Privacy Policy

otw88 ("we", "us", "our") operates the online betting platform available at otw88.club (the "Platform"). This Privacy Policy describes how otw88 collects, processes, stores, and protects personal data provided by users ("you", "your", "User") when you visit, register on, or interact with the Platform.

otw88 is an internationally licensed online betting platform primarily serving English-preference players across Indonesia. Our operations span sports betting — including BRI Liga 1, EPL, La Liga, Champions League, and major international tournaments — as well as live casino, slot games, and card games. As a result, we handle a significant volume of sensitive personal and financial data on behalf of Indonesian members and we take that responsibility with the highest degree of seriousness.

This Privacy Policy applies to all personal data processed in connection with your use of the Platform, including data submitted during account registration, KYC identity verification, deposit and withdrawal transactions, customer support interactions, and promotional communications. By accessing the Platform and creating an Account, you acknowledge that you have read, understood, and agreed to the practices described in this Privacy Policy.

This Privacy Policy should be read in conjunction with our Terms & Conditions, which govern your overall use of the Platform and are incorporated herein by reference.

The following capitalised terms carry the meanings defined below throughout this Privacy Policy:

otw88 collects Personal Data through several channels and for specific, documented purposes. The categories of data we collect are set out below:

3.1 Account Registration Data

When you create an account on the Platform, we collect: full legal name, date of birth, email address, mobile phone number, and your chosen username and password (stored as a hashed value — never in plain text).

3.2 Identity Verification (KYC) Data

Before processing your first withdrawal, we require a copy of your government-issued identification document (KTP or valid Indonesian passport) and a verification selfie. This data is processed under strict access controls and retained only for as long as required by our licensing obligations and applicable anti-money-laundering (AML) regulations.

3.3 Financial Transaction Data

We collect data relating to all deposits and withdrawals on your Account, including: the bank account name and number or e-wallet identifier (OVO, DANA, GoPay, ShopeePay, or LinkAja) used for each transaction, transaction amounts in IDR, transaction reference numbers, timestamps (in WIB, UTC+7), and the processing status of each transaction. We do not store full payment card numbers — the Platform does not accept card payments.

3.4 Betting and Gaming Activity Data

We record all bets and wagers placed through your Account, including the event or game selected, stake amount, odds at the time of placement, settlement outcome, and net profit or loss. This data is used for account management, dispute resolution, responsible gaming monitoring, and regulatory reporting.

3.5 Device and Technical Data

When you access the Platform, our servers and analytics systems automatically collect: IP address, browser type and version, operating system, device type (desktop, mobile, tablet), screen resolution, referring URL, pages visited, session duration, and approximate geographic location derived from IP geolocation (city-level, not GPS-precise).

3.6 Communications Data

Records of all communications between you and otw88 — including live chat transcripts, support emails, and any correspondence relating to complaints or responsible gaming requests — are retained for quality assurance, staff training, regulatory audit, and dispute resolution purposes.

3.7 Marketing Preference Data

Where you have opted in to receive promotional communications, we retain a record of your preferences and the communications you have received. You may update or withdraw your marketing preferences at any time from your Account settings or by contacting our support team.

We use the Personal Data we collect for the following specific purposes. We do not use your data for any purpose that is incompatible with the purposes listed here without first obtaining your explicit consent.

otw88 processes Personal Data only where a valid legal basis exists. The four legal bases we rely on are:

• Contract Performance: Processing is necessary to fulfil our contractual obligations to you under the Terms & Conditions — for example, to process a deposit or settle a winning bet.
• Legal Obligation: Processing is required to comply with applicable law — for example, retaining KYC documents for the period mandated by our AML obligations, or reporting suspicious transactions to the relevant regulatory authority.
• Legitimate Interests: Processing is necessary for our legitimate business interests, provided those interests are not overridden by your fundamental rights. Examples include fraud detection, platform security, and internal analytics used to improve the betting experience. We conduct a balancing test before relying on this basis and document our assessment.
• Consent: For processing that is not covered by the above bases — primarily direct marketing communications — we obtain your explicit, freely given, and revocable consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

otw88 does not sell, rent, or trade your Personal Data to any third party for marketing or commercial purposes. We share data only in the following specific, controlled circumstances:

6.1 Service Providers (Data Processors)

We engage trusted third-party service providers who process data strictly on our instructions and under written data-processing agreements. These include: payment gateway operators facilitating transfers to and from Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja); KYC identity verification technology providers; game software vendors (Pragmatic Play, Evolution Gaming, Spribe, Pocket Games Soft, NetEnt, Microgaming); cloud infrastructure providers; and customer support platform providers.

