Privacy Policy — ori33 Online Betting Platform

Introduction

ori33 ("ori33", "we", "us", "our") is committed to protecting the privacy and personal data of every individual who uses the ori33 online betting and gaming platform at https://ori33.pro (the "Platform"). This Privacy Policy describes our practices with respect to the collection, use, storage, sharing, and deletion of personal data relating to registered members and visitors to the Platform.

This policy applies to all personal data collected through the ori33 Platform, including data collected during account registration, identity verification (KYC), financial transactions, customer support interactions, and your use of any of ori33's betting and gaming products — including sports betting, live casino, slots, poker tournaments, and Sic Bo.

ori33 serves Indonesian members and operates with the privacy expectations of Indonesian users in mind. Where Indonesian members provide data in Indonesian Rupiah (IDR) transactions via local payment methods such as BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, or LinkAja, that data is handled with the same level of care and security as all other personal data described in this policy.

This Privacy Policy should be read alongside ori33's Terms & Conditions and Responsible Gaming policy, both of which incorporate data-processing obligations by reference.

Data Controller

For the purposes of this Privacy Policy, ori33 acts as the data controller in respect of all personal data collected from members and visitors to the Platform. As data controller, ori33 determines the purposes and means of processing your personal data.

ori33 may engage third-party service providers who act as data processors on ori33's behalf. These processors are described in Section 7 (Third-Party Sharing). All data processors engaged by ori33 are bound by written data processing agreements that restrict them to processing personal data only on ori33's documented instructions and for no other purpose.

If you have any questions about how ori33 handles your personal data, or if you wish to exercise any of the data rights described in Section 10, please contact ori33's Data Protection contact using the details provided in Section 15.

Data We Collect

ori33 collects personal data in three broad categories: data you provide directly, data collected automatically during your use of the Platform, and data received from third parties in the course of delivering ori33's services. The table below summarises each category:

ori33 does not collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data (beyond identity document photographs required for KYC), health data, or data concerning sexual orientation, except where such data is voluntarily disclosed by a member to ori33's support team in the context of a responsible gaming request.

How We Use Your Data

ori33 uses the personal data described in Section 3 for the following specific purposes. For each purpose, we have identified the corresponding legal basis for processing in Section 5.

• Account creation and management: To register your ori33 account, verify your identity, maintain your account profile, and provide you with access to ori33's betting and gaming products.
• Financial transaction processing: To process your IDR deposits and withdrawals via Indonesian banks and e-wallets, reconcile your account balance, and issue transaction confirmations.
• Identity verification (KYC): To verify that you are a resident of Indonesia aged 21 or over, in compliance with ori33's age verification and anti-fraud obligations.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent transactions, money laundering, collusion, bonus abuse, and other prohibited conduct as described in ori33's Terms & Conditions.
• Responsible gaming compliance: To monitor your betting activity for indicators of problem gambling, to apply deposit limits, cooling-off periods, or self-exclusion measures at your request, and to fulfil ori33's responsible gaming obligations.
• Customer support: To respond to your enquiries, process your complaints, and provide assistance via live chat and email.
• Platform improvement: To analyse aggregated, anonymised usage data to improve the design, performance, and product offering of the ori33 platform.
• Marketing communications: To send you promotional offers, bonus announcements, and platform news — only where you have expressly opted in to receive such communications. See Section 13 for details and opt-out instructions.
• Legal compliance: To comply with applicable laws, court orders, and instructions from competent regulatory authorities, and to establish, exercise, or defend legal claims involving ori33.

Legal Basis for Processing

ori33 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing is necessary to perform the contract between ori33 and you (i.e., the Terms & Conditions you agreed to upon registration). This covers account management, financial transaction processing, and KYC verification.
• Legitimate interests: Processing is necessary for ori33's legitimate interests, provided those interests are not overridden by your fundamental rights and freedoms. Legitimate interests include fraud prevention, platform security, anti-money laundering controls, and anonymised analytics for platform improvement.
• Legal obligation: Processing is necessary for ori33 to comply with a legal obligation, including record-keeping requirements for financial transactions, age verification obligations, and responding to lawful requests from competent authorities.
• Consent: For marketing communications and non-essential cookies, ori33 relies on your freely given, specific, informed consent. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal. See Sections 6 and 13 for details.

