Privacy Policy

1 Introduction

xototo is committed to handling your personal data responsibly, transparently, and in accordance with internationally recognised data protection principles. We collect only the information we genuinely need, use it only for the purposes disclosed in this Policy, and take all reasonable technical and organisational steps to keep it safe.

Our platform serves adult players (21+) across Indonesia, with particular communities in Jakarta, Surabaya, Bandung, Bali, Medan, and Yogyakarta. The payment and identity data we process reflects this local context: we work with Indonesian banks (BCA, BRI, BNI, Mandiri) and domestic e-wallets (OVO, DANA, GoPay, ShopeePay) whose data-handling obligations are also relevant to how we manage your information.

2 Definitions

• "Personal Data" means any information that identifies or could reasonably identify you as a natural person, whether directly (e.g., full name, KTP number) or indirectly (e.g., device fingerprint, IP address).
• "Processing" means any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, erasure, and destruction.
• "Controller" means xototo, the entity that determines the purposes and means of processing your Personal Data.
• "Processor" means any third party that processes Personal Data on behalf of xototo under a data-processing agreement (e.g., a KYC verification vendor).
• "Consent" means a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your Personal Data for a stated purpose.
• "Account" has the same meaning as in the xototo Terms & Conditions.
• "Platform" means the xototo website at https://xototo.cam and all associated services.

3 Data We Collect

xototo collects the following categories of Personal Data:

We do not intentionally collect Sensitive Personal Data such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data (except where submitted voluntarily as part of KYC), health data, or sexual orientation data. If such data is inadvertently provided (e.g., in a support chat), we will delete it as soon as practical.

4 How We Collect Data

We collect Personal Data through the following methods:

• Directly From You: When you create an Account, complete your player profile, submit KYC documents, request deposits or withdrawals, or contact customer support.
• Automatically: Through cookies, server logs, and analytics tools that record Technical Data and Usage Data whenever you interact with the Platform.
• From Third Parties: From payment processors (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay) who confirm transaction details; from KYC verification providers who validate your identity documents; and from fraud-prevention services that flag suspicious activity patterns.
• From Publicly Available Sources: In rare cases, where necessary for compliance or fraud investigation, we may cross-reference information from publicly available databases or social media profiles that you have made public.

5 How We Use Your Data

xototo processes your Personal Data for the following purposes:

1. Account Management: To create, maintain, and authenticate your Account; to deliver the gaming services you request; to process deposits and withdrawals.
2. Identity Verification (KYC): To verify your age (21+ requirement), confirm your identity, detect duplicate accounts, and comply with anti-money-laundering (AML) regulations.
3. Payment Processing: To facilitate transactions via BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, and other payment methods; to reconcile deposits and issue withdrawals to the correct beneficiary.
4. Fraud Prevention & Security: To monitor for unusual betting patterns, collusion, multi-accounting, automated bot usage, and other forms of abuse; to secure the Platform against cyber-attacks and unauthorised access.
5. Game Integrity: To record wager history and outcomes for sportsbook (including BRI Liga 1, EPL, La Liga, Serie A, Champions League), live casino, togel (lottery), sabung ayam (cockfighting), and slot games; to settle disputes over bet outcomes.
6. Responsible Gaming: To enforce deposit limits, session time-outs, self-exclusion requests, and other player-protection tools.
7. Customer Support: To respond to your enquiries, resolve technical issues, and improve service quality. Support interactions may be recorded for training and quality-assurance purposes.
8. Marketing: To send promotional offers, bonus notifications, and product updates, where you have opted in to receive marketing communications. You may unsubscribe at any time.
9. Platform Improvement: To analyse Usage Data and Technical Data in aggregate form to understand how players interact with the Platform, identify popular games, and guide product development decisions.
10. Legal Compliance: To meet our obligations under applicable gaming regulations, tax laws, and financial crime prevention statutes; to respond to lawful requests from regulatory authorities and law enforcement agencies.

6 Legal Basis for Processing

xototo processes your Personal Data only where we have a lawful basis to do so. The legal grounds on which we rely are:

• Contractual Necessity: Processing is necessary to perform the contract between you and xototo (i.e., the Terms & Conditions). This covers Account creation, game delivery, payment processing, and customer support.
• Legal Obligation: Processing is required to comply with applicable laws, including KYC obligations, AML regulations, tax reporting, and regulatory audits.
• Legitimate Interests: Processing is necessary for our legitimate business interests, such as fraud prevention, platform security, network monitoring, and product improvement, provided these interests do not override your fundamental rights and freedoms.
• Consent: Where none of the above bases apply, we rely on your explicit consent. This applies primarily to optional marketing communications and certain optional features (e.g., cookies beyond those strictly necessary). You may withdraw consent at any time without affecting the lawfulness of prior processing.

