2toto Privacy Policy

1.1 The operator of the 2toto platform, accessible at 2toto.bio, acts as the data controller for all personal information collected from Members and visitors. In this Privacy Policy, "2toto", "we", "us", and "our" refer to this operating entity and any affiliates or subsidiaries involved in delivering the Services described on the platform.

1.2 2toto operates as an international online gaming platform primarily serving players in Indonesia. All personal data processed in connection with the Services is handled in accordance with internationally recognised data protection principles, including purpose limitation, data minimisation, storage limitation, integrity, and confidentiality.

1.3 If you have any questions regarding how 2toto handles your personal data, or if you wish to exercise any of the rights described in Clause 10, you may contact our Data Protection team using the contact details provided in Clause 14.

2.1 2toto collects personal data that falls into several distinct categories. The table below summarises the categories of data we collect, provides examples of the specific data points within each category, and indicates the primary purpose for which each category is collected.

2.2 We do not collect special category personal data (commonly referred to as sensitive personal data) such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, or biometric data for the purpose of uniquely identifying you, unless you voluntarily disclose such information in the course of a customer support interaction. Any such disclosures are treated with the highest degree of confidentiality and used solely for the purpose for which they were shared.

3.1 Direct Collection. The majority of personal data 2toto holds about you is provided directly by you in the following circumstances:

• When you complete the account registration form on 2toto, providing your name, date of birth, email address, and mobile number;
• When you submit KYC identity verification documents, including your Indonesian National Identity Card (KTP) or other supporting documentation;
• When you make a deposit or request a withdrawal, providing your bank account or e-wallet details;
• When you contact our customer support team via Live Chat or email, sharing information relevant to your enquiry;
• When you respond to surveys, promotional competitions, or seasonal campaigns on the platform.

3.2 Automated Collection. As you interact with the 2toto platform, we automatically collect Technical Data and Usage Data through cookies, server logs, and similar technologies. This automated collection occurs each time you visit the website or use the mobile interface, and is essential to the delivery of a secure, personalised gaming experience. Full details of the technologies used are provided in Clause 9.

3.3 Third-Party Sources. In certain circumstances, 2toto may receive personal data about you from third parties, including:

• Identity verification partners who perform automated checks of KTP documents against public databases to confirm authenticity;
• Payment processors and banking partners (including BCA, BRI, BNI, Mandiri, CIMB Niaga, and e-wallet providers) who share transaction confirmation data necessary to credit your account;
• Fraud prevention and anti-money-laundering (AML) screening services that flag known high-risk identifiers against watchlists maintained by international regulatory bodies.

4.1 2toto processes your personal data on the following legal bases, depending on the specific processing activity involved:

• Contractual Necessity: Processing that is required to fulfil our obligations under the Terms & Conditions you accepted upon registration — including account creation, deposits, withdrawals, bet settlement, and customer support.
• Legal Obligation: Processing required to comply with applicable legal and regulatory obligations, including KYC identity verification, anti-money-laundering (AML) record-keeping, and fraud prevention reporting.
• Legitimate Interests: Processing conducted on the basis of 2toto's legitimate interests in operating a secure platform, detecting and preventing fraud, improving the quality and performance of the Services, and communicating service updates — provided those interests are not overridden by your rights and interests.
• Consent: Processing for which we have obtained your explicit consent, including sending promotional marketing emails and SMS messages about bonuses, new games, and seasonal offers. You may withdraw your consent to marketing communications at any time by contacting our support team.

5.1 2toto uses the personal data it collects for the following purposes, in each case on the appropriate legal basis identified in Clause 4:

• Account Management: Creating and maintaining your 2toto Account, processing login authentication, and enabling you to access the full range of Services including sportsbook, live casino, slot games, and togel.
• Transaction Processing: Executing deposit and withdrawal requests via your chosen Indonesian payment method (bank transfer or e-wallet), verifying payment ownership, and maintaining accurate financial records.
• Identity Verification (KYC): Confirming that you are at least 21 years of age, that your identity is genuine, and that you are not a prohibited person under applicable anti-money-laundering or sanctions regulations.
• Responsible Gaming: Monitoring betting activity for patterns consistent with problem gambling and, where appropriate, proactively reaching out to offer self-exclusion tools, deposit limits, or referral to support resources.
• Fraud Prevention and Security: Detecting, investigating, and preventing fraudulent transactions, bonus abuse, account takeover attempts, and other security incidents.
• Platform Improvement: Analysing aggregated and anonymised usage data to improve platform performance, game selection, user interface design, and the localisation of the experience for Indonesian players.
• Marketing Communications: Sending you information about promotions, bonuses, new game releases, and seasonal offers relevant to the Indonesian market — including events tied to Idul Fitri, Ramadhan, and Indonesian Independence Day — where you have consented to receive such communications.
• Legal Compliance: Maintaining records required under applicable laws and regulations, and responding to lawful requests from competent authorities.

