Privacy Policy
ori77 Data Protection Statement

This Privacy Policy ("Policy") applies to all personal data processed by ori77 in connection with the operation of the online betting and casino platform at https://ori77.cam ("Platform"). ori77 acts as the data controller in respect of personal data provided by Members and visitors. By registering an Account or continuing to use the Platform, you acknowledge that you have read and understood this Policy.

The following terms carry the meanings set out below throughout this Policy:

ori77, operating the Platform at https://ori77.cam, is the data controller responsible for Personal Data collected through the Platform. ori77 determines the purposes for which Member data is processed and the means by which that processing takes place.

Where ori77 engages third-party service providers to carry out processing activities on its behalf — such as payment processors, KYC verification providers, or cloud infrastructure operators — those parties act as Data Processors and are contractually bound to process data only in accordance with ori77's documented instructions and applicable data protection standards.

For all privacy-related enquiries, complaints, or data subject requests, Members may contact ori77's designated privacy team at [email protected]. We aim to acknowledge all privacy enquiries within 2 business days and resolve them within 30 calendar days.

ori77 collects the categories of Personal Data described below. We collect only what is necessary for the stated purpose and do not retain data beyond the periods set out in Section 8.

3.1 Identity and Contact Data

• Full legal name as it appears on a government-issued identification document.
• Date of birth (to verify the 21+ age requirement applicable to all Indonesian Members).
• Residential address, including city (e.g., Jakarta, Surabaya, Bandung, Bali, Medan) and province.
• Email address and, where provided, a contact phone number (used for WhatsApp support access only).
• Copies of government-issued identification documents submitted for KYC, such as a KTP (Indonesian National Identity Card) or passport.

3.2 Financial Data

• Bank account details associated with deposit and withdrawal transactions, including account name, account number, and the name of the banking institution (e.g., BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon).
• E-wallet identifiers for OVO, DANA, GoPay, ShopeePay, or LinkAja, where used for transactions.
• Transaction history, including deposit amounts, withdrawal amounts, dates, and processing status, all denominated in Indonesian Rupiah (IDR).
• Source-of-funds documentation where requested in connection with large or unusual transactions, in line with anti-money laundering obligations.

3.3 Account and Activity Data

• Account username, encrypted password, and Account creation date.
• Betting and gaming history, including wager amounts, game selections, outcomes, and session durations.
• Bonus and promotion participation history, including claims, wagering progress, and fulfilment status.
• Responsible gaming settings applied to the Account, such as deposit limits and self-exclusion periods.
• Support communication records, including live chat transcripts and email correspondence.

3.4 Technical and Device Data

• IP address and approximate geolocation derived from IP data.
• Device type, operating system, and browser version.
• Session logs, including login timestamps, session duration, and page-navigation data.
• Cookie identifiers and similar tracking technology data, as described in Section 10.

ori77 collects Personal Data through the following channels:

• Direct submission: Information you provide voluntarily when completing the Account registration form, submitting KYC documents, making deposit or withdrawal requests, or contacting support.
• Automated collection: Technical and device data collected automatically through the Platform's server infrastructure when you visit or interact with any page at ori77.cam.
• Payment providers: Transaction confirmation data returned by banking partners (BCA, BRI, BNI, Mandiri, and e-wallet providers) following a completed deposit or withdrawal instruction.
• KYC verification providers: Identity verification results and fraud-risk scores returned by third-party KYC service providers engaged by ori77.
• Cookies and similar technologies: Session and preference data gathered through first-party cookies placed on your device when you access the Platform, as described in Section 10.

The table below sets out the purposes for which ori77 processes Personal Data and the corresponding legal basis for each processing activity.

ori77 does not sell Personal Data to third parties. We share Member data only in the limited circumstances described below:

6.1 Service Providers (Data Processors)

ori77 engages carefully selected third-party service providers who process data strictly on our instruction. These include KYC and identity verification providers, payment gateway operators for BCA, BRI, BNI, Mandiri, and e-wallet integrations, cloud infrastructure and hosting providers, fraud detection and risk-scoring services, and customer support platform operators. Each provider is bound by a data processing agreement that limits their use of Member data to the specific service they are contracted to deliver.

6.2 Legal and Regulatory Obligations

ori77 may disclose Personal Data to relevant authorities, regulators, or law enforcement agencies where required to do so by applicable law, court order, or regulatory instruction. Such disclosures are made only to the extent strictly required and with appropriate safeguards where permissible.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets involving ori77, Member Personal Data may be transferred to the acquiring or successor entity. ori77 will provide notice of any such transfer that materially affects the processing of Member data and will require the successor entity to honour the commitments made in this Policy.

6.4 Affiliate Platforms

Where ori77 operates affiliated platforms under a shared group structure, limited identity and account-standing data may be shared between group entities for the purposes of responsible gaming enforcement (including cross-platform self-exclusion) and fraud prevention. Such sharing is governed by intra-group data sharing agreements.

ori77 operates globally and may transfer Personal Data to service providers located in countries outside Indonesia. Where such transfers occur, ori77 takes steps to ensure that adequate protections are in place, including the use of standard contractual clauses, binding corporate rules, or other legally recognised transfer mechanisms appropriate to the destination jurisdiction.

Members based in Indonesia should be aware that the data protection laws of the destination country may differ from those applicable in Indonesia. ori77 maintains data processing agreements with all international service providers that impose obligations equivalent to, or stricter than, the protections afforded by this Policy.

