ora87 Privacy Policy

Section 1

Introduction

This Privacy Policy describes how ora87 ("we", "us", "our") collects, uses, discloses, and safeguards personal data relating to individuals ("you", "your") who access or use the ora87 platform at ora87.cam, including all associated services, tools, and mobile-optimized interfaces (collectively, "the Platform").

We are committed to handling your personal data responsibly, transparently, and in accordance with internationally recognized data protection principles. This policy reflects our obligations under applicable data protection frameworks and our own internal data governance standards.

By registering an account on ora87, depositing funds, or otherwise using the Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this policy, you must stop using the Platform immediately.

Section 2

Data Controller

For the purposes of this Privacy Policy, the data controller responsible for your personal data is the operator of the ora87 platform. The data controller determines the purposes and means by which your personal data is processed.

All data rights requests, privacy complaints, and inquiries relating to this policy should be directed to our Data Protection contact using the details provided in Section 15 of this document. We have appointed a dedicated Data Protection Officer (DPO) responsible for overseeing our compliance with this policy and applicable data protection law.

Where ora87 engages third-party service providers to process personal data on its behalf — such as payment processors, identity verification partners, or analytics providers — those parties act as data processors under documented contractual agreements that restrict their use of your data to the specific purpose for which it was shared.

Section 3

Data We Collect

The categories of personal data we collect vary depending on how you interact with the Platform. The table below sets out the main data categories, examples, and the context in which each is collected.

We do not collect special category data (such as racial or ethnic origin, political opinions, religious beliefs, biometric data for the purpose of uniquely identifying you, or health data) except where strictly required for responsible gaming assessments and only with your explicit consent.

Section 4

How We Collect Data

ora87 collects personal data through the following primary channels:

• Direct submission: Data you provide when completing the registration form, submitting KYC documents, making a deposit or withdrawal request, contacting our support team, or participating in any survey or promotion.
• Automated technical collection: Data gathered automatically when you access the Platform, including IP addresses, device identifiers, and browser characteristics, collected via server logs, cookies, and similar tracking technologies (see Section 11).
• Third-party sources: Identity and fraud-risk data received from our KYC partner providers and fraud-screening services in the course of verifying your identity and assessing account risk. We may also receive updated contact or address information from payment processors where this is necessary to reconcile a transaction.
• Publicly available sources: In limited circumstances, we may supplement account data with information drawn from publicly available sources (such as sanctions lists or politically exposed persons registers) as part of our AML compliance obligations.

Section 5

Purposes & Legal Bases for Processing

We process your personal data only where we have a lawful basis for doing so. The table below maps our primary processing purposes to the corresponding legal basis.

Where we rely on legitimate interest as a legal basis, we conduct a balancing test to confirm that our interests are not overridden by your rights and freedoms. You may request a copy of any legitimate interest assessment we have conducted by contacting our DPO.

Section 6

Sharing Your Data

ora87 does not sell, rent, or trade your personal data. We share personal data only in the following circumstances, and only to the minimum extent necessary:

1. Payment processors and banking partners: Your financial data is shared with the relevant payment provider (e.g., BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay) solely to execute authorized deposits and withdrawals. These providers process your data under their own privacy policies and applicable Indonesian banking regulations.
2. KYC and identity verification providers: Your identity documents and personal details are shared with accredited third-party KYC service providers to fulfill our identity verification obligations. These providers are contractually bound to process your data only for verification purposes and to maintain equivalent security standards to our own.
3. Fraud prevention and AML screening services: Transactional data and identity data may be shared with fraud-screening and sanctions-checking services to protect the Platform and its users from financial crime.
4. Game content providers: Your session data and betting activity may be shared with licensed game studios (such as Evolution Gaming, Pragmatic Play, and Spribe) to the extent necessary to deliver their games, settle bets, and resolve disputes. These providers act as data processors under data processing agreements.
5. Analytics providers: Anonymized or pseudonymized usage data may be shared with analytics tools to help us understand how players use the Platform and improve our service. No directly identifying information is shared for analytics purposes.
6. Law enforcement and regulatory authorities: We will disclose personal data to government bodies, law enforcement agencies, or regulators where we are legally required to do so — for example, in response to a valid court order, AML reporting obligation, or regulatory inquiry.
7. Corporate transactions: In the event of a merger, acquisition, or sale of all or part of ora87's business, player data may be transferred to the acquiring entity, subject to equivalent privacy protections. Affected players will be notified prior to any such transfer.

