirements.
• Legitimate Interest: Processing where ova89 has a genuine and proportionate business interest, such as fraud prevention, platform security, product improvement, and analytics — provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing based on your freely given, specific, and informed consent — most notably for optional promotional and marketing communications. You may withdraw consent at any time by contacting [email protected] or by using the unsubscribe mechanism in any marketing email.

ova89 does not sell, rent, or trade personal data. We share personal data only in the following limited circumstances, and only to the extent strictly necessary for the stated purpose:

• Payment Processors: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the financial data necessary to process your deposit and withdrawal requests.
• KYC & Identity Verification Providers: Where automated document verification is used, your KYC documents are processed by a contracted third-party provider operating under a data-processing agreement with ova89. The provider is prohibited from using your data for any purpose other than the verification service.
• Fraud Prevention & Security Vendors: Risk-assessment and device-fingerprinting partners receive technical and usage data to help us identify and prevent unauthorized account access, bonus abuse, and financial crime.
• Game Content Providers: Game studios (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft) may receive anonymized session identifiers to facilitate gameplay and record bet outcomes. They do not receive your full identity or financial data.
• Legal and Regulatory Authorities: ova89 will disclose personal data to law enforcement, regulatory bodies, or other competent authorities when legally required to do so, or when disclosure is necessary to protect the safety of our members or the integrity of the platform.
• Corporate Transactions: In the event of a merger, acquisition, or sale of substantially all of ova89's assets, personal data held by ova89 may be transferred to the successor entity, subject to equivalent privacy protections.

ova89 retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, subject to applicable legal retention requirements. The following retention periods apply:

• Active Account Data: Retained for the full duration of your membership plus 5 years following account closure, to meet anti-money-laundering and financial record-keeping obligations.
• KYC Documents: Retained for 5 years from the date of submission or from the date of account closure, whichever is later, in accordance with financial crime prevention requirements.
• Transaction Records: Deposit, withdrawal, and betting history retained for 5 years post-transaction for regulatory compliance and dispute-resolution purposes.
• Customer Support Correspondence: Retained for 3 years from the date of the last interaction to support dispute resolution and service-quality monitoring.
• Marketing Preferences: Retained until you withdraw consent or request deletion. Suppression records (recording that you opted out) are kept indefinitely to ensure we do not inadvertently re-contact you.
• Technical Logs: Server access logs and security event logs retained for 12 months, after which they are anonymized or deleted.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in a manner that prevents reconstruction of the original data.

ova89 implements a comprehensive, layered security framework to protect member data against unauthorized access, disclosure, alteration, and destruction. Our security measures include, but are not limited to:

• Transport Encryption: All data transmitted between your browser and our servers is protected using TLS 1.2 or higher (256-bit SSL encryption), indicated by the padlock icon in your browser.
• Data-at-Rest Encryption: Sensitive stored data — including identity documents, payment details, and password hashes — is encrypted using AES-256 encryption.
• Access Controls: Internal access to member personal data is restricted to authorized personnel on a strict need-to-know basis, enforced by role-based access control (RBAC) and multi-factor authentication (MFA).
• Penetration Testing: The ova89 platform undergoes regular independent security assessments and penetration tests to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: ova89 maintains a documented data-breach incident-response plan. In the event of a confirmed breach affecting member data, we will notify affected Members promptly and take all reasonable steps to contain and remediate the incident.

ova89 uses cookies and similar technologies to ensure the platform functions correctly, to remember your session preferences, and to analyze aggregate usage patterns. We do not use third-party advertising cookies or share cookie data with external marketing networks.

• Strictly Necessary Cookies: Essential for the platform to operate. These enable core functions such as session management, login state, and security token validation. They cannot be disabled without significantly impairing the platform experience.
• Functional Cookies: Remember your preferences — such as language display settings and last-visited game categories — to provide a more personalized experience during your session.
• Analytics Cookies: Collect anonymized, aggregated data about how Members navigate the platform (pages visited, time on page, entry and exit points) to help us improve the user experience. Individual Member behavior is not profiled or shared.
• Security Cookies: Support fraud detection and account security functions, including session integrity checks and device recognition for repeat-login users.

You may manage or disable cookies at any time through your browser settings. Please note that disabling strictly necessary cookies will prevent you from logging in and accessing account features. For instructions on managing cookies in your specific browser, refer to your browser's help documentation.

As a Member of ova89, you hold the following rights with respect to your personal data. To exercise any of these rights, submit a written request to [email protected] from your registered email address. We will respond within 10 business days and process requests free of charge.

ova89 strictly prohibits access to and use of its platform by individuals under the age of 21. We do not knowingly collect personal data from anyone under 21 years of age. Age verification is a mandatory step in our account registration and KYC process.

If ova89 discovers or is notified that personal data has been collected from an individual under 21, we will immediately suspend the associated account, delete all personal data linked to that account (subject to any legal retention obligations relating to the activity that occurred), and, where appropriate, refer the matter to relevant authorities.

ova89 primarily processes and stores member data on servers located in jurisdictions with adequate data-protection frameworks. In certain circumstances — such as when using globally operated third-party services like game studio platforms or fraud-prevention tools — personal data may be transferred to and processed in countries outside Indonesia.

Where such transfers occur, ova89 ensures that appropriate safeguards are in place, including contractual data-protection clauses with the recipient organization, to provide a level of protection for your data equivalent to the standards described in this Policy. By using the ova89 platform, you acknowledge and consent to such international transfers occurring as necessary to deliver the services you have requested.

ova89 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data-processing practices, applicable law, or platform features. When material changes are made, we will notify Members by email to their registered address or by posting a prominent notice on the platform at least 7 days prior to the changes taking effect.

The date of the most recent revision is displayed at the top of this page. We encourage you to review this Policy periodically. Your continued use of the platform following the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not agree with any changes, you should discontinue use and contact us to arrange account closure.

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way in which ova89 handles your personal data, please contact our privacy team using the details below. We are committed to resolving all privacy-related enquiries promptly and transparently.

If you are not satisfied with our response to your privacy complaint, you retain the right to escalate your concern to the appropriate data protection authority in your jurisdiction. ova89 will cooperate fully with any such regulatory inquiry. We view every privacy complaint as an opportunity to improve our data-handling practices and take all feedback seriously.