Clause 1
Definitions
In this Privacy Policy, the following terms carry the meanings set out below. Reading these definitions carefully will help you understand how oja98 refers to you, your data, and the systems involved in processing it throughout this document.
| Term |
Meaning |
| "oja98" / "We" / "Us" / "Our" |
The online casino and sportsbook platform operated under the oja98 brand at https://oja98.com, including all services, features, and sub-pages accessible through that domain. |
| "You" / "Member" / "User" |
Any individual who visits, registers on, or otherwise interacts with the oja98 platform, whether as a guest visitor, a registered Member, or a prospective applicant for membership. |
| "Personal Data" |
Any information that, alone or in combination with other data, can identify you as an individual — including your name, email address, mobile number, date of birth, payment account details, device identifiers, and IP address. |
| "Processing" |
Any operation performed on Personal Data, including collection, storage, use, disclosure, transmission, alteration, deletion, or any other handling of such data. |
| "KYC Data" |
Identity and address verification documents submitted by a Member as part of the Know Your Customer process, including government-issued photo identification (such as a KTP — Indonesian National Identity Card) and proof of residential address. |
| "Platform" |
The oja98 website, mobile-optimized interface, and any associated applications or services accessible at https://oja98.com. |
| "Third-Party Processor" |
Any external organization engaged by oja98 to process Personal Data on our behalf, such as payment processors, identity verification providers, fraud detection vendors, and analytics services — each bound by contractual data protection obligations. |
Clause 2
Personal Data We Collect
oja98 collects only the personal data that is reasonably necessary to provide our services, comply with legal obligations, and maintain a safe and fair gaming environment. The categories of personal data we collect are set out below, along with the context in which each category is gathered.
Registration & Account Data
- Full legal name — required to create your account and to verify your identity during KYC review.
- Date of birth — required to confirm that you meet the minimum age requirement of 21 years. 21+ Only
- Email address — used for account communications, promotional messages (where consented), and password recovery.
- Indonesian mobile number — used for two-factor authentication (2FA) and account security notifications.
- Username and encrypted password hash — stored to authenticate your login sessions. oja98 never stores your password in plain text.
KYC & Identity Verification Data
- Government-issued photo ID — Indonesian KTP, passport, or equivalent document showing your full name, date of birth, and photograph.
- Proof of address — utility bill, bank statement, or official correspondence dated within the last three months showing your residential address in Indonesia.
- Payment method verification — confirmation that the bank account, e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja), or cryptocurrency address used for deposits is registered in your own name.
Financial & Transaction Data
- Deposit and withdrawal amounts, timestamps, and transaction reference numbers.
- Bank account identifiers (account name, partial account number) for local Indonesian bank transfers via BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, and Bank Permata.
- E-wallet account identifiers (display name and linked mobile number) for OVO, DANA, GoPay, ShopeePay, and LinkAja transactions.
- Cryptocurrency wallet addresses used for USDT, BTC, or ETH deposits and withdrawals. Private keys are never collected or stored.
Behavioral & Usage Data
- Game play history — game titles played, bet amounts, session duration, win/loss outcomes.
- Sportsbook activity — markets viewed, bets placed, odds accepted, settlement outcomes.
- Session data — login timestamps, session duration, pages visited, navigation sequences.
- Responsible gaming tool usage — deposit limits set, cooling-off periods applied, self-exclusion requests submitted.
Technical & Device Data
- IP address and approximate geolocation (country and city level — used for jurisdiction compliance, not precise tracking).
- Device type, operating system, and browser version.
- Cookie identifiers and session tokens — see Clause 7 for full cookie details.
Clause 3
How We Collect Your Data
oja98 collects personal data through three primary channels:
- Directly from you: When you complete the registration form, submit KYC documents, make a deposit or withdrawal request, contact our support team, or respond to a promotional survey, you are providing data directly to oja98.
- Automatically during platform use: Our servers, analytics tools, and fraud detection systems automatically record behavioral and technical data as you browse the platform, play games, and interact with sportsbook markets. This includes cookie-based tracking and server-side logging.
- From Third-Party Processors: Where you authenticate via a third-party payment provider (e.g., completing an OVO or GoPay payment), that provider may share transaction confirmation data with oja98 to reconcile your deposit. Identity verification services may return a pass/fail result based on the documents you submit to them directly.