Section 7

International Data Transfers

As an international gaming platform serving Indonesian players, some of the personal data we collect may be stored on, or transferred to, servers located outside Indonesia. This can occur when our infrastructure partners, cloud hosting providers, or game content studios operate in jurisdictions other than Indonesia.

Whenever personal data is transferred internationally, we take steps to ensure it receives an equivalent level of protection to that afforded within Indonesia. Our international transfer safeguards include:

• Data processing agreements containing standard contractual clauses that bind recipient parties to data protection obligations consistent with this policy.
• Transfers limited to jurisdictions that maintain adequate data protection frameworks recognized by relevant international standards bodies.
• Technical safeguards including end-to-end encryption for data in transit and encryption at rest on all servers holding personal data.

You may request further information about specific international transfer mechanisms applicable to your data by contacting our DPO at the address in Section 15.

Section 8

Data Retention

We retain your personal data only for as long as is necessary to fulfill the purposes described in this policy, or to comply with our legal, regulatory, or contractual obligations. The following retention periods apply as a baseline:

• Active account data: Retained for the duration of your account's active status, plus a further 5 years following account closure or termination.
• Financial transaction records: Retained for 7 years from the date of the transaction, in compliance with financial record-keeping obligations.
• KYC and identity documents: Retained for 5 years following account closure, or longer where required by AML regulations.
• Customer support communications: Retained for 3 years from the date of the last communication in a given support thread.
• Marketing preference data: Retained until you withdraw consent or close your account, plus a further 12 months for suppression list purposes.
• Technical and usage logs: Retained for 12 months on a rolling basis, then anonymized for long-term analytics use.

When data is no longer required, it is securely deleted or anonymized using industry-standard methods. We do not archive personal data indefinitely, and we conduct annual data audits to identify and purge records that have exceeded their retention period.

Section 9

Security Measures

ora87 implements a layered security architecture to protect your personal data against unauthorized access, accidental loss, destruction, or disclosure. Our security measures include, but are not limited to:

• Transport security: All data transmitted between your browser or app and our servers is encrypted using TLS 1.3 with 256-bit AES encryption. Our SSL certificates are maintained and renewed without interruption.
• Data at rest: Personal data stored on our infrastructure is encrypted at the database and file-system level. Encryption keys are managed separately from the encrypted data and rotated on a scheduled basis.
• Access controls: Access to systems holding personal data is restricted to authorized personnel only, enforced by role-based access control (RBAC), multi-factor authentication (MFA), and comprehensive audit logging of all access events.
• Penetration testing: Our platform undergoes scheduled independent penetration testing at least twice per year, with critical findings remediated within defined SLA windows.
• Incident response: We maintain a documented data breach response plan. In the event of a confirmed breach that is likely to result in a risk to your rights or freedoms, we will notify you and the relevant authority within the timeframes required by applicable law.
• Employee training: All ora87 personnel with access to personal data receive mandatory data privacy and security training upon onboarding and at annual refresher intervals.

Section 10

Your Data Rights

As a player on ora87, you hold the following rights in relation to your personal data. You may exercise any of these rights by contacting our DPO using the details in Section 15. We will acknowledge your request within 48 hours and provide a substantive response within 30 calendar days.

We will not charge a fee for exercising any of these rights unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable administrative fee or decline to act, notifying you of our reasons.

