Privacy Policy

1. Information We Collect

20toto collects various types of personal information to provide, maintain, and improve our services. The information we collect falls into the following categories:

1.1 Account Registration Information

When you create a 20toto account, we collect:

• Full legal name as it appears on your government-issued identification
• Date of birth (to verify age eligibility of 21 years or older)
• Gender
• Residential address including city, province, and postal code
• Email address
• Mobile phone number
• Username and encrypted password
• Preferred currency (Indonesian Rupiah)

1.2 Identity Verification Documents

To comply with Know Your Customer (KYC) requirements and prevent fraud, we collect:

• Copy of Indonesian National Identity Card (KTP)
• Proof of address documents (utility bills, bank statements dated within 3 months)
• Selfie photograph holding identification document
• Additional verification documents as may be required for high-value transactions

1.3 Financial Information

When you make deposits or withdrawals, we collect:

• Bank account details (account number, bank name, account holder name)
• E-wallet information (account identifiers for OVO, DANA, GoPay)
• Transaction history and amounts
• Payment method preferences
• Note: We do not store full credit or debit card numbers. Payment processing is handled by secure third-party payment gateways.

1.4 Gaming Activity Data

We automatically collect information about your gaming activities, including:

• Games played and betting history
• Wagering amounts and patterns
• Winnings and losses
• Bonus claims and wagering requirements completion
• Session duration and frequency
• Responsible gaming limits and self-exclusion settings

1.5 Technical and Device Information

When you access 20toto, we automatically collect:

• IP address and approximate geographic location
• Device type, operating system, and browser information
• Screen resolution and device identifiers
• Referring website or source
• Pages visited and navigation patterns
• Date and time of access
• Error logs and performance data

1.6 Communications Data

When you contact our customer support team, we collect:

• Content of your messages and inquiries
• Support ticket history
• Live chat transcripts
• Email correspondence
• Phone call recordings (with your consent, for quality assurance)

2. How We Collect Information

20toto collects information through multiple channels:

2.1 Directly From You

We collect information that you voluntarily provide when you register for an account, complete your profile, upload verification documents, make deposits or withdrawals, contact customer support, participate in promotions, or adjust account settings.

2.2 Automatically Through Technology

We use cookies, web beacons, server logs, and similar technologies to automatically collect certain information when you visit our website or use our services. This includes your browsing behavior, device information, and usage patterns.

2.3 From Third Parties

We may receive information from payment processors (transaction confirmation and status), identity verification services (document validation results), fraud prevention services (risk assessment data), and analytics providers (aggregated usage statistics). We only work with reputable third parties who comply with data protection standards.

2.4 From Public Sources

In limited circumstances for fraud prevention or compliance purposes, we may supplement the information you provide with publicly available information or data from government databases to verify your identity or comply with legal obligations.

3. How We Use Your Information

20toto uses the personal information we collect for the following legitimate purposes:

3.1 Account Management and Service Delivery

• Creating and maintaining your gaming account
• Processing your deposits and withdrawals
• Enabling you to participate in games and place bets
• Tracking your gaming history and account balance
• Providing customer support and responding to inquiries
• Sending service-related communications (transaction confirmations, account notifications)

3.2 Verification and Compliance

• Verifying your identity, age, and residential address
• Complying with Know Your Customer (KYC) and Anti-Money Laundering (AML) regulations
• Preventing underage gambling (21+ age restriction enforcement)
• Detecting and preventing fraud, money laundering, and other illegal activities
• Responding to legal requests from government authorities or regulators

3.3 Security and Fraud Prevention

• Monitoring account activity for suspicious patterns
• Detecting multiple accounts or identity fraud
• Preventing bonus abuse and gaming rule violations
• Protecting against hacking, phishing, and cyber attacks
• Maintaining the integrity and fairness of our gaming platform

3.4 Service Improvement and Personalization

• Analyzing usage patterns to improve website functionality
• Personalizing your gaming experience based on preferences
• Recommending games or promotions that may interest you
• Testing new features and optimizing platform performance
• Conducting statistical analysis and market research

3.5 Marketing Communications (With Consent)

• Sending promotional emails about bonuses, special offers, and new games
• Providing information about VIP program benefits and tier upgrades
• Announcing tournaments, competitions, and special events
• Note: You can opt out of marketing communications at any time through your account settings or by clicking the unsubscribe link in emails.

3.6 Responsible Gaming Support

• Implementing deposit limits, session time limits, and loss limits you set
• Processing self-exclusion requests
• Monitoring for signs of problem gambling behavior
• Providing access to responsible gaming resources and support

4. Data Sharing and Disclosure

20toto does not sell, rent, or trade your personal information to third parties for their marketing purposes. However, we may share your information in the following limited circumstances:

4.1 Service Providers

We share information with trusted third-party service providers who assist us in operating our platform, including payment processors (to process deposits and withdrawals), identity verification services (to conduct KYC checks), cloud hosting providers (to store data securely), customer support platforms (to manage support tickets), and analytics providers (to analyze usage data). All service providers are bound by strict confidentiality agreements and are only permitted to use your data for specified purposes.

