Privacy Policy

1. Information We Collect

To provide you with a secure and personalized gambling experience, 99toto collects various types of personal information. We are transparent about what data we collect and why we need it.

1.1 Information You Provide Directly

When you register an account with 99toto, you voluntarily provide us with personal information including:

• Identity Information: Full legal name, date of birth, nationality, and gender as shown on your government-issued identification documents (Indonesian national identity card / KTP).
• Contact Information: Email address, phone number (mobile), and residential address including city, province, and postal code.
• Account Credentials: Username, password (stored in encrypted form), and security questions/answers for account recovery purposes.
• Financial Information: Bank account details (bank name, account number, account holder name) for deposits and withdrawals, payment method preferences, and transaction history.
• Verification Documents: Copies of government-issued ID (KTP), proof of address (utility bills, bank statements), and selfie photographs for Know Your Customer (KYC) compliance.
• Communication Records: Content of your communications with our customer support team via live chat, email, or other channels.

1.2 Information Collected Automatically

When you use our platform, we automatically collect certain technical and behavioral information:

• Device Information: Device type (desktop, mobile, tablet), operating system, browser type and version, screen resolution, and device identifiers.
• Usage Data: Pages visited, features used, games played, betting patterns, time spent on the platform, click patterns, and navigation paths.
• Connection Information: IP address, internet service provider, geographic location (city/region level based on IP), and connection timestamps.
• Transaction Data: Deposit amounts, withdrawal requests, bet placements, game selections, win/loss records, and bonus claims.
• Cookies and Similar Technologies: We use cookies, web beacons, and similar tracking technologies to enhance user experience and collect usage analytics (see Section 7 for details).

1.3 Information from Third Parties

In certain circumstances, we may receive information about you from third-party sources:

• Payment Processors: Transaction confirmation, payment status, and fraud detection information from banks and payment service providers (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay).
• Identity Verification Services: Verification results from third-party KYC service providers we use to confirm your identity and age.
• Game Providers: Game session data, RNG results, and gameplay statistics from third-party game suppliers whose games are featured on our platform.
• Marketing Partners: If you reach our platform through affiliate or marketing channels, we may receive referral information (but not personal data) about how you found us.

2. How We Use Your Information

99toto uses the personal information we collect for specific, legitimate purposes. We only use your data in ways that are necessary for our services and that you would reasonably expect.

2.1 Service Provision

• Account Management: Creating and maintaining your user account, authenticating your identity when you log in, and managing your profile settings and preferences.
• Transaction Processing: Processing deposits, managing your account balance, executing withdrawal requests, and maintaining accurate financial records.
• Game Delivery: Providing access to our sports betting, casino games, slots, and togel (lottery) services, tracking your bets and gameplay, and delivering winnings to your account.
• Customer Support: Responding to your inquiries, resolving technical issues, handling complaints, and providing assistance through our 24/7 support channels.

2.2 Legal and Regulatory Compliance

• Age Verification: Confirming that you are at least 21 years old and legally permitted to gamble in accordance with Indonesian age restrictions.
• Identity Verification (KYC): Verifying your identity to prevent fraud, money laundering, and underage gambling as required by our gaming license and anti-money laundering regulations.
• Responsible Gaming: Monitoring for signs of problem gambling behavior, enforcing self-exclusion requests, and implementing deposit limits and other protective measures.
• Fraud Prevention: Detecting and preventing fraudulent activity, bonus abuse, collusion, and other terms violations to protect our platform and other users.
• Record Keeping: Maintaining transaction records, game logs, and other documentation as required by gaming regulations and tax authorities.

2.3 Service Improvement

• Platform Optimization: Analyzing usage patterns to improve our website and mobile interface, fix bugs, and enhance user experience.
• Personalization: Tailoring game recommendations, bonus offers, and content to your preferences and playing style (you can opt out of marketing personalization).
• Security Enhancement: Monitoring for security threats, preventing unauthorized access, and improving our cybersecurity measures.
• Analytics: Understanding how users interact with our platform to make informed business decisions about features, games, and services to offer.

2.4 Marketing and Communications

• Promotional Offers: Sending you information about bonuses, promotions, tournaments, and special offers (you can unsubscribe at any time).
• Service Updates: Notifying you about important changes to our terms, policies, features, or services.
• Transactional Emails: Sending essential notifications about your account activity, deposits, withdrawals, and security alerts.

3. Data Sharing and Disclosure

99toto respects your privacy and does not sell your personal information to third parties. However, we may share your data with trusted partners and service providers under specific circumstances and with appropriate safeguards.

3.1 Service Providers and Business Partners

We share personal information with third-party service providers who perform services on our behalf:

• Payment Processors: Banks and payment service providers (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay) receive necessary transaction information to process your deposits and withdrawals.
• Game Suppliers: Third-party game developers and providers receive minimal user information necessary to deliver their games on our platform and track gameplay sessions.
• Identity Verification Services: Specialized KYC service providers receive your identification documents to verify your identity and age on our behalf.
• Cloud Infrastructure Providers: We use secure cloud hosting services to store data; these providers have access to encrypted data but are contractually prohibited from using it for their own purposes.
• Customer Support Tools: Live chat and support ticket systems may process your communications to help us respond efficiently to your inquiries.
• Analytics Services: We use analytics platforms to understand user behavior and improve our services; these services receive anonymized or aggregated data whenever possible.

All service providers are carefully vetted and bound by strict confidentiality agreements. They are only permitted to use your data for the specific purposes we authorize and must implement adequate security measures.

3.2 Legal and Regulatory Disclosure

We may disclose personal information when required by law or to protect our rights:

• Legal Obligations: Responding to court orders, subpoenas, or other legal processes from government authorities or law enforcement agencies.
• Regulatory Compliance: Providing information to gaming regulators, financial authorities, or tax agencies as required by our license and applicable laws.
• Fraud Prevention: Sharing information with anti-fraud services or law enforcement to investigate suspected criminal activity, fraud, or terms violations.
• Rights Protection: Disclosing information necessary to enforce our Terms & Conditions, protect our intellectual property, or defend against legal claims.

3.3 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your personal information may be transferred to the acquiring entity. We will notify you of any such change and ensure the new entity adheres to this Privacy Policy or provides you with notice of any changes.

3.4 With Your Consent

We may share your information for other purposes if you provide explicit consent, such as participating in third-party promotions or surveys.

4. Data Security Measures

Protecting your personal information is paramount to 99toto. We implement industry-leading security measures to safeguard your data against unauthorized access, disclosure, alteration, or destruction.

4.1 Technical Security

• Encryption: All data transmission between your device and our servers uses 256-bit SSL (Secure Socket Layer) encryption, the same technology used by major banks. Sensitive data is also encrypted at rest in our databases.
• Secure Servers: Our infrastructure is hosted in secure data centers with 24/7 physical security, redundant power supplies, and advanced fire suppression systems.
• Firewalls: Multi-layered firewall protection prevents unauthorized network access to our systems.
• Access Controls: Personal data is accessible only to authorized employees and contractors who need it to perform their job functions. All access is logged and monitored.
• Password Security: User passwords are stored using strong one-way hashing algorithms (bcrypt or similar); even 99toto staff cannot view your actual password.

4.2 Organizational Security

• Employee Training: All staff members receive regular training on data protection, privacy regulations, and security best practices.
• Confidentiality Agreements: Employees and contractors with access to personal data are bound by strict confidentiality agreements.
• Security Audits: We conduct regular security assessments and penetration testing by independent cybersecurity firms to identify and address vulnerabilities.
• Incident Response: We maintain a comprehensive data breach response plan to quickly detect, contain, and respond to any security incidents.

4.3 Your Security Responsibilities

While we implement robust security measures, protecting your account also requires your cooperation:

• Choose a strong, unique password and never share it with anyone.
• Enable two-factor authentication (2FA) for enhanced account security.
• Log out of your account when using shared or public computers.
• Keep your email account secure, as it's used for account recovery.
• Be cautious of phishing attempts; 99toto will never ask for your password via email or chat.
• Report any suspicious account activity immediately to customer support.

5. Data Retention and Storage

5.1 Retention Periods

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected and to comply with legal obligations:

• Active Accounts: While your account is active, we retain all personal information necessary to provide services to you.
• Closed Accounts: After you close your account, we retain your data for 5 years to comply with gaming regulations, anti-money laundering requirements, and tax laws. Transaction records and KYC documents are kept for the legally required retention period.
• Marketing Data: If you opt out of marketing communications, we keep your email address on a suppression list to honor your preferences.
• Chat Logs: Customer support conversations are retained for 3 years for quality assurance and dispute resolution purposes.

5.2 Data Storage Locations

Your personal information is stored on secure servers located in data centers that comply with international security standards. While our primary servers may be located outside Indonesia, all data storage and processing complies with applicable data protection laws.

5.3 Data Deletion

After the required retention period expires, we securely delete or anonymize your personal information so that it can no longer be associated with you. Anonymized data may be retained indefinitely for statistical and business intelligence purposes.

6. Your Privacy Rights

Under applicable data protection laws, you have several rights regarding your personal information. 99toto respects these rights and provides mechanisms for you to exercise them.

6.1 Right to Access

You have the right to request a copy of the personal information we hold about you. You can view most of your information directly through your account settings. For a comprehensive data export, contact our Data Protection Officer.

6.2 Right to Rectification

If any of your personal information is inaccurate or incomplete, you can update it through your account settings or request assistance from customer support. For changes to verified KYC information, you may need to submit updated documentation.

6.3 Right to Erasure ("Right to be Forgotten")

You can request deletion of your personal data in certain circumstances. However, this right is not absolute; we may be legally required to retain certain information for regulatory compliance, fraud prevention, or dispute resolution. If you wish to delete your account and data, contact customer support with your request.

6.4 Right to Restrict Processing

You can request that we limit how we use your personal information in certain situations, such as while we verify the accuracy of data you've disputed.

6.5 Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit it to another service provider where technically feasible.

6.6 Right to Object

You can object to processing of your personal data for direct marketing purposes at any time by clicking "unsubscribe" in marketing emails or adjusting your account preferences. You can also object to processing based on legitimate interests by contacting us with your specific concerns.

6.7 Right to Withdraw Consent

Where we process your data based on consent, you can withdraw that consent at any time. This does not affect the lawfulness of processing that occurred before you withdrew consent.

6.8 How to Exercise Your Rights

To exercise any of these rights, contact our Data Protection Officer at [email protected] with your request. We will respond within 30 days. You may need to verify your identity before we process your request to protect against unauthorized access.

7. Cookies and Tracking Technologies

7.1 What Are Cookies?

Cookies are small text files stored on your device when you visit our website. They help us recognize you, remember your preferences, and improve your user experience.

7.2 Types of Cookies We Use

• Essential Cookies: Necessary for the platform to function properly. These enable you to log in, navigate the site, and use core features. You cannot opt out of these cookies.
• Performance Cookies: Collect anonymous information about how you use our site, helping us identify and fix errors and improve performance.
• Functionality Cookies: Remember your preferences (such as language, region, or username) to personalize your experience.
• Analytics Cookies: Help us understand user behavior and traffic patterns through aggregated statistics (we use services like Google Analytics).
• Marketing Cookies: Track your browsing across websites to deliver targeted advertising and measure campaign effectiveness (used only with your consent).

7.3 Managing Cookies

Most web browsers automatically accept cookies, but you can modify your browser settings to decline cookies if you prefer. However, disabling certain cookies may limit your ability to use some features of our platform. You can manage cookie preferences through our cookie consent banner when you first visit our site.

8. Third-Party Services

Our platform integrates with various third-party services to provide a comprehensive gaming experience. These third parties have their own privacy policies, which we encourage you to review.

• Payment Processors: BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, and other payment providers process transactions according to their own privacy policies and security standards.
• Game Providers: Slot games, live casino tables, and other content are supplied by third-party developers who may collect limited gameplay data.
• Social Media: If we offer social media integration features, these platforms may collect data about your interactions according to their own policies.

99toto is not responsible for the privacy practices of third-party services. We recommend reviewing their policies before using their services through our platform.

9. Children's Privacy

99toto is committed to protecting children from gambling activities. Our services are strictly for adults aged 21 and above. We do not knowingly collect personal information from individuals under 21 years of age.

If we discover that we have inadvertently collected information from someone under 21, we will delete that information immediately and permanently close the account. If you believe we have information from an underage user, please contact us immediately at [email protected].

Parents and guardians should monitor their children's internet use and use parental control tools to prevent access to gambling sites.

10. International Data Transfers

Your personal information may be transferred to and processed in countries outside Indonesia where our servers, service providers, or business partners are located. These countries may have different data protection laws than Indonesia.

When we transfer data internationally, we ensure appropriate safeguards are in place, such as:

• Standard contractual clauses approved by regulatory authorities
• Transfers to countries recognized as having adequate data protection standards
• Certification under recognized privacy frameworks
• Binding corporate rules for intra-company transfers

By using our services, you consent to the transfer of your information to countries outside Indonesia in accordance with this Privacy Policy.

11. Changes to This Policy

99toto reserves the right to update this Privacy Policy at any time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by:

• Posting the updated policy on our website with a new "Last Updated" date
• Sending an email notification to your registered email address
• Displaying a prominent notice on our platform

We encourage you to review this Privacy Policy periodically. Your continued use of our services after changes are posted constitutes your acceptance of the updated policy. If you do not agree with any changes, you should discontinue using our services and close your account.

12. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

For formal complaints about our data handling practices, you also have the right to lodge a complaint with your local data protection authority or regulatory body.