Section 11

Cookies & Tracking Technologies

ora87 uses cookies and similar tracking technologies (including local storage and pixel tags) to deliver, secure, and improve the Platform. Cookies are small data files placed on your device when you visit the Platform. We use four categories of cookies:

• Essential cookies are strictly necessary for the Platform to function. They maintain your login session, remember your language preference, and protect the Platform from CSRF attacks. These cookies cannot be disabled without breaking core functionality.
• Functional cookies remember your preferences — such as your preferred deposit method, odds display format, and notification settings — to provide a more personalized experience on return visits.
• Analytics cookies collect pseudonymized data about how you use the Platform (pages visited, features used, session duration) to help us identify performance issues and improve the user experience. No directly identifying information is used in analytics.
• Marketing cookies track your interactions with promotional content, both on and off the Platform, to help us display relevant offers and measure the effectiveness of our campaigns. Marketing cookies require your explicit opt-in consent.

You can manage non-essential cookie preferences through your browser settings at any time. Note that disabling functional or analytics cookies may affect your experience on the Platform. Most browsers allow you to view, delete, and block cookies via the browser's settings menu. Refer to your browser's documentation for specific instructions.

Section 12

Marketing Communications

With your consent, ora87 may send you promotional communications about new games, upcoming promotions, seasonal offers (such as those tied to Idul Fitri, Ramadhan, Chinese New Year/Imlek, Indonesian Independence Day, or major sporting events like Piala AFF or the FIFA World Cup), and other platform updates.

We communicate via the following channels, subject to your opt-in preferences:

• Email to your registered email address
• SMS to your registered Indonesian mobile number
• In-platform notifications within your logged-in session
• Push notifications, where you have permitted these via your device settings

You may opt out of marketing communications at any time by:

• Clicking the "unsubscribe" link in any marketing email.
• Updating your notification preferences in your Account settings.
• Contacting our support team via live chat or email with a clear opt-out request.

Opting out of marketing will not affect the delivery of transactional communications — such as withdrawal confirmations, security alerts, or policy update notices — which are sent as a necessary part of managing your account.

Section 13

Children & Minors

The ora87 Platform is strictly for adults aged 21 and over. We do not knowingly collect, store, or process personal data relating to individuals under the age of 21.

Our registration process includes an age declaration and we conduct age verification as part of KYC. Where we have reasonable grounds to suspect that an account holder is under 21, we will immediately suspend the account, initiate enhanced age verification, and — if the suspicion is confirmed — permanently close the account and delete all associated personal data that we are not legally required to retain.

If you are a parent or guardian and believe that your child under 21 has registered an account with ora87, please contact our support team immediately at [email protected]. We will investigate promptly and take all necessary remedial action within 48 hours of a confirmed report.

Section 14

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, platform features, or applicable law. When we make material changes, we will:

1. Update the "Effective Date" and version number at the top of this page.
2. Send a notification to your registered email address summarizing the key changes, at least 7 days before the updated policy takes effect.
3. Display a prominent in-platform notice for a minimum of 14 days following the change going live.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data. Your continued use of the Platform after the effective date of any amendment constitutes your acceptance of the revised policy. If you do not agree to the revised policy, you must stop using the Platform and may request account closure as described in our Terms & Conditions.

Minor non-material changes — such as correcting typographical errors or clarifying existing language without changing the substance of the policy — may be made without prior notification, and will be reflected in an updated version number on the document.

Section 15

Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to raise a data-related complaint, please contact our Data Protection Officer through the following channels:

• Email: [email protected] — please include "Data Privacy Request" or "Privacy Complaint" in the subject line to ensure prompt routing to the DPO.
• Live Chat: Available 24/7 via the in-platform live chat. For data rights requests, our support team will route your query to the DPO and provide you with a reference number.

We will acknowledge your request within 48 hours of receipt and provide a substantive response within 30 calendar days. For complex requests, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason before the initial 30-day deadline expires.

If you are not satisfied with our response to a privacy complaint, you have the right to escalate your complaint to the relevant data protection authority or supervisory body in your jurisdiction. For Indonesian residents, this includes escalation through applicable national consumer protection or data protection channels.