Privacy Policy

1. Introduction and Scope

This Privacy Policy governs the collection, processing, storage, and disclosure of personal information by toto90 ("we," "us," "our") in connection with your use of our online betting platform accessible at toto90.asia and all associated services, mobile applications, and communication channels.

By creating an account, accessing our website, or using any of our services, you acknowledge that you have read, understood, and consent to the data practices described in this Privacy Policy. If you do not agree with our privacy practices, you should not use the toto90 platform.

toto90 is committed to protecting the privacy and security of our users, particularly Indonesian players who entrust us with sensitive personal and financial information. We comply with applicable data protection regulations and implement industry-standard security measures to safeguard your data against unauthorized access, disclosure, alteration, or destruction.

2. Information We Collect

To provide you with a secure, personalized, and compliant betting experience, toto90 collects various categories of personal information through different channels and mechanisms.

2.1 Information You Provide Directly

When you register for a toto90 account, you voluntarily provide the following personal information:

• Identity Information: Full legal name as it appears on your government-issued identification document, date of birth, gender, and nationality.
• Contact Information: Residential address (including street, city, province, and postal code), email address, and mobile phone number.
• Account Credentials: Username, password, and security questions/answers used to protect your account.
• Financial Information: Bank account details (bank name, account holder name, account number) and e-wallet identifiers (OVO, DANA, GoPay, ShopeePay account information) used for deposits and withdrawals.
• Verification Documents: Government-issued identification (KTP - Indonesian ID card or passport), proof of address (utility bills, bank statements), and payment method verification documents (bank statements, screenshots of e-wallet accounts) submitted during KYC (Know Your Customer) procedures.
• Communication Data: Information you provide when contacting our customer support team via live chat, email, WhatsApp, or in-app messaging, including the content of your inquiries, complaints, and feedback.

2.2 Information Collected Automatically

When you access and use the toto90 platform, we automatically collect certain technical and behavioral information:

• Device Information: Device type (desktop, mobile, tablet), operating system (Windows, macOS, iOS, Android), browser type and version, screen resolution, and device identifiers.
• Connection Information: IP address, internet service provider, connection type (WiFi, mobile data), approximate geographic location based on IP address.
• Usage Data: Pages visited, features accessed, time spent on each page, navigation paths, referral sources, search queries within our platform, and interaction patterns.
• Transaction History: Detailed records of all deposits, withdrawals, bets placed, bet outcomes, bonuses claimed, and account balance changes.
• Game Activity: Specific games played, betting patterns, stake amounts, winnings and losses, RTP (Return to Player) statistics, and session durations.
• Cookies and Tracking Technologies: Data collected through cookies, web beacons, and similar technologies to recognize your device, remember your preferences, analyze site traffic, and deliver personalized content. See Section 8 for detailed cookie information.

2.3 Information from Third-Party Sources

In certain circumstances, we may receive information about you from external sources:

• Payment Providers: Transaction confirmation data from Indonesian banks (BCA, BRI, BNI, Mandiri) and e-wallet services (OVO, DANA, GoPay, ShopeePay).
• Identity Verification Services: Age verification and fraud prevention data from third-party verification providers used to comply with regulatory requirements.
• Affiliates and Marketing Partners: Referral information and marketing attribution data if you were referred to toto90 by a partner or affiliate.

3. How We Use Your Information

toto90 processes your personal information for specific, legitimate purposes related to operating our betting platform, ensuring compliance with legal obligations, and improving your user experience.

3.1 Account Management and Service Delivery

• Creating, maintaining, and authenticating your toto90 account.
• Processing deposits, withdrawals, and other financial transactions in Indonesian Rupiah (IDR).
• Recording and settling bets placed on sports events, casino games, slots, and togel lottery draws.
• Calculating winnings, applying bonuses, and updating account balances in real-time.
• Providing customer support and responding to your inquiries, complaints, and feedback.
• Communicating important account notifications, transaction confirmations, and service updates via email, SMS, or in-app messages.

3.2 Legal Compliance and Security

• Verifying your identity and age to ensure compliance with the 21+ age restriction and prevent underage gambling.
• Conducting KYC (Know Your Customer) and AML (Anti-Money Laundering) checks as required by international licensing regulations.
• Detecting, preventing, and investigating fraudulent activity, money laundering, collusion, bonus abuse, and other prohibited conduct.
• Monitoring gameplay patterns to identify problem gambling behaviors and implement responsible gaming interventions.
• Complying with legal obligations, court orders, regulatory requests, and law enforcement inquiries.
• Protecting our systems, networks, and intellectual property against unauthorized access, cyberattacks, and security breaches.

