toto24 Privacy Policy

toto24 ("we", "us", "our", or "the Company") operates the online casino and sports betting platform accessible at https://toto24.asia (the "Platform"). We are committed to protecting the privacy and personal data of every individual who visits, registers with, or uses the toto24 Platform (each a "Member" or "you").

This Privacy Policy sets out in full detail the personal data we collect about you, the purposes for which we process it, the legal basis on which we rely, the parties with whom we may share it, the period for which we retain it, and the rights you hold in relation to it. This policy applies to all personal data collected through the toto24 Platform, our customer support channels (live chat, email, WhatsApp), and any other interaction you have with the toto24 brand.

This Privacy Policy applies to Members who are residents of Indonesia and who access the toto24 Platform from within Indonesia or from any other jurisdiction in which toto24 makes its services available. By registering an account and using the toto24 Platform, you confirm that you have read and understood this Privacy Policy and that you consent to the collection and processing of your personal data as described herein.

For the purposes of applicable data protection legislation, toto24 is the data controller responsible for your personal data. The data controller is the entity that determines the purposes and means by which personal data is processed.

toto24 operates as an internationally licensed online gaming platform. All data protection enquiries, subject access requests, and privacy-related complaints should be directed to our Data Protection Officer (DPO) via the contact details set out in Clause 16 of this Policy.

Where toto24 engages third-party service providers to process personal data on its behalf — for example, payment processors, KYC verification providers, or customer support platforms — those parties act as data processors under toto24's instruction and are bound by strict contractual data protection obligations consistent with this Policy.

toto24 collects personal data across several categories, as described in the table below. We collect only the data that is necessary for the stated purpose.

toto24 collects your personal data through the following channels and mechanisms:

• Direct Submission: Data you provide when completing the toto24 registration form, submitting KYC documents, initiating deposit or withdrawal transactions, completing responsible gaming tool requests, or contacting our support team via live chat, email, or WhatsApp.
• Automated Technical Collection: Data collected automatically when you access the Platform, including your IP address, device identifiers, browser characteristics, and session activity logs. This data is collected via server logs and first-party analytics tools.
• Cookies and Similar Technologies: First-party cookies and similar tracking technologies placed on your device when you visit toto24.asia. See Clause 8 for full details of our cookie practices.
• Third-Party Verification Providers: Identity and document verification data returned to toto24 by authorised KYC and AML service providers following identity checks you initiate as part of the account verification process.
• Payment Processors: Transaction confirmation data received from Indonesian payment processors and banking partners (including BCA, BRI, BNI, Mandiri, and e-wallet providers) in connection with deposits and withdrawals you initiate.

toto24 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contract Performance: Processing that is necessary to perform the contract between toto24 and you as a Member — for example, processing your deposits, crediting winnings, or resolving disputes.
• Legal Obligation: Processing required by applicable law — for example, KYC and AML checks, record-keeping obligations imposed by our gaming licence, and fraud reporting to competent authorities.
• Legitimate Interests: Processing that is necessary for toto24's legitimate business interests, provided those interests are not overridden by your fundamental rights — for example, detecting and preventing fraud, securing the Platform, and improving our products and services.
• Consent: Processing carried out only where you have given clear, specific, and informed consent — primarily for optional direct marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

toto24 uses your personal data for the following purposes:

• Creating, verifying, and maintaining your toto24 Account, including processing your initial KYC submission and any subsequent re-verification requests.
• Processing deposits and withdrawals in Indonesian Rupiah (IDR) via your nominated local bank account or e-wallet.
• Administering bonus offers, promotions, and loyalty rewards to which your Account is entitled under the applicable promotion terms.
• Monitoring game sessions and betting patterns to detect potential signs of problem gambling and to apply responsible gaming tools where appropriate.
• Detecting, investigating, and preventing fraudulent activity, money laundering, collusion, bonus abuse, and other forms of prohibited conduct as defined in the toto24 Terms & Conditions.
• Providing customer support via live chat, email, and WhatsApp in both English and Indonesian, and maintaining records of those interactions for quality assurance and dispute resolution.
• Sending transactional communications — such as deposit confirmations, withdrawal approvals, and KYC status updates — which are necessary for the operation of your Account and cannot be opted out of.
• Sending optional promotional communications about toto24 offers, seasonal bonuses (e.g., Ramadhan promotions, Idul Fitri specials, Independence Day bonuses), and new game launches — only where you have opted in.
• Analysing aggregated, anonymised usage data to improve Platform performance, user experience, and game content selection.
• Complying with our obligations under applicable international gaming regulations, AML frameworks, and data protection laws.