4.2 Game Providers

When you play games from third-party providers on our platform, limited information (username, bet amounts, game outcomes) may be shared with those providers to enable gameplay. Game providers are required to maintain their own privacy policies and security standards consistent with ours.

4.3 Legal and Regulatory Authorities

We may disclose your information to government authorities, law enforcement, regulators, or courts when required by law, when responding to legal processes (subpoenas, court orders, warrants), to comply with gambling licensing and regulatory requirements, to investigate suspected illegal activities or terms violations, to protect the rights, property, or safety of 20toto, our users, or the public, or to enforce our Terms and Conditions.

4.4 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your personal information may be transferred to the acquiring entity. You will be notified via email or prominent notice on our website of any change in ownership or control of your personal information.

4.5 With Your Consent

We may share your information with other third parties when you have provided explicit consent for such sharing. You can withdraw consent at any time by contacting our support team.

5. Data Security Measures

20toto implements comprehensive technical and organizational security measures to protect your personal information:

5.1 Technical Security

• Encryption: All data transmitted between your device and our servers is encrypted using SSL/TLS protocols (minimum 256-bit encryption).
• Secure Storage: Personal data is stored on secure servers located in protected data centers with restricted physical and digital access.
• Password Protection: Your password is encrypted using strong one-way hashing algorithms. We never store passwords in plain text.
• Firewall Protection: Network firewalls and intrusion detection systems monitor and block unauthorized access attempts.
• Regular Security Audits: We conduct periodic security assessments and penetration testing to identify and address vulnerabilities.

5.2 Organizational Security

• Access Controls: Personal data access is restricted to authorized employees who require it for their job functions.
• Employee Training: Staff members receive regular training on data protection, privacy, and security best practices.
• Confidentiality Agreements: All employees and contractors sign confidentiality agreements prohibiting unauthorized disclosure of user data.
• Incident Response: We maintain a data breach response plan to quickly address and mitigate any security incidents.

5.3 User Security Responsibilities

While we implement robust security measures, you also play a critical role in protecting your account. Please choose a strong, unique password, never share your login credentials, log out after each session on shared devices, keep your contact information up-to-date, be cautious of phishing attempts, and report any suspicious account activity immediately to [email protected].

6. Data Retention

20toto retains your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy and to comply with legal, regulatory, and business requirements.

6.1 Active Accounts

For active accounts, we retain your account information, transaction history, gaming records, and communications as long as your account remains open. This enables us to provide continuous service, maintain your gaming history, and comply with regulatory requirements.

6.2 Closed Accounts

After you close your account, we retain certain information for legal and regulatory compliance purposes. Indonesian gambling regulations and anti-money laundering laws require us to maintain transaction records, identity verification documents, and betting history for a minimum of five years following account closure. After the required retention period expires, personal data is securely deleted or anonymized.

6.3 Marketing Data

If you opt out of marketing communications, we will retain a record of your opt-out preference to ensure we do not contact you again for marketing purposes. This information is kept indefinitely to honor your request.

6.4 Backup Data

For disaster recovery purposes, we maintain backup copies of data which may be retained for up to 90 days. Backup data is subject to the same security protections as primary data storage.

7. Your Privacy Rights

Under Indonesian data protection laws and international privacy standards, you have the following rights regarding your personal information:

7.1 Right to Access

You have the right to request access to the personal information we hold about you. You can view most of your account information directly through your 20toto account dashboard. For additional information or a comprehensive data export, contact our support team.

7.2 Right to Rectification

If any personal information we hold about you is inaccurate, incomplete, or outdated, you have the right to request correction. You can update most information directly in your account settings, including your address, phone number, and email. For changes to your name or identification documents, contact our verification team.

7.3 Right to Erasure

You may request deletion of your personal data in certain circumstances. However, we may be legally required to retain certain information for regulatory compliance (transaction records, KYC documents) for five years following account closure. Data not subject to legal retention requirements will be deleted upon request.

7.4 Right to Restrict Processing

You may request that we restrict the processing of your personal information in specific situations, such as while we verify the accuracy of disputed data or while determining whether we have legitimate grounds for processing. During restriction periods, we will store your data but not actively process it except with your consent.

7.5 Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format. You may request a data export which will be provided in CSV or JSON format within 30 days of your request.

7.6 Right to Object

You have the right to object to processing of your personal data for direct marketing purposes at any time. You can unsubscribe from marketing emails using the link in any promotional message or by adjusting your communication preferences in your account settings.

