toto08 Privacy Policy

In this Privacy Policy, the following terms carry the meanings set out below unless the context clearly requires otherwise.

toto08 collects Personal Data through three primary channels: data you provide directly, data collected automatically during your use of the Platform, and data received from trusted third-party verification partners. The categories of Personal Data we collect are set out in the table below.

toto08 processes Member Personal Data strictly for the following purposes. We do not use Personal Data for any purpose that is incompatible with the purposes stated here without first obtaining your explicit consent.

• Account Management: Creating and maintaining your toto08 account, verifying your identity at registration and during KYC, and processing your toto08 Login authentication.
• Service Delivery: Processing deposits and withdrawals via local Indonesian payment channels, settling bets and game rounds, and crediting bonus awards to your account.
• Legal & Regulatory Compliance: Satisfying our obligations under applicable anti-money-laundering (AML) and counter-terrorist-financing (CTF) regulations, retaining transaction records for audit purposes, and responding to lawful requests from competent authorities.
• Fraud Prevention & Security: Detecting and preventing unauthorised account access, duplicate account registration, bonus abuse, collusion, match-fixing, and other forms of Prohibited Conduct as defined in our Terms & Conditions.
• Platform Improvement: Analysing usage patterns, diagnosing technical issues, A/B testing new features, and improving the overall performance and user experience of the toto08 Platform.
• Responsible Gaming: Monitoring betting patterns to identify potential indicators of problem gambling and proactively offering responsible gaming tools such as deposit limits, time-outs, and self-exclusion.
• Marketing Communications: Sending promotional offers, bonus notifications, and seasonal campaigns (for example, Ramadhan reload bonuses, Idul Fitri cashback promotions, and Indonesian Independence Day special events) to Members who have not opted out of marketing communications. You may opt out at any time — see Section 9.
• Customer Support: Responding to inquiries, resolving disputes, and maintaining records of support interactions for quality assurance purposes.

toto08 relies on the following legal bases when processing your Personal Data:

• Contract Performance: Processing your Identity, Contact, and Financial Data is necessary to enter into and perform the membership agreement between you and toto08, including processing deposits, settling bets, and paying out winnings.
• Legal Obligation: Processing for KYC, AML, and CTF compliance is required by applicable international gaming regulations and financial crime prevention laws that toto08 is bound to observe as a licensed operator.
• Legitimate Interests: Processing Technical and Usage Data for fraud prevention, platform security, and service improvement serves toto08's legitimate interest in operating a safe and reliable gaming platform, provided that such interests are not overridden by your fundamental privacy rights.
• Consent: Processing your Contact Data for marketing communications is based on your consent, which you may withdraw at any time without affecting the lawfulness of processing that occurred prior to withdrawal.

toto08 does not sell or rent your Personal Data to any third party. We share Personal Data only in the circumstances described below, and only to the extent strictly necessary for the stated purpose.

• Payment Service Providers: We share Financial Data with Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) to process deposits and withdrawals. These providers process your data as independent controllers under their own privacy policies and applicable Indonesian banking regulations.
• Identity Verification Partners: We share Identity Data and Verification Data with accredited third-party KYC service providers to authenticate your identity documents. These partners operate under binding data processing agreements and are prohibited from using your data for any purpose other than identity verification.
• Game Content Providers: Game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive limited Technical and Usage Data (such as session tokens and bet values) necessary to deliver their games within the toto08 Platform. No Identity or Financial Data is shared with game studios.
• Regulatory & Law Enforcement Authorities: toto08 will disclose Personal Data to competent authorities where required by a valid legal obligation, court order, or regulatory requirement. We will notify affected Members of such disclosures where we are legally permitted to do so.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of the toto08 business, Personal Data held by toto08 may be transferred to the successor entity. Members will be notified in advance of any such transfer via a notice on the Platform.

toto08 uses cookies and similar technologies (including local storage and session storage) to operate and improve the Platform. The cookies we use fall into the following categories:

You may manage cookie preferences through your browser settings. Please note that disabling Strictly Necessary cookies will prevent you from logging in and using the Platform. toto08 does not use third-party advertising cookies or retargeting pixels.

toto08 retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply as general guidelines:

• Account and Identity Data: Retained for the duration of your active membership and for a minimum of 5 years following Account closure, to satisfy AML record-keeping requirements.
• Financial Transaction Data: Retained for a minimum of 5 years from the date of each transaction, in accordance with financial crime prevention regulations applicable to licensed gaming operators.
• KYC Verification Documents: Retained for a minimum of 5 years following the completion of verification or Account closure, whichever is later.
• Technical and Usage Data: Retained for up to 24 months from collection, after which records are either deleted or irreversibly anonymised.
• Communications Data: Support transcripts and email correspondence retained for up to 3 years from the date of the interaction.
• Marketing Consent Records: Retained until you withdraw consent, and for 3 years thereafter as evidence of the consent transaction.

toto08 implements a comprehensive set of technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, destruction, or alteration. Our security framework includes:

• Transport Layer Security: All data transmitted between your device and toto08 servers is encrypted using TLS 1.2 or higher, enforced via an always-on HTTPS policy. HTTP connections are automatically redirected to HTTPS.
• Data Encryption at Rest: Personal Data stored in toto08 databases is encrypted using AES-256 encryption. Encryption keys are managed through a dedicated key management system with access controls and rotation policies.
• Access Controls: Access to systems containing Personal Data is restricted to authorised toto08 personnel on a strict need-to-know basis, enforced through role-based access control (RBAC) and multi-factor authentication (MFA) requirements for all administrative accounts.
• Intrusion Detection: toto08's infrastructure is monitored 24/7 by automated intrusion detection and prevention systems (IDS/IPS). Anomalous access patterns trigger immediate alerts to the security operations team.
• Regular Security Audits: toto08 engages independent security professionals to conduct periodic penetration testing and vulnerability assessments of the Platform and its underlying infrastructure.
• Incident Response: In the event of a data breach that poses a material risk to Members' rights, toto08 will notify affected Members without undue delay and will take all reasonable steps to contain and remediate the breach.

