Privacy Policy

1. Definitions

For clarity throughout this Privacy Policy, the following terms are defined as follows:

• "Personal Data" means any information that identifies or can reasonably be used to identify a natural person, directly or indirectly, including name, identification number, location data, or online identifiers.
• "Processing" means any operation or set of operations performed on Personal Data, including collection, recording, storage, adaptation, retrieval, consultation, use, disclosure, erasure, or destruction.
• "Data Controller" means 12toto, the entity that determines the purposes and means of processing your Personal Data.
• "Data Processor" means any third-party service provider that processes Personal Data on behalf of 12toto under a written data-processing agreement.
• "User," "you," or "your" refers to any individual who accesses, registers for, or uses the 12toto platform.
• "Platform" means the 12toto website, mobile-optimized interface, and all associated services accessible at https://12toto.cam.

2. Information We Collect

12toto collects Personal Data that is necessary to provide you with a safe, secure, and compliant online gambling experience. The categories of data we collect include:

2.1 Registration and Identity Data

When you create a 12toto account, we collect your full legal name, date of birth, gender, Indonesian National ID number (from your KTP or passport), email address, mobile phone number, and residential address. This information is essential for account creation, age verification (you must be 21 or older), and anti-money-laundering (AML) compliance.

2.2 Financial and Transaction Data

To process deposits and withdrawals via Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja), we collect your bank account details, e-wallet account identifiers, transaction history, deposit and withdrawal amounts in Indonesian Rupiah (IDR), and payment reference numbers. We do not store full credit or debit card numbers on our servers.

2.3 KYC Verification Documents

As part of our Know Your Customer (KYC) obligations under international gaming regulations, we collect scanned copies or photographs of government-issued identity documents, proof-of-address documents, and selfie photographs used to confirm that documents belong to the account holder.

2.4 Betting and Gaming Activity Data

We record your betting history, game session logs, wager amounts, wins and losses, bonus usage, and platform interactions. This data is used for account management, dispute resolution, responsible gaming monitoring, and improving our product.

2.5 Technical and Device Data

When you access the platform, we automatically collect your IP address, browser type and version, device type, operating system, screen resolution, referring URL, pages visited, time spent on each page, and clickstream data. This technical data helps us maintain platform security, detect fraud, and optimize the user experience for Indonesian mobile users.

2.6 Customer Support Communications

If you contact our support team via live chat, email, or WhatsApp, we retain records of those communications, including timestamps, issue descriptions, and resolution outcomes. These records allow us to provide consistent support and improve our service quality.

3. How We Collect Your Data

12toto collects Personal Data through the following channels:

• Direct provision: Data you provide when registering, completing KYC, making deposits or withdrawals, placing bets, claiming bonuses, or contacting support.
• Automated collection: Technical data gathered automatically through cookies, log files, pixel tags, and similar tracking technologies as described in Section 7.
• Third-party sources: Identity verification and fraud prevention data from authorized third-party KYC service providers, credit reference agencies, and publicly available databases.
• Payment processors: Transaction confirmation data from your bank or e-wallet provider necessary to reconcile deposits and withdrawals.

4. How We Use Your Personal Data

12toto uses your Personal Data strictly for the purposes described below. We do not sell your data to third parties for marketing purposes.

• Account management: Creating, maintaining, verifying, and securing your account; processing login authentication; and managing account preferences.
• Payment processing: Facilitating deposits and withdrawals in Indonesian Rupiah via local banks and e-wallets; reconciling transactions; and detecting and preventing payment fraud.
• Regulatory compliance: Fulfilling KYC, AML, and counter-terrorism financing (CTF) obligations under international gaming regulations and applicable Indonesian law.
• Responsible gaming: Monitoring betting patterns to identify problem gambling indicators; enforcing deposit and loss limits you have set; and managing self-exclusion requests.
• Personalization: Tailoring game recommendations, bonus offers, and promotional content to your interests and betting history.
• Customer support: Responding to inquiries, resolving disputes, providing account assistance, and improving our support processes.
• Security and fraud prevention: Detecting and preventing unauthorized account access, fraudulent transactions, bonus abuse, and other violations of our Terms & Conditions.
• Platform improvement: Analyzing usage data to improve functionality, fix bugs, optimize performance, and develop new features relevant to Indonesian users.
• Legal obligations: Retaining records as required by law and responding to lawful requests from regulatory authorities or law enforcement agencies.

