Privacy Policy

1. Introduction and Scope

This Privacy Policy applies to all personal information collected by tktoto (the "Company", "we", "us", or "our") through our website at tktoto.cam, mobile applications, and any related services (collectively, the "Platform"). This policy covers information collected from users located in Indonesia and describes our practices regarding data collection, processing, storage, and disclosure in accordance with international data protection standards and applicable Indonesian laws.

tktoto operates as an online gaming platform offering sports betting, casino games, live dealer tables, slot machines, and togel (traditional Indonesian lottery games) to users aged 21 and above. As part of providing these services, we necessarily collect and process personal information to verify identities, process transactions, prevent fraud, comply with regulatory requirements, and improve our services.

We act as the "data controller" for the personal information you provide to us, meaning we determine the purposes and means of processing your data. Where we engage third-party service providers (such as payment processors, game providers, or customer support platforms), they act as "data processors" operating under our instructions and subject to confidentiality obligations.

2. Information We Collect

2.1 Information You Provide Directly

When you register for a tktoto account, we collect the following personal information:

• Identity Information: Full legal name, date of birth, gender, and Indonesian national identity card (KTP) number and photograph.
• Contact Information: Residential address (including street address, city, province, and postal code), email address, and mobile phone number.
• Account Credentials: Username and encrypted password.
• Financial Information: Bank account details (bank name, account number, account holder name) and e-wallet account information (OVO, DANA, GoPay, ShopeePay account identifiers) for deposit and withdrawal processing.
• Verification Documents: Copies of identity documents (KTP photograph), proof of address documents (utility bills, bank statements), and any additional documentation requested during enhanced due diligence procedures.

2.2 Information Collected Automatically

When you use the tktoto platform, we automatically collect certain technical and usage information:

• Device Information: Device type, operating system, browser type and version, screen resolution, and unique device identifiers.
• Connection Information: IP address, Internet Service Provider (ISP), approximate geographic location (city/region level based on IP address), and connection timestamps.
• Usage Data: Pages visited, features used, games played, time spent on platform, click patterns, navigation paths, and search queries.
• Transaction History: Complete records of all deposits, withdrawals, bets placed, game outcomes, winnings, losses, and bonus claims.
• Communication Records: Copies of correspondence with customer support (live chat transcripts, emails, support tickets) and any feedback or complaints submitted.

2.3 Information from Third-Party Sources

We may receive additional information about you from third-party sources, including:

• Identity Verification Services: Third-party KYC verification providers may supply identity confirmation, age verification, and fraud screening results.
• Payment Processors: Banks and e-wallet providers confirm transaction details and account ownership information.
• Fraud Prevention Services: Third-party services provide risk scores, device fingerprinting data, and fraud alerts to protect against account takeover and financial crime.
• Marketing Partners: If you reach tktoto through an affiliate or marketing partner, we may receive referral source information (but not your personal details unless you provide them directly to us).

3. How We Use Your Information

tktoto processes your personal information for the following legitimate purposes:

3.1 Account Management and Service Delivery

• Create, maintain, and manage your gaming account
• Verify your identity, age (21+ requirement), and residency in Indonesia
• Process deposits, withdrawals, and internal fund transfers
• Enable you to place bets and play games on the platform
• Calculate and credit winnings to your account balance
• Apply bonuses, promotions, and loyalty rewards according to program terms
• Provide customer support and respond to inquiries, complaints, or technical issues

3.2 Legal and Regulatory Compliance

• Comply with Know Your Customer (KYC) and Anti-Money Laundering (AML) regulations
• Verify the source of funds for large transactions or suspicious activity
• Detect, prevent, and investigate fraud, collusion, money laundering, and other illegal activities
• Enforce our Terms & Conditions and prevent terms violations
• Respond to legal processes, law enforcement requests, and regulatory inquiries
• Maintain records as required by gaming licenses and financial regulations

3.3 Platform Security and Fraud Prevention

• Monitor for unusual betting patterns, multi-accounting, and bonus abuse
• Detect and prevent unauthorized account access and identity theft
• Implement responsible gaming controls (deposit limits, self-exclusion enforcement)
• Protect against DDoS attacks, hacking attempts, and system vulnerabilities
• Analyze gameplay data to identify cheating, bot usage, or collusion between players

3.4 Service Improvement and Analytics

• Analyze user behavior to improve platform design, navigation, and user experience
• Test new features, games, and promotions with segments of our user base
• Generate aggregated, anonymized statistics for business intelligence and reporting
• Conduct market research to understand Indonesian player preferences
• Optimize payment processing speed and success rates

3.5 Marketing and Communications (With Your Consent)

• Send promotional emails about new games, bonuses, and special offers (you may opt out at any time)
• Display personalized game recommendations based on your play history
• Notify you of loyalty program tier upgrades and exclusive VIP benefits
• Send important service announcements (scheduled maintenance, policy updates, security alerts)

Legal Basis for Processing: We process your personal information based on the following legal grounds: (a) Contractual Necessity – processing is necessary to fulfill our contract with you (providing gaming services); (b) Legal Obligation – processing is required to comply with KYC, AML, and other regulatory requirements; (c) Legitimate Interests – processing serves our legitimate business interests (fraud prevention, service improvement) while respecting your privacy rights; (d) Consent – for marketing communications, you provide explicit opt-in consent which can be withdrawn at any time.

4. Data Sharing and Disclosure

tktoto does not sell your personal information to third parties for marketing purposes. However, we do share your data with the following categories of recipients as necessary to operate our business:

4.1 Service Providers and Business Partners

• Payment Processors: Banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Danamon, BSI, Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) receive transaction details and account information necessary to process deposits and withdrawals.
• Game Providers: Third-party software providers (Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Ezugi, Spribe, Habanero, and others) receive your username, bet amounts, and gameplay data to operate games and calculate results.
• Identity Verification Services: KYC verification platforms receive your name, date of birth, KTP number, and identity document images to confirm your identity and age.
• Customer Support Platforms: Live chat and ticketing systems store your communication history and may be hosted by third-party SaaS providers.
• Cloud Infrastructure Providers: We use secure cloud hosting services to store data; these providers have access to encrypted data but are contractually prohibited from using it for any purpose other than hosting.
• Analytics and Monitoring Tools: We use third-party analytics platforms to track website usage and performance; these tools may collect anonymized or pseudonymized data.

All third-party service providers are bound by confidentiality agreements and data processing agreements that restrict their use of your information to the specific services they provide to tktoto. We carefully vet all service providers for security practices and regulatory compliance.

4.2 Legal Disclosure and Law Enforcement

We may disclose your personal information when we believe in good faith that disclosure is necessary to:

• Comply with a legal obligation, court order, subpoena, or regulatory request
• Respond to law enforcement investigations or national security requests
• Enforce our Terms & Conditions or investigate suspected violations
• Protect the rights, property, or safety of tktoto, our users, or the public
• Detect, prevent, or address fraud, security, or technical issues

4.3 Business Transfers

In the event of a merger, acquisition, corporate restructuring, or sale of assets, your personal information may be transferred to the acquiring entity. We will notify you via email and/or prominent notice on the Platform before your information is transferred and becomes subject to a different privacy policy.

4.4 With Your Explicit Consent

In any circumstances not covered above, we will seek your explicit consent before sharing your personal information with third parties.

5. Data Security Measures

tktoto implements industry-standard security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction:

Your Responsibility: While we implement robust security measures, you also play a critical role in protecting your account. Never share your password with anyone, use a unique strong password (combining letters, numbers, and symbols), enable two-factor authentication if available, log out after each session on shared devices, and report suspicious activity immediately to our support team.

Data Breach Notification: In the unlikely event of a data breach that compromises your personal information, we will notify affected users within 72 hours via email and provide guidance on protective measures. We will also report the breach to relevant authorities as required by law.

6. Data Retention

tktoto retains your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

6.1 Active Account Data

While your account remains active, we retain all personal information, transaction history, and communication records to provide ongoing services and comply with regulatory requirements.

6.2 Closed Account Data

After you close your account, we retain certain data for the following periods:

• Identity Verification Records: Retained for 5 years after account closure to comply with KYC and AML regulations.
• Transaction History: Retained for 7 years after account closure for financial auditing, tax compliance, and fraud investigation purposes.
• Communication Records: Retained for 3 years after account closure to resolve potential disputes or customer service issues.
• Marketing Preferences: If you opt out of marketing communications, we retain a record of your opt-out preference indefinitely to ensure we do not contact you again.

6.3 Legal Hold and Investigations

If your account is subject to a legal dispute, regulatory investigation, or suspected fraud, we may retain data beyond standard retention periods until the matter is fully resolved.

6.4 Anonymized Data

After retention periods expire, we may convert personal data into anonymized, aggregated statistical information that cannot identify individuals. This anonymized data may be retained indefinitely for business intelligence, trend analysis, and research purposes.

7. Your Privacy Rights

Under applicable data protection laws, you have the following rights regarding your personal information:

7.1 Right to Access

You have the right to request a copy of all personal information we hold about you. To request your data, contact our customer support team with the subject line "Data Access Request." We will provide your data in a structured, commonly used, and machine-readable format (such as PDF or CSV) within 30 days.

