Privacy Policy

oke27 ("we", "us", "our", "the Platform") operates https://oke27.cam, an internationally licensed online sports betting and casino platform primarily serving English-preference users across Indonesia. We take the privacy and security of our members' personal information seriously and are committed to handling it in a responsible, transparent, and lawful manner.

This Privacy Policy describes how oke27 collects, uses, stores, and shares personal data in connection with the services we provide — including account registration, identity verification (KYC), deposits and withdrawals via Indonesian banking channels such as BCA, BRI, BNI, and Mandiri, customer support, and our sports betting, live casino, and gaming products.

This policy should be read alongside our Terms & Conditions, which govern your use of oke27. Where this Privacy Policy conflicts with any other document, this policy prevails with respect to data protection matters.

The following terms have the meanings set out below throughout this Privacy Policy:

• "Personal Data" — any information that identifies or could reasonably be used to identify a living individual, including name, email address, date of birth, national identity number, device identifiers, and IP address.
• "Processing" — any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, and deletion.
• "Data Controller" — oke27, the entity that determines the purposes and means of processing your Personal Data.
• "Data Processor" — a third party that processes Personal Data on behalf of oke27 under contractual instruction (e.g., a payment processor or KYC verification provider).
• "Member" — any individual who has registered an account on oke27.
• "Consent" — a freely given, specific, informed, and unambiguous indication of agreement to the processing of Personal Data for a stated purpose.
• "KYC" — Know Your Customer; the identity and address verification process conducted at oke27 to confirm Member eligibility and satisfy anti-money-laundering obligations.

oke27 collects the following categories of personal data from Members and visitors:

oke27 collects personal data through the following channels:

• Direct interactions — when you register an account, complete KYC verification, make a deposit or withdrawal, contact our support team, or update your account settings.
• Automated technologies — when you access oke27, our servers and analytics infrastructure automatically collect Technical Data and Usage Data through cookies, server logs, and session tracking tools.
• Third-party sources — we may receive identity verification data from licensed KYC providers, fraud risk scores from payment processors, and device reputation data from anti-fraud services. All third-party data sources used by oke27 are contractually bound to handle data lawfully and securely.

oke27 uses your personal data exclusively for the following purposes:

• Account management — to create, maintain, and secure your oke27 account, including authentication and password recovery.
• Identity verification (KYC) — to confirm that you meet oke27's eligibility requirements (including the 21+ age requirement and Indonesian residency) and to comply with anti-money-laundering (AML) obligations.
• Payment processing — to process deposits and withdrawals via your nominated bank accounts (BCA, BRI, BNI, Mandiri, CIMB Niaga) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja).
• Service delivery — to provide access to sports betting markets, live casino games, lottery draws, and all other wagering products offered on oke27.
• Customer support — to respond to your inquiries, resolve disputes, and maintain records of our interactions for quality assurance.
• Fraud prevention and security — to detect, investigate, and prevent fraudulent activity, unauthorized account access, money laundering, and other illicit conduct.
• Responsible gaming — to monitor wagering patterns that may indicate problem gambling behaviour and to implement protective measures such as deposit limits or self-exclusion where appropriate.
• Legal compliance — to meet our obligations under applicable international gaming regulations, AML requirements, and any lawful order from a competent authority.
• Platform improvement — to analyze aggregated, anonymized usage data to improve our products, fix technical issues, and optimize the user experience.
• Marketing communications — to send promotional offers, bonus notifications, and platform updates where you have opted in to receive such communications. You may opt out at any time by contacting [email protected].

oke27 processes your personal data on the following legal bases:

• Contractual necessity — processing required to fulfill the contract between you and oke27, including account creation, payment processing, and service delivery.
• Legal obligation — processing required to comply with applicable laws, including KYC/AML obligations, age verification requirements, and responses to lawful regulatory requests.
• Legitimate interests — processing conducted for oke27's legitimate business interests, including fraud prevention, platform security, and responsible gaming monitoring, provided those interests are not overridden by your privacy rights.
• Consent — where we rely on your consent (e.g., for marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of processing conducted prior to withdrawal.

oke27 does not sell your personal data. We share personal data only in the following circumstances and only to the extent strictly necessary:

• Payment processors — banking partners and e-wallet providers (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay) receive the financial data required to process your transactions. These entities are subject to their own privacy obligations and are not authorized to use your data for any purpose beyond payment processing.
• KYC and identity verification providers — licensed third-party identity verification services receive the documents you submit during KYC review. All KYC providers used by oke27 operate under contractual data processing agreements.
• Fraud prevention and security services — technical data including IP addresses and device fingerprints may be shared with anti-fraud services to detect and prevent unauthorized access.
• Legal and regulatory authorities — we may disclose personal data to competent authorities, courts, or regulators where required by law or in response to a lawful order. We will notify you of such disclosures where legally permitted to do so.
• Business transfers — in the event of a merger, acquisition, or sale of oke27's assets, personal data held by oke27 may be transferred to the acquiring entity, subject to equivalent privacy protections.

