toti12 Privacy Policy

1. Definitions

In this Privacy Policy, the following terms carry the meanings defined below unless the context clearly requires otherwise:

• "Platform" means the toti12 website at https://toti12.cam and any associated mobile-optimised interface.
• "Operator", "We", "Us", "Our" refers to the legal entity that owns and operates toti12.
• "User", "You", "Your" refers to any individual who registers an account, visits the Platform, or uses any service provided by toti12.
• "Personal Data" means any information that identifies or could reasonably be used to identify a natural person — including name, date of birth, email address, IP address, device identifiers, and financial data.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, erasure, or destruction.
• "Third Party" means any individual or legal entity that is not the Operator or the User.
• "KYC" (Know Your Customer) refers to the identity verification process required before Users may withdraw funds, as described in our Terms & Conditions.
• "Cookie" means a small text file placed on your device by a website to store information about your preferences and activity.

2. Personal Data We Collect

2.1 Data You Provide Directly

When you register an account, complete KYC verification, make a deposit, contact our support team, or otherwise interact with toti12, you provide us with Personal Data. The categories of data collected in this manner include:

Data Category	Examples	Collection Context
Identity Data	Full legal name, date of birth, nationality	Account registration, KYC verification
Contact Data	Email address, phone number, residential address	Account registration, support enquiries
Verification Documents	KTP (Indonesian National ID), passport, driver's licence, utility bills	KYC verification process
Financial Data	Bank account name and number (BCA, BRI, BNI, Mandiri, etc.), e-wallet account details (GoPay, OVO, DANA)	Deposit and withdrawal processing
Communications Data	Live chat transcripts, email correspondence, support ticket content	Customer support interactions

2.2 Data We Collect Automatically

When you visit or use the Platform, we automatically collect certain technical and behavioural data. This includes:

• Technical Data: IP address, browser type and version, device type, operating system, and screen resolution.
• Usage Data: Pages viewed, features used, time and duration of visits, click paths, and search queries within the Platform.
• Transaction Data: Betting history, deposit and withdrawal records, game participation records, and account balance changes.
• Location Data: General geographic location derived from your IP address (city and country level — not GPS-level precision).
• Cookie Data: Session identifiers, preference settings, and analytics data collected via cookies and similar tracking technologies. See Section 5 for full cookie details.

2.3 Data From Third Parties

In certain circumstances, we may receive Personal Data about you from third parties. This includes identity verification data from KYC service providers, fraud risk scores from payment security partners, and technical data from analytics providers. We only use such data where we have a lawful basis to do so and where the third party has confirmed that the data was obtained legitimately.

3. How We Use Your Personal Data

toti12 processes your Personal Data only for specific, legitimate purposes. We do not use your data for any purpose incompatible with those originally disclosed. The lawful bases and purposes for which we process your data are as follows:

Purpose	Lawful Basis	Data Categories Used
Account registration and management	Contractual necessity	Identity, Contact
Identity verification (KYC)	Legal obligation; contractual necessity	Identity, Verification Documents
Processing deposits and withdrawals	Contractual necessity	Financial, Identity
Customer support	Contractual necessity; legitimate interests	Identity, Contact, Communications
Fraud prevention and security monitoring	Legal obligation; legitimate interests	Technical, Transaction, Identity
Responsible gaming monitoring	Legal obligation; legitimate interests	Transaction, Usage
Platform improvement and analytics	Legitimate interests	Usage, Technical, Cookie
Promotional communications (where opted in)	Consent	Contact, Transaction
Legal and regulatory compliance	Legal obligation	Identity, Financial, Transaction

3.1 Marketing Communications

toti12 will only send you promotional emails, bonus offers, and other marketing communications if you have explicitly opted in to receiving them. You may withdraw consent at any time by clicking the unsubscribe link in any marketing email or by contacting us at [email protected]. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

3.2 Automated Decision-Making

We use automated systems to monitor for fraudulent activity, suspicious betting patterns, and potential bonus abuse. These systems may flag accounts for manual review or, in clear cases of fraud, trigger automatic suspension. If your account is affected by an automated decision, you have the right to request human review of that decision. Please contact our support team to exercise this right.

4. Data Sharing and Disclosure

4.1 We Do Not Sell Your Data

toti12 does not sell, rent, or trade your Personal Data to any third party for commercial purposes. Your data is yours. We share it only in the limited circumstances described below, and only to the extent necessary for the specified purpose.

