oja89 Privacy
Policy

This Privacy Policy ("Policy") is issued by oja89 ("oja89", "we", "us", "our"), the operator of the online gambling platform accessible at https://oja89.click ("Platform"). This Policy governs the collection, use, storage, and disclosure of personal data relating to all individuals ("Player", "User", "you") who access or use the oja89 Platform.

oja89 is committed to handling personal data responsibly, transparently, and in accordance with applicable data protection principles. We recognise that the players who trust us with their personal information — from Kuala Lumpur and Penang to Johor Bahru and Petaling Jaya — deserve a clear and honest explanation of how that data is managed.

By registering an account on oja89 or by continuing to use the Platform after this Policy has been made available to you, you acknowledge that you have read and understood this Policy and you consent to the processing of your personal data as described herein.

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial information, and online identifiers.
• "Processing" means any operation or set of operations performed on personal data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" means oja89, as the entity that determines the purposes and means of processing personal data collected via the Platform.
• "Data Processor" means any third-party entity that processes personal data on behalf of oja89, such as payment processors, KYC verification providers, or cloud infrastructure providers.
• "Consent" means any freely given, specific, informed, and unambiguous indication of the data subject's agreement to the processing of their personal data.
• "Cookie" means a small text file stored on a user's device by a web browser, used to recognise returning users, store session information, and support analytics functions.
• "KYC" means Know Your Customer — the identity and age verification procedures conducted by oja89 to comply with applicable anti-money laundering and responsible gambling obligations.

oja89 collects personal data that is necessary to provide its services, comply with applicable regulations, and maintain the security and integrity of the Platform. The categories of personal data we collect include:

We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or health information, except where health information is voluntarily provided in the context of a responsible gambling self-exclusion request, in which case it is handled with heightened confidentiality.

oja89 collects personal data through the following channels:

• Direct Submission: Information you provide when completing the registration form, submitting KYC documents, contacting customer support, or interacting with any Platform feature that requires your input.
• Automated Technical Collection: Technical data collected automatically when you access the Platform, including IP address, device fingerprint, browser type, and session activity logs.
• Transaction Records: Financial data generated when you make deposits or request withdrawals via payment methods such as Touch 'n Go eWallet, DuitNow, FPX, Maybank, CIMB, or other approved channels.
• Cookies and Tracking Technologies: Behavioural and preference data collected through cookies and similar technologies during your browsing and gaming sessions on the Platform. See Section 10 for full details.
• Third-Party Verification Services: Identity and address verification data returned by our approved KYC service providers following document checks.
• Referral and Promotional Activity: Data associated with referral programmes, promotional entries, or affiliate marketing interactions where relevant to your account.

oja89 processes personal data for the following specific purposes. We process only what is necessary for each stated purpose and do not repurpose data without your knowledge.

• Account Management: To create, maintain, and administer your oja89 account, including authentication, profile updates, and correspondence related to your account status.
• Payment Processing: To facilitate MYR deposits and withdrawals via your chosen payment method, reconcile transactions, and maintain accurate financial records.
• Identity Verification (KYC): To verify your age, identity, and residential address in compliance with applicable anti-money laundering and responsible gambling obligations.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, account takeover attempts, and other prohibited conduct on the Platform.
• Responsible Gambling: To monitor betting behaviour for indicators of problem gambling, apply player-requested limits, and fulfil our duty of care obligations.
• Customer Support: To respond to your queries, complaints, and requests, and to maintain a record of communications for quality assurance purposes.
• Platform Improvement: To analyse aggregated, anonymised usage data to identify technical issues, improve product features, and enhance the overall player experience.
• Marketing Communications: Where you have provided explicit consent, to send you promotional offers, bonus notifications, and platform updates. You may withdraw consent at any time.
• Legal & Regulatory Compliance: To fulfil our obligations to regulatory bodies, respond to lawful requests from competent authorities, and maintain records as required by applicable law.

oja89 relies on the following legal bases when processing your personal data, depending on the specific purpose of processing:

• Contractual Necessity: Processing required to perform the contract between you and oja89 — including account administration, payment processing, and service delivery.
• Legal Obligation: Processing necessary for oja89 to comply with applicable legal and regulatory requirements, including KYC, anti-money laundering, and responsible gambling obligations.
• Legitimate Interests: Processing necessary for the purposes of our legitimate interests — such as fraud prevention, platform security, and abuse detection — where those interests are not overridden by your rights and interests.
• Consent: Processing based on your freely given, informed consent — in particular for the sending of direct marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

oja89 does not sell, rent, or trade your personal data to any third party for commercial purposes. We may share your personal data only in the following limited and controlled circumstances:

• Payment Processors: Data shared with payment service providers — including operators of Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX gateways, and banking partners such as Maybank, CIMB, and Public Bank — solely for the purpose of processing your financial transactions.
• KYC & Verification Providers: Identity document and biometric data shared with approved third-party identity verification services to fulfil KYC obligations.
• Technology Infrastructure: Technical data shared with cloud hosting, cybersecurity, and platform infrastructure providers who support the operation of the oja89 Platform under strict data processing agreements.
• Regulatory & Law Enforcement Authorities: Personal data disclosed to competent governmental, regulatory, or law enforcement bodies where required by law, court order, or regulatory directive.
• Professional Advisors: Data shared on a confidential basis with legal counsel, auditors, or other professional advisors where necessary in connection with oja89's business operations.
• Business Transfers: In the event of a merger, acquisition, or asset sale, personal data may be transferred as part of the transaction. Affected users will be notified in advance where practicable.

