ong39 Privacy Policy

1.1 About This Policy. This Privacy Policy describes how ong39 ("the Platform", "we", "us", "our") collects, processes, stores, and protects personal data belonging to members and visitors ("you", "your") of ong39.org. ong39 is committed to handling personal data responsibly and in accordance with internationally recognized data protection principles.

1.2 Definitions. For the purposes of this Privacy Policy:

• "Personal Data" means any information relating to an identified or identifiable individual — including your name, email address, date of birth, phone number, payment details, device identifiers, and IP address.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, erasure, and transfer.
• "Data Controller" means ong39, which determines the purposes and means of processing your personal data.
• "Data Processor" means any third party that processes personal data on behalf of ong39, subject to a binding data processing agreement.
• "KYC" means Know Your Customer — the identity and age verification procedure required for financial transactions on the Platform.

1.3 Scope. This policy applies to all personal data collected through the ong39 website, live chat support, email communications, and any other channels through which you interact with the Platform. It does not apply to third-party websites or services that may be linked from, or integrated into, the Platform — those services operate under their own privacy policies.

2.1 Categories of Personal Data. ong39 collects the following categories of personal data depending on how you interact with the Platform:

2.2 Sensitive Data. ong39 does not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health information, or biometric data beyond what is strictly necessary for identity verification purposes (e.g., a selfie to confirm a photo ID document during KYC). Where sensitive data is collected for KYC, it is processed solely for that verification purpose and retained only as long as legally required.

2.3 Data You Provide Voluntarily. Certain data — such as your preferences, feedback submitted through support channels, or optional profile details — is provided by you on a voluntary basis. You may decline to provide optional data without affecting your ability to use the core features of the Platform, though mandatory data fields (marked as required during registration or KYC) must be completed to access certain functionality.

3.1 Directly From You. The majority of personal data ong39 holds is provided directly by you during:

• Account registration (name, date of birth, contact details);
• KYC verification (identity documents, proof of address);
• Deposit and withdrawal transactions (bank account or e-wallet details);
• Contacting customer support via live chat or email;
• Opting in to promotional communications.

3.2 Automatically. When you visit or use the Platform, ong39 automatically collects certain technical and usage data through:

• Server logs: Your IP address, timestamp, requested URL, and HTTP response code are recorded with each server request to support security monitoring and fraud prevention.
• Session tracking: An authenticated session token is issued upon login and used to maintain your session state across page requests. This token is stored in a secure, HttpOnly cookie.
• Analytics tools: Aggregate, anonymized usage statistics (page views, game launch counts, session lengths) are collected to help us understand how the Platform is used and where improvements are needed.

3.3 From Third Parties. In limited circumstances, ong39 may receive data about you from third parties, including:

• Identity verification service providers used to cross-check KYC documents;
• Payment processors and banking partners used to confirm the status of deposit or withdrawal transactions;
• Fraud detection and anti-money laundering screening services, which may flag accounts associated with known fraud patterns.

4.1 Primary Purposes. ong39 uses your personal data for the following primary purposes:

• Account management: Creating and maintaining your ong39 account, authenticating your identity on login, and enabling password recovery.
• Transaction processing: Processing IDR deposits and withdrawals through BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, and LinkAja.
• Identity and age verification: Confirming that you are at least 21 years of age and eligible to use the Platform under applicable requirements.
• Regulatory compliance: Meeting anti-money laundering (AML), know-your-customer (KYC), and responsible gaming obligations as mandated by ong39's licensing conditions.
• Customer support: Responding to queries, resolving disputes, and processing responsible gaming tool requests (deposit limits, self-exclusion).
• Security and fraud prevention: Detecting, investigating, and preventing unauthorized account access, payment fraud, bonus abuse, and other prohibited conduct.

4.2 Secondary Purposes. With your consent or where ong39 has a legitimate interest, your data may also be used for:

• Personalization: Tailoring game recommendations, promotions, and interface language to your demonstrated preferences and play history.
• Marketing communications: Sending you promotional emails, bonus notifications, and tournament invitations where you have opted in to receive such communications. You may unsubscribe at any time via the link in any marketing email or by contacting support.
• Platform improvement: Analyzing aggregated, anonymized usage data to identify popular features, diagnose technical issues, and prioritize development of new functionality.
• Responsible gaming monitoring: Using play patterns and deposit frequency to identify members who may be displaying signs of problem gambling, enabling proactive outreach in accordance with our responsible gaming commitments.

5.1 Contractual Necessity. Processing your identity data, contact data, and financial data is necessary to perform the contract between you and ong39 — specifically, to provide you with a functioning gaming account, process your transactions, and deliver the services described in the Terms & Conditions.