7 Data Sharing

xototo does not sell or rent your Personal Data to third parties. We share data only with the following categories of recipients, and only to the extent necessary to deliver our services or meet our legal obligations:

• Payment Processors: Your Financial Data is shared with banks (BCA, BRI, BNI, Mandiri, CIMB Niaga) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) to facilitate deposits and withdrawals. These processors operate under their own privacy policies and data protection standards.
• KYC & Compliance Vendors: Identity Data and copies of your identity documents are shared with third-party verification services that confirm your age, identity, and address. These vendors are bound by data-processing agreements that restrict how they may use your data.
• Game Providers: Usage Data related to specific games (e.g., time spent, RTP achieved on slot titles) may be shared with our game studio partners (Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, Pocket Games Soft) to enable gameplay and settle technical disputes. These providers do not receive Identity Data or Financial Data.
• Fraud Prevention Services: Technical Data (IP addresses, device fingerprints) and behavioural patterns are shared with anti-fraud platforms that maintain databases of known fraudsters and collusion networks.
• Legal & Regulatory Authorities: We will disclose Personal Data when required by law, court order, or regulatory directive, or where we reasonably believe disclosure is necessary to prevent fraud, protect the rights of xototo or third parties, or ensure public safety.
• Professional Advisors: Lawyers, accountants, auditors, and other professional service providers may access Personal Data where necessary to provide their services to xototo. These advisors are bound by confidentiality obligations.
• Corporate Transactions: In the event of a merger, acquisition, asset sale, or other corporate restructuring, Personal Data may be transferred to the acquiring entity as part of the business assets. You will be notified of any such transfer and your rights under this Policy will continue to apply.

8 Data Retention

We retain Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Specific retention periods are as follows:

• Active Account Data: Identity Data, Contact Data, and Financial Data are retained throughout the period your Account remains active.
• Inactive Accounts: If you do not log in for 12 consecutive months, your Account is classified as inactive. We will send a reminder email to your registered address. After a further 12 months of inactivity (24 months total), your Account will be closed and most Personal Data will be deleted.
• Transaction Records: Financial Data and bet history must be retained for a minimum of 7 years from the date of each transaction to comply with tax, AML, and regulatory obligations. This data is archived securely and access is restricted to authorised compliance personnel.
• KYC Documents: Identity verification documents are retained for 7 years following Account closure or the date of the last transaction, whichever is later, to meet regulatory record-keeping requirements.
• Marketing Data: If you unsubscribe from marketing communications, your email address is retained on a suppression list to ensure we do not contact you again. This record is kept indefinitely unless you request deletion.
• Support Communications: Chat logs, support tickets, and email correspondence are retained for 3 years to track service quality and resolve disputes.

Once the applicable retention period expires, Personal Data is securely deleted or anonymised such that you can no longer be identified from it.

9 Cookies & Tracking Technologies

xototo uses cookies and similar tracking technologies to enable core Platform functionality, enhance user experience, and analyse usage patterns. A cookie is a small text file placed on your device when you visit our website. We use the following types of cookies:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function. They enable you to log in, maintain your session, and navigate between pages. Without these cookies, services you have requested (such as placing a wager or viewing your balance) cannot be provided. Strictly necessary cookies do not require consent.
• Performance & Analytics Cookies: These cookies collect aggregated information about how visitors use the Platform, such as which pages are most popular and which features are used most frequently. This data helps us improve platform performance and user experience. We do not use this data to identify individual users.
• Functional Cookies: These cookies remember your preferences (e.g., language choice, display settings) and personalise your experience. They may also be used to provide features you have requested, such as viewing your recent bets or favourite games.

xototo does not use third-party advertising cookies or cross-site tracking pixels for behavioural advertising purposes. We do not participate in ad networks that track users across multiple websites.

You may block or delete cookies through your browser settings. Please note that disabling strictly necessary cookies will prevent you from using core Platform features, including logging in and placing wagers.