7.7 Right to Withdraw Consent

Where we process your data based on consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing conducted before withdrawal.

7.8 Exercising Your Rights

To exercise any of these rights, please contact us via email at [email protected] with the subject line "Privacy Rights Request." Include your account username and specify which right you wish to exercise. We will respond to all requests within 30 days. Identity verification may be required to protect your information from unauthorized access.

8. Cookies and Tracking Technologies

20toto uses cookies and similar tracking technologies to enhance your experience, analyze usage patterns, and deliver personalized content.

8.1 What Are Cookies

Cookies are small text files stored on your device when you visit a website. They help websites remember your preferences, login status, and browsing behavior. 20toto uses both session cookies (which expire when you close your browser) and persistent cookies (which remain on your device for a set period).

8.2 Types of Cookies We Use

• Essential Cookies: Required for basic website functionality, including maintaining your login session, processing transactions, and remembering your preferences. These cookies cannot be disabled.
• Performance Cookies: Collect anonymous information about how visitors use our website, including which pages are visited most, how long users spend on pages, and any error messages encountered. This helps us improve website performance.
• Functionality Cookies: Remember your preferences such as language selection, username, and game filters to provide a more personalized experience.
• Analytics Cookies: Help us understand user behavior through aggregated statistics. We may use third-party analytics services like Google Analytics to analyze traffic patterns.

8.3 Managing Cookies

You can control cookie settings through your browser preferences. Most browsers allow you to block all cookies, accept only first-party cookies, or delete cookies after each session. Note that disabling certain cookies may limit your ability to use some features of our website. Disabling essential cookies will prevent you from logging in or placing bets.

8.4 Other Tracking Technologies

In addition to cookies, we may use web beacons (small invisible images embedded in emails or web pages), local storage (HTML5 storage for caching certain data), and device fingerprinting (collecting device characteristics for fraud prevention). These technologies help us deliver services, prevent fraud, and understand user engagement.

9. Third-Party Services

The 20toto platform integrates with various third-party services to provide payment processing, game content, customer support tools, and analytics. These third parties have their own privacy policies governing their data practices.

9.1 Payment Processors

We partner with licensed payment gateways to process deposits and withdrawals securely for Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) and e-wallets (OVO, DANA, GoPay). When you make a transaction, your payment details are transmitted directly to the payment processor using encrypted connections. 20toto does not store full bank account numbers or card details.

9.2 Game Providers

Games on our platform are supplied by independent game development studios. When you play these games, limited data (bets placed, game outcomes, session duration) is shared with the respective game provider to enable gameplay. Each game provider maintains their own privacy policy governing their use of this data.

9.3 Third-Party Links

Our website may contain links to third-party websites for responsible gaming resources, payment providers, or informational content. 20toto is not responsible for the privacy practices of external websites. We encourage you to review the privacy policies of any third-party sites you visit.

10. Children's Privacy

20toto's services are strictly for adults aged 21 years and older. We do not knowingly collect, use, or retain personal information from individuals under 21 years of age. Our registration process requires date of birth verification, and our KYC procedures include identity document checks to prevent underage access.

If we discover that we have inadvertently collected information from a person under 21 years of age, we will immediately delete that information from our systems and permanently close the associated account. Any deposits or winnings in underage accounts will be forfeited.

If you are a parent or guardian and believe your child has provided personal information to 20toto, please contact us immediately at [email protected] so we can take appropriate action.

11. International Data Transfers

20toto primarily serves Indonesian residents and operates within Indonesian jurisdiction. However, some of our service providers, such as cloud hosting services and payment processors, may be located outside Indonesia. When your personal information is transferred internationally, we ensure appropriate safeguards are in place.

We only transfer data to countries that provide adequate data protection standards or to companies that have implemented appropriate safeguards such as standard contractual clauses approved by Indonesian data protection authorities. All international transfers comply with applicable Indonesian data protection laws.

12. Changes to This Privacy Policy

20toto reserves the right to update, modify, or revise this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or business operations. The "Last Updated" date at the top of this policy indicates when the most recent changes were made.

Material changes to this Privacy Policy will be communicated to registered users via email to the address on file or through prominent notice on our website. Continued use of 20toto services following notice of changes constitutes acceptance of the updated Privacy Policy.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal information. You can always access the current version of this policy at https://20toto.cam/privacy-policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us through the following channels:

• Email: [email protected] (Subject: Privacy Inquiry)
• Live Chat: Available 24/7 through the 20toto website
• WhatsApp: Indonesian-speaking support during business hours (08:00-23:00 WIB)

For privacy rights requests (data access, correction, deletion, etc.), please include "Privacy Rights Request" in the subject line along with your account username and the specific right you wish to exercise. We will respond to all privacy inquiries within 30 days.

Thank you for trusting 20toto with your personal information. We are committed to maintaining your privacy and protecting your data at all times.