6.2 Regulatory and Law Enforcement Authorities

We will disclose Personal Data to relevant regulatory bodies, financial intelligence units, or law enforcement agencies where required to do so by applicable law, court order, or regulatory direction. We will notify you of any such disclosure to the extent permitted by law.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of some or all of otw88's assets, Personal Data held by otw88 may be transferred to the acquiring entity as part of that transaction. We will notify affected Users via their registered email address prior to any such transfer and explain what choices they have.

6.4 With Your Explicit Consent

We may share Personal Data with specific third parties where you have given us explicit, informed consent to do so — for example, where you opt in to a third-party affiliate promotion. You may withdraw such consent at any time by contacting our support team.

As an internationally licensed platform, otw88 operates infrastructure and engages service providers located in multiple jurisdictions. Personal Data collected from Indonesian members may therefore be transferred to and processed in countries outside Indonesia. Where such transfers occur, otw88 ensures that appropriate safeguards are in place, including:

• Standard contractual clauses (SCCs) agreed with data processors in each destination jurisdiction, requiring them to maintain data protection standards equivalent to those applied by otw88.
• Data processing agreements that prohibit the onward transfer of your data by processors to sub-processors without our prior written approval.
• Technical controls ensuring that data is encrypted in transit (TLS 1.3 or higher) and at rest (AES-256) regardless of the jurisdiction in which it is stored.

If you would like to receive details of the specific safeguards applied to any particular international transfer of your data, please contact our DPO at [email protected].

otw88 retains Personal Data only for as long as necessary to fulfil the purpose for which it was collected, or for as long as required by applicable legal, regulatory, or licensing obligations. The retention periods below represent our standard approach:

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised so that it can no longer be linked to an individual. Anonymised, aggregated data may be retained indefinitely for statistical and business analysis purposes.

The Platform uses cookies and similar tracking technologies to deliver core functionality, maintain session security, analyse Platform performance, and — where you have consented — deliver relevant promotional content. The categories of cookies in use are:

• Strictly Necessary Cookies: These are essential for the Platform to function and cannot be disabled. They include session authentication tokens, CSRF protection tokens, and load-balancer routing cookies. No consent is required for these cookies.
• Analytics Cookies: Used to understand how members use the Platform — which pages are visited most frequently, where users drop off in the registration or deposit flow, and which game categories attract the most engagement. The data collected is aggregated and anonymised. You may opt out via your browser settings.
• Functional Cookies: Retain your preferences such as language setting, currency display, and timezone (WIB/WITA/WIT) so that you do not need to re-configure them on each visit. These improve your experience but are not essential to core functionality.
• Marketing Cookies: Only activated where you have given explicit consent. These cookies allow us to deliver personalised promotions relevant to your betting interests — for example, targeted offers during BRI Liga 1 season or EPL match days. You may withdraw consent and clear these cookies at any time from your browser or Account settings.

For full details of the specific cookies in use, their names, providers, and expiry periods, please refer to the Cookie Declaration maintained within your Account settings panel.

As an individual whose Personal Data is processed by otw88, you hold the following rights. We are committed to honouring these rights promptly and without unnecessary friction. To exercise any of the rights below, submit a written request to our DPO at [email protected] with the subject line "Data Subject Request". We will acknowledge your request within 3 business days and provide a full response within 30 calendar days.

otw88 applies a layered, defence-in-depth security architecture to protect all Personal Data processed through the Platform. Our technical and organisational security measures include:

• Encryption in Transit: All data transmitted between your browser or mobile device and the Platform is encrypted using TLS 1.3. We enforce HTTPS-only access site-wide and implement HSTS (HTTP Strict Transport Security) headers to prevent protocol downgrade attacks.
• Encryption at Rest: All Personal Data stored in our databases — including KYC documents, financial records, and Account credentials — is encrypted at rest using AES-256. Password hashes use bcrypt with a minimum work factor of 12.
• Access Controls: Access to Personal Data within otw88's internal systems is restricted on a strict need-to-know basis. All internal access is authenticated via multi-factor authentication and is logged, monitored, and subject to periodic access reviews.
• Network Security: The Platform is protected by enterprise-grade Web Application Firewall (WAF) technology, distributed denial-of-service (DDoS) mitigation, and intrusion detection systems. Our infrastructure is hosted in ISO 27001-certified data centres.
• Vulnerability Management: We conduct regular automated vulnerability scans and commission independent penetration tests at least twice per year. Critical vulnerabilities are patched within 24 hours of discovery; high-severity vulnerabilities within 72 hours.
• Incident Response: In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you via your registered email address within 72 hours of becoming aware of the breach, in accordance with our incident response procedure.

The Platform is strictly intended for adults aged 21 and above. otw88 does not knowingly collect Personal Data from any person under the age of 21. Age verification is a mandatory step in the Account registration process and is reinforced during KYC verification.

If we become aware that Personal Data has been collected from a person under 21 — whether through our own monitoring systems or via a notification from a parent, guardian, or third party — we will immediately suspend the Account, delete the associated Personal Data in its entirety, and return any deposited funds to the originating payment method. Any bets placed by an under-age user during the period prior to discovery will be voided.

otw88 sends promotional communications — including welcome bonuses, weekly reload offers, cashback notifications, and seasonal promotions tied to events such as Idul Fitri, Ramadhan, and major BRI Liga 1 and Champions League fixtures — only to members who have explicitly opted in to receive such communications during registration or subsequently through their Account settings.

You may opt out of all marketing communications at any time through any of the following methods:

• Clicking the "Unsubscribe" link at the bottom of any promotional email.
• Updating your communication preferences in the "Notifications" section of your Account dashboard.
• Contacting our 24/7 support team via live chat and requesting removal from all marketing lists.
• Sending a written opt-out request to [email protected] with the subject line "Marketing Opt-Out".

Opting out of marketing communications does not affect the receipt of transactional messages — such as deposit confirmations, withdrawal notifications, and account security alerts — which are sent as part of our contractual obligation to you and cannot be disabled while your Account is active.

The Platform may contain links to third-party websites or services — for example, links to the official BRI Liga 1 website, EPL fixture pages, or the websites of licensed game studios such as Pragmatic Play or Evolution Gaming — for informational or reference purposes. These links are provided for convenience only.

otw88 has no control over the content, privacy practices, or security standards of any third-party website. This Privacy Policy applies solely to Personal Data processed by otw88 through the Platform. We strongly encourage you to review the privacy policy of any third-party site you visit before submitting any Personal Data to it. otw88 assumes no responsibility or liability for the privacy practices of third-party sites linked from the Platform.

otw88 reviews and updates this Privacy Policy periodically to reflect changes in our data processing practices, applicable law, or the scope of our services. When we make material changes to this Policy, we will notify you through one or more of the following methods:

• A prominent notice displayed on the Platform homepage and your Account dashboard for a minimum of 30 days prior to the changes taking effect.
• An email notification to your registered email address summarising the key changes and the new effective date.
• An in-app notification delivered through the Platform's messaging system.

For minor, non-material updates — such as typographical corrections or clarifications that do not alter the substance of our data processing practices — we may update the Policy without advance notice, though the revised effective date will always be updated at the top of this document.

Your continued use of the Platform following the effective date of any revised Privacy Policy constitutes your acknowledgement of the updated Policy. If you do not agree with any material changes, you must stop using the Platform and may request account closure by contacting our support team. Any Personal Data collected prior to the effective date of the update will continue to be handled under the version of the Policy in force at the time of collection, except to the extent that applicable law requires otherwise.

All previous versions of this Privacy Policy are archived and available upon request by contacting our DPO. We maintain a version history with effective dates and a summary of changes made at each revision.

otw88 has appointed a Data Protection Officer (DPO) responsible for overseeing all matters relating to this Privacy Policy, data subject rights requests, and data protection compliance. If you have any questions, concerns, or complaints regarding this Privacy Policy or the way in which your Personal Data is being handled, you are encouraged to contact the DPO in the first instance.

If you are not satisfied with our response to a data subject rights request or a privacy complaint, you have the right to escalate the matter to the relevant data protection supervisory authority in your jurisdiction. otw88 commits to cooperating with any such authority in the resolution of complaints that cannot be resolved directly between us.