Privacy Policy — toto23

1.1 Who This Policy Applies To. This Policy applies to all individuals who access or interact with toto23 in any capacity — including registered players, prospective players who browse the Platform without registering, and individuals who contact us through our support channels. It applies regardless of the device used to access the Platform.

1.2 Geographic Scope. toto23 primarily serves players based in Indonesia, including major cities such as Jakarta, Surabaya, Bandung, Medan, Bali, Makassar, Semarang, and Yogyakarta. This Policy reflects data-handling practices applicable to Indonesian residents. Where toto23 is required to comply with the data protection laws of other jurisdictions (for example, in connection with its international gaming license), those requirements are incorporated into the practices described herein.

1.3 Relationship to Terms & Conditions. This Policy forms part of the contractual framework governing your use of toto23, alongside our Terms & Conditions. In the event of any inconsistency between this Policy and the Terms, this Policy governs with respect to data-privacy matters.

• "Personal Data" means any information relating to an identified or identifiable natural person — including name, identification number, location data, online identifiers, or factors specific to that person's physical, economic, cultural, or social identity.
• "Processing" means any operation performed on personal data, including collection, recording, storage, use, disclosure, or deletion.
• "Data Controller" means toto23, the entity that determines the purposes and means of processing personal data collected through the Platform.
• "Data Processor" means any third-party service provider that processes personal data on toto23's behalf under a contractual data-processing agreement.
• "Sensitive Data" means personal data that reveals racial or ethnic origin, political opinions, religious beliefs, health information, financial account details, or biometric data used for identification.
• "Consent" means a freely given, specific, informed, and unambiguous indication of agreement by which you signify acceptance of the processing of your personal data for a stated purpose.
• "KYC Documents" means identity verification documents submitted by Players as part of the Know Your Customer process, including Indonesian KTP (National Identity Card), passport, or SIM (driver's license).

toto23 collects the following categories of personal data, depending on your interaction with the Platform:

We do not collect or store full payment card numbers. Where card payments are facilitated, they are processed directly by PCI-DSS-compliant payment processors; toto23 receives only a tokenized reference.

4.1 Directly From You. The majority of personal data we hold is provided directly by you during account registration, KYC document submission, deposit or withdrawal requests, support interactions, and when you update your account preferences.

4.2 Automatically Through the Platform. When you access toto23, our servers and analytics infrastructure automatically record technical data including your IP address, device fingerprint, browser configuration, and session activity logs. This data is collected via server logs, cookies, and similar tracking technologies as described in Section 11.

4.3 From Third-Party Service Providers. We may receive supplementary data from third parties in the following limited circumstances:

• Identity verification bureaus used to cross-check KYC documents for authenticity;
• Payment processors and banking partners who confirm transaction status for deposits and withdrawals;
• Fraud-detection and anti-money-laundering (AML) screening services that provide risk signals based on publicly available financial intelligence data;
• Sports data providers (for bet settlement purposes only — no personal data is sourced from these providers).

4.4 From Publicly Available Sources. In limited circumstances relevant to fraud prevention or AML compliance, toto23 may consult publicly available sources such as sanctions lists, politically exposed persons (PEP) databases, and adverse media records.

toto23 processes personal data under one or more of the following legal bases, depending on the specific processing activity:

• Contractual Necessity: Processing required to perform the contract with you — including operating your account, processing deposits and withdrawals, settling bets, and providing customer support.
• Legal Obligation: Processing required to comply with applicable laws — including anti-money-laundering (AML) regulations, KYC obligations, financial record-keeping requirements, and responses to lawful requests from regulatory authorities.
• Legitimate Interests: Processing carried out for toto23's legitimate business interests where those interests are not overridden by your fundamental rights — including fraud detection, platform security, responsible gaming monitoring, and product improvement analytics.
• Consent: Processing for which you have given explicit consent — primarily in relation to marketing communications and the use of non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

toto23 uses your personal data for the following purposes:

• Account Management: Creating, maintaining, and securing your toto23 account; processing login requests; enforcing account-level limits and restrictions.
• Identity Verification (KYC): Confirming that you meet the eligibility requirements of these Terms — specifically that you are at least 21 years of age and a resident of Indonesia — before processing withdrawal requests.
• Payment Processing: Facilitating deposits and withdrawals via your nominated Indonesian bank accounts (BCA, BRI, BNI, Mandiri, CIMB Niaga, and others) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja).
• Fraud and AML Prevention: Detecting and investigating suspicious transactions, duplicate accounts, bonus abuse, and other prohibited conduct as defined in our Terms & Conditions.
• Responsible Gaming: Monitoring gaming activity patterns to identify players who may be exhibiting signs of problem gambling and proactively offering responsible gaming tools — including deposit limits, session time limits, and self-exclusion.
• Customer Support: Responding to your queries, resolving account disputes, and processing formal complaints.
• Regulatory Compliance: Maintaining records required by our gaming license and applicable law; reporting to financial intelligence authorities where legally mandated.
• Platform Improvement: Analyzing aggregated, anonymized usage data to improve the performance, reliability, and user experience of the Platform.
• Marketing (with consent): Sending you promotional communications about bonuses, new games, and seasonal offers — only where you have given explicit consent and subject to the preferences you maintain in your account settings.

7.1 Service Providers (Data Processors). toto23 shares personal data with carefully selected third-party service providers who process data on our behalf under binding data-processing agreements that require them to maintain confidentiality and implement appropriate security measures. These providers include:

• Payment gateways and banking partners for deposit and withdrawal processing;
• KYC and identity verification platforms;
• Fraud screening and AML compliance services;
• Game content providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft) — limited technical session data only, no financial or identity data;
• Hosting and cloud infrastructure providers operating under strict data-security contractual obligations;
• Customer support software providers for ticket and live-chat management.

7.2 Regulatory and Law Enforcement Authorities. toto23 will disclose personal data to government agencies, regulatory bodies, or law enforcement authorities where required to do so by applicable law, court order, or where we are legally permitted to do so in connection with AML or counter-terrorism-financing (CTF) obligations. Such disclosures are made in strict accordance with applicable legal requirements.

7.3 Business Transfers. In the event of a merger, acquisition, restructuring, or sale of all or part of toto23's business, player data may be transferred to the acquiring entity as part of the transaction. You will be notified of any such transfer and of any material changes to the way your data is processed as a result.

7.4 No Sale of Data. toto23 does not sell, rent, license, or trade your personal data to any third party for their own marketing or commercial purposes. This commitment is absolute and unconditional.

8.1 Cross-Border Processing. As an internationally operated platform, some of toto23's service providers and infrastructure components are located outside Indonesia. Personal data may therefore be transferred to, stored in, or processed in countries other than Indonesia, including the jurisdiction in which our gaming license is held.

8.2 Transfer Safeguards. Where personal data is transferred internationally, toto23 ensures that adequate safeguards are in place, including:

• Contractual clauses in service-provider agreements that impose equivalent data-protection standards to those applicable under our licensing jurisdiction;
• Transfer only to jurisdictions that maintain internationally recognized data-protection standards;
• Technical encryption measures that protect data in transit and at rest regardless of the geographic location of processing.

8.3 No Unnecessary Transfers. toto23 applies a data-minimization principle to international transfers — only the minimum data necessary for the specific processing purpose is transferred across borders.

9.1 Retention Principles. toto23 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or for as long as required by applicable law. The following retention periods apply as a general guide:

9.2 Secure Deletion. Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized so that it can no longer be attributed to any individual. Deletion is carried out in accordance with industry-standard secure erasure procedures.

10.1 Technical Safeguards. toto23 implements a layered security architecture to protect your personal data against unauthorized access, disclosure, alteration, or destruction. Key technical measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and our servers;
• AES-256 encryption for sensitive data stored at rest in our databases;
• Multi-factor authentication (MFA) available for player accounts and mandatory for all internal administrative access;
• Web Application Firewall (WAF) and DDoS mitigation systems;
• Continuous 24/7 security monitoring with automated threat detection and alerting;
• Regular penetration testing conducted by qualified independent security professionals.

10.2 Organizational Safeguards. Access to personal data within toto23 is granted on a strict need-to-know basis. All staff with access to personal data undergo data-protection training and are bound by confidentiality obligations. Our data-handling procedures are reviewed and updated regularly.

10.3 Data Breach Response. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, toto23 will notify affected players and relevant authorities within the timeframe required by applicable law. We maintain a documented incident-response procedure for this purpose.

11.1 What Are Cookies. Cookies are small text files placed on your device when you visit a website. toto23 uses cookies and similar technologies (such as local storage objects and session tokens) to operate the Platform effectively, remember your preferences, and analyze usage patterns.

11.2 Types of Cookies We Use.

• Strictly Necessary Cookies: Essential for the Platform to function — including session management, authentication tokens, and security cookies. These cannot be disabled without preventing use of the Platform.
• Functional Cookies: Remember your preferences such as language settings, display preferences, and responsible gaming limits between sessions.
• Analytics Cookies: Collect anonymized data about how visitors use the Platform — page views, session duration, navigation paths — to help us improve the user experience. No personal identity data is included in analytics reports.
• Security Cookies: Used to detect and prevent fraudulent activity, including bot detection and duplicate-account identification.

11.3 No Third-Party Advertising Cookies. toto23 does not use third-party advertising networks or tracking pixels that would allow external parties to build behavioral advertising profiles based on your activity on our Platform.

11.4 Managing Cookies. You may configure your browser to block or delete cookies. Note that disabling strictly necessary cookies will impair your ability to use the Platform. Analytics and functional cookies may be disabled without affecting core Platform functionality.

Subject to applicable law and certain legal exceptions, you have the following rights in relation to your personal data held by toto23:

• Right of Access: You may request a copy of the personal data we hold about you, along with information about how it is processed.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data. You can update many data fields directly through your account settings.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to our legal retention obligations (see Section 9).
• Right to Restriction: You may request that we restrict processing of your data in certain circumstances — for example, while a correction request is being assessed.
• Right to Data Portability: You may request a copy of the personal data you have provided to us in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing based on legitimate interests, including profiling, where you have grounds related to your particular situation.
• Right to Withdraw Consent: Where processing is based on consent (e.g., marketing), you may withdraw consent at any time without affecting the lawfulness of prior processing.

12.1 How to Exercise Your Rights. To exercise any of the above rights, please contact our Data Protection Officer at support@toto23.cam with the subject line "Data Rights Request". We will respond within 30 calendar days. We may request identity verification before processing your request to protect against unauthorized data access.

13.1 21+ Policy. toto23 is strictly an adult platform. We do not knowingly collect personal data from individuals under the age of 21. Account registration requires confirmation that you are at least 21 years of age, and all accounts are subject to KYC age verification before withdrawals are processed.

13.2 Discovery of Underage Data. If toto23 becomes aware that personal data has been collected from an individual under the age of 21, we will immediately close the relevant account, void all associated bets, return any deposited real-money funds, and permanently delete all personal data collected from that individual. Any bonus funds or winnings generated during the period of underage use will be forfeited.

13.3 Parental Responsibility. We urge parents and guardians to use appropriate device-level parental controls to prevent minors from accessing online gambling platforms. If you believe a minor in your household has accessed toto23, please contact our support team immediately at support@toto23.cam.

14.1 Consent-Based Marketing. toto23 sends promotional communications — including bonus offers, seasonal promotions tied to events such as Idul Fitri, Ramadhan, and Indonesian Independence Day (17 August), and new product announcements — only to players who have given explicit marketing consent at registration or through their account settings.

14.2 Channels Used. Marketing communications are delivered via email and, where consented to separately, via SMS to your registered Indonesian mobile number. toto23 does not send unsolicited marketing via WhatsApp, Telegram, or any other third-party messaging platform without explicit channel-specific consent.

14.3 Opting Out. You may withdraw marketing consent at any time by:

• Clicking the "Unsubscribe" link in any marketing email;
• Updating your notification preferences in your account settings; or
• Contacting support at support@toto23.cam with the subject line "Marketing Opt-Out".

Withdrawal of marketing consent will be processed within 5 business days. Transactional communications — such as deposit confirmations, withdrawal notifications, and security alerts — are not marketing and will continue regardless of marketing consent status.

15.1 Right to Amend. toto23 reserves the right to update this Privacy Policy at any time to reflect changes in our data-processing practices, applicable law, or our service offering. Material amendments will be communicated to registered players by email to the address on file, with a minimum of 14 calendar days' notice before the amended Policy takes effect.

15.2 Continued Use. Your continued use of the Platform after the effective date of any amendment constitutes acceptance of the updated Policy. If you do not accept a material amendment, you must close your account before the effective date of the change.

15.3 Version History. The version number and effective date at the top of this Policy identify the current version. Previous versions are available on request by contacting our Data Protection Officer.

For all privacy-related inquiries, data rights requests, or concerns about how toto23 handles your personal data, please contact our Data Protection Officer using the details below:

You also have the right to lodge a complaint with the relevant data-protection supervisory authority in your jurisdiction. toto23 encourages you to contact us directly in the first instance so we can address your concern promptly before any formal complaint is filed.