Privacy Policy

1toto is an online betting and gaming platform accessible at https://1toto.cam. The platform is operated by a licensed international entity (the "Data Controller") incorporated in a jurisdiction that permits the provision of online betting and gaming services to international players, including those based in Indonesia.

For the purposes of this Privacy Policy, "1toto", "we", "us", and "our" refer to the Data Controller and any subsidiaries or affiliates that process data on its behalf. "You" and "your" refer to any individual who visits the platform, registers a member account, or otherwise interacts with 1toto's services.

Our primary operational focus is the Indonesian market. All customer-facing communications, payment processing, and support services are oriented toward players based in Indonesia. Accordingly, this Privacy Policy reflects the data practices of a platform operating in the Indonesian market context while being governed by the legal framework of our international licensing jurisdiction.

1toto collects personal data across several categories depending on the nature of your interaction with the platform. The categories below describe the full scope of data we may hold about you.

• Identity Data: Full legal name, date of birth, Indonesian National Identity Number (NIK), nationality, and gender — collected at registration and used for KYC (Know Your Customer) verification.
• Contact Data: Email address, mobile phone number, and residential address (including city, province, and postal code within Indonesia).
• Financial Data: Bank account numbers and names registered with BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, or Bank Danamon; e-wallet identifiers for OVO, DANA, GoPay, ShopeePay, and LinkAja. We do not store full card numbers or CVV codes.
• Verification Documents: Scanned or photographed copies of government-issued photo ID (KTP, SIM, or passport) submitted during KYC verification, and supporting documents such as bank statements or utility bills where source-of-funds verification is required.
• Transaction Data: Deposit and withdrawal history including amounts in Indonesian Rupiah (IDR), timestamps, payment channels used, and transaction reference numbers.
• Wagering Data: A complete record of all bets, game sessions, wager amounts, outcomes, and bonuses applied — maintained for regulatory compliance, dispute resolution, and responsible gaming monitoring.
• Technical Data: IP address, browser type and version, device type and operating system, screen resolution, referring URLs, session duration, and pages visited within the platform.
• Communication Data: Records of all correspondence between you and 1toto support, including live chat transcripts, email threads, and any complaints submitted through our formal process.
• Preference Data: Preferred language, notification settings, marketing communication preferences, and responsible gaming tool settings (deposit limits, session timers, self-exclusion status).

We collect personal data through the following channels and mechanisms:

• Directly from you: When you complete the registration form, submit KYC documents, make a deposit or withdrawal, place a bet, contact customer support, or update your account settings.
• Automatically via technology: Through cookies, web beacons, server logs, and analytics scripts that record technical data about your session each time you visit the platform. See the Cookies & Tracking section for full details.
• From third-party identity verification providers: Where we engage a specialist KYC or anti-money laundering (AML) service to cross-check your identity data against authoritative databases, we may receive a verification result and associated flags from that provider.
• From payment processors: Our payment gateway partners transmit confirmation data (transaction status, reference codes, and in some cases masked account information) when you initiate a deposit or withdrawal.
• From fraud prevention partners: Risk scoring and device fingerprinting data may be received from third-party fraud detection services to help us identify suspicious activity on the platform.

Every instance of data processing at 1toto is tied to a specific, documented purpose and a corresponding legal basis. We do not process personal data for vague or undefined reasons. The table below summarizes our core processing activities:

1toto does not sell, rent, or trade your personal data to third parties for commercial gain. We share data only in the following limited and controlled circumstances:

• Payment processors and banking partners: We share the minimum necessary financial and identity data with BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, and the e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) solely to facilitate your deposit and withdrawal transactions.
• KYC and identity verification providers: We may share identity and document data with specialist third-party verification services engaged to fulfil our regulatory obligations. These providers are contractually bound to process data only on our instruction and in accordance with applicable data protection standards.
• Fraud detection and AML partners: Risk-related technical and identity data may be shared with fraud prevention service providers. These providers process data as data processors acting under our instruction.
• Game content providers: Our gaming studio partners (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft) may receive a pseudonymous player identifier and session data necessary to load and operate their games within the 1toto environment. These providers are not given your full identity data.
• Regulatory and law enforcement authorities: We will disclose personal data to Indonesian or international authorities where required to do so by law, court order, or lawful regulatory request. We will notify you of such disclosures where legally permitted to do so.
• Group companies and successors: In the event of a merger, acquisition, or business transfer, your data may be transferred to the acquiring entity, which will be bound by equivalent data protection commitments. You will be notified of any such transfer in advance.

1toto uses cookies and similar tracking technologies to operate the platform, remember your preferences, and analyze usage patterns. The following cookie categories are in use:

• Strictly Necessary Cookies: Essential for core platform functions such as session management, login state, and security token validation. These cookies cannot be disabled without impairing platform functionality.
• Functional Cookies: Store your preferences such as language setting, preferred deposit method, and responsible gaming tool configuration so that these settings persist across sessions.
• Analytics Cookies: Collect aggregated, pseudonymous data on how members navigate the platform — pages visited, features used, session duration, and device type. This data helps us improve the platform. No personally identifiable information is extracted from analytics cookies.
• Fraud Prevention Cookies: Support our device fingerprinting and risk-scoring processes by assigning a persistent device identifier. These cookies are essential for protecting members from unauthorized account access.

We do not deploy third-party advertising cookies or social media tracking pixels. You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent you from accessing your account.

