ok500 Privacy Policy

1Introduction

ok500 is an internationally operated online gaming platform serving players in Indonesia. We operate at ok500.cam and offer sports betting, live casino, and RNG slot products. In the course of delivering these services, we necessarily collect and process certain personal data about the individuals who use our platform.

We are committed to handling that data with the utmost care, in full compliance with applicable international data protection principles and the requirements of Indonesian Law Number 27 of 2022 on Personal Data Protection (UU PDP) to the extent it applies to our international operations. This Policy explains our practices in plain English so that you can make fully informed decisions about sharing your data with us.

This Policy applies to all data collected through the ok500 website, any associated mobile-optimised interfaces, communications sent to you by ok500, and interactions with our customer support team. It does not apply to third-party websites or services that may be linked to or from the ok500 platform — those parties maintain their own privacy policies for which ok500 bears no responsibility.

2Definitions

The following definitions apply throughout this Policy:

• "Personal Data" — any information that identifies or can reasonably identify a living individual, either directly (e.g., your full name, national ID number) or indirectly in combination with other data (e.g., account number plus device fingerprint).
• "Processing" — any operation performed on personal data, including collection, recording, organisation, storage, adaptation, retrieval, consultation, use, disclosure, combination, restriction, erasure, or destruction.
• "Data Controller" — the entity that determines the purposes and means of processing personal data. For data collected on the ok500 platform, ok500 acts as the Data Controller.
• "Data Processor" — a third party that processes personal data on behalf of ok500 and under our documented instructions (e.g., a payment gateway or identity verification provider).
• "KYC Data" — identity documents and supporting materials submitted by a Player as part of the Know Your Customer verification process, including but not limited to Indonesian KTP, passport scans, and bank account evidence.
• "Cookies" — small text files placed on your device by the ok500 platform for the purposes described in Clause 9.
• "Platform" — the ok500 website, sub-pages, mobile interfaces, APIs, and all services made available at ok500.cam.

3Data We Collect

ok500 collects personal data from you through several distinct channels. The categories below outline what we collect and the typical source of each category.

3.1 Data You Provide Directly

• Registration data: Full legal name, date of birth, Indonesian residential address, email address, and mobile phone number.
• KYC documents: Copies of your Indonesian National Identity Card (KTP) or passport, and proof of bank account ownership (e.g., a statement or screenshot from BCA, BRI, BNI, Mandiri, CIMB Niaga, or a registered e-wallet such as OVO, DANA, GoPay, ShopeePay, or LinkAja).
• Financial data: Bank account numbers, e-wallet account identifiers, deposit amounts, withdrawal requests, and transaction history. ok500 does not store full card numbers or CVV codes.
• Communications data: The content of emails, live chat transcripts, and any other messages you send to our support team at [email protected].
• Self-reported preferences: Responsible gaming limit settings, preferred language, and any voluntary information you add to your account profile.

3.2 Data Collected Automatically

• Device and technical data: IP address, browser type and version, operating system, device model, screen resolution, and time zone.
• Usage data: Pages visited, features used, session start and end times, betting history, game history (including individual round results in slots and live casino), and search queries entered on the platform.
• Log data: Server-side logs recording login timestamps, failed authentication attempts, password reset requests, and withdrawal requests, maintained for security and fraud-prevention purposes.
• Cookies and tracking data: As described in detail in Clause 9 below.

3.3 Data Received from Third Parties

• Identity verification agencies: When you submit KYC documents, we may cross-reference your data against third-party identity verification databases to confirm authenticity.
• Payment processors: Transaction confirmation data, settlement status, and fraud-scoring signals returned by our payment processing partners.
• Fraud prevention services: Risk scores, device fingerprints, and flagged-activity signals from contracted anti-fraud service providers.

4How We Use Your Data

ok500 processes your personal data only for specific, documented purposes. We do not repurpose your data for uses beyond those listed below without first obtaining your explicit consent or establishing a new legal basis.

• Account management: Creating, maintaining, and administering your ok500 player account, including processing deposits and withdrawals in IDR via Indonesian banking channels.
• Identity verification (KYC): Confirming that you are who you claim to be, that you are at least 21 years of age, and that you are a resident of Indonesia, in compliance with our anti-money laundering obligations.
• Service delivery: Enabling you to place wagers on sports markets (including BRI Liga 1, EPL, Champions League, and other competitions), play live casino tables, and access RNG games such as slot gacor (Indonesia's popular high-RTP slot category).
• Transaction processing: Facilitating deposits and withdrawals through BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja, and reconciling account balances accordingly.
• Security and fraud prevention: Detecting, investigating, and preventing fraudulent transactions, multi-accounting, bonus abuse, and other prohibited conduct as defined in our Terms & Conditions.
• Regulatory compliance: Meeting our obligations under applicable international anti-money laundering regulations, financial intelligence reporting requirements, and responsible gaming mandates.
• Customer support: Responding to your enquiries, resolving disputes, and managing self-exclusion and responsible gaming requests submitted via [email protected].
• Platform improvement: Analysing aggregated, anonymised usage data to improve the performance, stability, and user experience of the ok500 platform.
• Marketing communications: Sending you promotional offers, bonus notifications, and platform updates by email or SMS, where you have opted in to receive such communications. You may withdraw consent at any time as described in Clause 8.