💡 Note: oja98 does not purchase personal data from data brokers or marketing list providers. Every piece of data we hold about you originated from your own interaction with the platform or from a service directly connected to your oja98 account activity.
Clause 4
Legal Basis for Processing
oja98 processes your personal data on one or more of the following legal bases, depending on the nature and purpose of each processing activity:
| Legal Basis |
Applicable Processing Activities |
| Contractual Necessity |
Creating and managing your account; processing deposits and withdrawals; settling bets and game outcomes; providing customer support. Without this processing, oja98 cannot deliver its services to you. |
| Legal Obligation |
KYC identity verification; anti-money-laundering (AML) transaction monitoring; age verification (21+); record-keeping required under our international operating license; responding to lawful requests from regulatory authorities. |
| Legitimate Interests |
Fraud detection and prevention; platform security monitoring; improving product features based on anonymized usage analytics; detecting and investigating bonus abuse or collusion. |
| Consent |
Sending promotional emails, bonus offers, and seasonal marketing communications (e.g., Ramadhan specials, Indonesian Independence Day promotions). You may withdraw consent at any time by clicking "Unsubscribe" in any marketing email or by contacting support. |
Clause 5
How We Use Your Personal Data
oja98 uses your personal data exclusively for the following documented purposes. We do not use personal data for any purpose beyond those listed here without first updating this Privacy Policy and, where required, obtaining your consent.
- Account Management: Creating, maintaining, and securing your oja98 account; authenticating your login sessions; processing account closure requests.
- Payment Processing: Verifying deposit instructions, processing withdrawals to your registered bank account or e-wallet, reconciling cryptocurrency transactions, and issuing Rupiah (IDR) refunds where applicable.
- Identity & Age Verification: Confirming that you are at least 21 years of age and that your account details match your submitted KYC documents, in compliance with our licensing obligations.
- Fraud & AML Monitoring: Analyzing transaction patterns and behavioral signals to detect unauthorized account access, payment fraud, money laundering, and bonus abuse. Suspicious activity may be reported to relevant authorities.
- Customer Support: Responding to your support requests via live chat or email, investigating complaints, and maintaining records of dispute resolution outcomes.
- Responsible Gaming: Monitoring account activity for signs of problem gambling behavior; applying deposit limits, cooling-off periods, or self-exclusion at your request or, in exceptional cases, on a protective basis.
- Product Improvement: Using aggregated, anonymized behavioral data to improve game recommendations, optimize platform performance, and inform decisions about new features or markets.
- Marketing Communications: Sending you personalized bonus offers, seasonal promotions, and platform news via email, where you have consented to receive such communications.
- Legal Compliance: Maintaining records as required by our operating license, responding to court orders or regulatory inquiries, and cooperating with law enforcement where legally required.
Clause 6
Data Sharing & Third-Party Disclosure
oja98 does not sell, rent, or trade your personal data. We share personal data with third parties only in the limited circumstances described below, and only to the minimum extent necessary for the stated purpose.
- Payment Processors & Banking Partners: When you deposit or withdraw via BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, or LinkAja, transaction data is shared with the relevant financial institution solely to execute the payment. These partners are subject to their own data protection obligations under Indonesian financial regulations.
- Identity Verification Providers: KYC documents are processed by our contracted identity verification partner(s). These providers receive only the documents and data necessary to perform verification and return a pass/fail result; they do not retain your documents beyond their own stated retention period.
- Game Studio Providers: Game providers such as Pragmatic Play, Evolution Gaming, PG Soft (Pocket Games Soft), NetEnt, Microgaming, and Spribe receive a session token and anonymous player identifier to launch game sessions. They do not receive your name, email, payment details, or any directly identifying personal data.
- Fraud Detection & Security Vendors: Anonymized or pseudonymized behavioral and technical data (including IP addresses and device fingerprints) may be processed by fraud detection tools operating on oja98's behalf under strict data processing agreements.
- Regulatory Authorities & Law Enforcement: oja98 will disclose personal data to licensing authorities, financial intelligence units, or law enforcement agencies where required to do so by applicable law, court order, or our licensing obligations — and only to the extent required.
- Corporate Transactions: In the event of a merger, acquisition, or sale of substantially all of oja98's assets, personal data held by oja98 may be transferred to the acquiring entity, subject to equivalent data protection commitments.
