Privacy Policy — olo44 Data Protection

The following definitions apply throughout this Privacy Policy. Where a term is defined in the olo44 Terms & Conditions, that definition is incorporated here by reference unless a different meaning is expressly stated below.

This Privacy Policy applies to all Personal Data collected by olo44 in connection with the operation of the Platform. It covers data collected through the following channels:

• Direct registration and account management on the olo44 Platform at https://olo44.bet;
• Deposit and withdrawal transactions processed through Indonesian local banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja);
• Participation in betting activities including sportsbook, live casino, slot games, and crash games;
• Communications with the olo44 customer support team via live chat or email;
• Browsing activity on the Platform, including pages visited, session duration, and device information captured through cookies and server logs;
• Responses to promotional offers, surveys, or competitions operated by olo44.

This Privacy Policy does not apply to third-party websites or services that may be referenced or linked from the Platform. olo44 is not responsible for the privacy practices of any third party, and we encourage you to review the privacy policies of any third-party service you use.

olo44 collects Personal Data in three principal ways: data you provide directly, data generated automatically through your use of the Platform, and data received from trusted third-party service providers. The specific categories are as follows:

3.1 Data You Provide Directly

• Registration data: Full legal name, date of birth, Indonesian residential address, email address, chosen username, and password (stored as a one-way hash — never in plain text).
• KYC documents: Copies of your Indonesian KTP (national identity card) or passport, and where required, selfie verification images and proof of payment method ownership.
• Payment data: Bank account numbers (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) or e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja) submitted for deposit and withdrawal processing. Full card numbers are never stored on olo44 servers.
• Support communications: The content of messages you send to the olo44 support team via live chat or email, including any attachments or screenshots you provide.
• Promotional data: Responses to surveys, bonus opt-ins, referral codes, and competition entries.

3.2 Data Collected Automatically

• Device & browser data: IP address, device type, operating system, browser type and version, screen resolution, and language settings.
• Session data: Pages visited, time spent on each page, betting history, game session data, login timestamps (in WIB), and logout events.
• Geolocation data: Approximate geographic location derived from your IP address, used to confirm Indonesian residency and to enforce any applicable geo-restrictions.
• Cookies and similar technologies: Session identifiers, preference tokens, and aggregate analytics data. See Clause 7 for full details of our cookie practices.

3.3 Data Received from Third Parties

• KYC verification providers: Identity verification results, document authenticity scores, and watchlist screening outcomes received from our contracted KYC/AML service partners.
• Payment processors: Transaction confirmation references, payment status updates, and fraud-screening outcomes from Indonesian banking partners and e-wallet providers.
• Fraud & risk management services: Device fingerprint scoring, behavioural risk signals, and cross-operator alerts from industry-standard responsible gaming and fraud prevention networks.

olo44 processes your Personal Data only for clearly defined purposes. We do not use your data for any purpose that is incompatible with the reason it was originally collected. The primary purposes are:

• Account creation and management: To register your account, verify your identity, maintain your account preferences, and facilitate secure login to the Platform.
• Payment processing: To process deposits and withdrawals in IDR via your nominated Indonesian bank account or e-wallet, to reconcile transaction records, and to investigate and resolve payment disputes.
• KYC and AML compliance: To verify that you are at least 21 years of age, that you are a resident of Indonesia, and that deposits and withdrawals are free from money-laundering risk, in accordance with applicable regulatory obligations.
• Delivering betting services: To enable you to place bets on sports markets (including BRI Liga 1, EPL, La Liga, Serie A, Bundesliga, and Champions League), play live casino games, access slot titles from providers such as Pragmatic Play, Evolution Gaming, Microgaming, and Spribe, and use all other features of the Platform.
• Customer support: To respond to your enquiries, resolve complaints, and investigate disputed transactions or bet settlements.
• Responsible gaming: To monitor your betting activity for signs of problem gambling, to enforce deposit limits and self-exclusion orders you have set, and to provide proactive intervention where our risk systems identify concerning patterns of play.
• Security and fraud prevention: To detect, investigate, and prevent fraudulent activity, multi-accounting, bonus abuse, money laundering, and other forms of Prohibited Conduct as defined in our Terms & Conditions.
• Platform improvement: To analyse aggregate usage data in order to improve the Platform's performance, user interface, and product offering. This analysis uses anonymised or pseudonymised data wherever possible.
• Marketing communications: To send you promotional offers, bonus notifications, and seasonal promotions — for example, Idul Fitri cashback offers or Ramadhan reload bonuses — where you have opted in to receive such communications. You may opt out at any time.
• Legal compliance: To comply with applicable laws, respond to lawful requests from government authorities, and enforce our Terms & Conditions and this Privacy Policy.