6.1 2toto does not sell your personal data to third parties for their independent marketing or commercial purposes. We share your data only in the limited circumstances described below, and always under contractual or legal obligations that require the recipient to maintain appropriate data protection standards.

Authorised Third-Party Recipients

• Payment Processors and Banking Partners: We share the financial data necessary to process your transactions with BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, and LinkAja. This sharing is limited to the minimum data required to execute each specific transaction.
• KYC and Identity Verification Providers: We share identity documentation with our KYC verification partner to confirm the authenticity of your Indonesian National Identity Card (KTP) and assess eligibility.
• Game Content Providers: When you play games from studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or PG Soft, the relevant studio may receive a session token and anonymised player identifier necessary to deliver the game. These providers do not receive your name, banking details, or contact information.
• Fraud Prevention and AML Services: We share relevant transaction and identity data with specialist screening services to identify and prevent money laundering, terrorist financing, and other financial crimes.
• IT and Infrastructure Providers: Cloud hosting, data storage, cybersecurity, and platform maintenance providers who process data on our behalf under strict data processing agreements.
• Legal and Regulatory Authorities: Where required by a valid legal order, court judgment, or request from a competent law enforcement authority, we may disclose personal data. We will notify you of such a request where legally permitted to do so.

7.1 2toto retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, as described in this Privacy Policy, or to comply with applicable legal, regulatory, or contractual retention obligations.

7.2 The following retention periods apply to the principal categories of data we hold:

• Account and Identity Data: Retained for the duration of your active membership plus a minimum of five (5) years following account closure, to meet AML record-keeping obligations.
• Transaction and Financial Records: Retained for a minimum of five (5) years from the date of each transaction, in accordance with standard financial record-keeping requirements.
• Customer Support Communications: Retained for two (2) years from the date of the interaction, unless the communication forms part of an open or unresolved dispute.
• Technical and Usage Data: Retained in identifiable form for up to twelve (12) months, after which it is anonymised and may be retained indefinitely for aggregate analytics purposes.
• Marketing Consent Records: Retained for as long as you remain subscribed to marketing communications, plus a period of two (2) years following unsubscription to demonstrate the history of your consent.

7.3 When personal data reaches the end of its applicable retention period, it is securely and irreversibly deleted or anonymised. 2toto conducts periodic data audits to ensure compliance with these retention schedules.

8.1 2toto implements a layered, defence-in-depth approach to data security, combining technical, procedural, and organisational controls to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Our primary security measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the 2toto platform is encrypted in transit using industry-standard TLS 1.2 or higher protocols.
• Credential Hashing: Account passwords are never stored in plain text. All credentials are processed using a one-way cryptographic hashing algorithm with a unique per-account salt, ensuring that even internal staff cannot retrieve your password.
• Access Controls: Internal access to personal data is governed by a strict need-to-know policy. Staff members are granted only the minimum level of data access required to perform their job functions. All internal data access is logged and audited.
• Two-Factor Authentication (2FA): 2toto supports optional two-factor authentication for Member accounts and mandates 2FA for all internal staff accessing production systems or customer data.
• Penetration Testing: The 2toto platform undergoes regular independent security assessments and penetration tests to identify and remediate vulnerabilities before they can be exploited.
• Incident Response Plan: 2toto maintains a documented data breach response plan. In the event of a security incident affecting your personal data, we will notify affected Members and relevant authorities within the timeframes required by applicable law.

8.2 While 2toto takes all reasonable technical measures to protect your data, no security system is entirely impenetrable. You are responsible for maintaining the security of your own Account by using a strong, unique password, enabling two-factor authentication, and ensuring that you log out of your Account when using shared or public devices.