We retain personal data for the minimum period necessary to fulfil the purpose for which it was collected, subject to any longer retention periods required by law or regulatory obligation. Our standard retention periods are as follows:

• Active account data: Retained for the duration of your membership plus 5 years following account closure, to meet anti-money laundering and financial record-keeping obligations.
• KYC and verification documents: Retained for 5 years from the date of verification or account closure, whichever is later, in line with international AML standards.
• Transaction and wagering records: Retained for 5 years from the date of each transaction, for audit, dispute resolution, and regulatory compliance purposes.
• Customer support records: Retained for 3 years from the date of the last interaction, to support the resolution of any subsequent complaints or disputes.
• Technical and analytics data: Aggregated analytics data is retained indefinitely in anonymized form. Raw technical logs (server logs, IP records) are deleted after 12 months.
• Marketing consent records: Retained for 3 years from the date of consent or withdrawal of consent, as evidence of your preferences.

Upon expiry of the applicable retention period, data is securely deleted or irreversibly anonymized. You may request early deletion of your data subject to the overriding legal retention obligations described above.

1toto implements a layered security architecture to protect your personal data against unauthorized access, disclosure, alteration, or destruction. Our technical and organizational measures include:

• TLS 1.3 encryption for all data in transit between your device and our servers.
• AES-256 encryption at rest for sensitive data fields including identity documents and financial account details.
• Multi-factor authentication (MFA) for all internal staff accessing production systems containing member data.
• Role-based access controls limiting staff access to personal data strictly on a need-to-know basis.
• Regular independent security audits and penetration testing of the platform infrastructure.
• Automated anomaly detection systems monitoring for unusual access patterns or data exfiltration attempts.
• Secure data center facilities with physical access controls, CCTV monitoring, and environmental safeguards.

In the event of a personal data breach that poses a risk to your rights and freedoms, 1toto will notify affected members within 72 hours of becoming aware of the breach, or as soon as practicable, and will take all reasonable steps to mitigate the impact of the breach.

As a data subject, you hold the following rights in relation to your personal data held by 1toto. These rights may be exercised by submitting a written request to [email protected]. We will respond to all verified requests within 30 days.

1toto operates a strict 21+ age policy across all products and services. The platform is not directed at, and does not knowingly collect personal data from, individuals under the age of 21. This policy is in place to protect minors from the potential harms of gambling and to comply with responsible gaming standards applicable to platforms operating in the Indonesian market.

During the registration process, all applicants are required to confirm that they are at least 21 years of age. This confirmation is followed by age verification as part of the KYC process. Where we have reasonable grounds to suspect that a registered account belongs to a person under 21, we will immediately suspend the account pending age verification. If the account holder cannot provide satisfactory proof of age, the account will be permanently closed and any deposited funds will be returned to the verified source.

If you are a parent or guardian and believe that a minor in your care has registered an account with 1toto, please contact us immediately at [email protected]. We will investigate the matter promptly and take appropriate action, including account closure and return of funds where applicable.

As an internationally operated platform, 1toto may transfer your personal data to servers and processors located outside of Indonesia. Such transfers are necessary to operate the platform, process payments, and provide customer support at an international standard.

When transferring personal data internationally, 1toto ensures that appropriate safeguards are in place to protect your data to an equivalent standard as would apply within Indonesia. These safeguards include:

• Binding contractual clauses with all international data processors that require equivalent data protection standards to those described in this Privacy Policy.
• Transfer only to jurisdictions or entities that provide an adequate level of data protection as assessed by the relevant standards applied in our licensing jurisdiction.
• Ongoing due diligence reviews of all third-party processors to ensure continued compliance with contractual data protection obligations.

You may request information about the specific safeguards applied to international transfers of your personal data by contacting [email protected].

The 1toto platform integrates with a number of third-party services to deliver its full range of features. These include game content providers (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft), payment infrastructure partners, and platform analytics services. While we carefully vet all third-party integrations, 1toto is not responsible for the independent privacy practices of these third parties in their own right.

When you access a game provided by a third-party studio within the 1toto platform, a pseudonymous session token is passed to the game provider to authenticate the session. The game provider may independently log technical session data in accordance with their own privacy policy. We encourage you to review the privacy policies of our major game content providers if you have concerns about their independent data practices.

Where 1toto links to external resources (for example, in our responsible gaming guidance, we may reference external support organizations), those external sites operate under their own privacy policies. 1toto does not control and is not responsible for the privacy practices of any external website.

1toto reserves the right to update or revise this Privacy Policy at any time. We will notify registered members of material changes — those that affect how we use your personal data or that reduce your rights as a data subject — via email notification and/or a prominent notice on the platform at least 7 days before the change takes effect.

Non-material changes, such as clarifications of existing practices, formatting corrections, or updates to our contact details, will be reflected in this document with the "Last updated" date revised accordingly. We encourage you to review this Privacy Policy periodically.

Your continued use of the platform following the effective date of any amendment constitutes your acknowledgment of the revised policy. If you do not accept the amended policy, you must cease using the platform and may request account closure in accordance with our Terms & Conditions.

For any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data by 1toto, please contact our Data Protection team using the details below. We are committed to resolving all privacy queries fairly and promptly.

If you believe that 1toto has failed to handle your personal data in accordance with this Privacy Policy or applicable data protection law, you have the right to lodge a formal complaint. Please submit your complaint in writing to the privacy contact above, describing the nature of your concern in as much detail as possible. We will acknowledge receipt within 2 business days and provide a substantive response within 30 days.

If you remain unsatisfied with our response to your complaint, you may escalate the matter to the relevant data protection supervisory authority in our licensing jurisdiction, or seek independent dispute resolution through a recognized arbitration body.