ori77 Privacy Policy

ori77 ("we", "us", "our") operates the online casino and sportsbook platform accessible at https://ori77.lat (the "Platform"). We are committed to protecting the privacy and security of your personal data. This Privacy Policy sets out how we collect, use, store, share, and protect information about you when you access or use the Platform, and how you can exercise your rights in relation to that information.

This Privacy Policy applies to all registered players, prospective players who browse the Platform without registering, and any individual who communicates with ori77 via live chat, WhatsApp, or email. It should be read alongside our Terms & Conditions, which govern the contractual relationship between you and ori77.

By creating an Account or by continuing to use the Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this Policy, you should discontinue using the Platform and contact us to close your Account.

For the purposes of applicable data protection legislation, ori77 acts as the data controller in respect of personal data collected through the Platform. This means ori77 determines the purposes for which your personal data is processed and the means by which that processing takes place.

Where ori77 engages third-party service providers — such as payment processors, game studios, or identity verification services — to process personal data on its behalf, those parties act as data processors under ori77's instruction and are bound by contractual data processing agreements that restrict their use of your data to the specific services they provide.

If you have any questions about how ori77 handles your personal data, you may contact us using the details set out in Clause 14 of this Policy.

ori77 collects only the personal data that is necessary for the purposes described in this Privacy Policy. The categories of personal data we collect are set out in the table below.

ori77 collects your personal data through the following channels:

• Directly from you: When you register an Account, complete KYC verification, make a deposit or withdrawal, use the live chat or WhatsApp support, respond to a promotional offer, or update your account profile.
• Automatically through the Platform: When you visit, browse, or interact with the Platform, we automatically collect Technical Data and Usage Data via server logs, cookies, and similar tracking technologies. See Clause 10 for more detail on cookies.
• From identity verification partners: When you submit KYC documentation, ori77 may use third-party identity verification services to authenticate your KTP and confirm your identity. These partners return a verification result and, where permitted, matched identity fields to ori77.
• From payment processors: When a deposit or withdrawal is processed, our payment partners transmit transaction confirmation data (reference numbers, timestamps, amounts in IDR) to ori77 to reconcile your Account balance.
• From fraud prevention and AML services: ori77 may receive risk signals, watchlist match results, or transaction monitoring alerts from specialist anti-fraud and anti-money-laundering service providers as part of our international licensing obligations.

ori77 processes your personal data only when there is a valid legal basis to do so. The following table describes each processing purpose and the corresponding legal basis.

Where ori77 relies on legitimate interests as the legal basis for processing, we have conducted a balancing test confirming that our interests do not override your fundamental rights and freedoms. You may request a summary of any such balancing test by contacting our support team.

Where ori77 relies on your consent — specifically for promotional communications — you may withdraw that consent at any time by updating your notification preferences in your Account settings or by contacting support. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

ori77 does not sell, rent, or trade your personal data to any third party for their own commercial purposes. We share your data only in the limited circumstances described below, and only to the extent necessary for the relevant purpose.

• Payment processors and banking partners: We share the identity and financial data necessary to process your deposits and withdrawals via BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI, OVO, DANA, GoPay, ShopeePay, and LinkAja. Each payment partner operates under its own privacy policy and is contractually bound to use your data solely for the transaction at hand.
• Identity verification providers: KTP documentation and identity fields are shared with our KYC partner solely for the purpose of completing your identity verification. Verified results are returned to ori77; raw document copies are not retained by our KYC partner beyond the verification window.
• Game content studios: When you play a game supplied by a third-party studio (such as Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, or Pocket Games Soft), your account token and session data are transmitted to that studio's platform infrastructure to deliver the game. No identity data beyond an anonymized session token is shared with game studios.
• Anti-fraud and AML service providers: Transaction monitoring and fraud prevention partners receive the data necessary to generate risk scores and watchlist matches. These partners act as data processors under ori77's instruction.
• Regulatory and law enforcement authorities: ori77 will disclose personal data to competent authorities when required to do so by applicable law, court order, or regulatory direction under our international gaming license.
• Professional advisers: Legal counsel, auditors, and compliance consultants may access personal data on a strictly need-to-know basis, under obligations of professional confidentiality.
• Business transfers: In the event of a merger, acquisition, or sale of substantially all of ori77's assets, personal data may be transferred to the successor entity. We will notify registered players via email at least 30 days before any such transfer takes effect and will ensure the successor entity is bound by terms no less protective than this Privacy Policy.

ori77's Platform infrastructure and some of its service providers are located outside Indonesia. When your personal data is transferred to, or accessed from, a country other than Indonesia, ori77 ensures that appropriate safeguards are in place to protect that data to a standard at least equivalent to this Privacy Policy.

Safeguards we rely upon for international data transfers include:

• Contractual clauses between ori77 and its overseas processors that impose data protection obligations equivalent to applicable international standards.
• Transferring to processors located in jurisdictions that maintain adequate data protection frameworks recognized by our licensing authority.
• Technical and organizational security measures (described in Clause 9) that apply regardless of processing location.

You may request details of the specific safeguards in place for any particular international transfer by contacting ori77 support at the details in Clause 14.

ori77 retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by our international gaming license obligations and applicable anti-money laundering regulations.

