to288a Privacy Policy

1. Introduction and Scope

to288a (referred to as "we", "us", "our", or "the Platform") is committed to protecting the privacy and personal data of every individual who accesses or uses our online betting services. This Privacy Policy (the "Policy") applies to all users of the to288a Platform, including visitors, registered members, and any person whose personal data is processed in connection with our services — regardless of whether they are located in Jakarta, Surabaya, Bandung, Medan, Yogyakarta, Bali, or elsewhere across the Indonesian archipelago.

This Policy covers data collected through the to288a website (to288a.cam), our mobile applications, live chat systems, email communications, and any other touchpoint through which we receive your personal information. It does not cover third-party websites or services linked from our Platform — you should review their respective privacy policies independently.

By creating an Account or otherwise using the to288a Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and use of your personal data as described herein. If you disagree with any part of this Policy, you must cease use of the Platform immediately.

2. Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings assigned below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, date of birth, national identification number, residential address, email address, phone number, financial records, and device identifiers.
• "Processing" means any operation performed on personal data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" means the entity that determines the purposes and means of processing personal data — in this case, the operator of to288a.
• "Data Processor" means any third party that processes personal data on behalf of to288a, under written agreement and our documented instructions.
• "KYC Data" means identity and verification documents submitted by the User, including National ID (KTP Nasional), proof of address, and selfie verification materials.
• "Transactional Data" means records of deposits, withdrawals, wagers, bonuses, and all financial activity conducted through your Account, denominated in Indonesian Rupiah (IDR / Rp).
• "Cookies" means small text files stored on your device by the Platform to maintain session state, preferences, and analytical data.

3. Data We Collect

3.1 Data You Provide Directly

When you register an Account, complete KYC verification, or interact with the Platform, you provide us with the following categories of personal data:

• Registration data: Full legal name, date of birth, email address, mobile phone number, and chosen username.
• KYC documents: Indonesian National ID Card (KTP Nasional) or passport, proof of residential address (bank statement from BCA, BRI, BNI, Mandiri, or equivalent; utility bill; official government letter), and selfie verification photographs.
• Financial data: Bank account numbers (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OCBC NISP), e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja), deposit and withdrawal amounts, and transaction histories.
• Communication data: Messages, queries, and complaints submitted via live chat, email, or any other customer support channel.

3.2 Data Collected Automatically

When you access the Platform, certain technical data is collected automatically by our systems:

• Device & access data: IP address, device type, operating system, browser type and version, screen resolution, and preferred language settings.
• Usage data: Pages visited, games played, bets placed (including togel lottery draws, sabung ayam cockfighting markets, football betting, and live casino sessions), session duration, click-path data, and in-app navigation events.
• Location data: Approximate geolocation derived from IP address (country, province, city). We do not collect precise GPS coordinates unless you expressly consent via your device settings.
• Cookies and tracking technologies: Session cookies, persistent cookies, and similar tracking mechanisms. See Section 7 for full details.

3.3 Data from Third Parties

We may receive personal data about you from third parties in limited circumstances, including: payment processors and banking partners (for deposit and withdrawal verification), fraud detection services (for AML and KYC screening), and publicly available government databases (for sanctions and politically exposed persons screening). Any such data is handled in strict accordance with this Policy.

4. How We Use Your Data

to288a processes your personal data for the following specific purposes:

• Account management: Creating, maintaining, and securing your Account; processing logins; resetting credentials; and managing Account settings including deposit limits and self-exclusion tools.
• Identity verification (KYC): Confirming your age (21+ requirement strictly enforced), identity, and residential address to comply with anti-money-laundering (AML) obligations and prevent underage access.
• Payment processing: Facilitating deposits and withdrawals to and from your nominated Indonesian bank accounts (BCA, BRI, BNI, Mandiri, etc.) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja), denominated in Indonesian Rupiah (IDR / Rp).
• Service delivery: Providing access to all Platform services including football betting, live casino, togel (traditional lottery) draws, sabung ayam (cockfighting) live markets, slot games, and crash games.
• Customer support: Responding to queries, resolving disputes, and providing assistance in Bahasa Indonesia or English via live chat and email.
• Fraud prevention & security: Detecting, investigating, and preventing fraudulent transactions, bonus abuse, money laundering, and unauthorized Account access.
• Regulatory compliance: Meeting obligations under applicable international gaming licensing requirements, AML regulations, and sanctions screening programs.
• Platform improvement: Analyzing usage patterns to optimize game performance, identify technical issues, and develop new features based on aggregate (anonymized) behavioral data.
• Responsible gaming: Monitoring account activity for indicators of problem gambling and proactively offering intervention tools such as deposit limits and self-exclusion where appropriate.
• Marketing communications: Sending promotional offers, bonus notifications, and seasonal promotions (e.g., Idul Fitri, Ramadhan, Imlek, Indonesian Independence Day) — only to users who have provided consent and have not opted out.

5. Legal Basis for Processing

to288a processes personal data under the following legal bases, consistent with international data protection standards:

• Contractual necessity: Processing required to fulfil our obligations under the User Agreement — including Account management, payment processing, and service delivery.
• Legal obligation: Processing required to comply with applicable AML regulations, KYC requirements, gaming licensing conditions, and sanctions screening obligations.
• Legitimate interests: Processing for fraud prevention, platform security, service improvement, and responsible gaming monitoring — where these interests are not overridden by your privacy rights.
• Consent: Processing for optional purposes such as marketing communications, where you have given specific, informed, and freely revocable consent.

6. Data Sharing and Third Parties

to288a does not sell your personal data. We may share your data with the following categories of recipients, strictly for the purposes described in this Policy:

• Payment partners: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) — to process deposits and withdrawals.
• Identity verification services: Third-party KYC and AML screening providers — to verify your identity documents and screen against sanctions lists.
• Technology providers: Cloud hosting, data storage, cybersecurity, live chat, and analytics vendors who process data as Data Processors under written data processing agreements.
• Game providers: Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Pocket Games Soft (PG Soft), Spribe, and other studios — limited game session data (player ID, stake, outcome) is shared to deliver game services.
• Regulatory and law enforcement authorities: When required by a lawful order, court order, or regulatory directive — we will notify you of any such disclosure to the extent legally permitted.
• Group companies: Affiliated entities within the to288a corporate group, strictly for the operational purposes described in this Policy.

All third-party Data Processors are contractually bound to process your data only on our documented instructions, to implement appropriate technical and organizational security measures, and to comply with applicable data protection law.

7. Cookies and Tracking Technologies

to288a uses cookies and similar tracking technologies to operate the Platform, remember your preferences, and analyze usage patterns. The following categories of cookies are in use:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication tokens, load-balancing cookies, and CSRF protection tokens. They cannot be disabled without significantly impairing your ability to use the Platform.
• Preference cookies: Store your settings such as preferred language, display preferences, and responsible gaming configuration (e.g., deposit limits, session time reminders).
• Analytics cookies: Collect aggregate, anonymized data about how users navigate the Platform — which pages are visited most, how l ong sessions last, and which games generate the most engagement. This data helps us improve the Platform and fix technical issues. Analytics cookies do not identify you personally.
• Fraud prevention cookies: Detect and prevent fraudulent activity, bonus abuse, and unauthorized access. These cookies fingerprint device characteristics to identify suspicious patterns across multiple sessions or Accounts.

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will impair Platform functionality. Disabling preference or analytics cookies will not prevent you from using the Platform but may result in a less personalized experience.

8. Data Retention

to288a retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligations. As a general guide:

• Account and KYC data is retained for the full duration of your Account's active life plus a minimum of 7 years after Account closure, in accordance with standard AML record-keeping requirements.
• Transactional data (deposits, withdrawals, wager history) is retained for a minimum of 7 years from the date of each transaction.
• Customer support communications are retained for 3 years from the date of the last interaction on a given support thread.
• Server and access logs (IP addresses, session data) are retained for up to 24 months, after which they are securely anonymized or deleted.
• Marketing consent records are retained for the duration of your active consent and for 2 years after you withdraw consent, to evidence compliance.