10 Data Security

xototo employs industry-standard technical and organisational measures to protect your Personal Data against unauthorised access, accidental loss, destruction, or damage. Our security practices include:

• Encryption: All data transmitted between your device and our servers is protected by 256-bit SSL/TLS encryption. Payment card data (where applicable) is tokenised and processed in accordance with PCI DSS standards.
• Access Controls: Access to Personal Data is restricted to authorised employees and contractors on a need-to-know basis. All personnel with data access are bound by confidentiality obligations and receive regular security training.
• Secure Infrastructure: Our servers are hosted in secure data centres with physical access controls, fire suppression systems, and 24/7 monitoring. Regular security audits and penetration testing are conducted by independent third parties.
• Password Protection: Player passwords are hashed using industry-standard algorithms (bcrypt or Argon2) and are never stored in plain text. xototo staff cannot view your password and will never ask you to disclose it.
• Fraud Monitoring: Automated systems monitor account activity for suspicious patterns, including simultaneous logins from different geographic locations, unusual bet sizing, and rapid account creation.
• Incident Response: In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will notify affected users within 72 hours of becoming aware of the breach and report it to relevant authorities as required by law.

11 Your Rights

You have the following rights in relation to your Personal Data. To exercise any of these rights, contact us at [email protected] with the subject line "Data Rights Request". We will respond within 30 calendar days.

• Right of Access: You have the right to request a copy of the Personal Data we hold about you. We will provide this in a structured, commonly used, machine-readable format (e.g., CSV or PDF).
• Right to Rectification: If any of your Personal Data is inaccurate or incomplete, you have the right to request correction. You may update most details directly through your Account settings.
• Right to Erasure (Right to be Forgotten): You may request deletion of your Personal Data in certain circumstances, such as when the data is no longer necessary for the purposes it was collected, or when you withdraw consent. Note that we may be required to retain certain data to meet legal or regulatory obligations (e.g., transaction records for tax purposes).
• Right to Restriction of Processing: You may request that we limit how we use your Personal Data in certain situations, such as while we investigate a data accuracy dispute.
• Right to Data Portability: You have the right to receive your Personal Data in a portable format and transmit it to another service provider, where technically feasible.
• Right to Object: You may object to processing based on legitimate interests. If you object, we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, or where processing is necessary for legal claims.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted before withdrawal.
• Right to Lodge a Complaint: If you believe xototo has violated your data protection rights, you have the right to lodge a complaint with a supervisory authority or data protection regulator in your jurisdiction.

12 Minors

The xototo Platform is intended exclusively for adults aged 21 years or older. We do not knowingly collect Personal Data from individuals under the age of 21. If you are under 21, you must not create an Account, submit any Personal Data to xototo, or use any of our services.

If we become aware that we have inadvertently collected Personal Data from a person under 21 years of age, we will take immediate steps to delete that data and close the associated Account. Any winnings will be forfeited and deposited funds will be returned to the originating payment method following verification.

Parents and guardians are encouraged to monitor their children's internet usage and implement parental control software where appropriate.

13 Third-Party Links

The xototo Platform may contain links to external websites operated by our payment partners (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay), game studios (Evolution Gaming, Pragmatic Play, NetEnt, Microgaming), or other third parties. Once you leave the xototo Platform, this Privacy Policy no longer applies.

We are not responsible for the privacy practices or content of third-party websites. We encourage you to review the privacy policy of any external site before submitting Personal Data to it.

14 International Data Transfers

xototo primarily operates within the Indonesia market and stores Personal Data on servers located within secure, internationally certified data centres. However, certain third-party service providers we engage (such as cloud infrastructure providers and game studio partners) may process data in jurisdictions outside Indonesia.

Where Personal Data is transferred internationally, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs) approved by recognised data protection authorities;
• Binding Corporate Rules for multinational service providers;
• Certification under recognised cross-border data transfer frameworks.

You may request further information about the safeguards we employ for international transfers by contacting us at [email protected].

15 Amendments to This Policy

xototo reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, technology, or applicable laws. When material changes are made, we will notify registered users via the email address associated with their Account and post a prominent notice on the Platform at least 14 days before the changes take effect.

Your continued use of the Platform after the effective date of any revised Policy constitutes acceptance of the updated terms. If you do not agree with the changes, you must close your Account. We recommend reviewing this page periodically. The "Last Updated" date at the top of this document reflects the most recent revision.

16 Contact & Complaints

If you have any questions, concerns, or complaints regarding this Privacy Policy or our data practices, please contact us through the following channel:

Our support team is available 24/7 and includes Indonesian-speaking agents. For data rights requests (access, rectification, erasure), please use the subject line "Data Rights Request" and include your full name and registered email address to expedite verification.

We aim to respond to all enquiries within 30 calendar days. If you are not satisfied with our response or believe we have violated your data protection rights, you have the right to lodge a complaint with a relevant data protection supervisory authority.