5Legal Basis for Processing

Each processing activity we carry out rests on one of the following legal bases:

• Contractual necessity: Processing your registration data, KYC documents, and financial transaction data is necessary to perform the contract we have with you (your ok500 player account). Without this data, we cannot provide the service.
• Legal obligation: Processing for KYC verification, anti-money laundering record-keeping, and reporting to financial intelligence authorities is required by applicable law and cannot be waived by either party.
• Legitimate interests: Processing for fraud detection, platform security, server logging, and aggregated analytics is carried out in pursuit of our legitimate interest in operating a secure, fair, and viable gaming platform. We have assessed that this interest is not overridden by your privacy rights in these contexts.
• Consent: Processing for marketing communications, non-essential cookies, and optional profile features is based on your freely given, specific, and revocable consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

6Sharing Your Personal Data

ok500 does not sell your personal data. We share your data only in the limited circumstances described below, and always under contractual protections that require the recipient to process your data only for the specified purpose and to apply appropriate security measures.

6.1 Service Providers (Data Processors)

We engage third-party service providers to process data on our behalf, including:

• Payment processors: Partners integrated with Indonesian bank transfer networks (BCA, BRI, BNI, Mandiri, CIMB Niaga) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the minimum transaction data required to execute each payment.
• Identity verification providers: Third-party KYC services that verify the authenticity of government-issued identity documents against official databases.
• Game studios: Licensed studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Pocket Games Soft, and Habanero receive anonymised session identifiers required to deliver game content and resolve disputes. They do not receive your name, ID documents, or financial data.
• Cloud infrastructure providers: Servers and databases hosting ok500 platform data are operated by contracted cloud infrastructure partners under strict data processing agreements and security standards.
• Fraud and security services: Anti-fraud vendors that provide risk scoring and device intelligence to protect the integrity of the platform.

6.2 Regulatory and Law Enforcement Authorities

ok500 may disclose your personal data to competent governmental, regulatory, or law enforcement authorities where required to do so by applicable law, by a valid court order, or by a lawful request from a financial intelligence authority. We will, where legally permissible, notify you of such a disclosure request before responding to it.

6.3 Business Transfers

In the event that ok500 undergoes a merger, acquisition, asset sale, or corporate restructuring, your personal data may be transferred to the acquiring or successor entity as part of that transaction. You will be notified of any such transfer and of any material change to this Policy that results from it, with a minimum of 30 days' notice before the transfer takes effect.

7Data Retention

ok500 retains your personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable legal or regulatory obligations. The following retention periods apply:

• Account data and transaction history: Retained for a minimum of 5 years from the date of account closure or the last transaction, whichever is later, to satisfy anti-money laundering record-keeping requirements.
• KYC documents: Retained for a minimum of 5 years from the date of verification or account closure, whichever is later. After this period, documents are securely and permanently deleted.
• Customer support communications: Retained for 2 years from the date of the communication, or until resolution of any dispute to which the communication is relevant, whichever is later.
• Marketing consent records: Retained for the duration of your consent and for 1 year thereafter as proof of consent, unless you request earlier deletion.
• Anonymised analytics data: Aggregated and anonymised usage data from which no individual can be identified may be retained indefinitely for platform improvement purposes.
• Server and security logs: Retained for 12 months, after which they are automatically purged.

When data is no longer required, ok500 ensures its secure disposal through irreversible deletion from all active systems and physical destruction of any portable media on which it was stored.

8Your Data Rights

Subject to applicable law and our legal retention obligations, you have the following rights in relation to your personal data held by ok500:

• Right of access: You may request a copy of all personal data ok500 holds about you. We will provide this within 30 calendar days of a verified request.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. For minor corrections (e.g., email address), contact our support team. For corrections to KYC documents, a new verification submission will be required.
• Right to erasure ("right to be forgotten"): You may request the deletion of your personal data. We will comply where there is no overriding legal obligation to retain the data (e.g., anti-money laundering retention requirements take precedence). We will confirm the outcome of your erasure request within 30 calendar days.
• Right to restriction of processing: You may request that we restrict the processing of your data while a correction or erasure request is under review, or where you have objected to processing and we are assessing your objection.
• Right to data portability: You may request a machine-readable export of personal data you provided to us directly (e.g., account profile data, transaction history) for transfer to another service provider. This right applies to data processed on the basis of consent or contractual necessity.
• Right to object: You may object to processing carried out on the basis of legitimate interests. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing emails), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. To unsubscribe from marketing communications, follow the unsubscribe link in any marketing email or contact [email protected].