Where data is no longer required, it is securely deleted or anonymized so that it can no longer be associated with any identifiable individual. Anonymized aggregate data may be retained indefinitely for statistical and business analysis purposes.

9. Data Security

to288a takes the security of your personal data seriously and implements a multi-layered technical and organizational security framework:

• 256-bit SSL/TLS encryption: All data transmitted between your device and the to288a Platform is encrypted in transit using industry-standard TLS 1.2 or higher.
• Encryption at rest: Sensitive personal data — including KYC documents, financial records, and authentication credentials — is encrypted at rest using AES-256 encryption on our cloud infrastructure.
• Access controls: Internal access to personal data is restricted to authorized personnel on a strict need-to-know basis. All access is logged and subject to regular audit review.
• Two-factor authentication (2FA): to288a supports two-factor authentication for all user Accounts. We strongly recommend enabling 2FA to protect your Account from unauthorized access.
• Penetration testing: Our infrastructure undergoes regular third-party penetration testing and vulnerability assessments to identify and remediate security weaknesses before they can be exploited.
• Incident response: In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected users and relevant authorities within the timeframes prescribed by applicable law, and no later than 72 hours of becoming aware of the breach.

While we implement robust security measures, no system is completely immune to risk. You are responsible for maintaining the confidentiality of your Account credentials and for notifying us immediately at [email protected] if you suspect any unauthorized access to your Account.

10. Your Rights

Depending on your jurisdiction and applicable data protection law, you may hold the following rights with respect to your personal data held by to288a:

• Right of access: You have the right to request a copy of the personal data we hold about you, along with information about how it is being processed.
• Right to rectification: You have the right to request correction of any inaccurate or incomplete personal data. Minor corrections (such as email address or phone number updates) can be made directly via your Account settings.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, or where you withdraw consent. Note that we may be required by law to retain certain data (particularly KYC and transactional records) for a minimum period irrespective of your erasure request.
• Right to restrict processing: You may request that we temporarily halt processing of your data while a dispute about its accuracy or our legal basis for processing is resolved.
• Right to data portability: Where processing is based on consent or contractual necessity, you may request your personal data in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object to processing based on legitimate interests (including profiling for responsible gaming monitoring) and to processing for direct marketing purposes.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. To opt out of marketing communications, use the unsubscribe link in any promotional email or contact our support team.

To exercise any of the rights above, please contact our Data Protection Officer (DPO) at [email protected] with the subject line DATA RIGHTS REQUEST. We will respond within 30 calendar days. We may need to verify your identity before processing your request to prevent unauthorized disclosure.

11. Children's Privacy

The to288a Platform is strictly intended for adults aged 21 and over. We do not knowingly collect personal data from individuals below the age of 21. If we become aware that personal data has been submitted by or on behalf of a person under 21, we will immediately close the associated Account, void all wagers, and securely delete the data in question.

If you are a parent or guardian and believe that your child has registered an Account with to288a, please contact us immediately at [email protected]. We will investigate and take appropriate action within 48 hours of receiving your notification.

12. Changes to This Policy

to288a reserves the right to update or revise this Privacy Policy at any time. When material changes are made, we will notify registered users by email or via an in-Platform notification at least 14 days before the changes take effect. The updated Policy will be published on this page with a revised "Last Updated" date.

Your continued use of the Platform after the effective date of any revised Policy constitutes your acceptance of the changes. If you do not agree with a revised Policy, you must stop using the Platform and may request Account closure by contacting our support team.

13. Contact and Data Protection Officer

If you have any questions, concerns, or complaints regarding this Privacy Policy or our data processing practices, you are welcome to contact us through the following channels:

• Email (DPO inquiries): [email protected] — subject line: PRIVACY INQUIRY
• Live Chat: Available 24/7 on the Platform in Bahasa Indonesia and English (WIB, UTC+7)
• Response Time: Email inquiries — within 30 days. Live chat — within 60 seconds.

We are committed to resolving all privacy-related complaints promptly and fairly. If you are not satisfied with our response, you may have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction.