Privacy Policy

1. Introduction

ok27 ("we", "us", "our", or the "Company") operates the online gaming and sports betting platform accessible at https://ok27.cam (the "Platform"). This Privacy Policy ("Policy") sets out how ok27 collects, uses, stores, discloses, and protects personal information submitted by users ("you", "your", or "User") who access or use the Platform.

This Policy applies to all personal data processed in connection with your use of the ok27 Platform, including data provided during account registration, identity verification (KYC), payment transactions, customer support interactions, and general Platform usage. By registering an account or continuing to use the Platform, you acknowledge that you have read, understood, and agree to the terms of this Policy.

If you have questions about how your data is handled, please contact our Data Protection team at [email protected] or visit our FAQ page for commonly asked privacy questions.

2. Data We Collect

ok27 collects the following categories of personal data from Users. The specific data points collected may vary depending on your account type, the services you access, and whether you have completed KYC verification.

2.1 Identity & Registration Data

• Full legal name as it appears on your government-issued identity document
• Date of birth
• Indonesian National Identity Card number (NIK from KTP)
• Registered email address
• Mobile phone number
• Username and encrypted account password
• Preferred currency (Indonesian Rupiah, IDR)

2.2 Verification & KYC Documents

• Scanned or photographed copy of valid Indonesian National Identity Card (KTP)
• Proof of current residential address (utility bill, bank statement, or official correspondence dated within three months)
• Live selfie photograph holding the identity document, for liveness verification
• Source of funds documentation, where requested for enhanced due diligence

2.3 Financial & Transaction Data

• Bank account details (account holder name, bank name such as BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, or Bank Permata; account number)
• Digital wallet identifiers (OVO, DANA, GoPay, ShopeePay, or LinkAja registered mobile number)
• Deposit and withdrawal transaction history
• Bonus redemption and wagering history
• Deposit amounts in Indonesian Rupiah (IDR)

2.4 Technical & Usage Data

• IP address and approximate geolocation derived from IP
• Device type, operating system, browser type and version
• Session timestamps (login time, logout time, session duration in WIB timezone)
• Pages visited, features accessed, and navigation patterns within the Platform
• Game play history including game titles, wager amounts, and outcomes
• Referral source and marketing attribution data (where applicable)

2.5 Communications Data

• Live chat transcripts between you and ok27 support agents
• Email correspondence records
• Complaint and dispute records
• Responses to surveys or feedback forms submitted voluntarily

3. How We Collect Your Data

ok27 collects personal data through the following channels and mechanisms:

3.1 Directly From You

The majority of personal data we hold is provided directly by you when you register an account, complete the KYC verification process, make a deposit or withdrawal, contact our support team, participate in promotions, or respond to surveys.

3.2 Automatically Through Platform Use

When you access the Platform, our servers and analytics tools automatically record technical data including your IP address, device specifications, session timing, and browsing behavior within the site. This data is collected through server logs, cookies, and similar tracking technologies as described in Section 9 of this Policy.

3.3 From Third-Party Service Providers

ok27 may receive supplementary data from trusted third-party partners, including identity verification providers (for KYC checks), payment processors (for transaction confirmation), fraud detection services, and analytics platforms. All such providers are contractually obligated to handle your data in accordance with applicable data protection standards.

4. Purpose of Processing

ok27 processes your personal data only for specific, legitimate purposes. The table below summarizes the primary purposes for which your data is used:

5. Legal Basis for Processing

ok27 processes your personal data on the following legal grounds:

• Contractual necessity: Processing required to fulfill our obligations under the Terms and Conditions you accepted upon registration, including account management, payment processing, and game delivery.
• Legal obligation: Processing required to comply with applicable anti-money laundering (AML) regulations, KYC requirements, and financial record-keeping obligations.
• Legitimate interests: Processing for fraud prevention, security monitoring, platform analytics, and service improvement, where such interests are not overridden by your rights and freedoms.
• Consent: Processing for direct marketing communications, optional surveys, and non-essential cookies, where you have provided clear, informed consent. You may withdraw consent at any time.

6. Data Sharing & Disclosure

6.1 Service Providers

ok27 shares personal data with carefully selected third-party service providers who assist us in operating the Platform. These include payment processors (banking partners such as BCA, BRI, BNI, and Mandiri; e-wallet operators including OVO, DANA, and GoPay), identity verification providers, cloud hosting and infrastructure providers, fraud detection vendors, game content providers (such as Pragmatic Play, Evolution Gaming, Microgaming, and NetEnt), and customer support software platforms. All service providers are bound by contractual data processing agreements and are prohibited from using your data for any purpose other than the specific service they provide to ok27.

6.2 Legal and Regulatory Authorities

ok27 may disclose your personal data to relevant authorities, law enforcement agencies, or regulatory bodies when required to do so by applicable law, court order, or in connection with the prevention and investigation of fraud, money laundering, or other unlawful activities.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of ok27's business, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and the acquiring entity will be required to honor the terms of this Privacy Policy.

7. Data Retention

ok27 retains personal data only for as long as necessary to fulfill the purposes for which it was collected, as outlined in the table in Section 4, and to comply with applicable legal, regulatory, and audit requirements. The standard retention schedules are:

• Active account data: Retained for the full duration of your account's active status plus a minimum of five (5) years following account closure, to satisfy AML and financial record-keeping obligations.
• KYC documents: Retained for a minimum of seven (7) years from the date of submissi on, in compliance with international anti-money laundering standards.
• Transaction records: Retained for a minimum of seven (7) years from the date of each transaction.
• Support communications: Retained for three (3) years from the date of the last interaction.
• Self-exclusion records: Retained for the full duration of the exclusion period plus five (5) years thereafter.
• Anonymized analytics data: May be retained indefinitely in anonymized, non-identifiable form for statistical and platform improvement purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized using industry-standard data destruction procedures.

8. Data Security

ok27 employs a comprehensive set of technical and organizational measures to protect your personal data against unauthorized access, accidental loss, alteration, disclosure, or destruction. Our security infrastructure includes:

• SSL/TLS Encryption: All data transmitted between your device and the ok27 Platform is encrypted using 256-bit SSL/TLS protocols, the same standard used by major financial institutions.
• Data Encryption at Rest: Sensitive personal data stored on our servers — including identity documents and financial details — is encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data within ok27 is restricted on a strict need-to-know basis. Staff members are granted access only to the data categories required to perform their specific job functions, and all access events are logged and audited.
• Two-Factor Authentication: ok27 offers two-factor authentication (2FA) for User accounts, providing an additional layer of login security. We strongly recommend all Users enable 2FA via their account security settings.
• Penetration Testing: Our platform undergoes regular independent security audits and penetration testing to identify and remediate potential vulnerabilities before they can be exploited.
• Incident Response: In the event of a confirmed data breach that poses a risk to your rights and freedoms, ok27 will notify affected Users without undue delay and take all reasonable steps to contain the breach and mitigate its impact.

While ok27 takes all reasonable precautions to safeguard your data, no digital platform can guarantee absolute security. You are responsible for keeping your account credentials confidential and for notifying us immediately at [email protected] if you suspect unauthorized access to your account.

9. Cookies & Tracking Technologies

9.1 What Are Cookies?

Cookies are small text files placed on your device when you visit the ok27 Platform. They allow the Platform to recognize your device across sessions, remember your preferences, and collect usage data to improve your experience.

9.2 Types of Cookies We Use

9.3 Managing Your Cookie Preferences

You may manage or disable non-essential cookies at any time through your browser's privacy settings. Please note that disabling functional cookies may affect certain personalization features of the Platform. Disabling essential cookies will prevent you from logging in and using core Platform services.

10. Your Data Rights

As a User of the ok27 Platform, you hold the following rights with respect to your personal data. To exercise any of these rights, please submit a written request to [email protected] with the subject line "Data Rights Request". We aim to respond to all valid requests within 30 days.

• Right of Access: You have the right to request a copy of all personal data ok27 holds about you, along with information about how that data is being used.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or updated without undue delay.
• Right to Erasure: Subject to applicable legal retention obligations (such as AML record-keeping requirements), you may request the deletion of your personal data. Requests will be assessed on a case-by-case basis.
• Right to Restriction of Processing: You may request that ok27 restrict the processing of your personal data in specific circumstances, such as while a dispute over data accuracy is being resolved.
• Right to Data Portability: Where technically feasible, you may request that ok27 provide your personal data in a structured, commonly used, machine-readable format so that it may be transferred to another service provider.
• Right to Object: You have the right to object to the processing of your personal data for direct marketing purposes at any time. You may also object to processing based on ok27's legitimate interests, subject to our right to demonstrate compelling grounds.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

11. Third-Party Services

The ok27 Platform integrates third-party game content from providers including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft. These providers may operate their own data collection mechanisms within their game environments. ok27 is not responsible for the privacy practices of third-party game studios and recommends that you review their respective privacy policies where available.

ok27's Platform may also utilize third-party analytics tools, customer support software, and fraud detection services. Each of these third parties is bound by a Data Processing Agreement with ok27 and is prohibited from using your data for any purpose beyond the contracted service.

12. Minors

The ok27 Platform is strictly intended for adults aged 21 years or older. We do not knowingly collect personal data from individuals under the age of 21. If we become aware that personal data has been submitted by or on behalf of a minor, we will immediately close the associated account, delete the data in question, and handle any associated funds in accordance with applicable legal requirements.

If you believe that a minor has registered an account on ok27 or submitted personal data to our Platform, please contact us immediately at [email protected] so that we may investigate and take appropriate action without delay.

13. Changes to This Privacy Policy

ok27 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable legal requirements, or Platform features. When material changes are made, we will notify registered Users via the email address on file and display a prominent update notice on the Platform for a minimum of 14 days before the revised Policy takes effect.

The "Last Updated" date at the top of this page will be revised whenever the Policy is amended. Your continued use of the Platform following the effective date of any revision constitutes your acceptance of the updated Policy. If you do not agree with the revised terms, you must cease using the Platform and may request account closure in accordance with the Terms and Conditions.

14. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact ok27's Data Protection team through the following channels:

• Email: [email protected]
• Live Chat: Available 24/7 directly through the Platform interface
• Response Time: Live chat within 2 minutes; email within 2 hours during standard business hours (WIB, UTC+7)
• Formal Data Rights Requests: Please include "Data Rights Request" in the subject line of your email and provide your registered account email address for identity verification purposes

For information about our Terms and Conditions, please visit the Terms & Conditions page. For responsible gaming support and self-exclusion tools, please visit our Responsible Gaming page.