olo44 processes your Personal Data on one or more of the following legal bases:

olo44 does not sell, rent, or trade your Personal Data to any third party for commercial purposes. Personal Data is shared with third parties only in the following defined circumstances:

• Payment partners: Your bank account number or e-wallet identifier is shared with the relevant Indonesian payment institution (e.g., BCA, BRI, Mandiri, OVO, DANA, GoPay) solely for the purpose of processing your deposit or withdrawal transaction in IDR.
• KYC and AML service providers: Identity document images and personal details are shared with our contracted KYC verification provider for the purpose of confirming your identity, age (21+), and compliance with anti-money-laundering regulations. These providers operate under strict data processing agreements with olo44.
• Game content providers: Where game providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Pocket Games Soft operate games directly within the Platform, a session token and pseudonymised player identifier may be transmitted to the provider's gaming servers. No full Personal Data (name, address, KTP number) is shared with game providers.
• Fraud and responsible gaming networks: Anonymised or pseudonymised player risk indicators may be shared with industry-standard fraud prevention and responsible gaming platforms to protect the integrity of the betting ecosystem and to prevent harm to vulnerable players.
• Legal and regulatory authorities: olo44 will disclose Personal Data to government bodies, law enforcement agencies, or regulators where required to do so by law, court order, or regulatory directive. olo44 will notify affected players of such disclosures where legally permitted to do so.
• Corporate transactions: In the event of a merger, acquisition, or sale of all or part of olo44's business, Personal Data held by olo44 may be transferred to the acquiring entity, subject to the same data protection standards as set out in this Privacy Policy.

The olo44 Platform uses cookies and similar client-side storage technologies to deliver a functional, secure, and personalised betting experience. The following categories of cookies are in use:

olo44 does not use third-party advertising cookies or any tracking technology that follows you across websites outside of the olo44 Platform. Essential and security cookies are strictly necessary for the Platform to function securely and cannot be disabled without impairing core functionality. Functional and analytics cookies may be managed through your browser settings or the cookie preference panel in your Account Dashboard.

olo44 retains Personal Data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following retention schedule applies:

• Active Account data: Retained for the full duration of your Account's active status, plus a minimum of five (5) years following permanent Account closure, in accordance with anti-money-laundering record-keeping obligations.
• Transaction records (deposits, withdrawals, bet history): Retained for a minimum of five (5) years from the date of each transaction to satisfy financial compliance and audit requirements.
• KYC documents (KTP, passport, selfie images): Retained for a minimum of five (5) years following Account closure or the completion of the transaction to which the KYC check relates.
• Customer support communications: Retained for three (3) years from the date of the communication, unless the communication relates to an ongoing dispute, complaint, or legal proceeding, in which case it is retained until final resolution plus two (2) years.
• Marketing consent records: Retained for the duration of your consent plus three (3) years to evidence compliance with applicable marketing regulations.
• Analytics data: Retained in aggregated, anonymised form for up to twenty-four (24) months. Anonymised data is not subject to deletion requests as it cannot be linked to an identified individual.
• Data subject access request (DSAR) records: Retained for three (3) years from the date of the request to evidence compliance with your data rights.

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised. Where technical constraints temporarily prevent immediate deletion, the data is restricted from active processing until deletion can be completed.

olo44 implements a comprehensive set of technical and organisational security measures designed to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure. Key measures include:

• 256-bit TLS encryption: All data transmitted between your device and the olo44 Platform is encrypted in transit using industry-standard TLS 1.2 or TLS 1.3 protocols.
• Password hashing: Passwords are stored exclusively as one-way bcrypt hashes with a per-user salt. olo44 support staff cannot retrieve or view your password; only a password reset is possible.
• Two-factor authentication (2FA): olo44 strongly recommends — and makes available to all Players — TOTP-based two-factor authentication, configurable from the Account Security section of your Dashboard.
• Access controls: Internal access to Personal Data is governed by the principle of least privilege. Only olo44 staff members who require access to specific data categories in order to perform their job functions are granted that access, and all access events are logged.
• Encrypted storage: Personal Data at rest is stored on AES-256 encrypted servers hosted in access-controlled data centres. KYC documents are stored in isolated, access-restricted environments separate from general platform data.
• Penetration testing and vulnerability scanning: The olo44 Platform undergoes regular third-party penetration testing and continuous automated vulnerability scanning. Critical vulnerabilities are remediated within defined SLA windows.
• Anomalous session detection: Automated systems monitor login events for indicators of account takeover, including logins from new devices, unusual geographic locations, and rapid credential enumeration attempts.

olo44's primary platform infrastructure is designed to minimise unnecessary cross-border transfers of Personal Data. However, certain service providers — including game content providers (such as Pragmatic Play, Evolution Gaming, and Spribe) and KYC verification partners — may process data on servers located outside Indonesia.