toto24 does not sell or rent your personal data to any third party. We may share your personal data only in the following limited and controlled circumstances:

• Authorised Service Providers: We share data with carefully selected third-party vendors who provide services essential to Platform operation — including KYC/AML verification providers, payment processors (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja), cloud hosting providers, customer support platform operators, and game content providers (Pragmatic Play, Evolution Gaming, Spribe, Pocket Games Soft, NetEnt, Microgaming). All service providers are bound by contractual data processing agreements requiring them to handle your data only for the specific purpose for which it was shared and to maintain security standards consistent with this Policy.
• Regulatory & Law Enforcement Authorities: We may disclose personal data to competent regulatory authorities, law enforcement agencies, or courts where we are required to do so by law, court order, or regulatory directive.
• Fraud Prevention & AML: We may share data with fraud prevention organisations, gaming industry self-regulatory bodies, and shared self-exclusion registries where disclosure is necessary to prevent crime or protect the integrity of the gaming industry.
• Corporate Transactions: In the event of a merger, acquisition, restructuring, or sale of all or part of the toto24 business, your personal data may be transferred to the acquiring entity as part of that transaction. We will notify affected Members before any such transfer takes effect and your data will continue to be processed under the same terms as this Policy.

toto24 uses first-party cookies and similar technologies on the Platform. A cookie is a small text file placed on your device by a web server. toto24 uses the following categories of cookies:

toto24 does not use third-party advertising cookies or cross-site tracking cookies. You may manage cookie preferences through your browser settings; however, disabling strictly necessary cookies will prevent you from logging into your toto24 Account.

toto24 retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, including satisfying legal, regulatory, and audit obligations. The following retention periods apply:

• Active Account Data: Retained for the full duration of your toto24 membership and for a minimum of five (5) years following Account closure, in accordance with international AML record-keeping standards.
• KYC Documents: Retained for a minimum of five (5) years from the date of submission or Account closure, whichever is later.
• Transaction Records: Deposit and withdrawal records are retained for a minimum of five (5) years from the date of the transaction.
• Customer Support Communications: Live chat transcripts and email records are retained for two (2) years from the date of the interaction.
• Technical & Analytics Data: Server logs and anonymised analytics data are retained for up to 24 months from the date of collection.
• Marketing Preference Records: Records of your marketing opt-in/opt-out status are retained for as long as your Account remains active, plus one year thereafter.

Upon expiry of the applicable retention period, toto24 will securely delete or anonymise your personal data in a manner that prevents reconstruction or identification.

toto24 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, disclosure, or alteration. Our key security controls include:

• Encryption in Transit: All data transmitted between your device and the toto24 Platform is encrypted using 256-bit SSL/TLS protocols. The Platform operates exclusively over HTTPS.
• Encryption at Rest: Sensitive personal data — including identity documents, financial account details, and password hashes — is encrypted at rest using AES-256 encryption on our secure servers.
• Access Controls: Access to personal data is restricted to toto24 employees and contractors who require it to perform their job functions. All access events are logged and subject to regular audit.
• Multi-Factor Authentication: Administrative access to toto24 backend systems requires multi-factor authentication. Members are encouraged to enable 2FA on their own accounts for additional protection.
• Penetration Testing: toto24 engages independent cybersecurity professionals to conduct regular penetration tests and vulnerability assessments of the Platform.
• Incident Response: toto24 maintains a formal data breach response plan. In the event of a breach that poses a risk to your rights and freedoms, affected Members will be notified within 72 hours of toto24 becoming aware of the incident.

As an internationally operating platform, toto24 may transfer your personal data to, and store it in, countries outside Indonesia. This may occur when our game providers, payment processors, or hosting infrastructure are located in other jurisdictions.

