Privacy Policy

1. Introduction and Scope

This Privacy Policy applies to all personal information collected by 22toto through our website at https://22toto.cam, mobile applications, and related services (collectively, the "Platform"). By creating an account, depositing funds, or using any services offered by 22toto, you acknowledge that you have read, understood, and consent to the data practices described in this policy.

This policy should be read in conjunction with our Terms & Conditions and Responsible Gaming Policy, which together govern your use of the 22toto platform. If you do not agree with any aspect of this Privacy Policy, you must not use our services.

We reserve the right to update or modify this Privacy Policy at any time. Material changes will be communicated via email to your registered address and prominently displayed on the Platform. Your continued use of 22toto following any changes constitutes acceptance of the revised policy. We recommend reviewing this page periodically to stay informed of any updates.

2. Data Controller and Contact Information

22toto acts as the data controller for all personal information collected through the Platform. We are responsible for determining the purposes and means of processing your personal data in accordance with applicable privacy laws and regulations.

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal information, please contact our Data Protection Officer:

• Email: [email protected]
• General Support: [email protected]
• Response Time: We will respond to all privacy-related inquiries within 30 days of receipt.

3. Information We Collect

To provide our betting services, comply with legal obligations, and enhance your user experience, 22toto collects various categories of personal information through different channels and methods.

3.1 Information You Provide Directly

When you register an account, complete KYC verification, or interact with our services, you voluntarily provide the following information:

• Identity Information: Full legal name, date of birth, gender, nationality, Indonesian National Identity Card (KTP) number or passport number.
• Contact Information: Residential address, email address, mobile phone number.
• Financial Information: Bank account details (bank name, account number, account holder name), e-wallet information (OVO, DANA, GoPay account IDs), payment card information (processed through secure third-party payment processors - we do not store full card numbers).
• Verification Documents: Government-issued ID scans (KTP front and back, passport photo page), proof of address documents (utility bills, bank statements), selfie verification photos holding your ID.
• Communication Records: Customer support chat transcripts, email correspondence, feedback forms, complaints submitted through our platform.
• Preference Settings: Language preferences, odds display format, notification settings, marketing communication preferences.

3.2 Information Collected Automatically

When you access and use the 22toto platform, we automatically collect certain technical and behavioral data:

• Account Activity Data: Login timestamps, session durations, logout times, account balance changes, bonus claims, loyalty points accumulation.
• Betting and Gaming Data: Complete betting history (sports bets placed, casino games played, slot spins), stake amounts, odds accepted, winnings and losses, bet timestamps, game outcomes, RTP (Return to Player) statistics.
• Transaction History: Deposit records (amount, method, timestamp, status), withdrawal requests (amount, destination, processing time, status), payment processor transaction IDs, failed transaction attempts.
• Device and Technical Information: IP address, device type (mobile, tablet, desktop), operating system (Windows, macOS, Android, iOS), browser type and version (Chrome, Safari, Firefox), screen resolution, device ID or advertising identifier.
• Usage Analytics: Pages viewed, features used, click patterns, navigation paths, time spent on pages, referral sources (how you found our website), search queries within the platform.
• Location Data: Country and city-level location derived from IP address (we do not collect precise GPS coordinates unless explicitly provided for fraud prevention purposes).

3.3 Information from Third Parties

We may receive information about you from external sources to verify your identity, prevent fraud, and comply with regulatory requirements:

• KYC Verification Providers: Identity verification services that cross-reference your submitted documents against government databases and fraud watchlists to confirm authenticity and detect identity theft.
• Payment Processors: Transaction confirmation data from banks (BCA, BRI, BNI, Mandiri) and e-wallet providers (OVO, DANA, GoPay) including transaction success/failure status and fraud risk scores.
• Credit Reference Agencies: In cases of suspected fraud or high-value transactions, we may consult credit bureaus to verify financial standing and detect suspicious patterns.
• Marketing Partners: If you access 22toto through affiliate links or promotional campaigns, we may receive referral data and campaign tracking information (cookies, UTM parameters) to attribute your registration correctly.