7.2 Right to Rectification

If any of your personal information is inaccurate or incomplete, you have the right to request correction. You can update most information (email, phone number, address) directly through your account settings. For changes to identity information (name, date of birth), contact customer support with supporting documentation.

7.3 Right to Erasure ("Right to Be Forgotten")

You may request deletion of your personal information under certain circumstances, including:

• The data is no longer necessary for the purposes for which it was collected
• You withdraw consent for processing (where consent was the legal basis)
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed

Important Limitation: We cannot delete data that we are legally required to retain for regulatory compliance (KYC records, transaction history for tax/audit purposes). In such cases, we will restrict processing to the minimum necessary for legal compliance.

7.4 Right to Restrict Processing

You have the right to request that we temporarily restrict processing of your personal information if you contest the accuracy of data, object to processing, or need the data preserved for legal claims.

7.5 Right to Data Portability

You have the right to receive your personal information in a structured, commonly used format and transmit it to another service provider. This applies to data you provided to us based on consent or contract.

7.6 Right to Object

You have the right to object to processing of your personal information for direct marketing purposes at any time. You can opt out of marketing emails by clicking the "unsubscribe" link in any promotional email or updating your communication preferences in account settings.

7.7 Right to Withdraw Consent

Where we rely on your consent to process personal information, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

7.8 Exercising Your Rights

To exercise any of these rights, contact our Data Protection Officer at [email protected] with "Privacy Rights Request" in the subject line. Include your full name, account username (if applicable), and specify which right you wish to exercise. We will respond within 30 days and may request additional information to verify your identity before processing the request.

8. Cookies and Tracking Technologies

tktoto uses cookies and similar tracking technologies to enhance your experience on our platform, analyze usage patterns, and deliver personalized content.

8.1 What Are Cookies?

Cookies are small text files stored on your device by your web browser. They contain information about your browsing session and preferences. Cookies can be "session cookies" (deleted when you close your browser) or "persistent cookies" (remain on your device for a set period or until you delete them).

8.2 Types of Cookies We Use

8.3 Managing Cookies

You can control cookie settings through your browser preferences. Most browsers allow you to block all cookies, accept only first-party cookies, or delete cookies after each session. Please note that disabling essential cookies will prevent core platform features from working properly, and you may not be able to use certain services.

Browser Cookie Settings: Chrome (Settings > Privacy and Security > Cookies), Firefox (Options > Privacy & Security > Cookies), Safari (Preferences > Privacy > Cookies), Edge (Settings > Cookies and site permissions).

9. International Data Transfers

tktoto primarily serves users located in Indonesia. However, some of our service providers (cloud hosting, analytics platforms, game providers) operate servers located outside Indonesia. When we transfer your personal information internationally, we implement appropriate safeguards:

• Standard Contractual Clauses: We use European Commission-approved Standard Contractual Clauses (SCCs) with service providers to ensure adequate data protection.
• Data Processing Agreements: All international service providers sign agreements requiring them to protect data according to international standards.
• Encryption in Transit: All data transferred internationally is encrypted using secure protocols (TLS 1.3 or higher).
• Limited Access: International service providers have access only to the specific data necessary for their services and are prohibited from using it for any other purpose.

By using tktoto, you consent to the international transfer of your personal information as described in this policy.

10. Children's Privacy

tktoto's services are strictly for individuals aged 21 and above. We do not knowingly collect personal information from anyone under 21 years of age. Our registration process includes mandatory age verification through Indonesian national identity card (KTP) validation. If we discover that we have inadvertently collected information from someone under 21, we will immediately delete the account and erase all associated personal information. Parents or guardians who believe their child has provided information to tktoto should contact us immediately at [email protected].

11. Changes to This Privacy Policy

tktoto reserves the right to update or modify this Privacy Policy at any time to reflect changes in our practices, legal requirements, or business operations. Material changes will be communicated to registered users via email and/or prominent notice on the Platform at least 14 days before the effective date. The "Last Updated" date at the top of this policy indicates when it was most recently revised. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information. Continued use of the Platform after the effective date of a revised Privacy Policy constitutes your acceptance of the changes.

12. Contact Us

If you have questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us through the following channels:

• Email: [email protected] (use subject line "Privacy Inquiry" for faster routing)
• Data Protection Officer: For formal privacy rights requests or complaints, address correspondence to our Data Protection Officer at the email above with "DPO" in the subject line
• Live Chat: Available 24/7 through the Platform for general privacy questions (accessible after login)
• Response Time: We respond to privacy inquiries within 48 hours for urgent matters and within 14 business days for formal rights requests

Supervisory Authority: If you believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with your local data protection authority. In Indonesia, data protection matters may be escalated to the Ministry of Communication and Information Technology (Kominfo) or other relevant regulatory bodies.