⚠️ Important: oja98 will never share your personal data with third-party marketers, advertising networks, or data brokers for the purpose of targeting you with advertisements unrelated to oja98's own services. Any marketing communications you receive from oja98 directly are based solely on your own account data and preferences.
Clause 7
Cookies & Tracking Technologies
oja98 uses cookies and similar tracking technologies to deliver a functional, personalized, and secure platform experience. The table below describes the categories of cookies used, their purpose, and their typical retention period.
| Cookie Category |
Purpose |
Retention |
| Strictly Necessary |
Maintaining your login session, securing your account during active gameplay, and enabling core platform functionality. These cookies cannot be disabled without preventing the platform from functioning. |
Session / up to 24 hours |
| Functional |
Remembering your language preferences, game display settings, and responsible gaming configuration (e.g., session time limit reminders) between visits. |
Up to 12 months |
| Analytics |
Collecting anonymized data about how Members navigate the platform — which pages are visited most, where users exit the funnel, and how game categories perform — to inform product improvements. |
Up to 24 months |
| Fraud & Security |
Assigning a device fingerprint to detect anomalous login behavior, identify account sharing, and flag suspicious transaction patterns before they cause harm to your account. |
Up to 6 months |
You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will impair or prevent access to your oja98 account. Disabling analytics or functional cookies will not prevent you from using the platform but may result in a less personalized experience.
Clause 8
Data Security
oja98 applies industry-standard technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, alteration, or disclosure. Our security framework includes the following controls:
- 256-bit SSL/TLS Encryption: All data transmitted between your device and oja98's servers is encrypted in transit using TLS 1.2 or higher. The oja98 platform enforces HTTPS on all pages — unencrypted HTTP connections are automatically redirected.
- Password Hashing: Member passwords are never stored in plain text. We apply a modern, salted cryptographic hashing algorithm to all passwords before storage, ensuring that even in the event of an unauthorized database access, your actual password cannot be recovered.
- Two-Factor Authentication (2FA): oja98 supports and strongly recommends two-factor authentication for all Member accounts. When enabled, logging in requires both your password and a one-time code delivered to your registered Indonesian mobile number.
- Access Controls: Access to systems that process personal data is restricted to oja98 staff with a documented operational need. Access rights are reviewed periodically and revoked promptly when an employee's role changes or their employment ends.
- Penetration Testing & Security Audits: oja98's technical infrastructure undergoes periodic security assessments by qualified third-party professionals to identify and remediate vulnerabilities before they can be exploited.
- Incident Response: In the event of a data breach that poses a risk to your rights and freedoms, oja98 will notify affected Members and the relevant regulatory authority within the timeframe required by our licensing obligations. Notifications will be sent to the email address registered on your account.
✅ Your Role in Security: Strong account security is a shared responsibility. oja98 strongly recommends that all Members use a unique, complex password for their oja98 account (not reused from any other service), enable 2FA, and never share their login credentials with anyone — including individuals claiming to represent oja98 support. oja98 support agents will never ask for your password.
Clause 9
Data Retention
oja98 retains personal data for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable law and our international operating license. The following retention periods apply to the main categories of data we hold:
| Data Category |
Retention Period |
Reason |
| Account & Registration Data |
Duration of account + 5 years post-closure |
Licensing obligation; dispute resolution; AML record-keeping. |
| KYC Documents |
5 years from date of submission |
Anti-money-laundering compliance; licensing authority audit requirements. |
| Transaction Records |
5 years from transaction date |
Financial record-keeping; AML reporting; dispute evidence. |
| Game & Betting History |
3 years from the date of each session |
Dispute resolution; responsible gaming monitoring; licensing compliance. |
| Support Communications |
3 years from last interaction |
Complaint record-keeping; quality assurance; dispute resolution. |
| Marketing Consent Records |
Until consent is withdrawn + 1 year |
Evidence of consent; regulatory compliance. |
| Analytics / Behavioral Data |
Up to 24 months (anonymized) |
Product improvement; performance analysis. Anonymized data may be retained indefinitely. |
Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized in accordance with our internal data lifecycle procedures. Account closure requests do not result in immediate deletion of data subject to a legal retention obligation — we will retain only what we are legally required to keep and delete the remainder promptly.