For specific information about the safeguards applied to any international data transfer involving your Personal Data, you may submit a written request to [email protected].

ori77 retains Personal Data for the minimum period necessary to fulfil the purposes for which it was collected, subject to any longer retention periods required by law. The following indicative retention periods apply:

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised so that it can no longer be associated with an identifiable individual.

Subject to applicable law and any overriding regulatory obligations (such as AML retention requirements), Members have the following rights in relation to their Personal Data held by ori77:

To exercise any of the above rights, submit a written request to [email protected] with the subject line "Data Subject Request". We will verify your identity before processing any request and will respond within 30 calendar days. Where a request is complex or we receive a high volume of requests, we may extend this period by a further 30 days, providing notice of the extension within the initial 30-day window.

ori77 uses cookies and similar tracking technologies to ensure the Platform functions correctly, to maintain session security, and to understand aggregate user behaviour for the purpose of improving the Platform experience.

10.1 Types of Cookies Used

• Strictly Necessary Cookies: Essential for the Platform to operate. These include session authentication tokens and security cookies. They cannot be disabled without impairing Platform functionality.
• Functional Cookies: Remember Member preferences such as language settings and interface layout choices to improve the experience across sessions.
• Analytics Cookies: Collect anonymised or pseudonymised data about how Members navigate the Platform — including pages visited and session duration — to support product improvement decisions. No individually identifiable data is shared with analytics providers.
• Fraud Prevention Cookies: Used to identify and flag anomalous device behaviour that may indicate fraudulent Account access or bot activity. These cookies are a component of the Platform's security infrastructure.

10.2 Managing Cookies

Members may control non-essential cookies through their browser settings. Disabling functional or analytics cookies will not prevent access to the Platform but may affect certain preference-based features. Disabling strictly necessary cookies will impair the ability to log in or maintain a secure session and is not recommended.

ori77 does not use advertising or retargeting cookies that track Members across third-party websites. All cookies placed by ori77 are first-party cookies served directly by the ori77.cam domain.

ori77 implements a layered security architecture to protect Personal Data against unauthorised access, disclosure, alteration, and destruction. The key measures in place include:

• 256-bit SSL/TLS Encryption: All data transmitted between a Member's device and the ori77 Platform is encrypted in transit using industry-standard SSL/TLS protocols. This protects login credentials, financial data, and personal information from interception.
• Data Encryption at Rest: Sensitive data fields — including identity documents, financial account numbers, and authentication credentials — are encrypted at the storage layer using AES-256 encryption.
• Access Controls: Internal access to Member Personal Data is restricted on a strict need-to-know basis. Staff with access to sensitive data undergo background screening and are subject to confidentiality obligations.
• Two-Factor Authentication (2FA): Members are encouraged to enable 2FA on their Accounts to provide an additional layer of protection against unauthorised access.
• Penetration Testing and Audits: The Platform undergoes regular third-party security assessments and penetration tests to identify and remediate vulnerabilities proactively.
• Incident Response: ori77 maintains a documented data breach response procedure. In the event of a breach that poses a risk to Member rights and freedoms, ori77 will notify affected Members and relevant authorities within the timeframes required by applicable law.

The ori77 Platform is strictly intended for adults aged 21 and above. ori77 does not knowingly collect Personal Data from individuals under the age of 21. All registration applications are subject to age verification, and any Account found to have been created by a person under 21 will be immediately closed with all deposits returned and any associated winnings forfeited.

If ori77 becomes aware that Personal Data has been collected from a person under the age of 21 without verified parental or guardian consent, that data will be deleted promptly. If you believe that a minor has created an Account on ori77, please contact us immediately at [email protected] so that we can investigate and take appropriate action.

The ori77 Platform may contain references to third-party services — such as payment providers BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja — in the context of transaction processing instructions. ori77 does not operate or control the privacy practices of any third-party platform or service.

This Privacy Policy applies solely to the ori77 Platform at https://ori77.cam. ori77 accepts no responsibility for the data practices of any third-party website or service that a Member accesses in connection with their Account. Members are encouraged to review the privacy policies of any third-party service they use in conjunction with their ori77 Account.

ori77 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or the services we offer. The "Last Updated" date at the top of this document will be revised whenever a material change is made.

Where changes are material — for example, where we begin processing a new category of Personal Data or change the legal basis for an existing processing activity — ori77 will provide advance notice via the email address associated with your Account and/or through a prominent notice on the Platform, at least 14 days before the change takes effect.

Continued use of the Platform following the effective date of an updated Privacy Policy constitutes acceptance of the revised terms. If you do not agree to the updated Policy, you should cease using the Platform and may request Account closure in accordance with the ori77 Terms & Conditions.

For all privacy-related enquiries, data subject access requests, or complaints regarding ori77's handling of your Personal Data, please use one of the following contact channels:

• Email: [email protected] — mark the subject line as "Privacy Enquiry" or "Data Subject Request" for fastest routing to our privacy team.
• In-App Live Chat: Available 24/7 within your Account dashboard for general privacy questions. Complex or formal data subject requests should be submitted via email for a documented record.

ori77 aims to acknowledge all privacy communications within 2 business days and to resolve substantive requests within 30 calendar days. All communications should be submitted in English or Indonesian for fastest processing during WIB business hours (09:00–22:00 WIB).