9Cookies & Tracking Technologies

ok500 uses cookies and similar tracking technologies on the platform. A cookie is a small text file stored on your browser or device when you visit a website. We use the following categories of cookies:

9.1 Strictly Necessary Cookies

These cookies are essential for the platform to function. They enable core features such as session authentication (keeping you logged in), security token validation, and load balancing across our server infrastructure. You cannot opt out of strictly necessary cookies without disabling the platform entirely.

9.2 Performance and Analytics Cookies

These cookies collect anonymised information about how Players use the platform — which pages are visited most frequently, where errors occur, and how long sessions last. The data is aggregated and cannot be used to identify any individual. We use this data solely to improve platform performance and stability.

9.3 Functional Cookies

These cookies remember your preferences, such as your preferred payment method, session time limit settings, and responsible gaming reminders. They improve your experience by reducing the need to re-enter preferences on each visit.

9.4 What We Do Not Use

ok500 does not deploy third-party advertising cookies, behavioural profiling cookies, social media pixel trackers, or retargeting cookies of any kind. We do not participate in cross-site advertising networks.

9.5 Managing Cookies

You may manage or delete cookies through your browser settings at any time. Note that disabling performance or functional cookies may degrade certain platform features. Instructions for managing cookies in common browsers are available from the respective browser provider's help documentation.

10Minors & Under-21 Policy

ok500 strictly prohibits access to the platform by persons under 21 years of age. We do not knowingly collect, process, or retain personal data from minors.

During the registration and KYC process, ok500 verifies that the applicant is at least 21 years of age using date-of-birth declarations cross-referenced against identity documents. Any account found to have been registered by a person under 21 is immediately and permanently closed. All associated personal data is purged from our systems within 30 days of discovery, to the extent not required to be retained by law.

Parents and guardians who believe that a person under 21 in their care has registered an account or shared personal data with ok500 are encouraged to contact us immediately at [email protected]. We will act promptly to close the account and delete the data.

11Data Security

ok500 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, disclosure, or destruction. Key measures include:

• Encryption in transit: All data transmitted between your device and the ok500 platform is encrypted using TLS 1.2 or higher (256-bit SSL). Look for the padlock icon in your browser's address bar when visiting ok500.cam.
• Encryption at rest: Personal data and KYC documents stored on our servers are encrypted at rest using AES-256 encryption.
• Access controls: Access to personal data is restricted to authorised personnel on a strict need-to-know basis. All internal access is logged and subject to regular audit.
• Two-factor authentication: ok500 supports two-factor authentication (2FA) for player accounts and enforces 2FA for all internal staff accounts with access to personal data.
• Penetration testing: ok500 engages independent security specialists to conduct regular penetration tests on the platform infrastructure. Critical vulnerabilities are remediated within 72 hours of discovery.
• Incident response: ok500 maintains a documented data breach response plan. In the event of a breach affecting your personal data, we will notify you and, where required, the relevant supervisory authority, within 72 hours of becoming aware of the breach.

While ok500 applies industry-standard security controls, no system connected to the internet can be guaranteed to be completely secure. You play an important role in protecting your account by maintaining a strong, unique password and reporting any suspicious activity to [email protected] immediately.

12International Data Transfers

ok500 is an internationally operated platform. Your personal data may be stored on servers located outside Indonesia and may be transferred to, or accessed from, countries in which ok500's service providers operate. These countries may have data protection laws that differ from those of Indonesia.

When we transfer personal data internationally, we ensure that appropriate safeguards are in place to protect it to a standard at least equivalent to that afforded by this Policy. Safeguards include:

• Data processing agreements with all third-party service providers containing contractual data protection obligations.
• Transfer only to countries or service providers that maintain internationally recognised security certifications (e.g., ISO 27001) or equivalent contractual commitments.
• Limiting transferred data to the minimum set necessary for the third party to perform their contracted function.

If you would like further information about the specific safeguards applicable to any international transfer of your data, please contact us at [email protected].

13Amendments to This Policy

ok500 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or the structure of the platform. Material changes — those that significantly affect your rights or the way we use your data — will be communicated to registered players by email to the address on file at least 14 days before the revised Policy takes effect.

Non-material changes (such as formatting corrections or clarifications that do not alter the substance of our practices) may be posted to this page without advance notice, and the "Last Updated" date at the top of this Policy will be revised accordingly.

Your continued use of the ok500 platform after the effective date of any amended Privacy Policy constitutes your acceptance of the revised terms. If you do not agree to the changes, you should stop using the platform and request account closure at [email protected] before the effective date.

We maintain an internal version history of this Policy. If you require a copy of a previous version for reference, please contact our support team with the relevant date.

14Contact & Data Rights Requests

If you have any questions about this Privacy Policy, wish to exercise any of your data rights described in Clause 8, or want to report a data protection concern, please contact ok500 through the following channel:

We treat all data rights requests seriously and with complete confidentiality. To verify your identity before processing a request, we may ask you to confirm details matching your registered ok500 account. This is solely to prevent unauthorised access to another person's data.

For questions about our responsible gaming data practices, including self-exclusion records and deposit limit settings, you may also visit our Responsible Gaming page for direct access to player-protection tools.