Clause 10
Your Privacy Rights
As an oja98 Member, you have the following rights with respect to the personal data we hold about you. To exercise any of these rights, please contact our support team via live chat or at [email protected] — we will respond within 30 days of receiving your request.
- Right of Access: You may request a copy of all personal data oja98 holds about you, including the categories of data, the purposes for which it is processed, and any third parties with whom it has been shared.
- Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or update it. You may also update basic account information (such as your email address or mobile number) directly from your account settings.
- Right to Erasure: You may request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, or where you withdraw the consent on which processing was based. This right is subject to our legal retention obligations — data we are required to retain under our operating license cannot be deleted before the applicable retention period expires.
- Right to Restrict Processing: You may request that we pause the processing of your personal data in certain circumstances — for example, while you contest the accuracy of data we hold, or while you await the outcome of an objection to processing.
- Right to Data Portability: You may request that we provide a copy of the personal data you have provided to us in a commonly used, machine-readable format, suitable for transfer to another service provider.
- Right to Object to Marketing: You have the right to object at any time to the processing of your personal data for direct marketing purposes. Clicking "Unsubscribe" in any oja98 marketing email or submitting a request to our support team will stop all marketing communications within 10 business days.
- Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
💡 How to Submit a Privacy Request: Contact our support team via live chat (available 24/7 from the oja98 platform) or send a written request to
[email protected] with the subject line "Privacy Rights Request". Please include your registered username and a clear description of the right you wish to exercise. We may request additional verification to confirm your identity before processing the request.
Clause 11
Minors & Age Restriction
The oja98 platform is strictly restricted to individuals who are at least 21 years of age. 21+ Only oja98 does not knowingly collect personal data from anyone under the age of 21. Age verification is a mandatory step in the registration process, and KYC identity checks are used to confirm age compliance before withdrawal rights are granted.
If oja98 discovers or reasonably suspects that a Member is under 21 years of age, the following actions will be taken immediately:
- The account will be suspended and access to all platform features will be revoked pending investigation.
- All deposits and winnings associated with the account will be frozen during the review process.
- If the age violation is confirmed, any winnings generated during the period of underage play will be voided and donated to a recognized responsible gaming charity. The original deposited amount will be reviewed for return in accordance with oja98's underage play policy.
- The account will be permanently closed and flagged to prevent re-registration using the same identity.
If you are a parent or guardian who believes a minor has created an oja98 account, please contact us immediately at [email protected]. We will investigate and respond within 48 hours.
Clause 12
Third-Party Links & Integrations
The oja98 platform may contain references to third-party services — such as game studios (Pragmatic Play, Evolution Gaming, PG Soft, NetEnt), payment networks (Visa, Mastercard), and sports data providers. While oja98 takes care to partner with reputable organizations, we do not control and are not responsible for the privacy practices of any third-party website or service.
When you interact with a third-party service that is integrated into the oja98 platform — for example, when completing a payment via an e-wallet provider's interface, or when a game studio's software loads within the oja98 lobby — your data may be processed by that third party in accordance with their own privacy policy. oja98 recommends that you review the privacy policies of any third-party service you interact with, particularly payment providers such as OVO, DANA, GoPay, ShopeePay, and LinkAja.
⚠️ External Links: oja98 does not include outbound links to external websites within the platform. If you navigate away from https://oja98.com through a browser bookmark, search result, or link shared by a third party, your activity on those external sites is entirely outside oja98's control and this Privacy Policy does not apply.
Clause 13
Changes to This Privacy Policy
oja98 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, new legal obligations, or feedback from our Members. When we make material changes — particularly those that affect how we use your personal data or the rights available to you — we will notify you in advance through one or more of the following channels:
- An email notification sent to your registered oja98 email address, at least seven (7) days before the changes take effect.
- A prominent notice displayed on the oja98 platform homepage and login page for a minimum of seven (7) days prior to the effective date.
- An in-platform notification visible upon your next login session before the changes take effect.
Your continued use of the oja98 platform following the effective date of an updated Privacy Policy constitutes your acknowledgment of and agreement to the revised terms. If you do not agree to the revised Privacy Policy, you must cease using the platform and contact support to request account closure and the withdrawal of any real-money balance.
The current version of this Privacy Policy is always accessible at https://oja98.com/privacy-policy. The effective date displayed at the top of this page indicates when the current version came into force. We recommend reviewing this page periodically.