Cookies & Tracking Technologies

ori33 uses cookies and similar tracking technologies to operate and improve the Platform. A cookie is a small text file placed on your device when you visit the ori33 website. The following categories of cookies are used:

• Strictly necessary cookies: These cookies are essential for the Platform to function and cannot be disabled. They include session authentication cookies, load-balancing cookies, and security tokens. No consent is required for strictly necessary cookies.
• Functional cookies: These cookies remember your preferences (such as your preferred game lobby layout or language display settings) to provide a more personalised experience. They are activated only with your consent.
• Analytics cookies: These cookies collect anonymised data about how visitors use the Platform — such as which game categories are most popular or which pages generate the most navigation drop-off — to help ori33 improve the Platform. They are activated only with your consent.
• Marketing cookies: These cookies track your activity on the Platform to enable ori33 to deliver relevant promotional content. They are activated only with your explicit consent and can be withdrawn at any time.

You may manage your cookie preferences at any time via the cookie preference centre accessible from the ori33 platform footer. Disabling cookies other than strictly necessary ones may affect your experience on the Platform but will not prevent you from accessing core betting and gaming functions.

ori33 does not use third-party advertising networks' tracking pixels or cross-site tracking scripts that report your ori33 activity to external advertising platforms.

Third-Party Sharing

ori33 does not sell, rent, or trade your personal data to any third party. ori33 shares personal data only in the following limited and controlled circumstances:

• Payment processors and banking partners: ori33 shares the minimum necessary financial data (e.g., account name, account number, transaction amount in IDR) with Indonesian banking institutions (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) solely for the purpose of processing your deposits and withdrawals.
• KYC and identity verification partners: ori33 uses accredited third-party identity verification service providers to assist in validating KTP documents, passports, and proof of address. These providers process your identity documents solely for the purpose of verifying your identity on ori33's behalf and are bound by strict data processing agreements.
• Game content providers: Game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive anonymised session identifiers necessary to deliver their games within the ori33 platform. These providers do not receive your name, contact details, or financial data.
• Fraud prevention and security services: ori33 may share limited technical data (IP address, device fingerprint, session metadata) with specialist fraud prevention and cybersecurity service providers to protect the integrity of the Platform.
• Legal and regulatory disclosures: ori33 may disclose your personal data to courts, law enforcement agencies, or regulatory authorities where required to do so by applicable law, a valid court order, or a binding instruction from a competent authority. ori33 will, where legally permitted, notify you of such a disclosure.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of ori33's assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified by email of any such transfer and of any material changes to this Privacy Policy that result from it.

International Data Transfers

ori33 is an internationally operated platform. Some of the service providers that process data on ori33's behalf may be located in countries outside Indonesia. Where personal data is transferred outside Indonesia to a country that does not provide an equivalent level of data protection, ori33 ensures that appropriate safeguards are in place, including:

• Contractual clauses that bind the recipient to data protection standards consistent with internationally recognised principles;
• Limiting the scope of data transferred to the minimum necessary for the specific processing purpose;
• Requiring recipients to implement technical and organisational security measures appropriate to the risk level of the data transferred.

If you would like more information about the specific safeguards ori33 has put in place for international data transfers involving your personal data, please contact ori33 using the details in Section 15.

Data Retention

ori33 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following retention periods apply:

• Account data (identity, contact, KYC documents): Retained for five (5) years following the date of account closure or the date of your last transaction, whichever is later. This period reflects anti-money laundering record-keeping requirements.
• Financial transaction records (deposits, withdrawals, bet history): Retained for seven (7) years from the date of each transaction, in line with standard financial record-keeping obligations.
• Customer support communications: Retained for three (3) years from the date of the final communication in each support case, to allow ori33 to reference historical interactions in the event of a dispute.
• Marketing preference records: Opt-in consent records are retained for the duration of your account and for three (3) years thereafter as evidence of your consent. Marketing communications stop immediately upon opt-out; opt-out records are retained permanently to prevent inadvertent re-engagement.
• Technical and usage data (logs, IP records): Retained for ninety (90) days on a rolling basis, after which they are deleted or anonymised.

When personal data is no longer required under the retention periods above, ori33 will securely delete or irreversibly anonymise it so that it can no longer be associated with any individual.

Your Rights Over Your Personal Data

As a member of ori33, you hold the following rights in respect of your personal data. To exercise any of these rights, please contact ori33's support team using the details in Section 15. ori33 will respond to all verified data rights requests within thirty (30) calendar days of receipt.

