Privacy Policy

1. Definitions

Throughout this Privacy Policy, the following terms carry the meanings assigned below:

• "Personal Data" — any information that relates to an identified or identifiable natural person, including but not limited to name, identification number, location data, email address, and financial account details.
• "Processing" — any operation performed on Personal Data, including collection, storage, use, disclosure, transmission, erasure, or destruction.
• "Player" / "You" — any natural person who has registered or is seeking to register an account on the aosc platform.
• "Platform" — the aosc website at https://aosc.cam and all associated services, sub-domains, mobile interfaces, and APIs.
• "Third Party" — any natural or legal person other than aosc and the Player.
• "KYC" — Know Your Customer; identity and age verification procedures required before the Platform can process withdrawals or large transactions.
• "AML" — Anti-Money Laundering; regulatory obligations requiring financial service providers to identify, monitor, and report suspicious transactions.
• "Cookies" — small text files placed on your device by the Platform to store session preferences, authentication tokens, and analytics data.

2. Data Controller

2.1  For the purposes of this Privacy Policy, aosc acts as the Data Controller in respect of all Personal Data collected through the Platform. As Data Controller, aosc determines the purposes for which and the means by which your Personal Data is processed.

2.2  aosc operates the Platform under an international gaming license and maintains its primary data processing infrastructure in a jurisdiction that upholds internationally recognized data protection standards.

2.3  All privacy-related inquiries, access requests, and complaints should be directed to our dedicated privacy team at [email protected] with the subject line "Privacy Request — [Your Username]".

3. Data We Collect

3.1  The categories of Personal Data we collect depend on how you interact with the Platform. The table below summarizes the data types and their sources:

3.2  We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data (beyond selfie photos used solely for identity verification), or data concerning health or sexual orientation, unless such information is voluntarily provided to us in the context of a responsible gaming support request.

4. How We Collect Data

4.1  Direct Collection. The majority of your Personal Data is provided directly by you during account registration, KYC document submission, deposit and withdrawal requests, customer support interactions, and when you update your account preferences.

4.2  Automated Collection. When you access the Platform, our servers automatically record Technical Data including your IP address, device identifiers, browser fingerprint, and session activity logs. This data is collected through server logs, cookies, and similar tracking technologies described in Section 8 of this policy.

4.3  Third-Party Sources. In limited circumstances, we may receive data about you from third parties, including:

• Payment processors and Indonesian bank partners (BCA, BRI, BNI, Mandiri, and e-wallet providers) — to confirm transaction authenticity and account ownership.
• Identity verification service providers — to validate government-issued identification documents during KYC.
• Fraud detection and AML screening services — to identify high-risk account behaviour patterns.
• Our licensed game content providers (Pragmatic Play, Evolution Gaming, Microgaming, NetEnt) — who may share aggregate session data necessary for game fairness audits.

5. Purposes of Processing

5.1  aosc processes your Personal Data for the following specific purposes:

• Account Management: Creating, maintaining, and administering your Player account, including authentication and security controls.
• Transaction Processing: Executing deposits and withdrawal requests via Indonesian banking and e-wallet channels, and maintaining accurate financial records in IDR.
• Identity Verification (KYC): Verifying that you are aged 21 or older and are the legitimate holder of the payment methods registered to your account.
• Regulatory Compliance (AML): Monitoring transactions for suspicious activity in accordance with internationally recognized anti-money-laundering obligations.
• Customer Support: Responding to your inquiries, resolving disputes, and providing Indonesian-language assistance through our 24/7 support team.
• Fraud Prevention and Platform Security: Detecting and preventing unauthorized account access, multi-accounting, bonus abuse, and other forms of fraudulent activity.
• Responsible Gaming: Monitoring gaming patterns to identify potential problem gambling indicators and enforce self-imposed limits, time-outs, and self-exclusion requests.
• Mar keting and Promotions: Sending you relevant bonus offers, seasonal promotions tied to events such as Idul Fitri, Ramadhan, or Indonesian Independence Day, and platform updates — where you have not opted out of such communications.
• Platform Improvement: Analyzing aggregated and anonymized usage data to improve the Platform's performance, game selection, and user experience.
• Legal Obligations: Retaining records and responding to lawful requests from authorized regulatory or law enforcement bodies.

5.2  We will not use your Personal Data for any purpose that is incompatible with those listed above without first obtaining your explicit consent or establishing a separate lawful basis for doing so.