4.2 Authorised Third-Party Service Providers

We engage trusted third-party service providers who process Personal Data on our behalf under strict contractual data processing agreements. These providers are only permitted to process your data for the specific purpose for which they are engaged. Categories of service providers include:

• Payment Processors: Banks (BCA, BRI, BNI, Mandiri, CIMB Niaga) and e-wallet providers (GoPay, OVO, DANA, ShopeePay, LinkAja) process transaction data to execute deposits and withdrawals.
• KYC and Identity Verification Providers: Specialist third-party services that verify the authenticity of identity documents and cross-reference against sanctions and PEP (Politically Exposed Persons) lists.
• Fraud Prevention and Risk Management Partners: Providers that analyse transaction and behavioural patterns to detect and prevent fraudulent activity.
• Cloud Infrastructure Providers: Hosting and data storage providers that maintain the servers on which Platform data is stored. All data is stored on servers with enterprise-grade physical and logical security controls.
• Customer Support Platforms: Third-party tools used to manage live chat and ticketing interactions. These providers access communications data only as needed to deliver the support service.
• Analytics Providers: Tools that aggregate anonymised usage data to help us understand how the Platform is used and where improvements are needed.

4.3 Legal Disclosure

We may disclose your Personal Data to law enforcement agencies, regulatory bodies, or other authorised government authorities where we are legally required to do so, or where we believe in good faith that such disclosure is necessary to prevent illegal activity, protect the rights or safety of any person, or comply with a court order, subpoena, or binding legal process.

4.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of the toti12 business, your Personal Data may be transferred to the acquiring entity. You will be notified of any such transfer and the acquiring entity will be bound by the terms of this Privacy Policy or an equivalent policy offering no less protection.

5. Cookies and Track ing Technologies

5.1 What Are Cookies?

Cookies are small text files placed on your device when you visit a website. They help the website recognise your device on subsequent visits and remember your preferences. Cookies do not contain executable code and cannot harm your device.

5.2 Types of Cookies We Use

toti12 uses the following categories of cookies:

• Essential Cookies: Required for the Platform to function. These enable core features such as login sessions, account authentication, and secure transaction processing. You cannot opt out of essential cookies if you wish to use the Platform.
• Performance Cookies: Collect anonymous data about how visitors use the Platform — which pages are most popular, how long users spend on each page, and whether error messages are displayed. We use this data to improve Platform performance and user experience.
• Functional Cookies: Remember your preferences, such as language settings, display options, and previously viewed content. These cookies enhance convenience but are not strictly essential.
• Analytics Cookies: Used by third-party analytics tools (such as Google Analytics) to understand visitor behaviour at an aggregate level. Data collected via analytics cookies is anonymised and cannot be used to identify you personally.

5.3 Managing Cookie Preferences

You may disable or delete cookies through your browser settings. However, disabling essential cookies will prevent you from accessing certain features of the Platform, including login and account management. Instructions for managing cookies in popular browsers are available at:

• Chrome: Settings > Privacy and Security > Cookies
• Firefox: Options > Privacy & Security > Cookies and Site Data
• Safari: Preferences > Privacy > Manage Website Data
• Edge: Settings > Cookies and Site Permissions

6. Data Security Measures

6.1 Our Commitment to Security

Protecting your Personal Data is a top priority at toti12. We implement industry-standard technical and organisational security measures to safeguard data against unauthorised access, loss, misuse, disclosure, alteration, and destruction.

6.2 Technical Security Controls

All data transmitted between your device and our servers is encrypted using TLS 1.3 (Transport Layer Security) with 256-bit encryption. Personal Data stored on our servers is encrypted at rest using AES-256 encryption. Access to databases containing Personal Data is restricted to authorised personnel only, and all access is logged for audit purposes. We employ firewalls, intrusion detection systems, and regular security audits conducted by independent third-party security firms.

6.3 Organisational Security Measures

Access to Personal Data within toti12 is granted on a strict need-to-know basis. All employees and contractors who handle Personal Data are bound by confidentiality agreements and receive mandatory data protection training. We maintain a formal data breach response plan and will notify affected Users and relevant regulatory authorities within 72 hours of becoming aware of any breach that poses a risk to User rights.

6.4 Limitations

While we implement robust security measures, no method of electronic storage or transmission over the internet is 100% secure. We cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials. If you suspect unauthorised access to your account, notify us immediately at [email protected].