• Active Account data: Retained for the duration of your Account and for 5 years following Account closure, to satisfy AML record-keeping obligations and to resolve any latent disputes.
• KYC documentation: Retained for 5 years from the date of verification or from the date of Account closure, whichever is later, in accordance with our licensing authority's requirements.
• Transaction records: Deposit and withdrawal records in IDR are retained for 5 years following the date of the transaction.
• Gaming history: Game session records are retained for 3 years from the date of play. Aggregated, anonymized gameplay statistics may be retained indefinitely for platform analytics purposes.
• Communications data: Live chat and WhatsApp transcripts, and email correspondence, are retained for 2 years from the date of the interaction, or for the life of any related dispute, whichever is longer.
• Responsible gaming records: Self-exclusion and limit-setting records are retained for 5 years from the date of the election, to ensure compliance with exclusion obligations and to prevent re-registration during an active self-exclusion period.
• Marketing consent records: Records of consent and withdrawal of consent for promotional communications are retained for 3 years from the most recent consent action, to demonstrate compliance if challenged.

At the end of the applicable retention period, personal data is securely deleted or anonymized so that it can no longer be associated with you as an individual. Where anonymization is not technically feasible, data is encrypted and access-restricted until deletion is possible.

ori77 implements industry-standard technical and organizational measures to protect your personal data against unauthorized access, accidental loss, destruction, or disclosure. Our security framework includes the following controls:

• Transport Encryption: All data transmitted between your device and the ori77 Platform is encrypted using TLS 1.2 or higher. The Platform is served exclusively over HTTPS.
• Data-at-Rest Encryption: Personal data stored in ori77's databases is encrypted at rest using AES-256 encryption. KTP documentation and financial records are stored in isolated, access-controlled environments.
• Access Controls: Access to personal data within ori77's internal systems is restricted on a strict need-to-know basis. All staff with access to personal data undergo background screening and receive regular data protection training.
• Two-Factor Authentication: ori77's internal administrative systems require multi-factor authentication for all staff access. We strongly recommend that players enable any available two-factor authentication features on their ori77 Account.
• Penetration Testing: The Platform is subject to regular third-party security assessments and penetration testing. Critical vulnerabilities identified are remediated within defined SLA windows.
• Incident Response: ori77 maintains a documented security incident response plan. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify affected players via their registered email address within 72 hours of becoming aware of the incident.

ori77 uses cookies and similar tracking technologies to operate the Platform, remember your preferences, detect fraud, and analyze usage patterns. The following categories of cookies are used on the Platform:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function. They manage your session, maintain your login state, and enable core security features. They cannot be disabled without breaking Platform functionality.
• Functional Cookies: These cookies remember your preferences — such as your preferred language, display settings, and responsible gaming configurations — so that you do not need to reconfigure them on each visit.
• Analytics Cookies: These cookies collect anonymized or pseudonymized data about how visitors navigate the Platform — which pages are visited most, where users drop off, and which features are used — to help ori77 improve the user experience. Analytics data is aggregated and is not used to identify individual players.
• Security and Fraud Prevention Cookies: These cookies help ori77 detect and prevent fraudulent activity, multi-accounting, and automated bot traffic. They may capture device fingerprint signals and behavioral patterns for risk-scoring purposes.

ori77 does not use advertising or third-party retargeting cookies. We do not share cookie data with advertising networks or social media platforms for targeted advertising purposes.

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will impair your ability to log in and use the Platform. For analytics and functional cookies, you may opt out via your browser without affecting core Platform functionality.

You have the following rights in respect of your personal data held by ori77. To exercise any of these rights, contact our support team using the details in Clause 14. We will respond to all verified requests within 30 days. No fee is charged for exercising your rights unless a request is manifestly unfounded or excessive.

The ori77 Platform is strictly intended for adults aged 21 and above. 21+ ori77 does not knowingly collect personal data from any individual under the age of 21. If ori77 discovers or is notified that an Account has been created by a person under 21, we will immediately suspend that Account, delete all associated personal data to the extent permitted by our legal obligations, and refund any deposits to the extent they are recoverable.

If you believe a person under 21 has registered an Account on the ori77 Platform, please notify us immediately via live chat or at the email address in Clause 14. We take age verification seriously and act on all credible reports without delay.

ori77 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, new regulatory requirements, or updates to our Platform. When we make material changes — for example, changes to the categories of data we collect, the purposes for which we use it, or the third parties with whom we share it — we will notify registered players via their registered email address at least 14 days before the revised Policy takes effect.

Minor clarifications or non-material updates (such as correcting typographical errors or updating contact details) may be published without advance notice. The "Last Updated" date at the top of this page always reflects the date of the most recent revision. We encourage you to review this Policy periodically.

Continued use of the Platform after any revised Privacy Policy takes effect constitutes your acceptance of the updated terms. If you do not agree with any change, please cease using the Platform and contact support to close your Account.

If you have any questions, concerns, or requests relating to this Privacy Policy or ori77's processing of your personal data, please contact our Data Support team through any of the following channels:

• Live Chat: Available 24/7 directly on the ori77 Platform. Average response time under 90 seconds during Indonesian peak hours (08:00–24:00 WIB).
• WhatsApp: +62 811 0077 7700 — available around the clock for account, privacy, and data rights queries.
• Email: support@ori77.lat — for formal data subject access requests, erasure requests, and detailed privacy inquiries. We aim to respond within 5 business days (WIB) for privacy-related matters.

When submitting a data rights request by email, please include your registered username and the email address associated with your ori77 Account to allow us to verify your identity and locate your records efficiently.