All third parties with whom oja89 shares personal data are required to handle that data in compliance with applicable data protection standards, and are bound by contractual obligations that prohibit them from using your data for any purpose other than those specified by oja89.

oja89 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal or regulatory obligations. The following general retention periods apply:

• Account and Identity Data: Retained for the duration of your account and for a minimum period of five (5) years following account closure, in accordance with anti-money laundering record-keeping requirements.
• Financial Transaction Records: Retained for a minimum of seven (7) years from the date of each transaction, in accordance with financial record-keeping obligations.
• KYC Verification Documents: Retained for the period required by applicable KYC and AML regulations, typically five (5) years from the end of the business relationship.
• Customer Support Communications: Retained for three (3) years from the date of the interaction, or longer where the matter remains unresolved or the subject of ongoing investigation.
• Marketing Preferences and Consent Records: Retained for the duration of your account and for two (2) years following any withdrawal of consent.
• Technical and Session Logs: Retained for up to ninety (90) days, unless specific retention is required for an ongoing security investigation.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents reconstruction of the original data.

oja89 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS encryption applied to all data transmitted between your device and the oja89 Platform.
• Encryption at rest for stored personal data and financial records on our server infrastructure.
• Role-based access controls limiting internal access to personal data to authorised personnel with a legitimate operational need.
• Multi-factor authentication requirements for all administrative access to systems holding personal data.
• Regular penetration testing and vulnerability assessments conducted by independent cybersecurity specialists.
• Documented incident response procedures to contain, investigate, and remediate any data security breach in a timely manner.
• Staff training on data protection responsibilities and secure data handling practices.

oja89 uses cookies and similar tracking technologies on the Platform to support core functionality, improve the user experience, and gather aggregated analytics data. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the Platform to function correctly. These include session authentication cookies that keep you logged in and security tokens that protect against cross-site request forgery. These cannot be disabled.
• Functional Cookies: Used to remember your preferences, such as language settings, preferred deposit method, and display preferences, so that you do not need to reconfigure them on every visit.
• Analytical Cookies: Used to collect aggregated, anonymised information about how players interact with the Platform — including pages visited, features used, and session duration — to help us identify areas for improvement.
• Marketing Cookies: Used, where you have provided consent, to track engagement with promotional communications and to deliver personalised offers relevant to your activity on the Platform.

You may manage your cookie preferences via your browser settings. Please note that disabling functional or analytical cookies may affect the quality and functionality of your experience on the Platform. Strictly necessary cookies cannot be disabled without preventing use of the Platform.

As a data subject, you hold a number of rights in relation to the personal data that oja89 processes about you. These rights are described below. To exercise any of these rights, please contact our support team at [email protected] with a clear description of your request and sufficient information for us to verify your identity.

oja89 will respond to all valid data rights requests within thirty (30) calendar days of receipt. In complex or high-volume cases, this period may be extended by a further sixty (60) days, with notice provided to you before the initial deadline expires.

The oja89 Platform is strictly intended for persons aged 21 years and above. oja89 does not knowingly collect, store, or process personal data belonging to individuals under the age of 21.

Age verification is conducted as part of the mandatory KYC process for all new registrations. Where oja89 identifies or has reasonable grounds to believe that a registered account is held by or on behalf of a person under 21, the account will be immediately suspended pending investigation and any funds will be withheld until the matter is resolved in accordance with applicable responsible gambling procedures.

The oja89 Platform integrates with a number of third-party services to facilitate payments, identity verification, analytics, and game content delivery. These services may independently collect certain technical data as part of their normal operation.

oja89 is not responsible for the privacy practices of third-party services that operate under their own terms and privacy policies. These include, without limitation:

• Malaysian payment network operators (Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX gateway providers)
• Malaysian banking institutions (Maybank, CIMB, Public Bank, Hong Leong Bank, and others accessed via FPX)
• Independent KYC and document verification service providers
• Game content providers and live dealer studio operators
• Cloud infrastructure and content delivery network providers

When you interact with these third-party services — for example, when you initiate a DuitNow transfer or authenticate with your banking app — you are subject to that provider's own privacy policy, which oja89 has no control over. We recommend reviewing the privacy policies of any third-party services you use in connection with the Platform.

oja89 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or business operations. When material changes are made to this Policy, we will:

• Update the "Last Updated" date displayed at the top of this page.
• Notify registered players via email and/or a prominent in-platform notification where the changes materially affect how their data is processed.
• Where required by applicable law, seek fresh consent before processing data in a new manner.

We encourage you to review this Policy periodically to stay informed of how oja89 manages your personal data. Your continued use of the Platform following the publication of an amended Policy constitutes your acknowledgement of the changes.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way oja89 processes your personal data, please contact us through one of the following channels:

• Email (Data Enquiries): [email protected] Plain text address — not a clickable link. Copy and paste into your email client.
• Live Chat: Available 24/7 via the Platform interface. Fastest response channel for urgent data concerns.
• Response Commitment: All privacy-related enquiries are responded to within 5 business days. Formal data rights requests are handled within 30 calendar days.

Our support team operates during Malaysian Standard Time (MYT, UTC+8). For matters specifically relating to responsible gambling, self-exclusion, or player welfare, please visit our dedicated Responsible Gambling page.