4. How We Use Your Information

22toto processes your personal information for specific, legitimate purposes necessary to provide our services, comply with legal obligations, and improve the user experience. The legal bases for processing include contractual necessity, legal obligation, legitimate interests, and your explicit consent.

4.1 Account Management and Service Delivery

We use your personal information to create, maintain, and manage your 22toto account, enabling you to access our full range of betting services:

• Registering your account and assigning a unique username and account ID.
• Authenticating your identity during login and verifying you are authorized to access the account.
• Processing deposit transactions and crediting funds to your account balance.
• Accepting and recording bets placed across sports betting, casino games, and slots.
• Calculating bet outcomes, settling winnings, and updating account balances.
• Processing withdrawal requests and transferring funds to your designated bank account or e-wallet.
• Tracking loyalty points accumulation and VIP tier progression (Bronze, Silver, Gold).
• Applying bonuses, promotional credits, and cashback offers to your account.
• Providing customer support and resolving account-related issues or disputes.

4.2 Legal Compliance and Regulatory Obligations

As a licensed international betting operator, 22toto is subject to strict regulatory requirements including anti-money laundering (AML), counter-terrorism financing (CTF), and know-your-customer (KYC) regulations. We use your information to fulfill these legal obligations:

• Verifying your age to enforce our 21+ age restriction policy and prevent underage gambling.
• Confirming your identity through government-issued ID verification to prevent identity fraud and account takeovers.
• Conducting enhanced due diligence on high-value transactions or suspicious activity patterns.
• Monitoring transactions for signs of money laundering, terrorist financing, or other financial crimes.
• Reporting suspicious activities to relevant regulatory authorities and financial intelligence units as required by law.
• Responding to lawful requests from government agencies, courts, or law enforcement (search warrants, subpoenas, court orders).
• Maintaining transaction records and audit trails for regulatory inspection periods (typically 5-7 years).
• Complying with tax reporting obligations in jurisdictions where winnings are subject to taxation.

4.3 Fraud Prevention and Security

Protecting your account and funds from unauthorized access, theft, and fraudulent activity is a top priority. We use your information to detect and prevent security threats:

• Monitoring login patterns to detect unusual access attempts (unfamiliar devices, suspicious IP addresses, abnormal login times).
• Identifying duplicate accounts created to abuse bonuses or circumvent restrictions.
• Detecting collusion, chip dumping, or coordinated betting schemes between multiple accounts.
• Preventing payment fraud including stolen credit cards, third-party deposits, and chargeback abuse.
• Analyzing betting patterns to identify arbitrage betting, late betting exploitation, or insider trading.
• Implementing device fingerprinting and behavioral biometrics to distinguish legitimate users from bots or fraudsters.
• Blocking access from VPN services, proxy servers, or anonymization tools used to mask true location or identity.
• Investigating reported account compromises and unauthorized transactions.

4.4 Communications and Customer Support

We use your contact information to communicate important account notifications, respond to inquiries, and provide personalized customer service:

• Sending transactional emails confirming deposits, withdrawals, bet placements, and account changes.
• Delivering security alerts about password changes, new device logins, or withdrawal requests.
• Responding to customer support tickets, live chat inquiries, and email questions.
• Notifying you about account verification status, KYC document approvals, or requests for additional information.
• Informing you about platform maintenance windows, downtime, or technical issues affecting service availability.
• Communicating changes to our Terms & Conditions, Privacy Policy, or other governing documents.
• Sending promotional offers, bonus notifications, and VIP program benefits (only if you have consented to marketing communications - you can opt out anytime).

4.5 Platform Improvement and Analytics

We analyze aggregated, anonymized usage data to understand player behavior, improve platform functionality, and optimize the user experience:

• Identifying popular games, betting markets, and features to inform content strategy.
• Analyzing navigation patterns to improve website layout, menu structure, and user interface design.
• Testing new features, game releases, and promotional campaigns through A/B testing and controlled rollouts.
• Measuring platform performance metrics (page load times, transaction processing speeds, uptime statistics).
• Generating statistical reports on user demographics, betting volumes, and market trends (used internally only, never shared with third parties).
• Developing AI-powered game recommendation engines based on your play history and preferences.
• Optimizing payment routing to select the fastest and most reliable payment processors for your transactions.