5.2 Legal Obligation. ong39 is required to process certain categories of data — particularly KYC verification documents and transaction records — to comply with AML regulations, licensing conditions, and other applicable legal obligations.

5.3 Legitimate Interests. ong39 processes technical data, usage data, and fraud-related data on the basis of legitimate interests — specifically, our interest in maintaining platform security, detecting abuse, improving our services, and protecting the integrity of the gaming environment for all members.

5.4 Consent. Where processing is based on consent — principally for optional marketing communications — you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of any processing carried out prior to withdrawal.

6.1 We Do Not Sell Your Data. ong39 does not sell, rent, lease, or otherwise commercially transfer your personal data to any third party for their own marketing or commercial purposes.

6.2 Service Providers. ong39 engages carefully selected third-party service providers who process personal data on our behalf as Data Processors. These include:

• Payment processors: Banking and e-wallet infrastructure partners that facilitate IDR transactions (BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, LinkAja payment rails);
• Identity verification providers: Specialist KYC services that cross-reference submitted identity documents against official databases;
• Game content providers: Studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft receive limited technical session data (e.g., session tokens) to enable game delivery but do not receive your full personal profile;
• Cloud infrastructure providers: Servers hosting the ong39 platform and database layer are operated by enterprise-grade cloud providers bound by data processing agreements;
• Fraud and AML screening tools: Third-party risk platforms used to screen transactions and member profiles against sanctions lists and known fraud patterns.

All Data Processors are bound by contractual data processing agreements that restrict their use of your data to the specific service being provided and require them to maintain security standards equivalent to or exceeding those applied by ong39.

6.3 Legal Disclosures. ong39 may disclose personal data to law enforcement agencies, regulatory bodies, or other authorities without prior notice where required to do so by applicable law, court order, or in response to a valid legal process. ong39 will notify affected members of such disclosures to the extent permitted by law.

6.4 Business Transfers. In the event of a merger, acquisition, restructuring, or sale of ong39 assets, member personal data may be transferred to the acquiring entity. In such circumstances, affected members will be notified in advance and given the opportunity to request deletion of their data if they do not wish it to be transferred.

7.1 What Are Cookies. Cookies are small text files placed on your device by a website when you visit it. ong39 uses cookies and similar technologies (local storage, session storage, pixel tags) to operate the Platform, remember your preferences, and analyze usage patterns.

7.2 Types of Cookies Used.

7.3 Managing Cookies. You can control and manage cookies through your browser settings. Please note that disabling strictly necessary cookies will prevent you from logging in to your ong39 account and using core platform functionality. Disabling functional or analytics cookies will not prevent you from using the Platform but may result in a reduced or less personalized experience.

7.4 No Third-Party Advertising Cookies. ong39 does not place third-party advertising or retargeting cookies on your device. We do not participate in cross-site behavioral advertising networks.

8.1 Retention Principles. ong39 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal or regulatory obligations. When data is no longer needed, it is securely deleted or anonymized.

8.2 Retention Periods.

• Account and identity data: Retained for the duration of your active account relationship with ong39, plus a minimum of 5 years following account closure to satisfy AML record-keeping requirements.
• Transaction records: Retained for a minimum of 5 years from the date of each transaction to comply with financial record-keeping obligations.
• KYC documents: Retained for a minimum of 5 years from the date of verification, or longer if required by specific regulatory obligations.
• Support communications: Live chat transcripts and email correspondence are retained for 2 years following the resolution of the relevant matter.
• Technical logs: Server access logs are retained for 90 days for security monitoring purposes, after which they are automatically purged.
• Marketing preferences: Retained until you withdraw consent or request deletion, after which they are removed from active marketing lists within 10 business days.

8.3 Deletion on Request. Where you exercise your right to erasure (see Clause 10), ong39 will delete or anonymize your personal data subject to the retention obligations described above. Data that must be retained for legal or regulatory reasons will be isolated from active processing systems and deleted as soon as the mandatory retention period expires.

9.1 Technical Measures. ong39 implements a comprehensive set of technical security controls to protect your personal data, including:

• 256-bit SSL/TLS encryption for all data in transit between your device and ong39 servers;
• AES-256 encryption for all personal data and financial records stored at rest;
• Bcrypt hashing for all member passwords — plaintext passwords are never stored;
• Network-level firewalls and intrusion detection systems monitoring all inbound and outbound traffic;
• Regular automated vulnerability scanning and periodic penetration testing by independent security specialists;
• Role-based access controls ensuring that ong39 staff can only access member data necessary for their specific function.

9.2 Organizational Measures. Beyond technical controls, ong39 maintains organizational security practices including:

• Mandatory data protection training for all staff with access to member data;
• A documented incident response plan covering data breach detection, containment, and notification procedures;
• Contractual security requirements for all third-party Data Processors;
• Segregated access environments ensuring that production member data is inaccessible from development or test environments.