3.3 Platform Improvement and Personalization

• Analyzing user behavior, preferences, and engagement patterns to improve platform functionality, game selection, and user interface design.
• Personalizing your experience by recommending games, sports markets, and promotions based on your past activity and interests.
• Conducting market research, surveys, and A/B testing to optimize our services and develop new features.
• Generating aggregated, anonymized statistics and analytics reports that do not identify individual users.

3.4 Marketing and Promotional Communications

• Sending promotional offers, bonus announcements, and special event notifications that may interest you based on your gaming preferences.
• Delivering targeted marketing content through email, SMS, and in-app messages (you may opt out of marketing communications at any time).
• Measuring the effectiveness of marketing campaigns and attributing new player registrations to specific channels.

4. Legal Basis for Processing

Under applicable data protection laws, toto90 processes your personal information based on one or more of the following legal grounds:

• Contractual Necessity: Processing is necessary to perform our contract with you (the Terms and Conditions you agreed to when creating your account) and deliver the services you requested.
• Legal Obligation: Processing is required to comply with legal and regulatory obligations, including age verification, KYC/AML requirements, and licensing conditions.
• Legitimate Interests: Processing is necessary for our legitimate business interests, such as fraud prevention, security enhancement, platform improvement, and direct marketing, provided these interests do not override your fundamental rights and freedoms.
• Consent: In certain cases, we rely on your explicit consent, which you may withdraw at any time by contacting our support team.

5. Data Sharing and Disclosure

toto90 does not sell, rent, or lease your personal information to third parties for their marketing purposes. However, we may share your information with specific categories of third parties under the following circumstances:

5.1 Service Providers and Business Partners

We share personal information with trusted third-party service providers who perform functions on our behalf:

• Payment Processors: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) that facilitate deposit and withdrawal transactions.
• Game Providers: Software studios (Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Ezugi, Spribe) that supply casino games, slots, and live dealer tables to our platform. Game providers may receive limited data necessary to deliver game content and record outcomes.
• Identity Verification Services: Third-party KYC and age verification providers that validate your identity documents and check you against fraud databases.
• Customer Support Tools: Live chat platforms, help desk systems, and communication tools used to deliver customer service.
• Marketing and Analytics Providers: Email marketing services, analytics platforms, and advertising networks that help us measure campaign performance and deliver targeted content.
• Cloud Infrastructure and Security Services: Hosting providers, content delivery networks (CDNs), and cybersecurity firms that store and protect our data and systems.

All service providers are contractually obligated to protect your information, use it only for the purposes we specify, and comply with applicable data protection laws.

5.2 Legal and Regulatory Authorities

We may disclose your personal information when required or permitted by law:

• To comply with legal obligations, court orders, subpoenas, or regulatory requests from government authorities.
• To cooperate with law enforcement investigations into illegal activity, fraud, or money laundering.
• To report suspected underage gambling or other violations of applicable laws.
• To enforce our Terms and Conditions and protect our rights, property, or safety, or that of our users and the public.

5.3 Business Transfers

In the event of a merger, acquisition, corporate restructuring, or sale of assets, your personal information may be transferred to the acquiring entity as part of the business transaction. We will notify you via email and prominent website notice before your information is transferred and becomes subject to a different privacy policy.

6. Data Security Measures

Protecting your personal and financial information is a top priority for toto90. We implement comprehensive technical, administrative, and physical security measures to prevent unauthorized access, disclosure, alteration, or destruction of your data.

6.1 Technical Security Controls

• SSL/TLS Encryption: All data transmitted between your device and our servers is encrypted using industry-standard SSL (Secure Sockets Layer) or TLS (Transport Layer Security) protocols, ensuring that sensitive information like passwords and payment details cannot be intercepted.
• Data Encryption at Rest: Personal information stored in our databases is encrypted using strong encryption algorithms to protect against unauthorized access in the event of a security breach.
• Firewall Protection: Our servers are protected by advanced firewalls that monitor and filter incoming and outgoing network traffic to block malicious activity.
• Intrusion Detection and Prevention Systems (IDPS): Automated systems continuously monitor our network for suspicious activity, unauthorized access attempts, and potential security threats.
• Regular Security Audits and Penetration Testing: Independent cybersecurity experts conduct periodic vulnerability assessments and penetration tests to identify and remediate security weaknesses.

6.2 Access Controls and Authentication

• Access to personal information is restricted to authorized employees and service providers who require it to perform their job functions.
• Strong password policies, multi-factor authentication, and role-based access controls ensure that only authorized personnel can access sensitive systems.
• Employee access is logged, monitored, and regularly reviewed to detect unauthorized activity.

6.3 Your Role in Security

While we implement robust security measures, you also play a critical role in protecting your account:

• Choose a strong, unique password combining letters, numbers, and special characters.
• Never share your password, username, or account credentials with anyone.
• Log out of your account after each session, especially when using shared or public devices.
• Notify us immediately if you suspect unauthorized access to your account.