6. Legal Basis for Processing

6.1  aosc processes your Personal Data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual Necessity: Processing required to fulfill our obligations under the Terms & Conditions you agreed to upon registration — including account management, transaction processing, and KYC verification.
• Legal Obligation: Processing necessary to comply with applicable AML regulations, licensing requirements, and lawful orders from competent authorities.
• Legitimate Interests: Processing carried out in pursuit of aosc's legitimate business interests — such as fraud prevention, platform security, and responsible gaming monitoring — where those interests are not overridden by your fundamental rights and freedoms.
• Consent: Where we rely on your consent as the legal basis — for example, for sending marketing communications — you may withdraw that consent at any time by contacting our support team or using the opt-out mechanism in any marketing email.

6.2  Where processing is based on consent, withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

7. Data Sharing & Disclosure

7.1  aosc does not sell, rent, or trade your Personal Data to third-party marketers under any circumstances. We may share your Personal Data only with the following categories of recipients, and only to the extent strictly necessary:

• Payment Service Providers: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) and e-wallet operators (OVO, DANA, GoPay, ShopeePay) — to process deposits and withdrawals registered in your name.
• Identity Verification Providers: Third-party KYC service providers contracted to validate government-issued identification documents on our behalf.
• Game Content Providers: Licensed game studios including Pragmatic Play, Evolution Gaming, Microgaming, and NetEnt — who receive only the technical session data necessary to deliver their games and conduct fairness audits.
• Fraud & AML Screening Services: Specialist third-party tools used to screen transactions and account activity against known fraud patterns and sanctions lists.
• IT Infrastructure & Hosting Providers: Cloud and server infrastructure partners who store and process Platform data on our behalf under strict data processing agreements.
• Legal and Regulatory Authorities: Government bodies, regulators, law enforcement agencies, or courts where disclosure is required by law, court order, or regulatory directive. In such cases, aosc will disclose only the minimum amount of data required.
• Professional Advisors: Lawyers, auditors, and accountants who are bound by confidentiality obligations and who require access to Platform data in order to provide professional services to aosc.

7.2  All third-party service providers who handle your Personal Data on our behalf are required to enter into data processing agreements with aosc, committing them to process your data only on our documented instructions and to maintain appropriate security standards.

8. Cookies & Tracking Technologies

8.1  The aosc Platform uses cookies and similar tracking technologies to deliver a secure, personalized, and high-performance experience. The following categories of cookies are in use:

8.2  You may control cookie preferences through your browser's built-in settings. Please note that disabling strictly necessary or security cookies may render parts of the Platform inaccessible or impair account security. aosc does not respond to browser-level "Do Not Track" signals at this time, as no universal standard for such signals has been adopted.

9. Data Retention

9.1  aosc retains your Personal Data only for as long as is necessary to fulfill the purpose for which it was collected, to comply with legal and regulatory obligations, and to resolve any disputes or enforce our agreements. The principal retention periods are as follows:

• Account and Identity Data: Retained for the duration of your active account plus a minimum of five (5) years following account closure, in compliance with AML record-keeping requirements.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, as required by internationally recognized AML standards.
• KYC Documents: Retained for five (5) years after the end of the business relationship, then securely deleted or anonymized.
• Customer Support Communications: Retained for two (2) years from the date of the interaction, or longer if the communication relates to an unresolved dispute.
• Gaming Activity Logs: Retained for three (3) years from the date of each recorded session.
• Marketing Consent Records: Retained for the duration of the marketing relationship plus two (2) years, to demonstrate consent in the event of a complaint.
• Technical / Server Log Data: Retained for ninety (90) days in active logs, then archived for up to twelve (12) months for security investigation purposes before deletion.

9.2  Upon expiry of the applicable retention period, Personal Data is either securely deleted, pseudonymized, or anonymized such that it can no longer be attributed to any individual Player.

10. Security Measures

10.1  aosc implements a comprehensive suite of technical and organizational security measures to protect your Personal Data against unauthorized access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS Encryption: All data in transit between your device and our servers is encrypted using industry-standard SSL/TLS protocols.
• At-Rest Encryption: Sensitive data stored in our databases — including financial account details and KYC documents — is encrypted at rest using AES-256.
• Access Controls: Internal access to Player data is restricted on a strict need-to-know basis. All staff with data access are subject to binding confidentiality obligations and regular security training.
• Multi-Factor Authentication (MFA): Privileged internal system accounts require MFA. We also offer Players the option to enable two-factor authentication on their own accounts.
• Intrusion Detection: Our infrastructure is monitored around the clock by automated intrusion detection and prevention systems designed to identify and neutralize threats in real time.
• Regular Security Audits: The Platform undergoes periodic third-party security penetration testing and vulnerability assessments to identify and remediate potential weaknesses.