Where such international transfers occur, olo44 takes the following steps to ensure your Personal Data remains protected to a standard equivalent to that described in this Privacy Policy:

• All third-party Processors engaged by olo44 are required to enter into Data Processing Agreements (DPAs) that contractually oblige them to protect Personal Data to a standard no less protective than that applied by olo44 itself.
• Where data is transferred to jurisdictions that do not provide an equivalent level of data protection, olo44 implements appropriate safeguards, including standard contractual clauses or binding corporate rules, as applicable.
• Game session data transmitted to game provider servers is pseudonymised — it is identified by a session token rather than your full name, KTP number, or financial account details.

If you would like further information about the specific safeguards in place for any international transfer, please contact us at [email protected].

As a Player on the olo44 Platform, you hold the following rights in relation to your Personal Data. olo44 will respond to all valid requests within thirty (30) calendar days of receipt. Where a request is complex or involves a large volume of data, olo44 may extend this period by a further thirty (30) days, with prior notification to you.

• Right of Access: You have the right to request a copy of the Personal Data olo44 holds about you, together with information about how it is being processed. Submit a Data Subject Access Request (DSAR) by emailing [email protected] with the subject line "DSAR — Access Request".
• Right to Rectification: If any Personal Data held by olo44 is inaccurate or incomplete, you have the right to request correction. For most data fields, corrections can be made directly from your Account Dashboard. For KYC-linked data fields (name, date of birth), contact support to initiate the correction process.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (for consent-based processing only), or where processing is unlawful. Note that olo44 is subject to mandatory data retention obligations under AML regulations, which may mean that certain data cannot be immediately deleted even where an erasure request is valid.
• Right to Restriction of Processing: You may request that olo44 restricts the processing of your Personal Data while a rectification request or objection is being assessed, or where processing is unlawful but you prefer restriction over erasure.
• Right to Data Portability: You have the right to receive Personal Data you have provided to olo44 in a structured, commonly used, machine-readable format (e.g., CSV or JSON), and to transmit that data to another service provider, where technically feasible.
• Right to Object: You have the right to object at any time to the processing of your Personal Data on the basis of legitimate interests, including profiling. You also have the absolute right to object to direct marketing communications, with no requirement to provide justification.
• Right to Withdraw Consent: Where olo44 processes your data on the basis of your consent (specifically, marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal. Use the unsubscribe link in any marketing email or update your preferences in the Account Dashboard.

The olo44 Platform is strictly restricted to individuals who are at least 21 years of age. olo44 does not knowingly collect, store, or process any Personal Data relating to persons under the age of 21. If olo44 becomes aware that Personal Data belonging to a minor has been collected — whether through a false registration or any other means — the following actions will be taken immediately:

• The associated Account will be suspended and subsequently permanently closed;
• All Personal Data relating to the minor will be securely deleted, subject to any mandatory retention obligations that override the deletion request;
• Any Funds held in the Account will be returned to the payment source after investigation, or forfeited if the source cannot be established;
• The incident will be reviewed by olo44's compliance team and, where appropriate, reported to relevant authorities.

olo44 reserves the right to amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory guidance, or Platform functionality. The "Last Updated" date displayed at the top of this page reflects the date of the most recent revision.

Where a material change is made to this Privacy Policy — for example, a new category of data collection, a new sharing arrangement with a third party, or a change to your rights — olo44 will notify registered Players by email to their registered address at least fourteen (14) days prior to the change taking effect, and will display a prominent notice on the Platform.

Minor amendments that do not materially affect your rights — such as typographical corrections, clarifications of existing practices, or updates required to maintain legal compliance — may be made without advance notice. Your continued use of the Platform following any amendment constitutes your acknowledgment of the updated Privacy Policy. If you do not agree with any amendment, you must cease using the Platform and may request Account closure by contacting [email protected].

olo44 recommends that you review this Privacy Policy periodically to stay informed of how we protect your data. All previous versions of this Privacy Policy are available upon written request.

If you have any questions, concerns, or formal requests relating to this Privacy Policy or the way olo44 handles your Personal Data, please contact our support team through the following channels:

olo44 will acknowledge all privacy-related requests within 48 hours of receipt and provide a substantive response within thirty (30) calendar days. Where a request requires additional time — for example, a complex DSAR involving multiple data categories — olo44 will notify you of the extension and the expected completion date.

olo44's registered business address and full corporate details are available upon written request submitted via email to [email protected]. Requests for corporate information made in good faith will be responded to within 5 business days.