obs168 Privacy Policy

1. Introduction & Scope

obs168 ("we", "us", "our") operates the online betting and gaming platform available at obs168.cam and any associated subdomains or mobile applications (collectively, "the Platform"). This Privacy Policy describes how obs168 collects, processes, stores, shares, and protects personal data relating to individuals who register accounts, visit the Platform, or otherwise interact with our services ("Players" or "you").

This policy applies to all personal data processed in connection with the obs168 Platform, including data collected during account registration, identity verification (KYC), financial transactions (deposits and withdrawals via BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, and LinkAja), customer support interactions, marketing communications, and general Platform usage.

obs168 is committed to handling personal data in accordance with applicable international data protection principles, including transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality, and accountability. We treat privacy not as a compliance checkbox but as a fundamental component of the trust our Players place in us.

2. Definitions

• "Personal Data" means any information that identifies or could reasonably be used to identify a living individual, directly or indirectly (e.g., full name, national ID number, email address, IP address, device identifiers).
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, and deletion.
• "Data Controller" refers to obs168, which determines the purposes and means of processing your Personal Data.
• "Data Processor" refers to third parties engaged by obs168 to process Personal Data on our behalf (e.g., KYC verification providers, payment gateways, cloud hosting providers).
• "Sensitive Data" refers to data categories requiring heightened protection, including government-issued identity document numbers, biometric data, and financial account details.
• "DPO" means obs168's designated Data Protection Officer, the individual responsible for overseeing compliance with this Privacy Policy and applicable data protection regulations.

3. Data We Collect

3.1 Registration Data

When you create an obs168 account, we collect:

• Full legal name (as it appears on your government-issued ID).
• Date of birth (to verify you are at least 21 years of age).
• Indonesian residential address.
• Active Indonesian mobile phone number.
• Email address.
• Username and hashed (never plain-text) password.
• Preferred payment method and associated account details.

3.2 Identity Verification (KYC) Data

To comply with anti-money laundering (AML) obligations and verify your identity before processing withdrawals, we collect:

• Copy of government-issued photo ID (Indonesian KTP, passport, or SIM driver's license).
• Proof of current residential address (utility bill or bank statement, dated within 90 days).
• Selfie photograph holding your ID document with a handwritten date and "obs168" notation.
• Additional documentation as required in higher-risk or higher-value account cases.

3.3 Financial Transaction Data

For every deposit and withdrawal, obs168 records:

• Transaction amount in Indonesian Rupiah (IDR/Rp).
• Payment method used (e.g., BCA transfer, OVO, DANA, GoPay).
• Bank account number or e-wallet identifier (partially masked in storage).
• Timestamp of transaction initiation and completion.
• Transaction reference numbers from both obs168 and the payment provider.

3.4 Betting Activity Data

We log all betting activity on the Platform, including:

• Sports bets placed, including event, market, odds, stake, and settlement outcome.
• Togel (Indonesia's traditional numbers lottery) ticket purchases and draw results.
• Casino game sessions, including game type, stake, result, and session duration.
• Slot game activity, including titles played, bet sizes, and return amounts.

3.5 Technical & Device Data

Our servers and analytics tools automatically collect:

• IP address and derived approximate geographic location.
• Device type, operating system version, and browser type/version.
• Session duration, page visit sequence, and clickstream data.
• Unique device identifiers (where applicable on mobile applications).
• Referral URL (how you arrived at obs168.cam).

3.6 Customer Support Data

When you contact obs168 support via live chat or email, we record:

• The content of your messages and any attachments you submit.
• Support ticket reference numbers and agent interaction logs.
• Call recordings or chat transcripts (where applicable and disclosed).
• Resolution outcome and player satisfaction rating (where provided voluntarily).

4. How We Use Your Data

obs168 uses your Personal Data only for the following defined purposes:

Purpose	Data Categories Used
Account creation & management	Registration data, technical data
Identity verification (KYC/AML)	KYC data, registration data
Processing deposits & withdrawals	Financial transaction data, KYC data
Delivering betting & gaming services	Betting activity data, technical data
Fraud detection & platform security	All categories, with automated risk scoring
Customer support & dispute resolution	Support data, betting activity data
Responsible gaming monitoring	Betting activity data, financial transaction data
Platform performance & analytics	Technical data, anonymized betting activity
Promotional communications (opted-in only)	Registration data, betting activity data
Legal & regulatory compliance	All categories as required by applicable law

obs168 does not use your Personal Data for automated decision-making that produces significant legal effects without human review. Where automated tools are used in fraud detection or responsible gaming monitoring, a qualified compliance officer reviews any action taken against an account before it is enforced.

5. Legal Basis for Processing

obs168 processes your Personal Data under the following legal bases:

• Contractual necessity: Processing your registration data, KYC documents, and financial transaction records is necessary to fulfill our contractual obligations to you as a Platform user.
• Legal obligation: Anti-money laundering (AML) regulations, know-your-customer (KYC) requirements, and financial record-keeping laws require us to collect and retain certain categories of data regardless of your preferences.
• Legitimate interests: Fraud detection, platform security, responsible gaming monitoring, and internal analytics serve our legitimate business interests while not overriding your fundamental privacy rights.
• Consent: Marketing communications, promotional emails, and non-essential cookies are processed only where you have provided explicit, freely given, and revocable consent. You may withdraw consent at any time by contacting support.

6. Data Sharing & Disclosure

6.1 Authorized Third-Party Processors

obs168 engages carefully vetted third-party processors to deliver specific service functions. These parties access your data only as necessary to perform their contracted function and are bound by strict data processing agreements:

• KYC verification providers: Process identity document images and biometric selfie comparisons to confirm your identity and age.
• Payment gateways: Facilitate fund transfers via BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, and LinkAja. These providers operate under their own privacy policies and financial regulations.
• Cloud infrastructure providers: Host the obs168 Platform, databases, and backup systems in secure data centers with ISO 27001 certification.
• Game content providers: Studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft receive anonymous session identifiers for game delivery; they do not receive your name, bank details, or contact information.
• Customer support platform: Our live chat and ticketing system provider processes chat transcripts and support ticket content to deliver support services.
• Fraud detection services: Receive device fingerprint, IP, and behavioral data to detect suspicious patterns and protect the integrity of the Platform.

6.2 Legal Disclosure

obs168 may disclose your Personal Data to law enforcement authorities, regulatory bodies, or judicial courts when required to do so by a valid legal order, warrant, or applicable regulation. We will notify you of such disclosure requests where legally permitted to do so. We do not disclose data to government agencies beyond what is strictly required by a valid legal instrument.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of obs168's business, your Personal Data may be transferred to the acquiring entity as part of the transaction. We will notify you via the email address registered to your account at least 30 days before any such transfer takes effect, giving you the opportunity to close your account and withdraw funds if you do not wish your data to be transferred.

6.4 What We Never Do

• We do not sell your Personal Data to data brokers, advertisers, or marketing platforms.
• We do not share your betting history with your bank, e-wallet provider, or any Indonesian government agency for purposes beyond mandatory legal compliance.
• We do not share your contact details with other Players on the Platform.
• We do not disclose your KYC documents to any third party not directly involved in KYC processing.

7. International Data Transfers

As an internationally operated platform serving Indonesian players, obs168 may transfer certain categories of Personal Data to servers or processors located outside Indonesia. Where such transfers occur, we ensure adequate protection through:

• Standard contractual clauses (SCCs) binding the receiving party to data protection obligations equivalent to those in this policy.
• Transfer to jurisdictions recognized as providing an adequate level of data protection by relevant international standards.
• Binding corporate rules where data is transferred within the obs168 corporate group.

KYC document data is processed in jurisdictions with established financial crime prevention frameworks. Payment transaction data is processed within the secure environments of our licensed payment partners, each of which holds relevant financial services authorization. You may request details of the specific safeguards in place for any international transfer by contacting our DPO at the address in Section 14.

8. Data Retention

obs168 retains your Personal Data for as long as necessary to fulfill the purposes described in this policy, subject to the following minimum and maximum retention schedules:

Data Category	Retention Period	Basis
Account registration data	Duration of active account + 5 years post-closure	AML regulatory obligation
KYC identity documents	Duration of active account + 5 years post-closure	AML regulatory obligation
Financial transaction records	7 years from transaction date	Financial record-keeping law
Betting activity logs	Duration of active account + 2 years post-closure	Dispute resolution, responsible gaming
Customer support transcripts	3 years from ticket creation date	Dispute resolution, quality assurance
Technical & device logs	13 months from collection date	Security & fraud detection
Marketing preferences	Until consent is withdrawn or account closed	Consent

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymized so that it can no longer be associated with any identifiable individual. Anonymized, aggregated data (e.g., platform-wide betting statistics) may be retained indefinitely for internal analytics and product development.

9. Security Measures

obs168 implements a layered security architecture to protect your Personal Data against unauthorized access, accidental loss, destruction, or disclosure:

• Encryption in transit: All data exchanged between your browser/app and obs168 servers is encrypted using TLS 1.2 or TLS 1.3 protocols with 256-bit key strength.
• Encryption at rest: Sensitive Personal Data — including KYC documents, payment account details, and identity numbers — is encrypted at rest using AES-256 encryption.
• Access controls: Internal access to Personal Data is governed by role-based access control (RBAC). Only employees with a verified operational need may access specific data categories, and all access is logged and auditable.
• Two-factor authentication: Administrative access to systems containing Personal Data requires multi-factor authentication. Players are strongly encouraged to enable 2FA on their obs168 accounts.
• Regular penetration testing: Independent cybersecurity firms conduct scheduled and unannounced penetration tests on our infrastructure. Critical vulnerabilities are patched within 24 hours; high-severity issues within 7 days.
• Incident response: obs168 maintains a documented data breach response procedure. In the event of a breach affecting your Personal Data, we will notify affected Players within 72 hours of confirming the breach, detailing what data was affected and what steps we are taking.

While obs168 employs rigorous security controls, no digital system is entirely immune to sophisticated attacks. You share responsibility for your account security by maintaining a strong, unique password and enabling two-factor authentication on your account.

10. Cookies & Tracking Technologies

10.1 Types of Cookies We Use

obs168 uses the following categories of cookies and similar tracking technologies:

• Strictly necessary cookies: Essential for the Platform to function. These cannot be disabled. They manage your session authentication, security tokens, and load balancing. No consent is required for these cookies.
• Functional cookies: Remember your preferences such as preferred deposit method, language display, and odds format. Disabling these may reduce Platform functionality.
• Analytics cookies: Collect anonymized data on how Players navigate the Platform, which pages are most visited, and where technical errors occur. This data improves Platform performance. These require your consent.
• Marketing cookies: Track Platform referral sources to attribute sign-ups accurately. obs168 does not use cross-site behavioral advertising cookies. These require your consent.

10.2 Managing Cookies

You may control non-essential cookies through your browser settings. Most modern browsers allow you to block or delete cookies via the browser's settings or preferences menu. Note that disabling strictly necessary cookies will prevent you from logging into your obs168 account. For mobile app users, device-level privacy settings govern tracking permissions. Withdrawing cookie consent does not affect the lawfulness of processing based on consent before its withdrawal.

11. Your Privacy Rights

As an obs168 Player based in Indonesia, you hold the following rights with respect to your Personal Data. To exercise any of these rights, contact our DPO as described in Section 14:

• Right of access: You may request a copy of all Personal Data obs168 holds about you, along with information on how it is being used. We will respond within 30 business days.
• Right to rectification: If any Personal Data we hold is inaccurate or incomplete, you may request that we correct it. Contact support with supporting documentation.
• Right to erasure ("right to be forgotten"): You may request deletion of your Personal Data where processing is no longer necessary, consent has been withdrawn, or data has been unlawfully processed. Note that data subject to legal retention obligations (e.g., AML records) cannot be deleted on request until the retention period expires.
• Right to restrict processing: You may request that we restrict processing of your data (e.g., suspend use of your data while a rectification request is reviewed) in specific circumstances defined by applicable data protection law.
• Right to data portability: You may request that obs168 provide your Personal Data in a structured, machine-readable format for transfer to another service provider, where technically feasible.
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing emails, analytics cookies), you may withdraw consent at any time without affecting prior processing. Contact support or use the unsubscribe link in any marketing email.
• Right to object: You may object to processing based on legitimate interests grounds, including profiling for marketing purposes. obs168 will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.

obs168 will not charge a fee for exercising these rights unless requests are manifestly unfounded or excessive (e.g., repetitive requests). We reserve the right to verify your identity before processing any data rights request to prevent unauthorized access to another Player's data.

12. Minors & Age Verification

The obs168 Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect Personal Data from individuals under 21. All registrants are required to confirm their age at registration and to submit valid KYC documentation before any withdrawal is processed.

If obs168 discovers, through KYC review or other means, that a Player is under 21 years of age, the account will be immediately suspended, all pending bets voided, all bonus funds forfeited, and any remaining real-money balance returned to the originating payment method after deducting any applicable withdrawal fees. The underage Player's data will be retained only for the minimum period required by law for AML compliance and then securely deleted.

If you believe a minor has registered on obs168 using false information, please notify us immediately at support@obs168.cam so we may take prompt action.

13. Changes to This Privacy Policy

obs168 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform functionality. When material changes are made — defined as changes affecting the types of data collected, the purposes for which data is used, or the rights available to Players — we will:

• Post a prominent notice on obs168.cam at least 14 days before the updated policy takes effect.
• Send a notification to the email address registered to your account summarizing the key changes.
• Update the "Last Updated" date at the top of this document.

Your continued use of the obs168 Platform following the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not accept the revised policy, you must cease using the Platform and contact support to close your account and withdraw any remaining balance.

14. Contact Our Data Protection Officer

For any questions, concerns, or requests relating to this Privacy Policy or obs168's data handling practices, please contact our Data Protection Officer:

• Email: support@obs168.cam (include "Privacy / DPO Request" in the subject line)
• Live Chat: Available 24/7 on obs168.cam — available in Indonesian and English
• Response Time: We aim to acknowledge all privacy-related inquiries within 2 business days and provide a substantive response within 30 business days.

We take all privacy inquiries seriously. If you are not satisfied with our response to a privacy complaint, you retain the right to escalate the matter to a relevant data protection authority or pursue dispute resolution as outlined in our Terms & Conditions.

By using the obs168 Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your Personal Data as described herein.