pttoto Privacy Policy

1. Introduction and Scope

This Privacy Policy governs the collection, use, disclosure, and protection of personal data provided by users of the pttoto platform. pttoto operates as an internationally licensed online betting and gaming platform serving Indonesian residents. By creating an account and using our services, you acknowledge that you have read, understood, and agree to the data practices described in this Privacy Policy.

This Privacy Policy applies to all personal information collected through the pttoto website (https://pttoto.cam), mobile applications, customer support channels (live chat, WhatsApp, email), and any other services provided by pttoto. We are committed to transparency in our data practices and compliance with applicable data protection regulations including the General Data Protection Regulation (GDPR) where applicable, and Indonesian data protection principles under Law No. 27 of 2022 on Personal Data Protection (UU PDP).

pttoto acts as the data controller for all personal information collected through our platform. We determine the purposes and means of processing your personal data and are responsible for ensuring your data is handled lawfully, fairly, and transparently. If you have questions about our data practices or wish to exercise your data rights, please contact our Data Protection Officer via the contact details provided at the end of this policy.

2. Information We Collect

2.1 Information You Provide Directly

When you register an account on pttoto, we collect personal information including:

• Identity Information: Full legal name (as it appears on your Indonesian national identity card / KTP), date of birth, gender, and nationality.
• Contact Information: Email address, mobile phone number, residential address (street address, city, province, postal code), and preferred language for communications.
• Account Credentials: Username, password (stored in encrypted form), and security questions/answers used to verify your identity.
• Financial Information: Bank account details (bank name, account number, account holder name), e-wallet account identifiers (DANA, OVO, GoPay, ShopeePay, LinkAja), and payment card information (card number, expiration date, CVV — processed securely via PCI DSS-compliant payment processors and not stored on our servers).
• Identity Verification Documents (KYC): Clear photographs or scans of your Indonesian national identity card (KTP), recent selfie photograph, proof of address documents (utility bills, bank statements), and proof of payment method ownership (bank statements, e-wallet screenshots).
• Communications: Content of messages you send to our customer support team via live chat, WhatsApp, or email, including any attachments or documents provided during support interactions.

2.2 Information Collected Automatically

When you access and use the pttoto platform, we automatically collect certain technical and usage data including:

• Device Information: IP address, device type and model, operating system and version, browser type and version, screen resolution, device identifiers (IMEI, advertising ID), and mobile network information.
• Usage Data: Pages visited, features used, time spent on each page, click patterns, navigation paths through the site, search queries, bets placed (date, time, sport/game, market, stake amount, odds, outcome), deposits and withdrawals (transaction ID, amount, payment method, timestamp), and session duration.
• Location Data: Approximate geographic location derived from IP address or, with your explicit consent, precise GPS location from mobile devices. We use location data to verify your eligibility to access our services and to comply with geo-blocking requirements under our license.
• Cookies and Tracking Technologies: We use cookies, web beacons, pixel tags, and similar technologies to recognize your device, remember your preferences, track session activity, analyze site performance, and deliver personalized content. For details on our cookie practices, see Section 8 below.

2.3 Information from Third Parties

We may receive information about you from third-party sources including:

• Payment Processors: Transaction confirmation data, payment method verification status, and fraud risk assessments from Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata), e-wallet providers (DANA, OVO, GoPay, ShopeePay, LinkAja), and international payment gateways (Visa, Mastercard).
• Identity Verification Services: Age verification, identity authentication, and fraud screening results from KYC compliance providers.
• Game Providers: Gameplay data, betting patterns, and win/loss records from third-party game studios providing live casino, slots, and other gaming content on our platform.
• Affiliates and Marketing Partners: Referral source information (which marketing campaign or affiliate partner referred you to pttoto) and conversion tracking data.