4.6 Responsible Gaming and Player Protection

We use your account data and behavioral patterns to promote responsible gaming and identify players who may need support:

• Monitoring deposit frequency, bet sizes, and session durations to detect potentially problematic gambling behavior.
• Enforcing deposit limits, loss limits, and session time limits you have set through responsible gaming tools.
• Implementing self-exclusion requests (24-hour cool-off, 1-month timeout, 6-month exclusion, permanent closure).
• Proactively reaching out to players showing warning signs of problem gambling with offers of support resources and counseling links.
• Preventing underage gambling through strict age verification and monitoring for suspected minor access attempts.

5. How We Protect Your Information

22toto employs comprehensive technical, administrative, and physical security measures to protect your personal information from unauthorized access, theft, loss, misuse, or disclosure.

5.1 Technical Security Measures

• SSL/TLS Encryption: All data transmitted between your device and our servers uses 256-bit SSL (Secure Socket Layer) encryption - the same military-grade standard used by banks and government agencies. This prevents interception of sensitive information during transmission.
• Data Encryption at Rest: Sensitive data stored in our databases (passwords, financial information, ID documents) is encrypted using AES-256 encryption algorithms. Even if unauthorized parties gained physical access to our servers, encrypted data would be unreadable without decryption keys.
• Secure Password Storage: User passwords are never stored in plain text. We use bcrypt hashing with individual salts, making it computationally infeasible to reverse-engineer passwords even if the database were compromised.
• Firewall Protection: Multi-layer firewalls protect our network infrastructure from external attacks, unauthorized access attempts, and distributed denial-of-service (DDoS) attacks.
• Intrusion Detection Systems: Real-time monitoring systems detect and alert security teams to suspicious access patterns, potential breaches, or anomalous behavior.
• Regular Security Audits: Independent third-party security firms conduct annual penetration testing and vulnerability assessments to identify and remediate potential security weaknesses.
• Secure Development Practices: Our development team follows OWASP (Open Web Application Security Project) secure coding guidelines to prevent common vulnerabilities like SQL injection, cross-site scripting (XSS), and cross-site request forgery (CSRF).

5.2 Administrative Security Measures

• Access Controls: Personal data is accessible only to authorized employees with legitimate business need (customer support, compliance officers, senior management). Access is granted on a role-based, least-privilege basis.
• Employee Training: All staff members handling personal data receive mandatory training on data protection regulations, security best practices, and privacy obligations.
• Confidentiality Agreements: Employees, contractors, and third-party service providers sign legally binding non-disclosure agreements (NDAs) prohibiting unauthorized disclosure of customer information.
• Access Logging: Every access to personal data is logged with timestamps, user IDs, and actions taken. Logs are retained for audit purposes and reviewed regularly for suspicious activity.
• Incident Response Plan: We maintain a documented data breach response plan detailing immediate containment procedures, notification protocols, and remediation steps in the event of a security incident.

5.3 Physical Security Measures

• Secure Data Centers: Our servers are hosted in Tier 3/Tier 4 certified data centers with 24/7 physical security, biometric access controls, video surveillance, and redundant power and cooling systems.
• Geographic Redundancy: Data is replicated across multiple geographically distributed data centers to ensure business continuity in case of natural disasters or catastrophic failures.
• Secure Document Disposal: Physical documents containing personal information (printed ID copies, paper forms) are shredded and disposed of securely when no longer needed.

5.4 Payment Security

Financial transactions are protected through multiple layers of security:

• PCI-DSS Compliance: Our payment processors are certified compliant with Payment Card Industry Data Security Standards (PCI-DSS), the global standard for handling credit card information.
• Tokenization: Sensitive payment details (card numbers, bank account numbers) are replaced with randomly generated tokens. We store only tokens, never actual payment credentials.
• 3D Secure Authentication: For card deposits, we support 3D Secure (Verified by Visa, Mastercard SecureCode) which adds an extra authentication layer requiring OTP or biometric verification.
• Fraud Screening: Real-time fraud detection algorithms assess every transaction for risk indicators (unusual amounts, mismatched billing information, velocity checks) and flag suspicious transactions for manual review.

