Privacy Policy — ok25 Data Protection Commitment

1.1 Who This Policy Applies To. This Policy applies to all individuals who interact with ok25, including registered Members, applicants in the registration process, and visitors who browse the Platform without registering. It covers personal data collected online through the ok25 website, through our customer support channels, and through our payment processing partners in the context of transactions conducted on the Platform.

1.2 Geographic Context. ok25 primarily serves players residing in Indonesia. Many of our data processing practices reflect the payment infrastructure, identity verification requirements, and support operations specific to the Indonesian market. Where relevant, this Policy references Indonesian-specific data elements such as KTP (Kartu Tanda Penduduk) numbers, Indonesian bank account details (BCA, BRI, BNI, Mandiri, CIMB Niaga), and e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja).

1.3 Controller Identity. ok25, operating at ok25.cam, is the data controller in respect of the personal data described in this Policy. For all data-related inquiries, please contact us at support@ok25.cam.

ok25 collects the following categories of personal data in the ordinary course of providing its services:

3.1 Identity & Registration Data

• Full legal name as it appears on your government-issued identification;
• Date of birth (to verify 21+ age eligibility);
• Indonesian KTP number or, for non-Indonesian nationals, passport number;
• Gender (optional, where provided);
• Nationality and country of residence;
• Selfie photograph with KTP (collected during KYC verification).

3.2 Contact Data

• Email address (primary communication and account recovery channel);
• Mobile phone number (used for OTP/2FA and support contact);
• Residential address in Indonesia (city, province, postal code).

3.3 Financial Data

• Indonesian bank account number and account holder name (for BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, or other supported banks);
• E-wallet account identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja);
• Deposit and withdrawal transaction history;
• Account balance and betting/wagering transaction records.

3.4 Platform Usage Data

• Betting and gaming activity logs (game type, stake, outcome, timestamp);
• Login timestamps, session duration, and device fingerprint;
• In-platform navigation paths and feature usage patterns;
• Customer support conversation transcripts and correspondence.

3.5 Technical Data

• IP address and approximate geolocation derived therefrom;
• Browser type, version, and operating system;
• Device type (mobile, tablet, desktop) and screen resolution;
• Cookie identifiers and session tokens (see Section 7).

We collect personal data through the following methods:

• Direct submission: Information you provide when registering an account, completing KYC verification, submitting a deposit or withdrawal request, contacting support, or participating in a promotion;
• Automated technical collection: Data automatically recorded when you access the Platform, including IP address, device data, and cookies (see Section 7);
• Payment processors: Transaction confirmation data shared by our Indonesian banking and e-wallet partners as part of deposit and withdrawal processing;
• Identity verification providers: Third-party KYC service providers may share verification outcomes and risk signals with us where you have consented to that provider's terms during the verification flow;
• Publicly available sources: In limited circumstances, for fraud prevention or compliance purposes, we may cross-reference information you provide against publicly available databases.

The table below summarises the primary purposes for which ok25 processes personal data and the legal basis on which each activity rests:

ok25 does not sell, rent, or trade your personal data. We share personal data only in the limited circumstances described below, and always with appropriate safeguards in place.

6.1 Service Processors. We share personal data with trusted third-party service providers who process it on our behalf under written agreements that restrict their use of the data to the specific purpose for which it was engaged. These include:

• Payment processors and e-wallet providers (for deposit and withdrawal processing via BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja);
• Identity verification (KYC) and anti-fraud service providers;
• Game studio content providers (who receive only aggregated statistical data, never personally identifiable data);
• Cloud hosting and infrastructure providers (who store encrypted data in secure data centres);
• Customer support and CRM platform providers (who access account and support data to resolve tickets);
• Email and communication delivery providers.

6.2 Legal and Regulatory Disclosure. We may disclose personal data to regulatory authorities, law enforcement agencies, or governmental bodies where such disclosure is required by applicable law, regulation, or a valid court order. We may also disclose data to defend legal claims, protect the rights and safety of the Company and its Members, or enforce our Terms & Conditions.

6.3 Corporate Transactions. In the event of a merger, acquisition, restructuring, or sale of substantially all of the Company's assets, your personal data may be transferred as part of that transaction. Where legally required, we will provide notice before your data is transferred to and becomes subject to a different privacy policy.

6.4 Aggregate and De-identified Data. We may use and disclose aggregated, anonymised, or de-identified data that can no longer be used to identify an individual for analytics, industry research, platform improvement, or marketing purposes, and such data falls outside the scope of this Policy's restrictions.

ok25 uses cookies and similar tracking technologies to ensure the Platform functions correctly, to enhance your browsing experience, and to gather aggregate usage statistics.

7.1 Strictly Necessary Cookies. These are essential for you to navigate the Platform and use its core features, such as maintaining your login session and remembering your betting slip selection. The Platform cannot function correctly without them.

7.2 Functional Cookies. These allow the Platform to remember your preferences, such as your preferred language, odds format (decimal or American), and display settings, so you do not have to reconfigure them on each visit.

7.3 Analytics Cookies. These collect anonymised information about how visitors use the Platform — including pages visited, browsing time, and referral sources — to help us improve the Platform's performance and usability. These cookies do not identify you personally.

7.4 Managing Cookies. You can control and manage cookies through your browser settings. To block, delete, or restrict cookies, please refer to your browser's "Help" menu. Note that disabling strictly necessary cookies may prevent you from logging in and using the Platform's real-money features.

ok25 retains personal data only for as long as necessary to fulfil the purposes described in this Policy, unless a longer retention period is required or permitted by law.