3. How We Use Your Information

3.1 Legal Bases for Processing

Under applicable data protection law, we must have a lawful basis to process your personal data. We process your information based on the following legal grounds:

• Contractual Necessity: Processing is necessary to perform our contract with you (our Terms and Conditions), including account registration, processing deposits and withdrawals, settling bets, and providing customer support.
• Legal Obligation: Processing is required to comply with legal and regulatory obligations including identity verification (KYC), anti-money laundering (AML) checks, age verification (21+ requirement), tax reporting, and responding to lawful requests from authorities.
• Legitimate Interests: Processing is necessary for our legitimate business interests including fraud prevention, platform security, service improvement, analytics, and marketing (where not overridden by your privacy rights).
• Consent: Where required by law, we obtain your explicit consent for certain processing activities such as collecting precise GPS location data, sending promotional emails, or sharing data with third parties for marketing purposes.

3.2 Purposes of Data Processing

We use your personal information for the following purposes:

• Account Management: Creating and maintaining your pttoto account, authenticating your identity, managing login credentials, and processing account updates or closures.
• Service Provision: Processing bets on sports, togel, casino games, and slots; settling winning and losing bets; managing your account balance; processing deposits and withdrawals; and providing access to all features of the pttoto platform.
• Identity Verification and Compliance: Verifying your age (21+), confirming your identity and residential address, conducting KYC checks, screening for fraud and money laundering risks, complying with anti-money laundering (AML) regulations, and maintaining records as required by our licensing authority.
• Customer Support: Responding to inquiries via live chat, WhatsApp, and email; resolving disputes; investigating complaints; and providing technical assistance.
• Security and Fraud Prevention: Detecting and preventing unauthorized access, account takeover attempts, payment fraud, bonus abuse, collusion, multi-accounting, automated betting (bots), and other prohibited activities described in our Terms and Conditions.
• Marketing and Communications: Sending promotional offers, bonus notifications, new game announcements, and platform updates via email, SMS, push notifications, or in-app messages (you may opt out at any time via account settings or unsubscribe links in emails).
• Analytics and Improvement: Analyzing usage patterns, betting trends, and user behavior to improve platform features, optimize user experience, develop new products, and enhance service quality.
• Responsible Gaming: Monitoring for signs of problem gambling, enforcing deposit limits and self-exclusion requests, providing reality-check reminders, and offering support resources for users concerned about their gambling behavior.
• Legal and Regulatory Compliance: Cooperating with law enforcement agencies, regulatory bodies, and judicial authorities; responding to court orders, subpoenas, and lawful information requests; and protecting our legal rights in disputes or litigation.

4. How We Share Your Information

4.1 Service Providers and Business Partners

We share your personal data with trusted third-party service providers who assist us in operating the pttoto platform. These providers process data on our behalf under strict contractual obligations to protect your privacy and use data only for the specific purposes we authorize. Categories of service providers include:

• Payment Processors: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata), e-wallet providers (DANA, OVO, GoPay, ShopeePay, LinkAja), and international payment gateways to process deposits, withdrawals, and verify payment methods.
• Identity Verification Providers: KYC and AML compliance vendors who verify identity documents, screen for fraud, conduct age verification, and perform risk assessments.
• Game Providers: Third-party game studios (Evolution Gaming, Pragmatic Play, Microgaming, NetEnt, Pocket Games Soft, Spribe) that provide live casino, slots, and other gaming content on our platform.
• Cloud Infrastructure Providers: Data hosting, storage, and computing services to ensure platform availability, performance, and disaster recovery.
• Customer Support Tools: Live chat platforms, helpdesk software, and communication tools used to provide customer service.
• Analytics and Marketing Platforms: Tools for website analytics, A/B testing, email marketing, SMS delivery, and advertising campaign management (subject to your consent where required).

4.2 Legal and Regulatory Disclosures

We may disclose your personal information to government authorities, law enforcement agencies, regulatory bodies, or courts when required by law or when we believe in good faith that disclosure is necessary to:

• Comply with a legal obligation, court order, subpoena, warrant, or lawful government request.
• Enforce our Terms and Conditions, investigate suspected violations, or protect our legal rights and property.
• Detect, prevent, or address fraud, security vulnerabilities, or technical issues.
• Protect the safety, rights, or property of pttoto users or the public as required or permitted by law.