7. Data Retention

toto90 retains your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, comply with legal obligations, resolve disputes, and enforce our agreements.

Data Category	Retention Period	Rationale
Account Information	Duration of active account + 5 years after closure	Legal and regulatory compliance (AML/KYC requirements)
Transaction Records	7 years from transaction date	Financial record-keeping obligations and dispute resolution
Betting History	5 years from bet settlement	Regulatory reporting and audit requirements
Communication Logs	3 years from last contact	Customer service improvement and complaint resolution
Marketing Preferences	Until you withdraw consent or close account	Honoring opt-out requests and preference management
IP Logs and Device Data	2 years from collection	Fraud prevention and security analysis

Upon expiration of the applicable retention period, your personal information will be securely deleted or anonymized so that it can no longer be associated with you. You may request earlier deletion of your data, subject to our legal and regulatory obligations.

8. Cookies and Tracking Technologies

toto90 uses cookies and similar tracking technologies to enhance your browsing experience, analyze platform performance, and deliver personalized content. Cookies are small text files stored on your device that allow us to recognize you on subsequent visits.

8.1 Types of Cookies We Use

• Essential Cookies: Necessary for the platform to function properly. These cookies enable core features like account authentication, session management, and secure transactions. You cannot disable these cookies without affecting platform functionality.
• Performance Cookies: Collect anonymous information about how you use our platform, such as which pages you visit most frequently and whether you encounter error messages. This data helps us optimize performance and user experience.
• Functionality Cookies: Remember your preferences (language, currency, layout settings) to provide a more personalized experience on future visits.
• Marketing Cookies: Track your browsing behavior across websites to deliver targeted advertising and measure campaign effectiveness. These cookies may be set by third-party advertising networks.

8.2 Managing Cookie Preferences

Most web browsers automatically accept cookies, but you can modify your browser settings to decline cookies or alert you when a cookie is being sent. Please note that disabling certain cookies may limit your ability to use some features of the toto90 platform. Consult your browser's help documentation for instructions on managing cookies.

9. Your Privacy Rights

As a toto90 user, you have the following rights regarding your personal information:

• Right of Access: Request a copy of all personal information we hold about you, including account details, transaction history, and communication logs.
• Right to Rectification: Correct inaccurate or incomplete information in your account profile at any time.
• Right to Erasure: Request deletion of your personal information, subject to legal retention obligations and legitimate business needs (e.g., ongoing investigations, unresolved disputes).
• Right to Restriction: Request that we temporarily restrict processing of your information while we verify its accuracy or assess your objection to processing.
• Right to Data Portability: Receive your personal information in a structured, commonly used, machine-readable format and transmit it to another service provider.
• Right to Object: Object to processing of your information for direct marketing purposes or based on our legitimate interests.
• Right to Withdraw Consent: Withdraw consent for processing activities that rely on your consent, without affecting the lawfulness of processing conducted before withdrawal.

To exercise any of these rights, please contact our Data Protection Officer at [email protected] with your full name, username, and a description of your request. We will respond within 30 days and may request additional information to verify your identity before processing your request.

10. International Data Transfers

Your personal information may be transferred to, stored, and processed in countries outside of Indonesia where our service providers, payment processors, and data centers are located. These countries may have data protection laws that differ from Indonesian regulations.

When we transfer your information internationally, we ensure adequate safeguards are in place, such as standard contractual clauses, data protection agreements, or reliance on jurisdictions recognized as providing adequate data protection. Your information remains subject to the protections described in this Privacy Policy regardless of where it is processed.

11. Children's Privacy

toto90 is strictly intended for adults aged 21 years and older. We do not knowingly collect, process, or solicit personal information from individuals under the age of 21. If we become aware that we have inadvertently collected information from a minor, we will immediately delete such information and close the associated account.

If you are a parent or guardian and believe your child has provided personal information to toto90, please contact us immediately at [email protected] so we can take appropriate action.

12. Changes to This Privacy Policy

toto90 reserves the right to update, modify, or replace this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or business operations. Material changes will be communicated to you via email to your registered address or through prominent notice on our website at least 30 days before the changes take effect.

Your continued use of the toto90 platform after the effective date of the revised Privacy Policy constitutes your acceptance of the changes. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information. The "Last Updated" date at the top of this document indicates when the most recent revisions were made.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us through any of the following channels:

• Data Protection Officer: [email protected]
• Customer Support Email: [email protected]
• Live Chat: Available 24/7 via the chat icon on our website
• WhatsApp Support: +62 812 3456 7890 (08:00-02:00 WIB daily)

We are committed to addressing your privacy concerns promptly and transparently. All inquiries will be acknowledged within 24 hours, and we will provide a substantive response within 30 days.