As a Member of toto08, you hold the following rights with respect to your Personal Data. These rights may be subject to certain limitations where toto08 is required to retain or process data to meet legal obligations or to protect the rights of third parties.

• Right of Access: You may request a copy of all Personal Data that toto08 holds about you, along with information about the purposes for which it is processed, the categories of data held, and the recipients to whom it has been disclosed.
• Right to Rectification: If any Personal Data toto08 holds about you is inaccurate or incomplete, you may request that we correct or update it. You may also update certain information directly within your account settings.
• Right to Erasure: You may request that toto08 delete your Personal Data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where the processing has been unlawful. This right does not apply where toto08 is required to retain the data by law (for example, AML record-keeping requirements).
• Right to Restriction: You may request that toto08 restrict the processing of your Personal Data in certain circumstances, for example while a dispute regarding the accuracy of the data is being resolved.
• Right to Data Portability: You may request a copy of the Personal Data you have provided to toto08 in a structured, commonly used, machine-readable format (such as CSV or JSON) where processing is based on your consent or contract performance.
• Right to Object: You may object to the processing of your Personal Data where toto08 relies on its legitimate interests as the legal basis. You may also withdraw consent for marketing communications at any time by clicking the unsubscribe link in any marketing email or by contacting toto08 support.

To exercise any of the rights set out in Section 9, please submit a data request to toto08 via one of the channels listed in Section 14. To protect your privacy, toto08 must verify your identity before processing any data request. You will be asked to provide your registered email address and, in some cases, a copy of your identity document.

toto08 will acknowledge all data requests within 48 hours (WIB) and will aim to provide a full response within 30 calendar days of receipt. If the complexity or volume of requests requires additional time, toto08 will notify you of the extended deadline and the reason for the extension before the initial 30-day period expires.

There is no fee for submitting a data request. However, toto08 reserves the right to charge a reasonable administrative fee for requests that are manifestly unfounded or excessive in frequency.

The toto08 Platform integrates third-party services to deliver core functionality. Where these integrations involve the processing of your Personal Data, toto08 ensures that appropriate data protection agreements are in place. The categories of third-party service provider used by toto08 are:

• Payment Processors: Indonesian bank transfer gateways and e-wallet APIs (OVO, DANA, GoPay, ShopeePay, LinkAja) that process deposit and withdrawal instructions. These providers are regulated under Indonesian financial services law and operate under their own published privacy frameworks.
• Game Content Providers: Studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft deliver their game engines within toto08's platform environment. Game round data is shared with these providers to the extent necessary to calculate outcomes and return results.
• KYC & Identity Verification: Accredited third-party identity verification specialists analyse identity documents and liveness checks on behalf of toto08. Verification results (pass/fail and extracted identity fields) are returned to toto08 and the original document images are retained by the verification partner for the period required by applicable regulations.
• Platform Analytics: toto08 uses first-party analytics tooling to analyse Platform usage. No personally identifiable data is shared with external analytics vendors.

toto08 is not responsible for the privacy practices of third-party websites or services that are not operated by toto08. This Privacy Policy applies solely to the toto08 Platform at https://toto08.net.

The toto08 Platform is strictly intended for adults aged 21 years and over. toto08 does not knowingly collect Personal Data from individuals under the age of 21. Age is verified during the registration process and again as part of the KYC procedure.

If toto08 discovers that Personal Data has been collected from a person under the age of 21, we will immediately close the associated Account, forfeit any Balance in accordance with our Terms & Conditions, and permanently delete the Personal Data from our systems within 30 days.

toto08 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, the services we offer, applicable law, or regulatory guidance. When we make material changes to this Policy, we will:

• Update the "Last Updated" date at the top of this page.
• Display a notice on the Platform informing Members of the change upon their next login.
• Where the change materially affects the way we use your Personal Data, we will send a notification to your registered email address at least 14 days before the change takes effect.

Your continued use of the toto08 Platform following the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. If you do not agree with the revised Policy, you should discontinue use of the Platform and contact toto08 support to request Account closure.

If you have any questions, concerns, or requests regarding this Privacy Policy or the way toto08 handles your Personal Data, please contact our Data Protection team through any of the following channels:

• Live Chat: Available 24/7 via the toto08 Platform — the fastest route to our support team for urgent privacy concerns.
• Email: support at toto08.net — please include "Privacy Request" in the subject line so your message is routed to the correct team.
• WhatsApp: +62 812 0000 0808 — available 07:00–23:00 WIB.

toto08 aims to respond to all privacy-related inquiries within 48 hours and to resolve data requests within 30 calendar days as described in Section 10. For Members located in Jakarta, Surabaya, Bandung, Bali, Medan, Yogyakarta, Semarang, or elsewhere across Indonesia, our 24/7 live chat provides the most consistent availability across all time zones including WIB, WITA, and WIT.