Whenever toto24 transfers personal data internationally, we ensure appropriate safeguards are in place to protect your data to a standard equivalent to that required under applicable data protection law. These safeguards include:

• Transfers to countries recognised as providing an adequate level of data protection by relevant regulatory bodies.
• Data processing agreements incorporating standard contractual clauses that impose binding data protection obligations on the recipient.
• Contractual requirements for recipient parties to implement security measures consistent with those described in Clause 10 of this Policy.

By using the toto24 Platform and providing your personal data, you acknowledge and consent to the transfer of your personal data as described in this clause.

The toto24 Platform is strictly intended for adults aged 21 years and over. toto24 does not knowingly collect personal data from individuals under the age of 21. If you are under 21, you must not use the toto24 Platform or provide any personal data to us.

If toto24 discovers or is notified that personal data has been collected from an individual under the age of 21, we will immediately suspend the relevant Account, delete the associated personal data, and — where fraud or misrepresentation is suspected — report the matter to relevant authorities.

To exercise any of the rights described in this Privacy Policy — including access, rectification, erasure, restriction, portability, objection, or withdrawal of consent — please submit a written request to toto24 via one of the following channels:

• Email: Send your request to [email protected] with the subject line "Data Rights Request — [Your Registered Email Address]".
• Live Chat: Contact our 24/7 support team via the live chat facility within the toto24 Platform. Indonesian-speaking agents are always available.
• WhatsApp: Send a message to +62 812 0000 2424 during extended support hours.

To protect your privacy and prevent unauthorised access to your data, toto24 will ask you to verify your identity before processing any data rights request. We will respond to all valid requests within 30 calendar days. Where a request is complex or involves a large volume of data, we may extend this period by a further 60 days, in which case we will notify you of the extension and the reason for it.

If you are not satisfied with toto24's response to your data rights request, you have the right to lodge a complaint with the applicable data protection supervisory authority in your jurisdiction.

toto24 sends promotional and marketing communications only to Members who have expressly opted in to receive them. Marketing communications may include information about deposit bonuses, reload offers, free spins, cashback promotions, seasonal campaigns (e.g., Ramadhan specials, Idul Fitri bonuses, Indonesian Independence Day promotions), new game launches, and toto24 loyalty programme updates.

You may opt in to marketing communications during registration or at any time thereafter from within your Account preferences dashboard. You may withdraw your consent and opt out of marketing communications at any time by:

• Updating your communication preferences in your toto24 Account dashboard.
• Clicking the "Unsubscribe" link in any marketing email you receive from toto24.
• Contacting our support team via live chat or at [email protected] and requesting removal from all marketing lists.

Please allow up to 5 business days for opt-out requests to take full effect across all communication channels. Note that opting out of marketing communications does not affect your receipt of transactional messages that are necessary for the operation of your Account (e.g., deposit confirmations, withdrawal notifications, KYC status updates, security alerts).

toto24 reviews this Privacy Policy on a regular basis and reserves the right to update or am end it at any time to reflect changes in our data practices, applicable law, or Platform features. When we make material changes to this Policy, we will:

• Post the updated Privacy Policy on this page with a revised "Last Updated" date at the top of the document.
• Send an email notification to your registered toto24 email address summarising the key changes, at least 14 days before the updated Policy takes effect.
• Display a prominent notice on the toto24 Platform for a period of no less than 14 days following publication of the updated Policy.

Your continued use of the toto24 Platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree to the updated Privacy Policy, you must stop using the Platform and may request Account closure by contacting our support team.

We encourage you to review this Privacy Policy periodically to stay informed about how toto24 protects your personal data. The current version of this Policy is always accessible at https://toto24.asia/privacy-policy.

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way toto24 handles your personal data, please contact our Data Protection Officer or customer support team using the details below:

• Email: [email protected]
• WhatsApp: +62 812 0000 2424
• Live Chat: Available 24/7 via the toto24 Platform (WIB, UTC+7). Indonesian-speaking agents are always on hand.
• Postal Address: toto24 Data Protection Officer, toto24 Operations, International Gaming Division (address available on request via email).

We are committed to resolving all privacy-related enquiries promptly and transparently. If you submit a complaint, we will acknowledge receipt within 2 business days and provide a full substantive response within 30 calendar days.