Privacy Policy

1.1  toti80 is committed to safeguarding the privacy of all members who use our platform. We operate strictly within the principles of data minimization, purpose limitation, transparency, and user rights that underpin internationally recognized data protection frameworks.

1.2  Our platform serves members primarily based in Indonesia. All personal data is handled with particular sensitivity to the expectations and rights of Indonesian consumers, including alignment with the principles of Indonesia's Personal Data Protection Law (UU PDP) and internationally recognized privacy standards.

1.3  We do not engage in the sale of personal data. We do not permit third-party advertising networks to track our users. Our data collection practices are limited to what is strictly necessary to deliver, secure, and improve the toti80 platform experience.

For the purposes of this Policy, the following terms have the meanings set out below:

• "Personal Data" means any information that identifies or could reasonably be used to identify you as an individual, including your name, email address, telephone number, device identifiers, and financial account details.
• "Processing" means any operation performed on Personal Data, including collection, recording, organization, storage, retrieval, use, disclosure, and deletion.
• "Data Controller" means toti80, the entity that determines the purposes and means of processing your Personal Data.
• "Data Processor" means any third party that processes Personal Data on behalf of toti80 under a data processing agreement, such as a payment gateway provider or fraud detection service.
• "KYC Data" means identity verification documents and associated information submitted as part of the Know Your Customer process, including national ID cards (KTP), passports, and proof-of-address documents.
• "Cookies" means small text files placed on your device by the toti80 platform to store session and preference information.
• "Platform" means the toti80 website at https://toti80.cam and any associated mobile or application interfaces.

3.1  toti80 collects the following categories of Personal Data from members:

3.2  We do not collect or process special category data (such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data) except where expressly required by applicable law and only with your explicit consent.

4.1  toti80 collects Personal Data through the following channels:

• Direct submission: when you register an account, complete KYC, make a deposit or withdrawal, contact support, or participate in promotions.
• Automated collection: through Cookies, server logs, and analytics tools that record technical and usage data when you interact with the Platform.
• Third-party sources: from payment processors (e.g., BCA payment gateway, OVO API), identity verification providers, and fraud prevention services, where they share data relevant to your account activity.

4.2  You are not obligated to provide all requested Personal Data; however, failure to provide mandatory information (such as KYC documents) may prevent toti80 from processing withdrawal requests or maintaining your account in good standing.

5.1  toti80 processes your Personal Data for the following purposes:

• Creating, managing, and maintaining your Account on the toti80 Platform.
• Processing deposits and withdrawals via Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja).
• Verifying your identity and age (21+) as required by our responsible gaming and compliance obligations.
• Detecting, investigating, and preventing fraud, money laundering, bonus abuse, and other prohibited conduct.
• Providing customer support and resolving account disputes.
• Sending transactional communications — such as deposit confirmations, withdrawal notifications, and security alerts — that are necessary for the operation of your account.
• Sending promotional communications about bonuses, new games, and special offers — only where you have provided explicit consent. You may withdraw this consent at any time.
• Complying with applicable legal, regulatory, and anti-money laundering obligations.
• Improving the Platform through aggregate, anonymized usage analysis.
• Enforcing our Terms & Conditions and other policies.

6.1  toti80 processes your Personal Data on the following legal grounds:

• Contractual necessity: processing required to perform the contract between you and toti80, including account management, payment processing, and KYC verification.
• Legal obligation: processing required to comply with applicable laws and regulations, including anti-money laundering obligations and age verification requirements.
• Legitimate interests: processing necessary for toti80's legitimate business interests, such as fraud prevention, platform security, and service improvement, where those interests are not overridden by your data protection rights.
• Consent: processing based on your freely given, specific, informed, and unambiguous consent — primarily for marketing communications. You may withdraw consent at any time by contacting support or updating your account notification preferences.

7.1  toti80 does not sell, rent, or trade your Personal Data to any third party for commercial purposes. We may share your data only in the following limited circumstances:

• Payment processors: financial institutions and e-wallet providers (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja) receive the minimum data necessary to execute deposit and withdrawal transactions on your behalf.
• Identity verification providers: KYC and age-verification service providers receive identity documents solely for the purpose of completing mandatory verification checks.
• Fraud and security partners: specialized fraud detection and cybersecurity vendors may receive technical and behavioral data to identify and prevent unauthorized account access, bonus abuse, and money laundering.
• Legal authorities: toti80 will disclose Personal Data to law enforcement agencies, regulatory bodies, or courts of competent jurisdiction where required to do so by applicable law, court order, or regulatory directive. Where legally permissible, toti80 will notify you of such disclosure.
• Business transfers: in the event of a merger, acquisition, or sale of all or a substantial part of toti80's assets, your Personal Data may be transferred to the successor entity, subject to equivalent data protection obligations.

7.2  All third-party service providers that process Personal Data on toti80's behalf are bound by written data processing agreements that require them to process data only on documented instructions from toti80, implement appropriate security measures, and delete or return data upon termination of the agreement.

8.1  toti80 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by applicable law. The following default retention periods apply:

• Account and identity data: retained for the duration of your account plus five (5) years following account closure, to meet anti-money laundering record-keeping obligations.
• Financial transaction records: retained for five (5) years from the date of the transaction in accordance with financial record-keeping requirements.
• KYC documents: retained for five (5) years from the date of submission or account closure, whichever is later.
• Support communications: retained for two (2) years from the date of the most recent interaction, unless the communication relates to an ongoing dispute or legal matter.
• Technical and usage logs: retained for twelve (12) months, after which they are aggregated and anonymized.
• Marketing consent records: retained for the duration of your consent plus two (2) years to evidence compliance.

8.2  Upon expiry of the applicable retention period, toti80 will securely delete or anonymize your Personal Data so that it can no longer be associated with you as an individual.

9.1  toti80 implements a comprehensive set of technical and organizational security measures to protect your Personal Data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures include:

• Transport encryption: all data transmitted between your device and the toti80 Platform is protected by TLS 1.3 / 256-bit SSL encryption.
• Data-at-rest encryption: Personal Data stored on toti80 servers is encrypted using AES-256 encryption.
• Access controls: access to Personal Data is restricted to toti80 staff who have a genuine operational need. All staff with data access undergo regular data protection training and are bound by confidentiality obligations.
• Two-factor authentication (2FA): available to all members and mandatory for all internal staff accounts with access to Personal Data systems.
• Penetration testing: toti80's infrastructure undergoes regular independent security audits and penetration tests to identify and remediate vulnerabilities.
• Incident response: toti80 maintains a documented data breach response procedure. In the event of a breach that is likely to result in risk to your rights, we will notify affected members within 72 hours of becoming aware of the incident.

9.2  While toti80 takes every reasonable precaution to protect your Personal Data, no internet transmission or digital storage system is completely secure. You are responsible for maintaining the security of your account credentials and for notifying toti80 immediately if you suspect unauthorized access to your account.

10.1  The toti80 Platform uses Cookies and similar tracking technologies to deliver a functional and personalized experience. The following categories of Cookies are used:

10.2  toti80 does not use third-party advertising cookies, social media tracking pixels, or behavioral retargeting technologies on the Platform.

10.3  Essential and security Cookies are required for the Platform to function correctly and cannot be disabled. You may configure your browser to refuse or delete functional and analytics Cookies; however, doing so may impair certain features of the Platform.

11.1  As a toti80 member you hold the following rights in respect of your Personal Data. To exercise any of these rights, please contact our Data Protection team at [email protected] with the subject line "Data Rights Request":

• Right of Access: you may request a copy of all Personal Data toti80 holds about you, along with information about how it is processed.
• Right to Rectification: you may request correction of any inaccurate or incomplete Personal Data held in your account.
• Right to Erasure: you may request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, subject to toti80's legal retention obligations (see Section 8).
• Right to Restriction: you may request that toti80 restrict processing of your Personal Data in certain circumstances, such as where you contest the accuracy of the data or object to its use.
• Right to Data Portability: you may request a machine-readable export of the Personal Data you have provided to toti80, where processing is based on your consent or the performance of a contract.
• Right to Object: you may object to processing based on legitimate interests — including direct marketing — at any time. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

11.2  toti80 will respond to all data rights requests within 30 calendar days of receipt. Where a request is complex or numerous, we may extend this period by a further 60 days, in which case we will notify you of the extension and the reason for it within the initial 30-day window.

11.3  toti80 will not charge a fee for handling data rights requests unless a request is manifestly unfounded or excessive, in which case a reasonable administrative fee may apply.

12.1  The toti80 Platform is strictly intended for adults aged 21 years and older. toti80 does not knowingly collect, process, or store Personal Data from individuals under the age of 21.

12.2  If toti80 becomes aware that a member is under the age of 21, the account will be immediately suspended, all Personal Data associated with that account will be permanently deleted, and any funds deposited will be returned to the originating payment method following identity verification.

12.3  If you are a parent or guardian and believe that a minor in your care has registered an account with toti80, please contact us immediately at [email protected]. We will investigate and act upon all such reports within 24 hours.

13.1  The toti80 Platform may occasionally reference third-party services (such as game studios like Pragmatic Play, Evolution Gaming, or Spribe) whose own privacy practices govern how they handle any data you interact with directly through their embedded products. toti80 is not responsible for the privacy practices of third-party content providers operating within the Platform.

13.2  Where third-party game content is delivered via embedded iframes or APIs within the toti80 Platform, toti80 requires those providers to maintain data security standards consistent with our own. However, we encourage you to review the privacy documentation of any third-party provider whose services you use.

14.1  toti80 reserves the right to update this Privacy Policy at any time. When material changes are made — meaning changes that significantly affect your rights or our data handling practices — toti80 will notify you by email at least seven (7) days before the updated Policy takes effect.

14.2  The updated Policy will be published on this page with a revised "Last Updated" date. Your continued use of the toti80 Platform after the effective date of any update constitutes acceptance of the revised Policy. If you do not accept the updated Policy, you must cease using the Platform and may request account closure in accordance with our Terms & Conditions.

15.1  If you have any questions, concerns, or requests regarding this Privacy Policy or the way toti80 handles your Personal Data, please contact our team using the details below. All privacy-related enquiries will be handled with the highest priority and treated in strict confidence.

• Email: [email protected]
• Subject Line: "Privacy Policy Enquiry" or "Data Rights Request"
• Response Time: Within 24 hours for general enquiries; within 30 calendar days for formal data rights requests
• Support Hours: 24 hours a day, 7 days a week (WIB, UTC+7)

Reminder: toti80 is a Trusted and Secure Platform. All data is protected by 256-bit SSL encryption. We are committed to transparency, security, and your right to privacy. toti80 strictly enforces a 21+ policy — this platform is for adults only.