Privacy Policy — opo999

In this Privacy Policy, the following terms carry the meanings set out below:

• "Platform" — the opo999 website at opo999.cam and any associated mobile-optimised interfaces.
• "opo999", "we", "us", or "our" — the internationally licensed entity operating the opo999 Platform.
• "User", "you", or "your" — any individual who accesses the Platform, creates an Account, or whose personal data is processed by opo999 in connection with the Platform.
• "Personal Data" — any information relating to an identified or identifiable natural person, including but not limited to name, date of birth, national identity number, contact details, financial account details, and device identifiers.
• "Processing" — any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, erasure, and destruction.
• "KYC Data" — identity and address verification documents submitted by a User in connection with the Know Your Customer (KYC) verification process, including copies of KTP (Indonesian National Identity Card), selfie photographs, and supporting financial documents.
• "Cookies" — small text files placed on a User's device by the Platform to store session information, preferences, and analytics data.
• "Third-Party Service Provider" — an external company engaged by opo999 under a data processing agreement to perform specific functions, such as payment processing, KYC verification, or fraud detection.

2.1 This Privacy Policy applies to all Personal Data collected and processed by opo999 in connection with your use of the Platform, regardless of whether you access it from a desktop browser, mobile browser, or any other device.

2.2 This Policy is incorporated by reference into opo999's Terms and Conditions. By creating an Account or using the Platform, you confirm that you have read and understood this Privacy Policy and consent to the processing of your Personal Data as described herein.

2.3 This Policy primarily addresses the data of Indonesian users, as Indonesia is opo999's primary target market. Where Indonesian personal data protection legislation (including the Personal Data Protection Law, commonly referred to as UU PDP, which came into force in October 2024) sets higher standards than international norms, opo999 applies the higher standard.

3.1 opo999 collects the following categories of Personal Data:

3.2 opo999 does not collect special categories of Personal Data (such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data) except where strictly required by KYC obligations (e.g., a photograph on an identity document). Such data is handled with additional safeguards as described in Section 11.

4.1 opo999 collects Personal Data through the following means:

• Directly from you: When you register an Account, complete KYC verification, make a deposit or withdrawal request, contact support, or use any interactive feature of the Platform.
• Automatically: Technical and Usage Data are collected automatically as you navigate the Platform, via server logs, session tracking, and Cookies (see Section 9).
• From third parties: Where required for KYC verification, opo999 may receive verification outcomes from third-party identity verification services. Payment providers (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay) may share transaction confirmation data with opo999 to reconcile deposits and withdrawals.

5.1 opo999 processes your Personal Data for the following purposes:

• Account management: Creating, maintaining, and securing your Account; authenticating your identity on login; processing password resets.
• KYC compliance: Verifying your identity, age (21+ requirement), and payment method ownership before processing withdrawals and as required under anti-money laundering obligations.
• Transaction processing: Receiving and crediting deposits; processing and verifying withdrawal requests; maintaining an auditable transaction history in IDR.
• Platform operation: Delivering game content, maintaining platform stability, diagnosing and fixing technical issues, and ensuring a consistent cross-device experience.
• Customer support: Responding to queries, resolving complaints, and managing support escalations.
• Fraud prevention and security: Detecting and preventing fraudulent activity, bonus abuse, money laundering, and account compromise attempts.
• Responsible gaming: Monitoring betting patterns to identify potential problem gambling indicators; administering deposit limits, loss limits, and self-exclusion requests.
• Legal compliance: Meeting obligations under applicable offshore licensing requirements, anti-money laundering regulations, and data protection law.
• Service improvement: Analysing aggregated, anonymised usage data to understand how the Platform is used and to guide product improvements.

5.2 opo999 does not use your Personal Data for automated profiling that produces legal or similarly significant effects without human review.

6.1 opo999 relies on the following legal bases for processing Personal Data:

7.1 opo999 does not sell, rent, or otherwise transfer your Personal Data to third parties for their own commercial benefit. Your data may be shared with the following categories of third party, strictly for the purposes described:

• Payment processors: BCA, BRI, BNI, Bank Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja receive transaction data necessary to process your deposits and withdrawals. These entities operate under their own privacy policies and applicable Indonesian financial regulations.
• KYC verification providers: Third-party identity verification services receive KYC Data to confirm your identity, age, and payment method ownership. These providers are contractually bound to process your data only for verification purposes and to maintain appropriate security standards.
• Fraud prevention services: Anonymised or pseudonymised device and behavioural data may be shared with fraud detection providers to identify suspicious activity patterns.
• Game content providers: Game studios (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft) may receive minimal session data required to deliver their game content within the Platform. These studios are contractually prohibited from using this data for independent purposes.
• Legal and regulatory authorities: Where opo999 is required by law, court order, or regulatory direction to disclose Personal Data, it will do so. Where legally permissible, opo999 will notify you of such disclosure.

7.2 All third-party service providers engaged by opo999 are subject to contractual data processing agreements that require them to process Personal Data only as instructed, maintain appropriate technical and organisational security measures, and not transfer data beyond the agreed scope.

8.1 opo999 is an offshore platform operating under an international gaming licence. Personal Data collected from Indonesian users may be processed on servers located outside Indonesia, in the jurisdiction where opo999 holds its licence and/or where its infrastructure partners operate.

