oltoto Privacy Policy

Last Updated: January 1, 2026
Effective Date: January 1, 2026

1. Introduction

oltoto International Gaming Ltd. (hereinafter "oltoto," "we," "us," or "our") is committed to protecting the privacy and security of your personal information. This Privacy Policy describes how we collect, use, disclose, store, and protect the personal data of users (hereinafter "you" or "your") who access or use the oltoto online gaming platform.

We recognize that trust is fundamental to the relationship between oltoto and our users. This Privacy Policy is designed to provide transparency regarding our data practices and to demonstrate our compliance with applicable data protection laws, including the General Data Protection Regulation (GDPR), the Indonesian Personal Data Protection Law, and international best practices.

By registering an account, accessing the oltoto website, or using any of our services, you acknowledge that you have read, understood, and agree to the terms of this Privacy Policy. If you have any questions or concerns about how we handle your personal data, please contact our Data Protection Officer using the contact details provided at the end of this document.

2. Data Controller

For the purposes of applicable data protection laws, the data controller responsible for your personal information is:

oltoto International Gaming Ltd.
Registered Address: Jakarta, Indonesia
Email: privacy@oltoto.cam
Data Protection Officer: dpo@oltoto.cam

As the data controller, oltoto determines the purposes and means of processing your personal data. We are responsible for ensuring that all data processing activities comply with applicable privacy laws and that your rights as a data subject are respected.

3. Information We Collect

oltoto collects several categories of personal information necessary to provide our gaming services, verify your identity, process transactions, and comply with legal obligations. The types of information we collect include:

3.1 Information You Provide Directly

• Account Registration Data: Full legal name, date of birth, email address, mobile phone number, residential address, nationality, and preferred currency (IDR).
• Identity Verification (KYC) Documents: Government-issued photo identification (Indonesian National ID Card (KTP), passport, or driver's license), proof of address (utility bills, bank statements), and selfie photographs for identity confirmation.
• Payment Information: Bank account details (account number, bank name, account holder name), e-wallet account identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja), and transaction history.
• Communication Records: Correspondence with our customer support team, including live chat transcripts, email exchanges, and phone call records.
• Optional Profile Information: Username, profile preferences, communication preferences, and responsible gaming settings (deposit limits, self-exclusion requests).

3.2 Information Collected Automatically

• Technical Data: IP address, device type, operating system, browser type and version, screen resolution, time zone setting, and geographic location (derived from IP address).
• Usage Data: Pages visited, time spent on pages, navigation paths, clickstream data, games played, bet history, deposit and withdrawal transactions, login times, and session duration.
• Cookies and Tracking Technologies: We use cookies, web beacons, pixels, and similar technologies to recognize your device, remember your preferences, analyze platform usage, and deliver personalized content. See Section 10 for detailed information on our cookie practices.

3.3 Information from Third Parties

• Payment Processors: Transaction confirmation data from banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI) and e-wallet providers to verify deposits and withdrawals.
• Identity Verification Services: Third-party KYC and anti-fraud service providers may supply additional verification data to confirm your identity and detect fraudulent activity.
• Game Providers: Game play data, RTP statistics, and session information from third-party software suppliers (e.g., Pragmatic Play, Evolution Gaming, NetEnt, Microgaming) integrated into the oltoto platform.

4. How We Use Your Information

oltoto uses your personal information for the following purposes:

4.1 Providing Gaming Services

• Creating and managing your oltoto account
• Processing deposits, withdrawals, and bet settlements
• Granting access to sports betting markets, togel (lottery) draws, live casino tables, and slot games
• Maintaining account balances and transaction histories
• Delivering customer support and responding to inquiries

4.2 Identity Verification and Security

• Verifying your age (21+ requirement) and identity to comply with anti-money laundering (AML) and know-your-customer (KYC) regulations
• Preventing fraud, money laundering, and other illegal activities
• Detecting and preventing multiple account registrations, collusion, and bonus abuse
• Monitoring account activity for suspicious or unusual patterns
• Securing your account with two-factor authentication (2FA) and login alerts

4.3 Legal and Regulatory Compliance

• Complying with Indonesian data protection laws, anti-money laundering regulations, and international gaming compliance standards
• Responding to lawful requests from law enforcement, regulatory authorities, and courts
• Maintaining records required by applicable laws and regulations
• Investigating and resolving disputes, complaints, and terms of service violations

4.4 Platform Improvement and Analytics

• Analyzing usage patterns to improve platform performance, user experience, and game offerings
• Conducting A/B testing and user research to optimize features and interfaces
• Developing new products and services tailored to Indonesian player preferences
• Monitoring system performance and diagnosing technical issues

4.5 Marketing and Communication (With Consent)

• Sending promotional offers, bonuses, and updates about new games (only if you have opted in to marketing communications)
• Delivering personalized content and recommendations based on your gaming preferences
• Notifying you about account activity, security alerts, and important policy changes

Note: You can opt out of marketing communications at any time by updating your preferences in your account dashboard or clicking the "unsubscribe" link in our emails.

