Privacy Policy

tot80 ("we", "us", "our") operates the online betting and casino platform at https://tot80.bet (the "Platform"). We are committed to protecting the privacy and personal data of every individual who registers an Account with us, accesses the Platform, or otherwise engages with our services.

This Privacy Policy ("Policy") sets out in clear terms what personal data tot80 collects from users in Indonesia and internationally, the purposes for which that data is processed, the legal grounds on which we rely to do so, and the rights available to you as a data subject. It applies to all products and services offered through the tot80 Platform, including our sportsbook, live casino, slots, sabung ayam (Indonesia's traditional live-streamed cockfighting betting product), Dragon Tiger, and all other game categories.

This Policy should be read alongside our Terms & Conditions, which govern your use of the Platform as a whole. By registering an Account or continuing to use the Platform after this Policy has been updated, you acknowledge that you have read and understood its contents. If you do not agree with any aspect of this Policy, you should not register an Account or continue using the Platform.

For the purposes of applicable data protection legislation, tot80 is the data controller responsible for the personal data you provide to us or that we collect during your use of the Platform. As data controller, tot80 determines the purposes and means by which your personal data is processed.

If you have any questions about this Policy, wish to exercise any of your data subject rights, or wish to raise a concern about how we handle your personal data, you may contact our Data Protection Officer (DPO) at [email protected]. We aim to respond to all data-related enquiries within 30 days of receipt.

tot80 collects personal data across several categories, depending on how you interact with the Platform. The table below summarises the main categories of data we process:

We do not collect special categories of sensitive personal data (such as health data, biometric data for identification purposes, or data revealing racial or ethnic origin) unless this is strictly required for responsible gaming assessment or is explicitly provided by you in the context of a self-exclusion request.

tot80 collects personal data through the following channels:

• Direct Interactions: When you register an Account, complete our KYC verification process, make a deposit or withdrawal, place a bet, contact our support team, or submit any form on the Platform, you provide personal data directly to us.
• Automated Technical Collection: When you access the Platform, our servers automatically record technical data including your IP address, device identifiers, browser fingerprint, and session behaviour. This data is collected through server logs, cookies, and similar tracking technologies (see Clause 9 for full details).
• Third-Party Identity Verification Providers: When you complete KYC verification, we share identity documents with licensed third-party verification services who return a verification result and risk score. Those providers process your data under their own privacy policies, which are consistent with internationally recognised data protection standards.
• Payment Processors: When you make a deposit or withdrawal via local Indonesian banks or e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja), the payment processor confirms transaction status and transmits limited transaction data to tot80 for reconciliation purposes.
• Fraud Prevention and AML Systems: tot80 may receive data from licensed third-party fraud detection and anti-money laundering (AML) screening services in order to fulfill our compliance obligations.
• Game Studios: Third-party game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may transmit game session data (bet amounts, game outcomes, session durations) to tot80 as part of the service integration. This data is governed by the data-sharing agreements between tot80 and those studios.

tot80 processes your personal data for the following specific purposes:

• Account Registration and Management: To create and administer your Account, verify your identity and age, maintain your account settings and preferences, and communicate essential account updates to you.
• Service Delivery: To enable you to place bets, play casino games, access live dealer tables, process deposits and withdrawals in IDR, and use all features of the Platform.
• KYC and Age Verification: To verify that you are at least 21 years of age and to confirm your identity in compliance with our international licensing obligations and AML standards.
• Payment Processing: To process deposits via BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, and supported e-wallets, and to process withdrawal requests to your registered payment account.
• Responsible Gaming: To monitor wagering patterns for signs of problem gambling, enforce deposit limits and self-exclusion requests, and fulfil our duty of care obligations to our users. Where you have requested a self-exclusion, we retain your data for the purpose of enforcing that exclusion even after it would otherwise be deleted.
• Fraud Prevention and Security: To detect and prevent fraudulent activity, bonus abuse, multi-accounting, money laundering, and unauthorised Account access. This includes automated pattern analysis of betting behaviour and transaction monitoring.
• Legal and Regulatory Compliance: To comply with applicable laws, respond to lawful requests from regulatory or law enforcement authorities, and maintain records as required by our international operating licence.
• Customer Support: To respond to your enquiries, resolve disputes, process complaints, and deliver the 24/7 support service available to all tot80 users.
• Marketing and Promotions: Where you have provided consent, to send you promotional offers, seasonal bonus notifications (e.g., Idul Fitri, Indonesian Independence Day, Imlek promotions), and platform updates via email or in-app messaging. You may withdraw marketing consent at any time by contacting [email protected].
• Platform Improvement: To analyse aggregated usage data, improve the Platform's user experience, optimise game lobby layouts, and develop new features. Where possible, this analysis is performed on anonymised or pseudonymised data.