8.2 Where Personal Data is transferred internationally, opo999 implements appropriate safeguards, which may include: contractual clauses that meet recognised data protection standards; processing only by third parties in jurisdictions with adequate data protection frameworks; and technical encryption measures that protect data in transit regardless of server location.

9.1 opo999 uses Cookies and similar tracking technologies to operate and improve the Platform. The following cookie categories are used:

• Strictly necessary cookies: Essential for Platform operation — session management, authentication state, security tokens. These cannot be disabled without breaking core Platform functionality.
• Functional cookies: Store your preferences such as language settings, time-zone display (WIB / WITA / WIT), and notification settings. Disabling these cookies may affect your Platform experience.
• Analytics cookies: Collect aggregated, anonymised data on how users navigate the Platform — pages visited, session duration, error rates. This data helps opo999 diagnose performance issues and prioritise improvements. No personally identifiable information is included in analytics reports.
• Security and fraud-detection cookies: Used to identify anomalous device or behavioural patterns that may indicate fraud, account compromise, or bonus abuse attempts.

9.2 opo999 does not use third-party advertising cookies or behavioural tracking cookies that serve targeted advertisements on external networks.

9.3 You can manage cookie preferences through your browser settings. Blocking strictly necessary cookies will impair your ability to use the Platform.

10.1 opo999 retains Personal Data for the periods set out below, after which data is securely deleted or anonymised:

10.2 Where opo999 is required by law to retain data for a longer period than specified above, the legally mandated period takes precedence.

11.1 opo999 implements a layered security architecture to protect Personal Data against unauthorised access, disclosure, alteration, and destruction. Key measures include:

• Transport security: All data transmitted between your device and opo999 is protected by TLS 1.2 or higher (256-bit encryption). HTTP connections are automatically redirected to HTTPS.
• Storage encryption: KYC documents, payment account details, and other sensitive stored data are encrypted at rest using AES-256.
• Access controls: Internal access to Personal Data is restricted on a need-to-know basis. Staff with access to Personal Data are subject to confidentiality obligations and role-based access controls.
• Two-factor authentication (2FA): Available to all users for Account login. Strongly recommended for all active accounts, and mandatory for withdrawal requests above specified thresholds.
• Penetration testing: opo999's platform undergoes periodic independent security assessments to identify and remediate vulnerabilities.
• Incident response: opo999 maintains a documented data breach response procedure. In the event of a breach that poses a material risk to users, affected users will be notified within a reasonable timeframe in accordance with applicable law.

11.2 While opo999 applies rigorous security measures, no online platform can guarantee absolute security. You are responsible for maintaining the security of your own Account credentials and for notifying opo999 promptly if you suspect any unauthorised access to your Account.

12.1 As a User, you have the following rights in relation to the Personal Data that opo999 holds about you. These rights may be subject to limitations under applicable law, but opo999 will respond to all requests in good faith and within a reasonable timeframe (typically 30 days):

12.2 To exercise any of these rights, contact opo999 support via the email address listed in Section 16. opo999 will not charge a fee for handling data rights requests, except in exceptional circumstances where requests are manifestly unfounded or excessive.

13.1 The opo999 Platform is strictly for adults aged 21 years and over. opo999 does not knowingly collect Personal Data from persons under the age of 21.

13.2 Where opo999 discovers or is notified that Personal Data belonging to a person under 21 has been collected — for example, where an underage individual has misrepresented their age during registration — opo999 will immediately suspend the relevant Account, delete or retain the data only as required by applicable legal obligations (e.g., AML), and take appropriate steps to prevent further access.

14.1 The opo999 Platform does not contain links to external third-party websites. This Privacy Policy applies exclusively to Personal Data collected and processed by opo999 in connection with the Platform at opo999.cam.

14.2 If you access opo999 via a third-party referral link from another website, opo999 is not responsible for the privacy practices of that referring website. You should review the privacy policy of any third-party site independently.

15.1 opo999 reserves the right to update or amend this Privacy Policy at any time. Where amendments are material — meaning they meaningfully change how your Personal Data is collected, used, or shared — opo999 will notify registered users by email to the address on file no less than 14 days before the amendments take effect.

15.2 Where an amendment is required immediately to comply with a change in applicable law or a regulatory direction, it may take effect upon publication. opo999 will make reasonable efforts to provide advance notice in such circumstances.

15.3 The "Last Updated" date at the top of this page reflects the effective date of the current version. We recommend reviewing this page periodically, particularly if you use the Platform regularly.

16.1 For any question, request, or complaint relating to this Privacy Policy or opo999's handling of your Personal Data, please contact our support team using the details below. All contact information is provided as plain text — these are not clickable links:

16.2 If you are not satisfied with opo999's response to a privacy complaint, you may have the right to escalate the matter to the relevant data protection authority in your jurisdiction. For Indonesian users, the supervisory authority for personal data protection is the Ministry of Communication and Information Technology (Kominfo) or its designated successor under UU PDP.

16.3 For responsible gaming-related concerns — including requests to activate self-exclusion or deposit limits — please refer to the Responsible Gaming page, which provides dedicated guidance and priority contact routes for these matters.