6. Data Sharing and Third-Party Disclosure

22toto does not sell, rent, or trade your personal information to third parties for their marketing purposes. However, we do share your information with trusted service providers and partners under strict contractual obligations to protect your data and use it only for specified purposes.

6.1 Service Providers and Business Partners

We share personal information with carefully selected third-party service providers who assist in operating the 22toto platform:

Service Provider Type	Data Shared	Purpose
Payment Processors	Name, bank account details, transaction amounts, e-wallet IDs	Processing deposits and withdrawals through BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay
KYC Verification Services	ID documents (KTP, passport), proof of address, selfie photos	Verifying identity authenticity, cross-referencing against government databases, fraud detection
Game Providers	Account ID (anonymized), betting data, game outcomes	Operating slots, live casino tables, and other gaming products
Cloud Hosting Providers	All data stored on servers (encrypted)	Secure server infrastructure, data storage, and platform hosting
Customer Support Tools	Contact information, chat transcripts, ticket history	Managing customer service interactions, tracking support tickets
Analytics Platforms	Usage data (anonymized), device information, behavioral patterns	Platform performance monitoring, user experience optimization

All third-party service providers are contractually bound by Data Processing Agreements (DPAs) requiring them to maintain confidentiality, implement appropriate security measures, process data only as instructed, and comply with applicable data protection laws.

6.2 Legal and Regulatory Disclosures

We may disclose your personal information when required or permitted by law:

• Regulatory Authorities: Gaming license regulators, financial intelligence units, and oversight bodies may request information to verify compliance with licensing conditions.
• Law Enforcement: Police, prosecutors, or government agencies may compel disclosure through search warrants, subpoenas, or court orders in criminal investigations.
• Legal Proceedings: Your information may be disclosed in civil litigation where 22toto is a party, or to enforce our rights under the Terms & Conditions.
• Fraud Prevention Networks: We participate in industry-wide fraud prevention databases that share information about confirmed fraudsters to protect the broader gaming ecosystem.

Where legally permitted, we will notify you before disclosing your information in response to legal requests unless notification is prohibited by law or would undermine an investigation.

6.3 Business Transfers

In the event 22toto is involved in a merger, acquisition, asset sale, bankruptcy, or other business transaction, your personal information may be transferred to the acquiring entity as part of the transaction. We will notify you via email and prominent notice on the Platform before your information is transferred and becomes subject to a different privacy policy.

7. Your Privacy Rights

Under applicable data protection laws, you have specific rights regarding your personal information. 22toto is committed to honoring these rights and providing mechanisms to exercise them.

7.1 Right to Access

You have the right to request a copy of all personal information we hold about you. To submit an access request, email [email protected] with your account details and a description of the information you wish to access. We will provide the information in a structured, commonly used format within 30 days.

7.2 Right to Rectification

If your personal information is inaccurate or incomplete, you can update it directly through your account settings or by contacting customer support. For significant changes (name corrections, address updates), we may request supporting documentation to verify accuracy.

7.3 Right to Erasure (Right to Be Forgotten)

You can request deletion of your personal information by closing your account. However, we may retain certain data where required by law (transaction records for anti-money laundering compliance, typically 5-7 years), to defend legal claims, or for legitimate business interests (fraud prevention blacklists). Retained data will be securely archived and not used for operational purposes.

7.4 Right to Restriction of Processing

You can request we temporarily limit how we use your information while you dispute the accuracy of data or object to processing. During restriction periods, we will store your data but not actively process it except with your consent or for legal purposes.

7.5 Right to Data Portability

You can request your personal data in a machine-readable format (CSV, JSON, XML) to transfer to another service provider. We will provide account data, betting history, and transaction records where technically feasible.

7.6 Right to Object

You can object to processing based on legitimate interests (marketing, analytics, profiling). We will cease processing unless we demonstrate compelling legitimate grounds that override your interests or need the data for legal claims.