7. Your Rights as a Data Subject

Under internationally recognised data protection principles, you hold the following rights concerning your Personal Data. toti12 respects and facilitates the exercise of these rights.

• Right of Access: You have the right to request a copy of all Personal Data we hold about you. We will provide this data in a structured, commonly used, machine-readable format within 30 days of your request.
• Right to Rectification: If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request correction. You may update most data directly through your account settings, or contact support for assistance.
• Right to Erasure (Right to Be Forgotten): You may request deletion of your Personal Data under certain conditions, such as when the data is no longer necessary for the purposes for which it was collected, or when you withdraw consent. Note that we may be legally required to retain certain data (e.g., transaction records for anti-money laundering compliance) even after account closure.
• Right to Restriction of Processing: You may request that we temporarily suspend processing of your Personal Data in certain circumstances, such as while we verify the accuracy of contested data or assess whether we have legitimate grounds to continue processing.
• Right to Data Portability: You have the right to receive your Personal Data in a portable format and, where technically feasible, to have it transmitted directly to another service provider. This right applies to data processed on the basis of consent or contractual necessity.
• Right to Object: You may object to processing of your Personal Data where we rely on legitimate interests as the lawful basis. If you object, we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted prior to withdrawal.

7.1 Exercising Your Rights

To exercise any of the rights described above, please contact us at [email protected] with the subject line "DATA SUBJECT REQUEST". Include your full name, registered email address, and a clear description of the right you wish to exercise. We will respond within 30 days. In complex cases, we may extend this period by an additional 60 days, and we will inform you of any such extension.

7.2 Right to Lodge a Complaint

If you believe that toti12 has processed your Personal Data in violation of applicable data protection laws, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction. We encourage you to contact us first so that we may address your concerns directly.

8. Data Retention

8.1 Retention Principles

We retain Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Different categories of data are subject to different retention periods based on legal, regulatory, and operational requirements.

8.2 Retention Periods by Data Category

Data Category	Retention Period	Reason
Identity and KYC Data	5 years after account closure	Anti-money laundering and regulatory compliance
Transaction Records	7 years after transaction date	Financial record-keeping and tax compliance
Communications Data	3 years after last interaction	Dispute resolution and service improvement
Usage and Technical Data	2 years	Platform improvement and security monitoring
Marketing Consent Records	Until consent is withdrawn, then deleted immediately	Compliance with consent requirements

8.3 Secure Deletion

When Personal Data reaches the end of its retention period, it is securely deleted or anonymised in a manner that prevents reconstruction. Deletion is carried out in accordance with industry best practices, including overwriting of storage media and secure destruction of physical records.

9. International Data Transfers

9.1 Cross-Border Transfers

toti12 operates internationally and may transfer your Personal Data to countries outside Indonesia for processing and storage. Some of these countries may not offer the same level of data protection as Indonesia. Where we transfer data internationally, we implement appropriate safeguards to protect your rights.

9.2 Safeguards for International Transfers

All international data transfers are governed by:

• Standard Contractual Clauses (SCCs) approved by recognised data protection authorities, which impose strict data protection obligations on the receiving party.
• Adequacy decisions, where the destination country has been deemed to provide an adequate level of data protection.
• Binding Corporate Rules (BCRs) where data is transferred within a multinational corporate group that has adopted consistent global data protection standards.

9.3 Data Centre Locations

Our primary data centres are located in jurisdictions with robust data protection frameworks. You may request information about the specific countries where your data is stored by contacting us at [email protected].

10. Contact and Data Enquiries

10.1 Data Protection Contact

If you have any questions about this Privacy Policy, wish to exercise your data subject rights, or need to report a data security concern, please contact us:

• Email: [email protected] (plain text — not a clickable link)
• Subject Line for Data Requests: "PRIVACY ENQUIRY" or "DATA SUBJECT REQUEST"
• Response Time: We aim to respond to all privacy enquiries within 48 hours, and to complete data subject requests within 30 days.

10.2 Changes to This Policy

We reserve the right to update this Privacy Policy at any time to reflect changes in our data processing practices, legal requirements, or operational needs. Material changes will be communicated to Users via email at least 14 days before they take effect. The "Effective Date" at the top of this Policy indicates when it was last revised. We encourage you to review this Policy periodically.