Privacy Policy

ora178 ("the Company", "we", "us", "our") operates the online betting and casino platform accessible at ora178.app. We are committed to protecting the privacy and security of every Member who uses the ora178 platform, with particular regard to the expectations of Indonesian users regarding personal data handling.

This Privacy Policy describes in full detail the categories of personal data we collect, the purposes for which we process that data, the third parties with whom we may share it, the safeguards we apply to protect it, the period for which we retain it, and the rights available to you as a data subject. This Policy applies to all personal data collected through the ora178 website, mobile-optimised web application, live chat support interactions, email correspondence, and any other channel through which you interact with ora178.

This Policy should be read in conjunction with the ora178 Terms & Conditions, which govern your use of the platform as a whole.

The following definitions apply throughout this Privacy Policy:

ora178 collects the following categories of personal data from Members and platform visitors:

ora178 collects personal data through the following channels:

• Account registration: When you create an ora178 account, you provide your name, email address, and phone number directly.
• KYC verification: When you complete identity verification prior to your first withdrawal, you submit identity documents and a selfie photograph directly via the KYC submission form in your account.
• Deposits and withdrawals: When you conduct a financial transaction, your payment account details (bank account name and number, or e-wallet account details) are captured and recorded.
• Platform usage: Technical and usage data is collected automatically as you browse and interact with the platform, via server logs, session tracking, and first-party cookies.
• Customer support interactions: When you contact ora178 via live chat or email, the content of your communication and any personal data you share within it is recorded for support quality and compliance purposes.
• Third-party sources: In limited circumstances, ora178 may receive personal data about you from third-party fraud prevention services, payment processors, or identity verification bureaux in order to verify your identity or protect the integrity of the platform.

ora178 processes your personal data on one or more of the following legal bases, depending on the specific purpose of processing:

ora178 uses the personal data it collects for the following purposes:

• Account management: Creating, maintaining, and securing your ora178 account, including authentication, password reset, and session management.
• Transaction processing: Processing deposits via local Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja), settling bets, crediting winnings, and processing withdrawal requests to your registered payment account.
• Identity and age verification: Conducting KYC checks to confirm you are at least 21 years of age and that your account details are accurate, in compliance with our international licensing requirements.
• Fraud prevention and security: Detecting and preventing fraudulent transactions, account takeovers, money laundering, and other prohibited conduct as defined in the ora178 Terms & Conditions.
• Responsible gaming: Monitoring betting patterns and account activity to identify potential problem gambling behaviour and to enforce any deposit limits, cooling-off periods, or self-exclusion requests you have set via your account.
• Customer support: Responding to your queries, resolving disputes, and handling formal complaints in a timely manner.
• Regulatory compliance: Meeting our obligations under the terms of our international operating licence, including maintaining transaction records, filing mandatory reports, and cooperating with regulatory enquiries.
• Platform improvement: Analysing aggregated, anonymised usage data to improve platform performance, game selection, payment flows, and the overall Member experience.
• Marketing communications: Sending you promotional offers, bonus notifications, and seasonal promotions (such as Idul Fitri or Indonesian Independence Day offers) where you have consented to receive such communications. You may opt out at any time.

ora178 does not sell, rent, or trade your personal data. We share personal data with third parties only where strictly necessary and only under the following circumstances:

• Payment processors: We share your name, bank account or e-wallet details, and transaction amounts with Indonesian payment processors and banking partners (including BCA, BRI, BNI, Mandiri, and e-wallet providers) solely to execute your deposit and withdrawal instructions.
• Game studio providers: To deliver live casino, slots, togel (Indonesia's traditional numbers lottery), and sabung ayam (live cockfighting) products, we share a pseudonymous player identifier and session token with our licensed game studio partners (including Evolution Gaming, Pragmatic Play, Spribe, Pocket Games Soft, and Microgaming). These providers do not receive your full name, email, or financial account details.
• Identity verification providers: During KYC processing, your identity documents and selfie photograph may be shared with an authorised third-party identity verification bureau. That bureau processes your data solely for the purpose of verification and is bound by strict data processing agreements.
• Fraud prevention and AML services: Relevant transaction data and account metadata may be shared with specialist fraud detection and anti-money laundering screening services to protect the platform and all Members.
• Regulatory and legal authorities: We will disclose personal data to competent regulatory bodies, law enforcement agencies, or courts where required to do so by law, by our licensing conditions, or by a valid legal order. We will notify you of such disclosure where we are legally permitted to do so.
• Corporate transactions: In the event of a merger, acquisition, or sale of substantially all of the assets of ora178, your personal data may be transferred to the acquiring entity, subject to equivalent privacy protections.

ora178 is an internationally licensed operator. Some of our service providers and technology partners are located outside Indonesia. Where personal data is transferred to a country that does not provide an equivalent level of data protection to that applied within Indonesia, ora178 ensures appropriate safeguards are in place, which may include:

• Standard contractual clauses approved by the relevant data protection authority;
• Binding corporate rules where the recipient is a member of the same corporate group as ora178;
• The recipient country having been assessed as providing an adequate level of protection by a recognised international data protection framework.