tot80 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual Necessity: Processing required to perform the contract between you and tot80 — specifically, the Terms & Conditions you accept upon registration. This covers Account creation, service delivery, payment processing, and support.
• Legal Obligation: Processing necessary to comply with applicable legal requirements, including KYC verification obligations, AML transaction monitoring, and regulatory record-keeping requirements under our international gaming licence.
• Legitimate Interests: Processing carried out in the legitimate interests of tot80, provided those interests are not overridden by your data protection rights. This covers fraud prevention, platform security, multi-accounting detection, responsible gaming monitoring, and product analytics. You have the right to object to processing based on legitimate interests (see Clause 11).
• Consent: Processing based on your freely given, specific, and informed consent — primarily for direct marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

tot80 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share personal data only in the following circumstances and only to the extent strictly necessary:

• Licensed Payment Processors: Indonesian bank transfer processors and e-wallet gateways (OVO, DANA, GoPay, ShopeePay, LinkAja) receive your financial data solely to execute and reconcile deposit and withdrawal transactions.
• KYC and Identity Verification Providers: Licensed identity verification services receive your identity documents and return a verification result. These providers are contractually bound to process your data solely for the purpose of identity verification and to maintain data security standards equivalent to those imposed by this Policy.
• Game Studios: Third-party studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft) receive session and account identifiers necessary to deliver their game content within the Platform. They do not receive full identity data.
• Fraud Prevention and AML Services: Specialist compliance services receive transaction and behavioural data to assist tot80 in detecting suspicious activity and fulfilling AML obligations. All such providers operate under binding data processing agreements.
• Regulatory and Law Enforcement Authorities: Where required by applicable law or a lawful order from a competent authority, tot80 will disclose personal data. We will notify you of such disclosure where legally permitted to do so.
• Group Companies and Successors: In the event of a merger, acquisition, or corporate restructuring, your personal data may be transferred to a successor entity, subject to the same privacy protections set out in this Policy. You will be notified of any material change to data controllership.

All third-party service providers engaged by tot80 are required to process personal data only on our documented instructions and to maintain appropriate technical and organisational security measures.

tot80 operates as an international online gaming platform. As a result, your personal data may be transferred to and processed in countries outside Indonesia, including the jurisdiction in which tot80 holds its international operating licence and the locations where our third-party service providers maintain their infrastructure.

Wherever personal data is transferred internationally, tot80 takes appropriate safeguards to ensure that your data continues to receive a level of protection consistent with internationally recognised data protection standards, including:

• Binding data processing agreements with all international service providers that include standard contractual clauses or equivalent protections.
• Transfer impact assessments where required, to evaluate the risk level of transferring data to a given jurisdiction.
• Limiting the scope and volume of data transferred internationally to only what is strictly necessary for the processing purpose.

By registering an Account and accepting our Terms & Conditions, you acknowledge that your personal data may be transferred internationally in accordance with the safeguards described in this clause.

tot80 uses cookies and similar tracking technologies to operate the Platform effectively, maintain session security, and understand how users interact with our services. The table below describes the categories of cookies we use:

Most web browsers allow you to control cookies through their settings preferences. However, disabling strictly necessary or security cookies will impair the functionality of the Platform and may prevent you from logging in to your Account. For more information on managing cookies in your specific browser, refer to your browser's help documentation.

tot80 does not use third-party advertising cookies or behavioural tracking cookies for cross-site advertising purposes.

tot80 retains personal data for only as long as is necessary to fulfil the purposes for which it was collected, or as required by our legal and regulatory obligations. Our standard retention periods are as follows:

• Active Account Data: Retained for the duration of your Account and for a minimum of five years following Account closure, to comply with AML record-keeping requirements and to resolve any disputes that may arise after closure.
• KYC and Identity Documents: Retained for a minimum of five years following Account closure or the conclusion of the business relationship, in line with internationally recognised AML standards.
• Financial Transaction Records: Retained for a minimum of five years from the date of each transaction, in line with financial record-keeping obligations under our operating licence.
• Support and Communications Records: Retained for two years from the date of the last interaction, to enable us to resolve any follow-up queries or complaints effectively.
• Marketing Consent Records: Retained for the duration of the consent period and for one year after consent is withdrawn, as evidence of prior consent status.
• Self-Exclusion Records: Retained indefinitely for permanent self-exclusions, and for a minimum of two years beyond the exclusion end date for temporary self-exclusions, to prevent re-registration during or immediately following an exclusion period.
• Technical and Log Data: Typically retained for 12 months, after which it is anonymised or deleted, except where specific log data is required as evidence in an active fraud investigation or dispute.

Upon expiry of the applicable retention period, tot80 will securely delete or anonymise your personal data in a manner that prevents reconstruction of the original information.

As a data subject, you have the following rights with respect to your personal data held by tot80. To exercise any of these rights, please contact us at [email protected] with a clear description of your request. We will respond within 30 days.