4.3 Business Transfers

In the event of a merger, acquisition, sale of assets, bankruptcy, or other business transaction involving pttoto, your personal data may be transferred to the acquiring entity or successor organization. We will notify you via email or prominent notice on our website before your data is transferred and becomes subject to a different privacy policy.

4.4 No Sale of Personal Data

pttoto does not sell, rent, or trade your personal information to third parties for monetary consideration. We share data only with service providers as described above, and only to the extent necessary to provide our services, comply with legal obligations, or protect our legitimate interests.

5. Data Security

pttoto implements industry-leading security measures to protect your personal data from unauthorized access, disclosure, alteration, or destruction. Our security practices include:

• Encryption: All data transmitted between your device and our servers is protected by 256-bit SSL/TLS encryption. Sensitive data stored in our databases (passwords, payment information, identity documents) is encrypted at rest using AES-256 encryption.
• Access Controls: Strict role-based access controls limit employee and contractor access to personal data on a need-to-know basis. Multi-factor authentication (MFA) is required for administrative access to critical systems.
• Network Security: Firewalls, intrusion detection systems (IDS), intrusion prevention systems (IPS), and regular vulnerability scanning protect our infrastructure from cyberattacks.
• Secure Data Centers: Personal data is stored in secure, redundant data centers with physical security controls including 24/7 surveillance, biometric access controls, and environmental monitoring.
• Regular Audits: Independent security audits, penetration testing, and vulnerability assessments are conducted regularly to identify and remediate security weaknesses.
• Incident Response: We maintain a documented incident response plan to detect, contain, and mitigate data breaches. In the event of a breach affecting your personal data, we will notify you and relevant authorities as required by applicable data protection law.

While we implement robust security controls, no internet-based service can be 100% secure. You are responsible for maintaining the confidentiality of your account credentials and for notifying us immediately if you suspect unauthorized access to your account.

6. Data Retention

pttoto retains your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy and to comply with legal, regulatory, and contractual obligations. Retention periods vary depending on the type of data and the purpose for which it was collected:

• Account Information: Retained for the duration of your active account plus 5 years after account closure to comply with anti-money laundering regulations, tax reporting requirements, and to resolve disputes or legal claims.
• Transaction Records: Deposit, withdrawal, and betting transaction records are retained for 7 years from the date of the transaction as required by financial services regulations and tax law.
• Identity Verification Documents: KYC documents (KTP scans, selfies, proof of address) are retained for 5 years after account closure in accordance with regulatory requirements.
• Customer Support Communications: Live chat transcripts, emails, and WhatsApp messages are retained for 3 years for quality assurance, training, and dispute resolution purposes.
• Marketing Consent Records: Records of your marketing preferences and consent are retained for 3 years after you withdraw consent or close your account to demonstrate compliance with data protection law.
• Technical and Usage Data: Log files, IP addresses, and usage analytics are typically retained for 12 months unless required for longer periods for security investigations or legal proceedings.

After the applicable retention period expires, your personal data is securely deleted or anonymized such that it can no longer identify you. Anonymized data may be retained indefinitely for statistical analysis and research purposes.

7. Your Data Rights

Under applicable data protection laws including the GDPR and Indonesian Personal Data Protection Law (UU PDP), you have the following rights regarding your personal data:

• Right of Access: You have the right to request a copy of the personal data we hold about you. We will provide this information in a structured, commonly used, and machine-readable format (typically PDF or JSON).
• Right to Rectification: You may request that we correct any inaccurate or incomplete personal data. You can update most information directly via your account settings.
• Right to Erasure (Right to be Forgotten): You may request deletion of your personal data in certain circumstances, such as when data is no longer necessary for the purposes collected, or when you withdraw consent. Note that we may be required to retain certain data to comply with legal obligations (KYC, AML, tax records).
• Right to Restriction of Processing: You may request that we limit how we use your personal data in certain situations, such as when you contest the accuracy of data or object to processing.
• Right to Data Portability: You have the right to receive your personal data in a portable format and to transmit it to another service provider (where technically feasible).
• Right to Object: You may object to processing of your personal data for direct marketing purposes (including profiling for marketing). You may also object to processing based on legitimate interests, though we may continue processing if we have compelling legitimate grounds.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
• Right to Lodge a Complaint: You have the right to file a complaint with a data protection supervisory authority if you believe we have violated your data protection rights.