4.6 Responsible Gaming

• Implementing and monitoring deposit limits, loss limits, and session time reminders that you have set
• Processing self-exclusion requests and cooling-off periods
• Identifying potentially problematic gambling behavior and offering support resources

5. Legal Basis for Processing

Under applicable data protection laws, oltoto must have a lawful basis for processing your personal information. Our legal bases include:

• Contractual Necessity: Processing is necessary to fulfill our contract with you under the Terms & Conditions, including account management, payment processing, and service delivery.
• Legal Obligation: Processing is required to comply with Indonesian law, anti-money laundering regulations, tax obligations, and court orders.
• Legitimate Interests: Processing is necessary for our legitimate business interests, such as fraud prevention, platform security, customer support, and service improvement, provided these interests do not override your fundamental rights.
• Consent: For marketing communications and certain optional data processing activities, we rely on your explicit consent, which you can withdraw at any time.

6. Data Sharing and Third Parties

oltoto does not sell, rent, or trade your personal information to third parties for marketing purposes. However, we may share your data with the following categories of third parties under strict contractual obligations to protect your privacy:

6.1 Service Providers

• Payment Processors: Banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) to process deposits and withdrawals.
• Identity Verification Providers: Third-party KYC and AML service providers to verify your identity and screen for fraud.
• Game Providers: Software suppliers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, and Pocket Games Soft who power our casino games and live dealer tables.
• Cloud Hosting and IT Services: Secure data storage and infrastructure providers who host our servers and manage technical operations.
• Customer Support Tools: Live chat and ticketing system providers to deliver efficient customer service.

6.2 Legal and Regulatory Authorities

We may disclose your personal information to law enforcement agencies, regulatory bodies, tax authorities, or courts if required by law, court order, or legal process, or if necessary to protect the rights, property, or safety of oltoto, our users, or the public.

6.3 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your personal information may be transferred to the acquiring entity. You will be notified of any such change in ownership via email and prominent notice on the platform.

6.4 Data Processing Agreements

All third-party service providers who process your personal data on behalf of oltoto are bound by strict data processing agreements that require them to:

• Process data only for the specific purposes we authorize
• Implement appropriate technical and organizational security measures
• Not use your data for their own purposes or share it with unauthorized parties
• Delete or return your data upon termination of the service agreement

7. Data Retention

oltoto retains your personal information only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements.

• Active Accounts: Your account data is retained as long as your account remains active and in good standing.
• Closed Accounts: After account closure or self-exclusion, we retain your data for up to 7 years to comply with anti-money laundering regulations, tax obligations, and legal record-keeping requirements.
• Transaction Records: Financial transaction data (deposits, withdrawals, bet history) is retained for a minimum of 7 years to comply with Indonesian financial regulations.
• Communication Records: Customer support transcripts and correspondence are retained for 3 years for quality assurance and dispute resolution purposes.
• Marketing Data: If you opt out of marketing communications, your contact details are retained on a suppression list to ensure we do not contact you again.

After the applicable retention period expires, your personal data is securely deleted or anonymized so that it can no longer be associated with you.

8. Data Security Measures

oltoto employs industry-leading security measures to protect your personal information from unauthorized access, disclosure, alteration, or destruction. Our security practices include:

• 256-bit SSL Encryption: All data transmitted between your device and our servers is encrypted using Transport Layer Security (TLS) protocols.
• AES-256 Data Encryption: Personal data stored in our databases is encrypted at rest using Advanced Encryption Standard (AES-256) encryption.
• Firewall Protection: Multi-layered firewalls protect our servers from external attacks and unauthorized access attempts.
• Access Controls: Personal data is accessible only to authorized personnel who require it to perform their job functions, and all access is logged and monitored.
• Regular Security Audits: Our systems undergo regular penetration testing and security audits conducted by independent third-party cybersecurity firms.
• Two-Factor Authentication (2FA): Users can enable 2FA for an additional layer of account security.
• Fraud Detection Systems: Advanced algorithms monitor account activity in real-time to detect and prevent suspicious behavior.