oke27 retains personal data only for as long as necessary to fulfill the purposes described in this policy, or as required by applicable law. The following indicative retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized so that it can no longer be associated with an identifiable individual.

oke27 implements a layered security architecture to protect personal data against unauthorized access, disclosure, alteration, and destruction. Our security measures include:

• Encryption at rest: All personal data stored on oke27 infrastructure is encrypted using AES-256 bit encryption. Database fields containing sensitive identifiers are additionally hashed where appropriate.
• Encryption in transit: All data transmitted between Members' devices and oke27 servers is protected by TLS 1.2 or higher. We enforce HTTPS across the entire Platform with HTTP Strict Transport Security (HSTS).
• Access controls: Access to personal data within oke27 is restricted to personnel with a documented operational need. All internal access is logged, audited, and subject to least-privilege principles.
• Fraud and intrusion detection: Real-time monitoring systems analyze login patterns, transaction behavior, and system activity for anomalies indicating unauthorized access or fraudulent conduct.
• Incident response: oke27 maintains a documented data breach response procedure. In the event of a breach likely to result in risk to Members, affected individuals will be notified without undue delay.

oke27 uses cookies and similar tracking technologies to operate the Platform effectively and to understand how Members interact with our services. The following cookie categories are in use:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication tokens, security cookies, and load-balancing identifiers. These cannot be disabled without disrupting Platform functionality.
• Functional Cookies: Remember your preferences such as language settings, preferred deposit method display, and interface customization. These persist across sessions to improve your experience.
• Analytics Cookies: Collect aggregated, anonymized information about how Members navigate the Platform. This data is used to identify usability issues and improve our product. No personally identifiable information is collected via analytics cookies.
• Security Cookies: Detect and prevent fraud, bot activity, and unauthorized access attempts. These are essential and cannot be opted out of without impairing Platform security.

You may manage cookie preferences through your browser settings. Disabling certain cookie categories may affect the functionality of the oke27 Platform. oke27 does not use third-party advertising or retargeting cookies.

As a Member of oke27, you have the following rights with respect to your personal data. To exercise any of these rights, contact us at [email protected] with the subject line "Privacy Rights Request — [Your Account Username]".

We aim to respond to all privacy rights requests within 30 calendar days. Complex requests may require an extension of up to 60 days, in which case we will notify you of the extension and the reason for the delay.

oke27 strictly prohibits the use of its services by persons under the age of 21. We do not knowingly collect personal data from individuals under 21 years of age. Age verification is a mandatory step in the KYC process, and oke27 reserves the right to request proof of age from any Member at any time.

If oke27 becomes aware that personal data has been collected from a person under the age of 21, that data will be deleted immediately and the associated account will be closed with all wagering activity voided. Deposited funds will be returned to the original payment method.

Parents and guardians who have reason to believe that a minor has registered on oke27 are encouraged to contact us immediately at [email protected] for prompt account closure and data deletion.

oke27 is an internationally operated platform. Your personal data may be transferred to and processed in jurisdictions outside Indonesia, including the jurisdiction in which oke27 holds its international gaming license and the locations of our data processors.

Whenever personal data is transferred internationally, oke27 ensures that appropriate safeguards are in place, including contractual data transfer agreements with receiving entities requiring data protection standards equivalent to those described in this policy. Such transfers are conducted only to the extent necessary to operate our services.

oke27 may update this Privacy Policy periodically to reflect changes in our data practices, legal obligations, or Platform features. The following process governs policy updates:

• Material changes — those that affect how we use your data or your privacy rights — will be communicated to registered Members via email at least 14 days before they take effect.
• Minor updates (such as formatting changes, clarifications, or updated contact details) may take effect immediately upon publication.
• The "Last Updated" date at the top of this page reflects the date of the most recent revision.
• Your continued use of oke27 following the effective date of any material update constitutes acceptance of the revised Privacy Policy.

For any questions, concerns, or requests related to this Privacy Policy or to the personal data oke27 holds about you, please contact our team using the details below. oke27 is committed to acknowledging all privacy-related inquiries within 2 business days.

If you are not satisfied with oke27's response to a privacy inquiry, you have the right to escalate the matter to a relevant data protection authority or seek resolution through the dispute process outlined in our Terms & Conditions.