8.1 Standard Retention Periods.

• Active account data: Retained for the duration of your account's existence plus an optional buffer period of 6 months to allow for reactivation, after which it is subject to the data retention schedule below.
• Transaction and wager records: Retained for a minimum of 7 years to comply with the Company's anti-money laundering (AML) and accounting obligations.
• KYC identity documents: Retained for a minimum of 5 years from the date of account closure, per international regulatory standards.
• Self-exclusion records: Retained permanently to ensure that an excluded person is not permitted to re-register, even after an exclusion period ends.
• Support communication transcripts: Retained for 3 years from the date of last contact, for dispute resolution and service improvement.

8.2 Archiving and Erasure. Upon expiry of the applicable retention period, personal data is either securely deleted, anonymised, or archived in a restricted-access format that is no longer used for active processing. You may request earlier erasure of your data in accordance with Section 10, subject to the Company's legal and regulatory retention obligations.

The security of your personal data is of paramount importance to ok25. We implement a layered security framework combining administrative, technical, and physical safeguards designed to protect your data against unauthorised access, alteration, disclosure, or destruction.

9.1 Encryption. All data transmitted between your browser and the ok25 Platform is encrypted using 256-bit SSL (Secure Sockets Layer) technology. Sensitive data stored in our databases is protected with industry-standard encryption at rest.

9.2 Access Controls. Access to personal data is restricted to authorised personnel only, on a least-privilege basis. Each employee's access level is proportionate to their role, and all access is logged and audited.

9.3 Payment Data Handling. We are Payment Card Industry Data Security Standard (PCI DSS) compliant in our approach to payment data. We do not store full card numbers or CVC codes. Financial information processed through Indonesian banks and e-wallets is routed through encrypted, tokenised payment gateways.

9.4 Infrastructure Security. Our data centres employ multi-layered physical security, redundant power and cooling, continuous monitoring, and regular penetration testing of the Platform's perimeter and application layers.

9.5 Incident Response. In the unlikely event of a data breach affecting your personal data, the Company will assess the risk to affected Members and, where required, notify the relevant supervisory authorities and affected individuals in accordance with applicable law within the legally mandated timeframe.

Subject to applicable law, you have the following rights in respect of your personal data held by ok25:

To exercise any of these rights, submit a written request to support@ok25.cam with the subject line "Data Rights Request". We will respond within 30 days of receiving a complete and verifiable request. Some rights may be subject to legal or regulatory exceptions, and we will always explain our reasoning if we are unable to grant a request in full.

ok25 operates under an international gaming licence and its infrastructure is distributed across secure data centres in multiple jurisdictions. As a consequence, personal data may be transferred to, stored at, and processed in countries outside both Indonesia and the European Economic Area.

Where such international transfers take place, the Company ensures that appropriate safeguards are applied in accordance with applicable data protection law, including but not limited to:

• Execution of Standard Contractual Clauses (SCCs) or equivalent legally binding agreements with all data processors;
• Verification that recipient entities maintain a robust data protection framework and undergo regular independent security audits;
• Application of the same level of encryption and access-control protections regardless of where the data resides.

The ok25 Platform is strictly for adults and is not directed at individuals under the age of 21. We do not knowingly collect personal data from, or offer services to, persons under the age of 21.

If you believe that a person under 21 has provided personal data to us or registered an account, please contact us immediately at support@ok25.cam. Upon reasonable verification, we will take the appropriate steps to close the account, remove the relevant personal data, and return any deposited funds held in the account to the minor's parent or legal guardian.

The Company proactively employs age-verification checks during registration and may suspend any account where verification cannot be completed satisfactorily.

The ok25 Platform may contain links to third-party websites, tools, or services that are not operated by the Company. This may include payment service provider portals (such as those of BCA, BRI, BNI, or the various e-wallet providers) that you are redirected to in order to complete a transaction.

This Policy applies only to the ok25 Platform. We are not responsible for the privacy practices, content, or data handling of any third-party site or service. We encourage you to review the privacy policy of any third party before submitting your personal data to them.

Where you are redirected to a third-party payment page, note that the information you submit there is governed by that third party's own privacy policy and is not collected by the Company. The Company receives only transaction confirmation data from the payment provider after the transaction is completed.

ok25 may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or the regulatory environment. Where a material change is made, we will provide reasonable notice to affected Members via email or a prominent notification on the Platform before the change takes effect.

Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Policy. The "Last Updated" date at the top of this document indicates the most recent version. We encourage you to review this Policy periodically to remain informed about how we protect your data.

If you do not agree to a material change, you may close your account and request the erasure of your personal data, subject to the Company's legal retention obligations.

For any questions, concerns, or formal requests relating to this Privacy Policy or the processing of your personal data, please contact our Data Protection team through the following channels:

• Email: support@ok25.cam — the preferred channel for formal data rights requests. Please use the subject line "Data Rights Request" for the fastest routing, or "Privacy Inquiry" for general questions.
• Live Chat: Available 24/7 via your logged-in account dashboard for general privacy questions and account-related matters.
• Response Time: We aim to respond to all privacy-related inquiries within 48 hours and to fully resolve data rights requests within 30 days, per applicable regulatory timelines.

When submitting a data rights request, please include your registered username, account email address, and a clear description of the right you wish to exercise. This allows us to locate and verify your account efficiently while protecting against unauthorised disclosure.