9.1 2toto uses cookies and similar tracking technologies (including web beacons and session tokens) to operate and improve the platform. The cookies used on 2toto fall into the following categories:

9.2 You can control the use of non-essential cookies through your browser settings. Instructions for managing cookies are available in the help documentation of all major browsers. Please note that disabling certain cookie categories may reduce the functionality of the 2toto platform or require you to re-enter preferences on each visit.

10.1 As a data subject whose personal information is processed by 2toto, you hold the following rights in relation to your personal data. To exercise any of these rights, please contact our Data Protection team using the details in Clause 14. We will respond to all valid requests within thirty (30) calendar days.

• Right of Access: You may request a copy of all personal data that 2toto holds about you, along with information on how it is used, where it came from, and with whom it has been shared.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you may request that it be corrected. For identity data, corrections may require the re-submission of KYC documentation.
• Right to Erasure: You may request the deletion of personal data that is no longer necessary for the purpose for which it was collected, where we are not required to retain it to comply with a legal obligation. Note that transaction records and identity data held for AML compliance purposes cannot be deleted prior to the expiry of the retention period specified in Clause 7.
• Right to Restrict Processing: You may request that we restrict the processing of your personal data in certain circumstances, for example while you dispute the accuracy of the data or object to our use of it.
• Right to Data Portability: Where processing is based on your consent or on a contract, and is carried out by automated means, you may request a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You may object at any time to the processing of your personal data for direct marketing purposes. You may also object to processing based on legitimate interests, though in that case we will assess whether our interests are overridden by your particular circumstances.
• Right to Withdraw Consent: Where we rely on your consent to process personal data (primarily for marketing communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing.

11.1 The 2toto platform is strictly intended for adults aged 21 years and over. We do not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory step of the KYC process described in our Terms & Conditions, and any account found to belong to a person under 21 will be immediately suspended, with all balances held pending investigation.

11.2 If a parent or legal guardian believes that a minor has registered an account on 2toto or has provided personal data to the platform, they should contact our support team immediately via Live Chat or at the email address listed in Clause 14. We will promptly investigate the report and, if confirmed, delete the minor's data and close the account.

11.3 We encourage account holders who share devices or households with minors to make use of reputable parental control software and to ensure that their 2toto Account is logged out and inaccessible whenever the device is not under their direct personal supervision.

12.1 The 2toto platform may display content or games provided by third-party studios, including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and PG Soft. While these studios deliver their content within the 2toto interface, they operate under their own privacy and data handling policies. 2toto is not responsible for the data practices of third-party content providers beyond the contractual obligations described in Clause 6.

12.2 2toto does not display third-party advertising or link to external websites for the purpose of driving traffic to third parties. All navigation links on the platform remain within the 2toto ecosystem. Where a third-party link is unavoidably present (for example, in a responsible gaming resource), 2toto provides no warranty regarding the privacy practices of the linked site and recommends that you review the relevant site's own privacy policy.

13.1 2toto reviews this Privacy Policy at least annually and may update it at any time to reflect changes in our data processing activities, applicable law, or best practices. The date of the most recent revision is displayed at the top of this document.

13.2 When we make material changes to this Privacy Policy — changes that affect your rights or the way we use your data in a significant way — we will notify all registered Members by email at their registered address and display a notice on the 2toto platform prior to the effective date of the changes. Non-material changes (such as typographic corrections or clarifications that do not alter the substance of any clause) may be made without advance notice.

13.3 Your continued use of the 2toto platform following the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with any changes, you may request Account closure in accordance with Clause 3.4 of the Terms & Conditions.

If you wish to exercise any of the rights described in Clause 10, have a question about this Privacy Policy, or wish to raise a concern about how 2toto has handled your personal data, please reach out to our Data Protection team through any of the following channels:

• Live Chat: Available 24/7 directly on the 2toto platform. Identify your enquiry as a "Privacy / Data Request" so it is routed to the correct team immediately.
• Email: [email protected] (plain text — not a link). Please use the subject line "Privacy Policy Enquiry" and include your registered email address. We aim to respond within 5 business days and will complete all valid data subject requests within 30 calendar days.
• WhatsApp: +62 812 3456 7890 (plain text — not a link). Available 08:00–22:00 WIB, Monday to Saturday.

We take all privacy enquiries seriously. If you are not satisfied with our response to your request, you have the right to escalate your complaint to the appropriate data protection authority in your jurisdiction.