• Right of Access: You have the right to request a copy of the personal data tot80 holds about you (commonly known as a Subject Access Request or SAR). We will provide the information in a structured, commonly used format within 30 days of receiving your request.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request correction. You may update certain data directly within your Account settings; for other corrections, contact our support team.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (and no other legal basis applies), or where the data has been unlawfully processed. This right is subject to our legal retention obligations — data we are required by law to retain cannot be deleted before the mandatory retention period expires.
• Right to Restriction: You may request that tot80 restricts the processing of your personal data in certain circumstances, such as while the accuracy of data is contested, or where processing is unlawful but you prefer restriction over erasure.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity, and is carried out by automated means, you have the right to receive your personal data in a structured, machine-readable format and to transmit it to another controller.
• Right to Object: You have the right to object to processing based on legitimate interests, including profiling carried out for fraud prevention or responsible gaming purposes. tot80 will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., for marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Right to Lodge a Complaint: If you believe tot80 has processed your personal data in a manner that violates applicable data protection law, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction.

tot80 will not charge a fee for responding to data subject requests unless the request is manifestly unfounded, excessive, or repetitive, in which case we reserve the right to charge a reasonable administrative fee or to decline the request, with written explanation.

The tot80 Platform is strictly intended for adults aged 21 and over. We do not knowingly collect, process, or retain personal data from any person under the age of 21. Our registration process includes mandatory date-of-birth verification, and KYC procedures are designed to detect and reject underage registrations.

If you are a parent or guardian and believe that a person under 21 in your care has registered an Account with tot80 or has provided personal data to us without your knowledge, please contact us immediately at [email protected]. We will promptly investigate the matter, close the Account, and securely delete all associated personal data.

If we become aware that an Account belongs to a person under the age of 21, we will suspend that Account immediately, initiate a refund of any remaining real-money Balance, and permanently delete all personal data associated with the Account within 30 days of confirmed identification.

tot80 takes the security of your personal data extremely seriously. We implement a multi-layered approach to data security that includes both technical and organisational safeguards:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the tot80 Platform is protected by industry-standard 256-bit SSL/TLS encryption, ensuring that your credentials, financial data, and personal information cannot be intercepted in transit.
• Encryption at Rest: Sensitive data stored on tot80's servers — including identity documents, financial records, and password hashes — is encrypted at rest using strong cryptographic algorithms. Plain-text passwords are never stored.
• Two-Factor Authentication (2FA): tot80 offers 2FA for all registered Accounts. We strongly recommend enabling 2FA to provide an additional layer of protection against unauthorised Account access.
• Access Controls: Access to personal data within tot80's internal systems is restricted on a strict need-to-know basis. Staff access is governed by role-based access controls, and all data access events are logged for audit purposes.
• Penetration Testing and Security Audits: tot80's Platform and infrastructure undergo regular independent security assessments, including penetration testing and vulnerability scanning, to identify and remediate potential security weaknesses before they can be exploited.
• Incident Response: In the event of a data security incident that is likely to result in a risk to your rights and freedoms, tot80 will notify affected users and, where required, the relevant supervisory authority, within 72 hours of becoming aware of the breach. Notifications will be sent to the email address registered to your Account.

While tot80 takes every reasonable precaution to protect your data, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your Account credentials and for using secure, updated devices and browsers to access the Platform. If you suspect that your Account has been compromised, contact our support team immediately.

tot80 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, our data processing practices, or the services we offer. When material changes are made, we will post a notice on the Platform and, where practicable, notify registered users by email at least 14 days before the amended Policy takes effect.

The "Last Updated" date displayed at the top of this Policy reflects when the most recent version came into force. We encourage you to review this Policy periodically to stay informed about how tot80 protects your data. Your continued use of the Platform after the effective date of any amendment constitutes your acceptance of the updated Policy.

If any amendment materially reduces your privacy rights, we will seek fresh consent where required by applicable law before continuing to process your data on that basis.

If you have any questions, concerns, or complaints regarding this Privacy Policy or tot80's data processing practices, please contact our Data Protection Officer through the following channel:

• Email (plain text — not a clickable link): [email protected]
• Subject line: "Privacy Enquiry — [Your Account Username]"
• Response Time: We aim to respond to all privacy-related enquiries within 30 days of receipt
• Languages: Support is available in both English and Indonesian
• Support Hours: 24 hours a day, 7 days a week

If you are not satisfied with our response to a privacy complaint, you have the right to escalate your complaint to the relevant data protection supervisory authority in your jurisdiction. tot80 will cooperate fully with any supervisory authority investigation.

For urgent data security matters — such as suspected unauthorised access to your Account or a suspected data breach affecting your personal information — please contact our support team immediately via the live chat function available within the Platform after login. Our security team operates 24/7 and will take immediate action to protect your Account and personal data.