5. Legal Basis for Processing

12toto processes your Personal Data on one or more of the following legal bases:

• Contractual necessity: Processing is necessary to perform the contract between you and 12toto — specifically, to operate your account, process bets, and handle deposits and withdrawals.
• Legal obligation: Processing is required for compliance with international gaming regulations, KYC requirements, AML obligations, and applicable Indonesian laws.
• Legitimate interests: Processing is necessary for our legitimate business interests, including fraud prevention, platform security, and service improvement, provided those interests are not overridden by your rights and freedoms.
• Consent: Where required by law, we will obtain your explicit consent before processing your data for specific purposes such as direct marketing communications. You may withdraw consent at any time.

6. Data Sharing and Disclosure

12toto does not sell, rent, or trade your Personal Data to third parties for their own marketing purposes. We may share your data only in the following circumstances and only to the extent necessary:

6.1 Service Providers and Data Processors

We engage carefully vetted third-party service providers who process data on our behalf under strict contractual obligations. These include payment gateway operators for BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja integrations; KYC and identity verification providers; fraud detection and cybersecurity firms; cloud hosting and data center operators; and customer support software vendors. All processors are bound by data-processing agreements that prohibit them from using your data for any purpose beyond the specific service they provide to 12toto.

6.2 Game and Software Providers

To deliver games from providers such as Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft, we transmit limited technical session data (such as a pseudonymous session token and your account balance) to the relevant provider's servers. Game providers do not receive your full identity documents or financial account details.

6.3 Regulatory and Law Enforcement Authorities

We may disclose your Personal Data to competent regulatory authorities, law enforcement agencies, or other government bodies when required to do so by law, court order, or other binding legal process. Where permitted, we will notify you of such a disclosure request before complying.

6.4 Business Transfers

In the event that 12toto undergoes a merger, acquisition, restructuring, or sale of all or substantially all of its assets, your Personal Data may be transferred to the acquiring entity as part of that transaction. We will notify you of any such change and the successor entity will be required to honor the commitments made in this Privacy Policy.

6.5 Protection of Rights

We may disclose your data when we believe in good faith that disclosure is necessary to protect the rights, property, or safety of 12toto, our users, or the public — including exchanging information with fraud prevention organizations and other online gambling operators to reduce risk.

7. Cookies and Tracking Technologies

12toto uses cookies and similar tracking technologies to operate the platform, remember your preferences, and analyze usage patterns. The categories of cookies we use are described below.

7.1 Strictly Necessary Cookies

These cookies are essential for the platform to function. They manage your login session, maintain your account authentication state, enable secure transactions, and preserve your language and currency preferences. Because they are strictly necessary, they cannot be disabled without impairing your ability to use the platform.

7.2 Performance and Analytics Cookies

We use analytics cookies to collect aggregated, anonymized data about how users interact with the platform — which pages are visited most frequently, how long sessions last, and where users encounter errors. This information helps us improve platform performance and the overall user experience for Indonesian players accessing 12toto from mobile devices.

7.3 Functionality Cookies

Functionality cookies remember choices you have made on the platform, such as your preferred deposit method (e.g., BCA transfer, OVO, or GoPay), game display settings, and responsible gaming limit configurations. These cookies enhance convenience but are not strictly essential to core functions.

7.4 Security Cookies

Security cookies support our fraud detection and account-integrity systems. They record device fingerprint signals and unusual access patterns that may indicate unauthorized login attempts or automated bot activity. These cookies are essential to keeping your account and funds safe.

7.5 Managing Cookies

Most web browsers allow you to control cookie behavior through the browser's settings menu. You can block or delete cookies at any time; however, doing so may affect your ability to use certain features of the 12toto platform, including staying logged in between sessions. Consult your browser's help documentation for instructions specific to your browser.

8. Data Security

12toto implements a comprehensive set of technical and organizational security measures designed to protect your Personal Data against unauthorized access, accidental loss, alteration, or disclosure. Key measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and our servers — the same standard used by major Indonesian banks such as BCA and BNI.
• Encryption at rest for all sensitive Personal Data stored in our databases, including identity documents and financial records.
• Role-based access controls ensuring that only authorized personnel whose job function requires it can access Personal Data, with all access activity logged and audited.
• Multi-factor authentication required for all internal administrative systems that handle user data.
• Regular penetration testing and independent security audits conducted by certified third-party cybersecurity firms to identify and remediate vulnerabilities.
• Incident response procedures that include breach notification protocols; in the event of a data breach affecting your rights and freedoms, we will notify you without undue delay.