9.3 Breach Notification. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, ong39 will notify affected members without undue delay — and in any event within 72 hours of becoming aware of the breach — by email to your registered address. The notification will describe the nature of the breach, the categories of data affected, and the steps ong39 is taking to mitigate the impact.

10.1 Rights Overview. As a data subject, you have the following rights in relation to personal data that ong39 holds about you. These rights may be exercised by contacting us at [email protected]. ong39 will respond to all valid data rights requests within 30 days of receipt.

10.2 Identity Verification for Rights Requests. To protect your privacy, ong39 requires that all data rights requests be submitted from your registered email address or verified through a secondary authentication step. This ensures that personal data is not disclosed or deleted in response to fraudulent requests.

10.3 Complaints. If you are not satisfied with how ong39 handles your personal data or responds to a data rights request, you have the right to lodge a complaint with the relevant data protection authority. ong39 encourages you to contact us directly in the first instance so that we have an opportunity to resolve your concern promptly.

11.1 Age Restriction. The ong39 Platform is strictly intended for adults aged 21 years and above. ong39 does not knowingly collect personal data from any person under the age of 21. Age verification is a mandatory step during account registration, and all accounts are subject to KYC verification which confirms date of birth against government-issued identity documents.

11.2 Discovery of Minor's Data. If ong39 discovers that personal data has been collected from a person under 21 years of age — whether through an inaccurate age declaration or any other means — the affected account will be immediately suspended, all deposits returned to the payment source, and all personal data associated with that account permanently deleted without delay.

11.3 Parental Notification. If you are a parent or guardian and believe that your child under the age of 21 has created an ong39 account or provided personal data to the Platform, please contact us immediately at [email protected]. We will take prompt action to verify, suspend, and delete the account.

12.1 Game Providers. ong39 hosts games developed and operated by third-party studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft. When you launch a game from one of these providers, a session token is passed to the provider's game server to authenticate your game session. These providers do not receive your full personal profile; they receive only the minimum technical data required to operate the game. Each provider's own privacy policy governs their processing of that session data.

12.2 Payment Partners. When you initiate a deposit or withdrawal, your transaction is routed through the relevant banking or e-wallet infrastructure (BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, or LinkAja). These providers receive only the financial data necessary to process the transaction and are bound by their own privacy policies and applicable Indonesian financial regulations.

12.3 No Responsibility for Third-Party Practices. ong39 is not responsible for the privacy practices of third-party service providers or game studios. We encourage you to review the privacy policies of any third-party services you interact with in connection with your use of the Platform.

13.1 Cross-Border Processing. As an internationally operated platform serving the Indonesia market, ong39 may process or store certain categories of member data on servers located outside Indonesia. This may occur where cloud infrastructure providers or third-party Data Processors operate data centers in other jurisdictions.

13.2 Transfer Safeguards. Where personal data is transferred outside Indonesia, ong39 ensures that appropriate safeguards are in place to protect that data, including:

• Contractual data processing agreements that impose equivalent data protection obligations on the receiving entity;
• Selection of processors who operate in jurisdictions with recognized data protection standards;
• Encryption of all data in transit and at rest, regardless of the jurisdiction in which it is processed or stored.

13.3 No Transfer to Unauthorized Parties. ong39 does not transfer personal data to any entity that has not agreed to be bound by a data processing agreement consistent with the principles of this Privacy Policy. International transfers are made solely to facilitate the delivery of ong39's services to Indonesian members.

14.1 Right to Update. ong39 reserves the right to update, revise, or replace this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or platform functionality. The date of the most recent revision is displayed prominently at the top of this page.

14.2 Notification of Material Changes. Where a change to this Privacy Policy is material — such as a new category of data being collected, a new purpose for which existing data will be used, or a new category of third party with whom data will be shared — ong39 will notify active members by email to their registered address at least 14 days before the change takes effect.

14.3 Continued Use as Acceptance. Your continued use of the ong39 Platform after the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree to the revised policy, you must stop using the Platform and may request account closure and deletion of your data in accordance with Clause 10.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the personal data that ong39 holds about you, please contact our Data Protection team through any of the following channels:

• Email: [email protected] — for data rights requests, please include "Privacy Request" in the subject line and send from your registered email address
• Live Chat: Available 24/7 via the chat widget on the Platform — for urgent matters such as suspected unauthorized access to your account, live chat is the fastest channel
• Response Time: Data rights requests are acknowledged within 2 business days (WIB) and substantively responded to within 30 calendar days of receipt

For responsible gaming-related data requests (e.g., requesting your full bet history for personal review, or activating a self-exclusion that removes your data from active marketing systems), please visit our dedicated Responsible Gaming page or indicate the responsible gaming nature of your request to our support team.