To exercise any of these rights, please contact our Data Protection Officer via email at [email protected] with the subject line "Data Rights Request". We will respond to your request within 30 days as required by law. We may require verification of your identity before processing data rights requests to prevent unauthorized disclosure of personal information.

8. Cookies and Tracking Technologies

pttoto uses cookies, web beacons, pixel tags, local storage, and similar tracking technologies to enhance your user experience, analyze platform performance, and deliver personalized content. A cookie is a small text file stored on your device that allows us to recognize your browser and remember your preferences across sessions.

8.1 Types of Cookies We Use

• Essential Cookies: Required for the platform to function properly. These cookies enable core features like account login, session management, payment processing, and security. You cannot opt out of essential cookies without impacting platform functionality.
• Performance Cookies: Collect anonymous information about how you use pttoto, including pages visited, time on site, and error messages. This data helps us optimize site performance and identify technical issues.
• Functionality Cookies: Remember your preferences such as language selection, display settings, and favorite games to provide a more personalized experience.
• Analytics Cookies: Used to understand user behavior, track conversion rates, measure campaign effectiveness, and generate usage statistics. We use analytics platforms like Google Analytics (with IP anonymization enabled).
• Advertising Cookies: Track your browsing activity to deliver targeted advertising and measure ad campaign performance. These cookies may be set by third-party advertising networks (subject to your consent where required by law).

8.2 Managing Cookies

You can manage cookie preferences through your browser settings. Most browsers allow you to block or delete cookies, though doing so may impact your ability to use certain features of pttoto. Please note that blocking essential cookies will prevent you from logging in or placing bets. You can also opt out of targeted advertising cookies via industry opt-out tools such as the Digital Advertising Alliance (DAA) opt-out page or the Network Advertising Initiative (NAI) opt-out page.

9. Third-Party Links

The pttoto platform may contain links to third-party websites, services, or applications (such as game provider sites, payment processors, or social media platforms). This Privacy Policy does not apply to third-party sites. We are not responsible for the privacy practices or content of external sites. We encourage you to review the privacy policies of any third-party sites you visit.

10. Children's Privacy

pttoto services are strictly intended for adults aged 21 years or older. We do not knowingly collect personal data from individuals under 21 years of age. If we discover that we have inadvertently collected information from a minor, we will immediately delete that data and terminate the associated account. Parents or guardians who believe a minor has accessed our platform should contact us immediately at [email protected].

11. International Data Transfers

pttoto operates internationally and may transfer your personal data to servers located outside Indonesia for processing and storage. When we transfer data to countries that do not provide an equivalent level of data protection as Indonesian law or the GDPR, we implement appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by data protection authorities, or we rely on adequacy decisions where available.

Our primary data centers are located in secure jurisdictions with robust data protection laws. All international data transfers are conducted in compliance with applicable data protection regulations and under contractual protections ensuring your data receives the same level of protection regardless of where it is processed.

12. Changes to This Privacy Policy

pttoto reserves the right to modify this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or business operations. When we make material changes, we will notify you via email (to the address on file) or by posting a prominent notice on our website at least 30 days before the changes take effect. We encourage you to review this Privacy Policy periodically. The "Last Updated" date at the top of this page indicates when the policy was most recently revised.

Continued use of the pttoto platform after changes to this Privacy Policy constitutes your acceptance of the revised policy. If you do not agree to the updated terms, you must discontinue use of our services and may request account closure and deletion of your personal data (subject to legal retention requirements).

13. Contact Information and Data Protection Officer

If you have questions, concerns, or complaints about this Privacy Policy or our data practices, or if you wish to exercise your data rights, please contact our Data Protection Officer:

• Email: [email protected] (Subject: Privacy Inquiry or Data Rights Request)
• Response Time: We will respond to privacy inquiries within 5 business days and to data rights requests within 30 days as required by law.

For general customer support (non-privacy inquiries), please use our live chat, WhatsApp, or standard email channels available 24/7 in Indonesian and English.