While we implement robust security measures, no system is completely impenetrable. In the unlikely event of a data breach that affects your personal information, we will notify you and relevant authorities in accordance with applicable data breach notification laws.

9. Your Privacy Rights

Under applicable data protection laws, you have the following rights regarding your personal information:

• Right of Access: You have the right to request a copy of the personal data we hold about you.
• Right to Rectification: You can request that we correct any inaccurate or incomplete personal information.
• Right to Erasure (Right to be Forgotten): You can request that we delete your personal data, subject to legal retention requirements.
• Right to Restriction of Processing: You can request that we limit how we use your personal data in certain circumstances.
• Right to Data Portability: You can request a copy of your personal data in a structured, machine-readable format for transfer to another service provider.
• Right to Object: You can object to processing of your personal data based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent: If processing is based on your consent, you can withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

To exercise any of these rights, please contact our Data Protection Officer at dpo@oltoto.cam or submit a request through your account dashboard. We will respond to your request within 30 days. Note that in some cases, legal or regulatory obligations may prevent us from fulfilling certain requests (e.g., deletion of transaction records required by law).

10. Cookies and Tracking Technologies

oltoto uses cookies, web beacons, pixels, and similar tracking technologies to enhance your user experience, analyze platform usage, and deliver personalized content. Cookies are small text files stored on your device that allow us to recognize your browser and remember your preferences.

10.1 Types of Cookies We Use

• Essential Cookies: Required for the platform to function properly, including authentication, security, and load balancing. These cookies cannot be disabled.
• Functional Cookies: Remember your preferences, such as language settings, currency, and account preferences.
• Analytics Cookies: Collect aggregated data on how users interact with the platform to help us improve performance and user experience.
• Marketing Cookies: Track your browsing activity to deliver personalized promotions and advertisements (only if you have consented to marketing communications).

10.2 Managing Cookies

You can manage or disable cookies through your browser settings. Note that disabling essential cookies may prevent you from accessing certain features of the oltoto platform. Disabling analytics or marketing cookies will not affect platform functionality but may result in a less personalized experience.

For more information on how to manage cookies in popular browsers:

• Google Chrome: Settings > Privacy and security > Cookies and other site data
• Mozilla Firefox: Options > Privacy & Security > Cookies and Site Data
• Safari: Preferences > Privacy > Cookies and website data
• Microsoft Edge: Settings > Cookies and site permissions > Cookies and site data

11. International Data Transfers

oltoto primarily processes and stores user data within Indonesia. However, some of our third-party service providers (e.g., cloud hosting providers, game software suppliers) may be located outside Indonesia. When we transfer your personal data internationally, we ensure that:

• The receiving country has adequate data protection laws recognized by international standards, or
• We use standard contractual clauses (SCCs) approved by the European Commission to safeguard your data, or
• The transfer is necessary to fulfill our contract with you or comply with legal obligations.

We take all reasonable steps to ensure that your personal information is treated securely and in accordance with this Privacy Policy, regardless of where it is processed.

12. Children's Privacy

oltoto strictly prohibits underage gambling. Our services are intended solely for individuals who are at least 21 years of age and legal residents of Indonesia. We do not knowingly collect personal information from individuals under the age of 21.

If we discover that we have inadvertently collected personal data from a minor, we will immediately delete that information and permanently close the associated account. If you believe that a minor has registered on oltoto, please contact us immediately at support@oltoto.cam.

Parents and guardians are encouraged to monitor their children's internet usage and to use parental control software to prevent minors from accessing gambling websites.

13. Changes to This Policy

oltoto reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or business operations. The "Last Updated" date at the top of this document will reflect the most recent revision.

Material changes to this Privacy Policy (e.g., changes to how we use or share your personal data, changes to your privacy rights) will be communicated to you via email and prominent notice on the platform. Continued use of the oltoto platform following any changes constitutes your acceptance of the updated Privacy Policy.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal information.

14. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact us:

oltoto Data Protection Officer
Email: dpo@oltoto.cam
General Privacy Inquiries: privacy@oltoto.cam
Customer Support: support@oltoto.cam (available 24/7, WIB)

We are committed to addressing your privacy concerns promptly and transparently. All privacy-related inquiries will receive a response within 30 days.