10.2  In the event of a data breach that is likely to result in a high risk to your rights and freedoms, aosc will notify affected Players without undue delay and will take all reasonable steps to contain the breach and mitigate its impact.

10.3  While aosc employs industry-leading security practices, no system is entirely immune to risk. Players are strongly encouraged to use strong, unique passwords and to enable two-factor authentication on their accounts as an additional layer of protection.

11. Your Rights

11.1  As a Player whose Personal Data is processed by aosc, you hold the following rights, which you may exercise at any time by submitting a written request to [email protected]:

• Right of Access: You may request a copy of the Personal Data we hold about you, along with information about how it is processed.
• Right to Rectification: If any Personal Data we hold is inaccurate or incomplete, you may request that we correct or update it without undue delay.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to any overriding legal retention obligations (such as AML record-keeping requirements).
• Right to Restriction of Processing: You may request that we restrict the processing of your Personal Data in certain circumstances — for example, while a dispute about data accuracy is being resolved.
• Right to Data Portability: Where processing is based on your consent or on a contract, you may request that we provide your Personal Data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing carried out on the basis of our legitimate interests, including for direct marketing purposes. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your rights.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

11.2  We will respond to all valid data rights requests within thirty (30) calendar days of receipt. In complex cases, we may extend this period by a further two months, in which case we will notify you of the extension and the reasons for it within the initial 30-day period.

11.3  We reserve the right to request proof of identity before processing any data rights request, to ensure that Personal Data is not disclosed to or altered by unauthorized individuals.

12. Minors

12.1  The aosc Platform is strictly for adults aged 21 years and older. We do not knowingly collect, store, or process Personal Data relating to individuals under the age of 21. Age verification is performed during the KYC process for all accounts prior to withdrawal processing.

12.2  If we become aware that Personal Data has been collected from an individual under the age of 21 without appropriate verification having been conducted, we will take immediate steps to delete that data and permanently close the associated account. Any funds held in such an account will be handled in accordance with our Terms & Conditions.

12.3  If you are a parent or legal guardian and believe that your child has created an account on the Platform, please contact us immediately at [email protected] so that we may investigate and take appropriate action without delay.

13. International Data Transfers

13.1  aosc operates globally and your Personal Data may be processed in countries outside of Indonesia, including the jurisdiction in which our primary data hosting infrastructure is maintained. Such transfers occur only where the recipient country or organization provides an adequate level of data protection, or where appropriate safeguards — such as contractual data processing agreements — are in place.

13.2  When your data is transferred internationally to third-party service providers such as KYC vendors, game providers, or cloud hosting partners, those transfers are governed by data processing agreements that require the recipients to apply protections equivalent to those described in this Privacy Policy.

13.3  By using the aosc Platform, you acknowledge and consent to the transfer of your Personal Data to jurisdictions outside Indonesia where such transfers are necessary to deliver our services.

14. Policy Amendments

14.1  aosc reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory requirements. When material changes are made, we will notify registered Players via email to the address on file, or via a prominent notice displayed on the Platform.

14.2  The updated Privacy Policy will take effect on the date specified in the revision notice. Your continued use of the Platform after that date constitutes your acceptance of the revised terms. If you do not agree with any amendment, you must cease using the Platform and may request account closure by contacting our support team.

14.3  The most current version of this Privacy Policy is always accessible at https://aosc.cam/privacy-policy. We recommend reviewing this page periodically to remain informed of how we protect your data.

15. Contact & Complaints

15.1  If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or have a concern about how your Personal Data has been handled, please contact the aosc privacy team through the following channels:

• Email: [email protected] — use subject line "Privacy Request — [Your Username]"
• Live Chat: Available 24/7 on the Platform — average response time 2–5 minutes (peak hours 18:00–23:00 WIB)
• WhatsApp: +62-812-3456-7890 (available 08:00–22:00 WIB)

15.2  We are committed to resolving all privacy concerns promptly and fairly. If you are not satisfied with our response to your complaint, you may escalate the matter to the relevant data protection authority or seek independent legal advice.

15.3  All formal privacy correspondence submitted in English will receive an English-language response within the timelines specified in Section 11.2 above. Our 24/7 support team includes native Indonesian-speaking agents who can assist with privacy inquiries in Bahasa Indonesia upon request.