Privacy Policy

okta33 ("we", "us", "our") is committed to protecting the privacy and personal data of every individual who interacts with our platform. This Privacy Policy sets out in plain, accessible terms how okta33 collects, uses, stores, shares, and safeguards your personal information when you visit or use the okta33 online gaming platform.

This policy applies to all members registered on the okta33 platform, all visitors to https://okta33.app, and all individuals who contact okta33 through any support channel, including live chat and email. It covers data collected automatically when you browse the platform, data you provide directly during registration and verification, and data generated by your betting, gaming, and transaction activity.

okta33 operates as an internationally licensed gaming platform with a significant member base across Indonesia, including players in Jakarta, Surabaya, Medan, Bandung, Yogyakarta, Bali, Makassar, Semarang, and Palembang. We recognize the trust our Indonesian members place in us when they share their personal information, and we take that responsibility seriously.

For the purposes of applicable data protection law, okta33 is the data controller responsible for the personal data collected through the https://okta33.app platform and all associated services.

As data controller, okta33 determines the purposes and means of processing personal data described in this Privacy Policy. Where okta33 engages third-party service providers to process data on its behalf (for example, payment processors or KYC verification services), those providers act as data processors under binding contractual obligations that restrict their use of your data to the specific services they provide to okta33.

If you have any questions about how okta33 handles your personal data, or if you wish to exercise any of your data rights described in Section 11 of this policy, you may contact us at the email address listed in Section 15.

okta33 collects personal data through several channels. The categories of data we collect, and the circumstances in which they are collected, are described below:

3.1 Data You Provide Directly

• Registration data: Full legal name, date of birth, gender, Indonesian residential address, email address, mobile phone number (Indonesian format), and preferred username.
• Identity verification (KYC) data: Copies or photographs of government-issued identity documents, including Indonesian National ID (KTP), passport, or driving license (SIM). This data is collected where required for age and identity verification purposes.
• Payment data: Bank account details (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI) or e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja) used for deposits and withdrawals. Full card numbers are not stored on the okta33 platform.
• Support communications: The content of messages, emails, and live chat conversations you initiate with the okta33 support team.

3.2 Data Collected Automatically

• Technical data: IP address, device type, operating system, browser type and version, screen resolution, and mobile network operator.
• Usage data: Pages visited, features accessed, time spent on each section, bet history, game history, session start and end times, and click-through behavior.
• Cookie and tracking data: Session cookies, preference cookies, and first-party analytics data. See Section 9 for full details on our cookie practices.

3.3 Data We Receive From Third Parties

• KYC verification partners: Identity verification outcomes (pass/fail, risk score) from third-party KYC services used to confirm a member's identity and age.
• Payment processors: Transaction status confirmations, payment reference numbers, and fraud screening outcomes from payment gateway partners.
• Anti-fraud and AML services: Risk indicators and flags from anti-money-laundering screening services used to identify suspicious activity.

okta33 uses the personal data it collects for the following specific purposes:

okta33 does not use automated decision-making or profiling in a manner that produces legal or similarly significant effects on members, except where required for fraud prevention or responsible gaming interventions — in which case the member is notified and has the right to request human review.

okta33 processes personal data only where a valid legal basis exists. The primary legal bases we rely upon are:

• Contractual necessity: Processing required to fulfill our contract with you as an okta33 member — including account management, payment processing, and delivery of gaming services.
• Legal obligation: Processing required to comply with applicable laws and regulations, including KYC identity verification, anti-money-laundering obligations, and data retention requirements imposed by our licensing authority.
• Legitimate interests: Processing necessary for okta33's legitimate business interests, including fraud prevention, platform security, and responsible gaming monitoring — where those interests are not overridden by your data protection rights.
• Consent: Where okta33 relies on your consent for a specific processing activity (such as sending promotional emails), we will ask for your explicit consent at the point of collection. You may withdraw consent at any time by contacting support or updating your account communication preferences.

okta33 does not sell, rent, or trade personal data. We share personal data only in the following circumstances and only to the extent strictly necessary:

1. Service providers acting as data processors: Payment processing partners (handling IDR bank transfers and e-wallet transactions via BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja), KYC and identity verification services, cloud infrastructure providers, and customer support platform operators. All such providers are bound by data processing agreements that restrict their use of your data to the agreed service.
2. Game content providers: When you play a game from a third-party studio (Pragmatic Play, Evolution Gaming, PG Soft, NetEnt, Microgaming, Spribe), certain session data — such as player ID, currency, and game round identifiers — is shared with the provider to power the game. This is technically necessary and does not include your full name, ID documents, or payment account details.
3. Regulatory and law enforcement authorities: Where okta33 is legally required to disclose personal data in response to a valid order, warrant, or regulatory request, we will comply. Where permitted by law, we will notify the affected member of such a request before disclosure.
4. Anti-fraud and AML networks: In the event that fraudulent activity or money laundering is suspected, we may share relevant data with recognized industry anti-fraud organizations or financial intelligence authorities as required by our licensing obligations.
5. Business transfers: In the event of a merger, acquisition, or asset sale involving okta33, member data may be transferred to the acquiring entity. Members will be notified in advance of any such transfer and will have the opportunity to close their accounts if they do not wish their data to be transferred.

As an internationally licensed gaming platform, okta33 may transfer personal data to service providers and infrastructure partners located outside Indonesia. Where such transfers occur, okta33 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to the protections applicable in the jurisdiction of our licensing authority.

Safeguards used for international transfers include:

• Contractual clauses that bind the recipient to data protection standards consistent with international best practices.
• Transfer only to jurisdictions recognized as providing adequate data protection, or where the recipient has implemented approved binding corporate rules.
• Encryption of data in transit and at rest, regardless of the jurisdiction in which it is stored.

okta33 retains personal data only for as long as is necessary to fulfill the purposes for which it was collected, subject to any longer retention periods required by applicable law or our licensing authority. The following retention periods apply as a general guide:

• Active account data: Retained for the duration of your membership and for a minimum of five years following account closure, in accordance with anti-money-laundering record-keeping requirements.
• KYC and identity documents: Retained for a minimum of five years following the date of verification or account closure, whichever is later.
• Transaction records: Retained for a minimum of five years from the date of the transaction.
• Support communications: Retained for three years from the date of the last communication, unless a longer retention period is required for dispute resolution or regulatory purposes.
• Technical and usage logs: Retained for 12 months from the date of collection, after which they are anonymized or deleted.
• Marketing consent records: Retained for the duration of your consent and for one year following withdrawal of consent.

When personal data is no longer required, okta33 securely destroys or anonymizes it in a manner that prevents reconstruction of the original data.

okta33 uses cookies and similar client-side technologies to provide a functional, secure, and responsive platform experience. We do not use third-party advertising cookies or cross-site tracking technologies.

The following categories of cookies are used on the okta33 platform:

• Essential cookies: Required for the platform to function. These include session authentication cookies that keep you logged in during a session and security tokens that protect against cross-site request forgery (CSRF). These cookies cannot be disabled without impairing platform functionality.
• Preference cookies: Store your platform settings, such as display preferences and notification configurations. Disabling these cookies will reset your preferences on each visit.
• Analytics cookies (first-party only): Used to understand aggregate usage patterns — which sections of the platform are most visited, how long sessions last, and what device types are common among our Indonesian members. All analytics data is aggregated and anonymized before analysis. okta33 does not use Google Analytics or similar third-party analytics services that transmit data to external servers.

You may manage cookie preferences through your browser settings. Note that disabling essential cookies will prevent you from logging into your okta33 account.

okta33 implements a layered security architecture to protect personal data against unauthorized access, disclosure, alteration, and destruction. Our security measures include:

• Encryption: All data transmitted between your device and the okta33 platform is encrypted using 256-bit SSL/TLS. Data stored in our databases is encrypted at rest using AES-256 encryption.
• Access controls: Access to personal data within okta33 is restricted to authorized personnel who require it for specific job functions. All internal access is logged and subject to regular audit.
• Two-factor authentication (2FA): Available to all okta33 members and mandatory for high-risk account operations. We strongly encourage all members to enable 2FA on their accounts.
• Penetration testing and vulnerability management: The okta33 platform undergoes regular independent security assessments. Identified vulnerabilities are prioritized and remediated in accordance with a formal patch management process.
• Incident response: okta33 maintains a documented data breach response procedure. In the event of a breach that is likely to result in a risk to member rights, affected members will be notified without undue delay.