You may request further information about the specific safeguards in place for any international transfer of your personal data by contacting ora178 at [email protected].

ora178 retains personal data for the minimum period necessary to fulfil the purposes for which it was collected, subject to any longer retention periods required by our legal, regulatory, or licensing obligations. The following general retention guidelines apply:

Once a retention period expires, personal data is securely and permanently deleted or irreversibly anonymised in accordance with our data destruction procedures. Data subject to an active legal hold is exempt from standard deletion schedules until the hold is lifted.

ora178 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, or destruction. These measures include:

• Transport encryption: All data in transit between your device and ora178 servers is encrypted using TLS 1.2 or higher (256-bit SSL).
• At-rest encryption: Personal data stored in our databases and file systems is encrypted using AES-256 encryption.
• Access controls: Internal access to personal data is restricted on a strict need-to-know basis, enforced through role-based access controls and multi-factor authentication for administrative systems.
• KYC data isolation: Identity documents and selfie photographs submitted during KYC are stored in a dedicated, access-restricted environment separate from general member data, accessible only to authorised compliance personnel.
• Penetration testing: ora178's platform and infrastructure undergo regular independent security assessments and penetration tests to identify and remediate vulnerabilities.
• Fraud monitoring: Automated fraud detection systems monitor account activity in real time for anomalous patterns indicative of account compromise, money laundering, or other threats.
• Incident response: ora178 maintains a documented data breach response procedure. In the event of a breach that is likely to result in a high risk to Members' rights, affected Members will be notified promptly in accordance with applicable law.

ora178 uses first-party cookies and similar browser storage technologies on the platform. We do not use third-party advertising networks or cross-site behavioural tracking cookies. The cookies we use fall into the following categories:

You may manage or disable cookies through your browser settings at any time. Disabling strictly necessary cookies will prevent you from logging in to your ora178 account and using the platform. Disabling functional or analytics cookies will not affect your ability to place bets or conduct transactions, but may reduce the quality of your experience on the platform.

As a Member of the ora178 platform, you hold the following rights with respect to the personal data we hold about you. To exercise any of these rights, please contact us at [email protected] with the subject line "Data Rights Request — [Your Account Username]". We will respond within 30 calendar days of receipt.

Please note that certain rights are subject to limitations where legal, regulatory, or licensing obligations require us to retain or process specific data regardless of a data subject request. We will clearly explain any such limitation when responding to your request.

The ora178 platform is strictly intended for adults aged 21 and over. ora178 does not knowingly collect personal data from individuals under 21 years of age. Age verification is a mandatory step in the account registration and KYC process for all Members.

If ora178 discovers that personal data has been collected from an individual who is under 21, that account will be immediately closed, all associated personal data will be deleted (subject to any mandatory legal reporting obligations), and any funds in the account will be handled in accordance with our underage gambling policy and applicable law.

ora178 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or platform features. Where a proposed change materially affects your rights or how we use your personal data, we will provide at least 14 days' advance notice by email to your registered address, or by displaying a prominent notice on the platform.

The "Last Updated" date at the top of this Policy indicates when the most recent revision was made. Continued use of the ora178 platform following the effective date of any amendment constitutes acceptance of the revised Policy. If you do not accept the revised Policy, you must cease using the platform and may request account closure in accordance with the Terms & Conditions.

For any questions, concerns, or requests relating to this Privacy Policy or the personal data ora178 holds about you, please contact our Data Privacy team through the following channels:

• Live Chat: Available 24/7 within your logged-in ora178 account. For data rights requests, please state "Privacy / Data Rights" at the start of your message so the query can be routed to the correct team.
• Email: [email protected] — use the subject line "Privacy Policy Enquiry" or "Data Rights Request — [Your Username]". We aim to acknowledge all privacy-related emails within 24 hours (WIB) and to provide a substantive response within 30 calendar days.

If you are not satisfied with our response to a privacy-related complaint, you have the right to escalate the matter to the data protection supervisory authority in your jurisdiction, or to the authority in the jurisdiction where ora178 is licensed. We will provide details of the relevant authority upon request.