Privacy Policy

Section 1

Definitions

The following terms carry the meanings set out below throughout this Privacy Policy:

• "toto8", "We", "Us", "Our" — the operator of the toto8 platform at https://toto8.lat and all associated services.
• "Player", "You", "Your" — any individual who registers an account on or accesses the toto8 platform.
• "Personal Data" — any information that identifies or can be used to identify a living individual, including but not limited to name, email address, phone number, national identity number, payment details, and device identifiers.
• "Processing" — any operation performed on Personal Data, including collection, storage, use, disclosure, and deletion.
• "Platform" — the toto8 website, mobile-optimized site, and any associated applications or services operated under the toto8 brand.
• "KYC" — Know Your Customer verification procedures, including identity document checks required under anti-money-laundering obligations.
• "KTP" — Kartu Tanda Penduduk, the Indonesian National Identity Card issued by the Indonesian civil administration authority.
• "Third-Party Providers" — game studios, payment processors, fraud-detection services, analytics providers, and other vendors whose services are integrated into the Platform.

Section 2

Data We Collect

toto8 collects Personal Data across several categories. The table below summarizes what we collect, why, and under what circumstances:

Section 3

How We Collect Data

toto8 collects Personal Data through the following channels:

• Direct provision by you: When you register an account, complete your profile, upload KYC documents, make a deposit or withdrawal, contact support, or participate in promotional activities, you provide us with Personal Data directly.
• Automated technical collection: When you visit or interact with the Platform, our servers and analytics tools automatically log Technical Data and Usage Data. This includes standard web server logs, session cookies, and first-party analytics scripts.
• Third-party payment processors: When you transact through a payment channel such as BCA transfer, OVO, or GoPay, the relevant payment processor shares transaction confirmation data with toto8 to enable crediting and reconciliation of your account balance.
• Third-party game providers: Game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may share aggregated session and wagering data with toto8 for reporting, RTP auditing, and fraud-detection purposes.
• Fraud and risk management services: toto8 may receive risk scores, device fingerprints, and IP-reputation signals from integrated fraud-prevention services to protect the Platform and its players.
• Publicly available sources: In limited circumstances, toto8 may supplement identity data with information from publicly available databases for KYC and AML compliance purposes.

Section 4

Purpose of Processing

toto8 processes your Personal Data for the following purposes:

• Account creation and management: To register and maintain your toto8 account, authenticate logins, and provide access to Platform features.
• Payment processing: To facilitate deposits and withdrawals in IDR via local Indonesian payment channels, reconcile transactions, and maintain accurate financial records.
• Identity verification (KYC/AML): To verify that you meet the eligibility requirements (21 years of age or older, resident of Indonesia), to prevent underage gambling, and to fulfill anti-money-laundering obligations.
• Service delivery and improvement: To operate and maintain Platform functionality, diagnose technical issues, and continuously improve the product based on usage patterns.
• Responsible gaming: To monitor wagering behavior for signs of problem gambling, enforce self-imposed limits, and deliver responsible gaming interventions as appropriate.
• Customer support: To respond to inquiries, resolve disputes, and provide assistance through live chat and email channels.
• Fraud prevention and security: To detect, investigate, and prevent fraud, cheating, collusion, money laundering, and other prohibited conduct on the Platform.
• Legal and regulatory compliance: To comply with applicable laws, international gaming licensing requirements, and lawful requests from competent authorities.
• Marketing communications (with consent): Where you have opted in, to send you promotional offers, bonus notifications, and personalized game recommendations by email or in-app notification. You may withdraw marketing consent at any time via Account Settings.
• Analytics and business intelligence: To understand aggregate platform usage, game performance, and player engagement patterns for internal reporting purposes. Analytics are conducted on aggregated or pseudonymized data wherever possible.

Section 5

Legal Basis for Processing

toto8 processes Personal Data on the following legal grounds:

• Contractual necessity: Processing required to perform the contract between toto8 and the Player — including account management, payment processing, and service delivery — is based on contractual necessity.
• Legal obligation: Processing required to comply with applicable law, including KYC/AML obligations under international gaming licensing requirements, is based on legal obligation.
• Legitimate interests: Processing for fraud prevention, Platform security, and internal analytics is based on toto8's legitimate interests in operating a secure and commercially viable platform, balanced against the privacy interests of Players.
• Consent: Processing for direct marketing communications is based on your freely given, specific, and informed consent. You may withdraw this consent at any time without affecting the lawfulness of prior processing.

Section 6

Data Sharing & Disclosure

toto8 does not sell, rent, or trade your Personal Data to any third party for their own marketing purposes. We share Personal Data only in the following limited circumstances:

• Payment processors: Financial Data (account name, account number, transaction amount) is shared with the relevant payment provider (e.g., BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, LinkAja) solely to process your deposit or withdrawal transaction.
• Game providers: A pseudonymized player identifier and session data are shared with game studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft) to enable game functionality, calculate winnings, and conduct RTP audits.
• KYC and fraud service providers: Identity documents and risk signals may be shared with specialist KYC verification and fraud-detection vendors operating under strict data processing agreements with toto8.
• Legal and regulatory authorities: toto8 will disclose Personal Data to competent authorities, courts, or regulators where required by law, by a valid court order, or in response to a lawful government request. We will notify you of such disclosures unless legally prohibited from doing so.
• Professional advisors: Lawyers, auditors, and accountants engaged by toto8 may have access to Personal Data to the minimum extent necessary to provide professional services, and are bound by professional confidentiality obligations.
• Corporate transactions: In the event of a merger, acquisition, or sale of all or part of the toto8 business, Personal Data may be transferred to the successor entity, subject to equivalent privacy protections. Players will be notified of any such transfer in advance.