While we take every reasonable precaution, no method of transmission over the internet is completely secure. You also bear responsibility for keeping your account credentials confidential and notifying us immediately if you suspect unauthorized access to your account.

9. Data Retention

We retain your Personal Data only for as long as necessary to fulfill the purposes described in this Privacy Policy or as required by law. Specific retention periods are:

• Account and identity data: Retained for the duration of your account plus a minimum of five (5) years following account closure, as required by international AML and gaming regulatory standards.
• Transaction and betting records: Retained for a minimum of five (5) years from the date of each transaction to satisfy financial recordkeeping obligations.
• KYC documents: Retained for five (5) years after account closure or the end of the business relationship, whichever is later.
• Customer support communications: Retained for two (2) years from the date of each interaction, unless the communication relates to a dispute that remains unresolved, in which case it is retained until resolution plus one (1) year.
• Technical and log data: Retained for twelve (12) months from collection, after which it is anonymized or deleted.

Once the applicable retention period has expired and there is no longer a legal or regulatory obligation to retain your data, we will securely delete or anonymize it in accordance with our data destruction procedures.

10. Your Data Protection Rights

Subject to applicable law, you have the following rights with respect to your Personal Data held by 12toto. To exercise any of these rights, please contact our Data Protection team at the email address provided in Section 14.

• Right of Access: You have the right to request a copy of the Personal Data we hold about you and information on how it is processed. We will respond within 30 days of a verified request.
• Right to Rectification: You have the right to request correction of inaccurate or incomplete Personal Data. You may update basic account details directly through your account settings; for identity document corrections, contact support.
• Right to Erasure: In certain circumstances, you have the right to request deletion of your Personal Data. Note that this right is subject to our legal obligations — we are required to retain certain data for regulatory compliance purposes even after account closure.
• Right to Restriction of Processing: You may request that we restrict processing of your data in specific situations, such as when you contest the accuracy of data we hold.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity, you may request that we provide your Personal Data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing of your Personal Data where we rely on legitimate interests as our legal basis, unless we demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

11. Minors and Age Restriction

The 12toto platform is strictly intended for adults aged 21 years or older. We do not knowingly collect Personal Data from individuals under the age of 21. If you are a parent or guardian and believe that a minor has provided us with Personal Data or created an account without your consent, please contact us immediately at the address in Section 14. We will take prompt steps to delete the data and close the account. Any funds deposited by a confirmed minor will be returned through the original deposit channel after identity verification.

As part of our commitment to preventing underage gambling, 12toto uses automated age verification checks at registration and reserves the right to request additional proof-of-age documentation at any time. Accounts that cannot confirm eligibility will be suspended pending verification.

12. International Data Transfers

12toto operates internationally and may transfer your Personal Data to servers and service providers located outside of Indonesia. Where such transfers occur, we ensure that appropriate safeguards are in place to protect your data to a standard at least equivalent to the protections provided under this Privacy Policy. Safeguards may include standard contractual clauses approved by competent authorities, data-processing agreements with certified processors, or transfers to jurisdictions that maintain adequate data-protection standards.

By using the 12toto platform, you consent to the transfer of your Personal Data to countries outside Indonesia for the purposes described in this Privacy Policy. If you have concerns about international data transfers, please contact us before using the platform.

13. Changes to This Privacy Policy

12toto reserves the right to update or amend this Privacy Policy at any time. When we make material changes, we will update the "Last Updated" date at the top of the page and, where the changes are significant, notify active users via the email address associated with their account. We encourage you to review this page periodically to stay informed about how we protect your data.

Continued use of the 12toto platform after a revised Privacy Policy has been posted constitutes your acceptance of the updated terms. If you do not accept the revised policy, you must discontinue using the platform and contact support to close your account and request data deletion where legally permitted.

14. Contact Us — Privacy Inquiries

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data, please contact our Data Protection team through the following channels:

• Email: [email protected]
• Live Chat: Available 24/7 through the platform interface
• Response Time: We aim to acknowledge all privacy-related requests within 48 hours and provide a substantive response within 30 calendar days.

When submitting a data access or erasure request, please include your registered email address and account username so we can locate your records efficiently. For security purposes, we may ask you to complete identity verification before acting on your request.