At toto12, protecting your personal data is a core responsibility — not an afterthought. This Privacy Policy explains in plain terms what data we collect, why we collect it, how we use and protect it, and what rights you have as a registered member of our platform.
Six principles that define how toto12 handles every piece of data you share with us.
All data transmitted between your device and toto12 servers is protected by 256-bit SSL/TLS encryption. Data stored at rest is encrypted using AES-256 standards across all production database environments.
toto12 does not sell, rent, or trade your personal information to third-party advertisers or data brokers under any circumstances. Your data is used solely for the purposes described in this Privacy Policy.
You retain the right to access, correct, export, or request deletion of your personal data at any time. Submit a data subject request to our support team and we will respond within the timeframes described in this policy.
We collect only the personal data that is strictly necessary to provide our services, fulfill legal and compliance obligations, and protect the security of our platform and all members on it.
Access to member personal data within toto12 is restricted on a strict need-to-know basis. All staff with data access are subject to confidentiality obligations and regular data-handling training.
In the unlikely event of a data breach that poses a risk to your rights and freedoms, toto12 will notify affected members promptly and take immediate remedial action in accordance with applicable data protection standards.
In this Privacy Policy, the following terms carry the meanings set out below:
toto12 acts as the Data Controller for all Personal Data collected through the Platform. We operate under an international offshore license and are subject to data protection obligations arising from that licensing framework as well as applicable international data protection standards.
If you have any questions regarding the manner in which your Personal Data is processed, or if you wish to exercise any of your rights described in Section 11 of this policy, you may contact our designated data protection point of contact as described in Section 16.
toto12 collects Personal Data across several categories, depending on your interaction with the Platform:
When you create an account on toto12, we collect:
To comply with our licensing obligations and prevent underage gambling and financial crime, we collect:
We record all deposit and withdrawal transactions including amount (in IDR), timestamp, payment channel used, transaction reference number, and processing status. We do not store full bank account numbers or complete card details — only masked references sufficient to confirm ownership.
We record your betting and gaming activity on the Platform, including bets placed, games played, wagering amounts, wins, losses, bonus usage, session duration, and game preferences. This data is used for account management, responsible gaming monitoring, and fraud detection.
When you access the Platform, we automatically collect:
When you contact our customer support team — available 24/7, with native Indonesian-speaking agents during WIB (UTC+7) business hours — we retain records of those communications, including chat transcripts, email correspondence, and call logs where applicable.
toto12 collects your Personal Data through the following means:
| Collection Method | Data Types Collected |
|---|---|
| Account registration form | Name, date of birth, email, phone, address, password |
| KYC document submission | ID documents, proof of address, selfie photograph |
| Deposit and withdrawal requests | Transaction amounts, payment channel references, timestamps |
| Platform usage (automatic) | IP address, device data, session logs, page interactions |
| Customer support interactions | Chat transcripts, email correspondence, support tickets |
| Cookies and tracking technologies | Session tokens, preference settings, analytics events |
| Third-party payment providers | Transaction confirmation data from BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay and others |
toto12 uses your Personal Data for the following purposes:
To create, maintain, and administer your toto12 account, verify your identity, authenticate your sessions, and process your deposit and withdrawal transactions in Indonesian Rupiah (IDR).
To deliver the core services of the Platform, including sports betting markets (BRI Liga 1, EPL, Champions League, AFF Cup, and others), togel (Indonesia's traditional numbers lottery) markets, live casino, and slot games, including personalizing your experience based on your activity and preferences.
To fulfill our obligations under our international offshore license, including age verification (21+ enforcement), anti-money laundering (AML) checks, Know Your Customer (KYC) verification, fraud detection, and transaction monitoring.
To monitor gaming behavior for signs of problem gambling, apply any self-imposed limits you have set (deposit limits, session time alerts, self-exclusion), and to contact you proactively if our responsible gaming systems flag unusual patterns in your play. See Section 14 for full details.
To respo nd to your inquiries, resolve disputes, investigate complaints, and maintain records of communications for quality assurance and audit purposes.
To detect, investigate, and prevent fraudulent transactions, unauthorized account access, bonus abuse, collusion, money laundering, and other prohibited conduct as described in our Terms & Conditions.
To analyze aggregated, anonymized usage data to understand how members interact with the Platform, identify technical issues, and improve the overall user experience. This analysis does not involve decisions based solely on automated profiling that produce legal or similarly significant effects on you.