While okta33 takes all reasonable steps to protect your personal data, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your okta33 login credentials and for notifying us immediately if you suspect unauthorized access to your account.

As an okta33 member, you hold the following rights in relation to your personal data. These rights may be exercised at any time by contacting okta33 at the email address listed in Section 15:

1. Right of access: You may request a copy of the personal data okta33 holds about you. We will provide this within 30 calendar days of a valid request, at no charge.
2. Right to rectification: If any personal data okta33 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. Minor corrections (such as updating your phone number or address) can be made directly through your okta33 account settings.
3. Right to erasure: You may request that okta33 delete your personal data. This right is not absolute — we may be required to retain certain data for legal, regulatory, or fraud-prevention purposes. Where full deletion is not possible, we will explain the specific reasons and delete all data that can be deleted.
4. Right to restrict processing: You may request that okta33 pause processing of your personal data in specific circumstances, such as while a data accuracy dispute is under review.
5. Right to data portability: You may request a copy of the personal data you provided to okta33 in a structured, machine-readable format (such as CSV or JSON), where technically feasible.
6. Right to object: Where okta33 processes your data based on legitimate interests, you have the right to object. We will assess your objection and cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
7. Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal.

The okta33 platform is strictly for adults aged 21 years and over. okta33 does not knowingly collect personal data from individuals under the age of 21.

Where okta33 becomes aware, or has reasonable grounds to believe, that a registered member is under 21 years of age, the following actions will be taken immediately:

• The member's account will be suspended pending investigation.
• All bets placed and winnings generated by the underage member will be voided.
• Any deposited balance will be returned via the original payment method after identity verification of the account holder.
• Personal data collected from the underage individual will be deleted as soon as it is no longer required for the investigation or any resulting legal process.

Parents and guardians who believe a minor may have accessed the okta33 platform are encouraged to contact [email protected] immediately so that the matter can be investigated and resolved as quickly as possible.

The okta33 platform does not contain links to third-party websites or external resources. All navigation within the platform remains within the okta33 domain. This Privacy Policy applies exclusively to data collected and processed by okta33 in connection with the https://okta33.app platform.

If you access game content delivered by a licensed third-party studio (such as a live dealer game from Evolution Gaming or a slot from Pragmatic Play), those game interfaces are integrated into the okta33 platform and your use of them is governed by this Privacy Policy as it applies to okta33's collection of session and game-round data. The game provider's own privacy practices govern any data collected at their end, which is limited to game-round identifiers and session tokens as described in Section 6.

okta33 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we provide. When a material change is made — meaning a change that significantly affects how your personal data is used or what rights you hold — okta33 will:

• Notify you via the email address registered to your okta33 account at least 14 days before the change takes effect.
• Post a prominent notice on the okta33 platform homepage for a minimum of 14 days prior to the effective date of the change.
• Update the "Last Updated" date at the top of this page.

For minor or administrative updates — such as corrections of typographical errors, clarifications of existing practices that do not alter member rights, or formatting improvements — no advance notice is required. The updated policy will be published on this page with a revised date.

Your continued use of the okta33 platform after the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with any change, you should discontinue use of the platform and contact support to arrange account closure.

For any questions, concerns, or requests relating to this Privacy Policy or the personal data okta33 holds about you, please contact our Data Privacy team using the following details:

• Email: [email protected] (plain text — not a clickable link)
• Subject line: "Privacy Policy Inquiry" or "Data Rights Request"
• Live Chat: Available 24/7 via the chat widget on the okta33 platform — our Indonesian-speaking support agents can assist with privacy queries and escalate to the data privacy team where required.
• Response time: Privacy-related inquiries are handled within 30 calendar days. Urgent data breach notifications or requests involving suspected unauthorized access will be prioritized and addressed as quickly as possible.

When submitting a data rights request, please include your registered email address, your okta33 member ID, a clear description of your request, and a copy of your identity document to allow us to verify your identity before processing the request. This verification step is mandatory to protect you against unauthorized data requests made by third parties.