Section 7

Data Retention

toto8 retains Personal Data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

Upon expiry of the applicable retention period, toto8 will securely delete or anonymize your Personal Data. Anonymized data (from which you cannot be identified) may be retained indefinitely for aggregate statistical purposes.

Section 8

Data Security

toto8 implements industry-standard technical and organizational measures to protect your Personal Data against unauthorized access, accidental loss, destruction, or disclosure. Our security framework includes:

• SSL/TLS 256-bit encryption for all data transmitted between your device and toto8 servers.
• Bcrypt password hashing — passwords are never stored in plaintext and are irreversible in storage.
• Two-factor authentication (2FA) available to all account holders to protect against unauthorized login.
• Role-based access controls limiting visibility of Personal Data to authorized personnel whose job roles require access.
• Regular security audits conducted by independent third-party security specialists, including penetration testing of the Platform infrastructure.
• Encrypted database storage for all sensitive Personal Data at rest, including financial records and KYC documents.
• Intrusion detection and DDoS mitigation systems monitoring the Platform infrastructure in real time.

Section 9

Cookies & Tracking Technologies

toto8 uses cookies and similar tracking technologies on the Platform to deliver core functionality, improve performance, and — where you have consented — to serve relevant promotional content. The categories of cookies in use are as follows:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication tokens, load-balancing cookies, and security cookies. These cannot be disabled without preventing you from using the Platform.
• Functional cookies: Remember your preferences such as language settings, responsible gaming limit configurations, and notification preferences. Disabling these cookies may affect Platform usability.
• Analytics cookies: First-party analytics scripts that collect pseudonymized usage data (pages visited, session duration, game interaction patterns) to help toto8 understand how the Platform is used and where improvements can be made.
• Marketing cookies: Used only where you have consented to receive personalized promotional communications. These track your engagement with toto8 promotional content to deliver relevant bonus offers and game recommendations.

You may manage cookie preferences via your browser settings. Blocking strictly necessary cookies will prevent you from logging in to the Platform. For other cookie categories, you can opt out via the Account Settings page or by clearing cookies in your browser.

Section 10

Your Data Rights

As a toto8 player, you are entitled to exercise the following rights in relation to your Personal Data. All requests should be submitted to [email protected] with the subject line "Data Rights Request" and must include sufficient information to verify your identity before we can process your request.

• Right of access: You have the right to request a copy of the Personal Data toto8 holds about you, together with information about how it is used and shared.
• Right to rectification: You have the right to request correction of any inaccurate or incomplete Personal Data held by toto8.
• Right to erasure: You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and no other legal basis applies. Note that toto8 may be required to retain certain data under AML/KYC obligations even after an erasure request.
• Right to restriction: You may request that toto8 restricts processing of your Personal Data in certain circumstances, such as while a dispute regarding accuracy is resolved.
• Right to data portability: You may request a copy of your Personal Data in a structured, machine-readable format for transfer to another service provider, where technically feasible.
• Right to object: You may object to processing based on legitimate interests or for direct marketing purposes at any time. Where you object to direct marketing, toto8 will cease that processing immediately.
• Rights related to automated decision-making: Where toto8 makes automated decisions about your account (such as automated fraud flags or bonus-abuse detections) that produce significant effects, you have the right to request human review of that decision.

toto8 will respond to all valid data rights requests within 30 calendar days. In complex cases, this may be extended by a further 30 days, with notification provided to you of the extension and the reason for it.

Section 11

Minors & Age Restriction

toto8 strictly prohibits use of the Platform by any person under the age of 21. The Platform is intended exclusively for adults aged 21 and over. toto8 does not knowingly collect Personal Data from anyone under the age of 21.

As part of our age-verification process, all new accounts are required to complete KYC verification confirming date of birth via a KTP document before withdrawal functionality is enabled. Any account discovered to belong to a person under the age of 21 will be immediately suspended, and any deposited funds will be returned to the original payment source after mandatory verification.

Section 12

Third-Party Links & Services

The toto8 Platform may display references to third-party brands — such as game studios, payment providers, or sports organizations — for informational and functional purposes. This Privacy Policy applies solely to data processed by toto8 in connection with the Platform. toto8 is not responsible for the privacy practices of third-party entities whose services are integrated into or referenced by the Platform.

Players who interact directly with a third-party service (for example, by initiating a payment via their OVO or DANA application) should review that third party's own privacy policy to understand how their data is processed outside of the toto8 environment.

Section 13

Policy Amendments

toto8 may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or Platform features. When a material change is made, toto8 will notify registered Players by email to the address on file and/or by a prominent notice on the Platform, at least 7 days before the updated Policy takes effect.

The "Last updated" date at the top of this page will reflect the most recent revision. Continued use of the Platform after the effective date of a revised Policy constitutes acceptance of the updated terms. If you do not accept the revised Policy, you must cease using the Platform and may request account closure in accordance with the toto8 Terms & Conditions.

Section 14

Contact & Data Protection Officer

For any questions, concerns, or requests relating to this Privacy Policy or your Personal Data, please contact the toto8 Data Protection team through the following channels:

• Email (data privacy matters): [email protected] — use the subject line "Privacy Policy Enquiry" or "Data Rights Request" for priority routing.
• Live Chat: Available 24/7 directly from the toto8 Platform. Our Indonesian-speaking support team can assist with general privacy questions and escalate formal requests to the Data Protection team.

toto8 commits to acknowledging all privacy-related enquiries within 24 hours (WIB) and providing a substantive response within 30 calendar days of receipt of a valid, verified request.