To send you promotional offers, bonus notifications, and platform updates where you have provided consent to receive such communications. You may withdraw this consent at any time by contacting our support team or using the unsubscribe mechanism included in every marketing message.
toto12 processes your Personal Data on the following legal grounds:
| Processing Purpose | Legal Basis |
|---|---|
| Account creation and service delivery | Performance of a contract — necessary to provide the services you have requested |
| Identity verification (KYC) and age checks | Legal obligation — required under our licensing framework |
| Anti-money laundering and fraud monitoring | Legal obligation and legitimate interests — protecting the Platform and its members |
| Responsible gaming monitoring | Legitimate interests — duty of care to members and licensing requirements |
| Customer support and dispute resolution | Performance of a contract and legitimate interests |
| Platform analytics and improvement | Legitimate interests — improving service quality using anonymized aggregate data |
| Marketing communications | Consent — you may withdraw consent at any time |
toto12 does not sell your Personal Data. We may share your data with third parties only in the following limited and controlled circumstances:
We share transactional data with payment processors and financial institutions necessary to complete your deposit and withdrawal requests, including Indonesian banks such as BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, and Bank Permata, as well as e-wallet operators OVO, DANA, GoPay, ShopeePay, and LinkAja. These providers receive only the minimum data necessary to process the transaction and are bound by their own privacy and security obligations.
We may use third-party KYC service providers to assist with document verification and identity authentication. These providers process data solely on our behalf and under contractual data processing agreements that prohibit any independent use of your information.
Some games on the Platform are operated by certified third-party studios including Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Pocket Games Soft. These studios may receive a pseudonymous player session identifier to enable game functionality. They do not receive your full name, contact details, or financial data.
We may disclose your Personal Data to law enforcement agencies, regulatory authorities, licensing bodies, or courts where we are legally required to do so, or where disclosure is necessary to protect the rights, property, or safety of toto12, its members, or the public. toto12 will, where lawfully permitted, notify you of any such request before complying.
In the event of a merger, acquisition, restructuring, or sale of all or part of toto12's business, your Personal Data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such change of data controller via the email address registered to your account, and your rights under this policy will remain in force.
toto12 retains your Personal Data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable legal, regulatory, or licensing obligations. The following retention periods apply as a general guide:
| Data Category | Retention Period |
|---|---|
| Account registration data | Duration of account plus 5 years after closure |
| KYC and identity verification documents | Duration of account plus 5 years after closure (or longer if required by licensing authority) |
| Financial transaction records | 7 years from the date of transaction (AML compliance requirement) |
| Gaming activity logs | 5 years from the date of activity |
| Customer support communications | 3 years from the date of the last interaction |
| Technical and device logs | 13 months on a rolling basis |
| Marketing consent records | Until consent is withdrawn, plus 3 years thereafter |
Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymized in accordance with toto12's data disposal procedures. Where anonymization is applied, the resulting data is no longer considered Personal Data and may be retained indefinitely for statistical analysis purposes.
toto12 implements the following technical security measures to protect your Personal Data:
Access to member Personal Data within toto12 is governed by role-based access controls and the principle of least privilege. Only staff members with a direct operational need to access specific data categories are granted that access. All staff with data responsibilities undergo mandatory data protection and security training upon onboarding and at regular intervals thereafter.
toto12 maintains a documented data breach response procedure. In the event of a confirmed data breach that poses a material risk to your rights or interests, we will notify affected members without undue delay and, where applicable, within the timeframe required by our licensing authority. Notifications will include a description of the nature of the breach, the data categories affected, and the steps we are taking to mitigate harm.
Cookies are small text files placed on your device when you visit the toto12 Platform. They allow the Platform to recognize your device across sessions, maintain your login state, remember your preferences, and gather analytical data about how the Platform is used.
| Cookie Type | Purpose | Duration |
|---|---|---|
| Strictly Necessary | Session authentication, security tokens, load balancing — the Platform cannot function without these | Session / up to 24 hours |
| Functional | Remembering your language preference, display settings, and last-used deposit method | Up to 12 months |
| Analytical | Aggregated, anonymized usage statistics to understand page performance and member navigation patterns | Up to 13 months |
| Responsible Gaming | Session time tracking to support time-limit and cool-off features you have activated | Session-based |
You may configure your browser to refuse or delete cookies at any time. Please note that disabling strictly necessary cookies will prevent the Platform from functioning correctly and may prevent you from accessing your account. Analytical and functional cookies can be disabled without affecting core Platform access, though some preference features may be reset between sessions.
toto12 does not use third-party advertising or retargeting cookies. No behavioral data collected through cookies on the toto12 Platform is shared with or sold to advertising networks.