• Right of access: You have the right to request a copy of all personal data ori33 holds about you. ori33 will provide this in a structured, commonly used format.
• Right to rectification: If any personal data ori33 holds about you is inaccurate or incomplete, you have the right to request that ori33 correct or complete it without undue delay.
• Right to erasure ("right to be forgotten"): You may request that ori33 delete your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn your consent (and no other legal basis applies), or where you have successfully objected to the processing. Note that this right is subject to ori33's legal retention obligations — ori33 cannot delete financial transaction records required to be retained under applicable law.
• Right to restriction of processing: You may request that ori33 restrict the processing of your personal data in certain circumstances — for example, while a rectification request is being investigated, or while an objection to processing is pending.
• Right to data portability: Where ori33 processes your data on the basis of your consent or contractual necessity, and that processing is carried out by automated means, you have the right to receive your data in a machine-readable format and to transmit it to another service provider.
• Right to object: You have the right to object to ori33 processing your personal data on the basis of legitimate interests. ori33 will cease such processing unless ori33 can demonstrate compelling legitimate grounds that override your interests, or where the processing is necessary for the establishment, exercise, or defence of legal claims.
• Right to withdraw consent: Where ori33 processes your data on the basis of your consent (e.g., marketing communications, non-essential cookies), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that took place before withdrawal.

Children & Minors

ori33 strictly prohibits access to the Platform by any individual under the age of 21. ori33 does not knowingly collect personal data from any person under 21 years of age.

If ori33 becomes aware that personal data has been collected from an individual under 21, ori33 will immediately close the associated account, delete all personal data related to that account, and return any deposited funds to the payment method used, subject to identity verification.

Parents and guardians in Indonesian households are strongly encouraged to use parental control software to prevent minors from accessing online gambling and betting platforms. If you believe a minor has registered on ori33, please contact ori33's support team immediately using the details in Section 15.

Security Measures

ori33 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• TLS/SSL encryption: All data in transit between your device and ori33's servers is encrypted using current-generation Transport Layer Security (TLS) protocols. Our SSL certificate is maintained and renewed continuously.
• Encryption at rest: Sensitive personal data stored in ori33's databases — including KYC documents, financial data, and account credentials — is encrypted at rest using AES-256 or equivalent industry-standard encryption.
• Access controls: Access to systems containing personal data is restricted to ori33 staff who genuinely need it to perform their role. All access is authenticated, logged, and subject to regular access review audits.
• Two-factor authentication: ori33 strongly recommends that all members enable two-factor authentication (2FA) on their accounts. 2FA adds an additional verification step at login, significantly reducing the risk of unauthorised account access.
• Penetration testing and vulnerability management: ori33's platform infrastructure is subject to regular penetration testing by qualified security professionals. Identified vulnerabilities are triaged and remediated according to a risk-based priority framework.
• Incident response: ori33 maintains a documented data breach response procedure. In the event of a personal data breach that poses a risk to your rights and freedoms, ori33 will notify affected members without undue delay and in accordance with applicable notification obligations.

While ori33 takes all reasonable precautions to protect your personal data, no data transmission over the internet or electronic storage system is 100% secure. You are responsible for keeping your ori33 account credentials confidential and for using a secure internet connection when accessing the Platform.

Marketing Communications

With your consent, ori33 may send you promotional emails and platform notifications about bonuses, new game releases, seasonal promotions (including promotions tied to Indonesian occasions such as Idul Fitri, Ramadhan, and Indonesian Independence Day on 17 August), and platform updates.

ori33 will never send marketing communications to members who have not opted in. Your marketing preference can be updated at any time via your account settings or by contacting ori33's support team. Opt-out requests are actioned within five business days, after which no further marketing communications will be sent to you.

ori33 does not share your contact details with third-party marketers for their own direct marketing purposes. All marketing communications sent by ori33 come from ori33 exclusively and are clearly identified as such.

Amendments to This Policy

ori33 reserves the right to update or amend this Privacy Policy at any time to reflect changes in ori33's data practices, applicable law, or the nature of ori33's services. When material changes are made, ori33 will notify registered members by email to their registered email address at least seven (7) calendar days before the amended policy takes effect.

The effective date shown at the top of this page indicates when the current version of the Privacy Policy entered into force. Your continued use of the ori33 Platform after the effective date of any amendment constitutes your acknowledgment of the revised policy. If you do not agree with the amended policy, you must stop using the ori33 Platform and may request account closure by contacting ori33 support.

The most current version of this Privacy Policy is always accessible at /privacy-policy.

Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or wish to raise a complaint about how ori33 has handled your personal data, please contact ori33's support team through any of the following channels:

• Live Chat: Available 24/7 via the ori33 Platform (WIB, UTC+7). Indonesian-speaking support agents are available at all times.
• Email: [email protected] (plain text — not a clickable link). ori33 aims to respond to all privacy-related email enquiries within two business days.

When submitting a data rights request or privacy complaint, please include your ori33 account username, a clear description of your request or complaint, and any relevant reference numbers. This will help ori33's team process your request as efficiently as possible.

If you are not satisfied with ori33's response to a privacy complaint, you may escalate the matter through ori33's formal dispute resolution process as described in Section 14 of ori33's Terms & Conditions.