7.7 Right to Withdraw Consent

Where processing is based on your consent (marketing emails, optional data collection), you can withdraw consent at any time. This does not affect the lawfulness of processing before withdrawal. Opt out of marketing emails using the unsubscribe link or account preferences.

7.8 Right to Lodge a Complaint

If you believe 22toto has violated your privacy rights or mishandled your personal information, you have the right to lodge a complaint with the relevant data protection authority in your jurisdiction. Contact details for Indonesian data protection authorities are available through the Ministry of Communication and Information Technology (Kominfo).

8. International Data Transfers

22toto operates internationally, and your personal information may be transferred to, stored in, and processed in countries outside Indonesia where our servers, service providers, or business partners are located. These jurisdictions may have different data protection standards than Indonesia.

When transferring data internationally, we implement appropriate safeguards including Standard Contractual Clauses (SCCs) approved by data protection authorities, ensuring recipient countries provide adequate protection, or obtaining your explicit consent for transfers. Data transferred outside Indonesia receives the same level of protection as outlined in this Privacy Policy.

9. Cookies and Tracking Technologies

22toto uses cookies (small text files stored on your device) and similar tracking technologies to enhance functionality, remember preferences, and analyze platform usage.

Types of Cookies We Use:

• Essential Cookies: Required for login, session management, security, and core functionality. Cannot be disabled without breaking the platform.
• Functional Cookies: Remember your preferences (language, odds format, display settings). Improve convenience but not strictly necessary.
• Analytics Cookies: Track page views, user flows, and behavior patterns (anonymized) to help us optimize the platform. We use self-hosted analytics to maintain full control over data.
• Security Cookies: Detect and prevent fraudulent activity, identify suspicious login attempts, and protect against unauthorized access.

We do not use third-party advertising cookies that track you across the web. You can manage cookie preferences through your browser settings, though disabling essential cookies will impair platform functionality. Refer to your browser's help documentation for instructions on blocking or deleting cookies.

10. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, comply with legal obligations, and resolve disputes.

Retention Periods:

• Active Accounts: Personal information and transaction history retained as long as your account remains open and active.
• Closed Accounts: Account data retained for 7 years after closure to comply with anti-money laundering regulations and tax reporting obligations.
• KYC Documents: Verification documents retained for 7 years post-closure or as required by licensing jurisdiction law.
• Betting History: Bet records and game outcomes retained for 7 years for dispute resolution and regulatory audit purposes.
• Communication Records: Customer support transcripts and email correspondence retained for 3 years for quality assurance and complaint resolution.
• Marketing Data: Deleted immediately upon opt-out or unsubscribe, except where needed for suppression lists to prevent re-contact.

After retention periods expire, data is securely deleted or anonymized so it can no longer identify you. Archived data is stored securely with restricted access and not used for operational purposes.

11. Children's Privacy

22toto strictly prohibits underage gambling. Our services are intended solely for individuals 21 years of age or older (or the legal age in their jurisdiction, whichever is higher). We do not knowingly collect personal information from minors.

If we discover that a user is underage, we will immediately suspend the account, void all bets and transactions, and delete all collected personal information. Parents or guardians who believe their child has accessed 22toto should contact us immediately at [email protected] so we can take prompt action.

12. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, legal requirements, or business operations. Material changes will be communicated via email to your registered address and prominently displayed on the Platform at least 30 days before taking effect.

Your continued use of 22toto after the effective date of changes constitutes acceptance of the revised policy. If you do not agree with the updated terms, you must cease using the platform and may close your account. We encourage you to review this page regularly to stay informed of our privacy practices.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or how we handle your personal information, please contact us:

• Data Protection Officer: [email protected]
• Customer Support: [email protected] (24/7 live chat also available)
• Response Time: We aim to respond to all privacy inquiries within 30 days.

For detailed answers to common questions, visit our FAQ page. To understand your rights and obligations as a player, read our Terms & Conditions. For responsible gaming resources, see our Responsible Gaming page.