As a member of toto12, you have the following rights with respect to your Personal Data. To exercise any of these rights, contact our support team as described in Section 16. We will respond to all verified requests within 30 calendar days and will notify you if an extension is required.
You have the right to request a copy of the Personal Data toto12 holds about you, along with information about how it is processed and the legal basis for each processing activity.
You have the right to request correction of any inaccurate or incomplete Personal Data we hold about you. Some corrections (such as changes to registered name) may require supporting documentation for verification purposes.
You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (for consent-based processing), or where you object to processing and there are no overriding legitimate grounds. This right is subject to our legal obligations to retain certain data — particularly financial transaction records and KYC documents — for the periods described in Section 8.
You have the right to request that we restrict the processing of your Personal Data in certain circumstances — for example, while you contest the accuracy of the data, or while a complaint you have raised is under investigation.
Where processing is carried out by automated means on the basis of your consent or a contract, you have the right to receive a copy of your Personal Data in a structured, commonly used, machine-readable format (such as JSON or CSV), or to request that we transmit it directly to another data controller where technically feasible.
You have the right to object to processing of your Personal Data based on legitimate interests, including profiling for responsible gaming monitoring. toto12 will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests, or where processing is necessary for the establishment, exercise, or defense of legal claims.
Where processing is based on your consent (such as marketing communications), you may withdraw that consent at any time without affecting the lawfulness of any processing conducted prior to withdrawal. To unsubscribe from marketing messages, contact our support team or use the opt-out link in any promotional email.
The toto12 Platform is strictly intended for adults aged 21 years or older. We do not knowingly collect Personal Data from anyone under the age of 21. Age verification is performed as part of the KYC process, and accounts found to belong to individuals under this age threshold are closed immediately with all balances forfeited.
If you believe that a person under the age of 21 has registered an account on toto12 or has provided us with Personal Data, please contact our support team immediately at the address provided in Section 16. We will investigate and take prompt action to delete any such data and close the associated account.
toto12 strongly encourages parents and guardians to monitor their household's online activity and to use parental control software where appropriate. Our Responsible Gaming page contains further guidance on preventing underage access to gambling platforms.
toto12 operates as an internationally licensed platform. As a result, your Personal Data may be transferred to, stored in, or processed in countries outside Indonesia. These countries may have data protection laws that differ from those applicable in Indonesia.
Where such transfers occur, toto12 ensures that appropriate safeguards are in place to protect your data, including:
By registering an account on toto12 and accepting our Terms & Conditions, you acknowledge and consent to the international transfer of your Personal Data as described in this section.
toto12 processes gaming behavior data specifically to fulfill our responsible gaming obligations. This includes monitoring deposit frequency and amounts, session lengths, wager sizes relative to deposit history, and self-exclusion or limit-setting activity.
Where our responsible gaming systems identify patterns that may indicate problematic gambling behavior, we may use this data to:
Responsible gaming data is processed on the basis of legitimate interests (our duty of care to members) and legal obligation (licensing requirements). This data is never used for marketing purposes and is not shared with third parties except where required by our licensing authority.
For full details of the responsible gaming tools available to you, including how to set deposit limits, activate self-exclusion, or request a voluntary account closure, please visit our dedicated Responsible Gaming page.
toto12 reserves the right to update or amend this Privacy Policy at any time. Material changes — those that affect your rights or the manner in which we use your Personal Data in a significant way — will be communicated to registered members via the email address on file at least 14 calendar days before the updated policy takes effect.
Minor changes, such as clarifications of existing practices or corrections of typographical errors, may be made without advance notice. The "Last Updated" date at the top of this page will always reflect the most recent revision. We encourage you to review this policy periodically to stay informed about how toto12 protects your data.
Your continued use of the Platform following the effective date of any amended Privacy Policy constitutes your acknowledgment of the revised terms. If you do not accept the amended policy, you must cease using the Platform and may request account closure under the procedure described in our Terms & Conditions.
If you have any questions, concerns, or complaints regarding this Privacy Policy or the manner in which toto12 processes your Personal Data, please contact our data protection team through the following channel:
Review our full Terms & Conditions, explore our FAQ for quick answers, or visit our Responsible Gaming page to learn about the tools available to keep your experience safe.