Privacy Policy

1. Introduction and Scope

aatoto ("we," "us," "our") is committed to protecting the privacy and security of all personal data we collect from users ("you," "your") of our online gaming platform. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you register an account, use our services, or interact with us through any channel.

This Policy applies to all users of aatoto, with particular relevance to residents of Indonesia. By creating an account or using any aatoto service, you consent to the collection and use of your data as described in this Policy. If you do not agree with any part of this Policy, you should cease using the platform immediately.

This Policy should be read alongside our Terms & Conditions, which govern your general use of aatoto, and our Responsible Gaming policy, which describes the tools and data we use to promote safe play.

2. Definitions

• "Personal Data" means any information that directly or indirectly identifies a natural person, including name, date of birth, national identity number, email address, phone number, bank account details, IP address, and device identifiers.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, and deletion.
• "Data Controller" means aatoto, the entity that determines the purposes and means of processing your personal data.
• "Third Party" means any natural or legal person other than you or aatoto, including payment processors, identity verification providers, and analytics vendors.
• "KYC" (Know Your Customer) refers to the identity verification process required by international gaming regulations before account activation and withdrawal processing.

3. Data We Collect

3.1 Information You Provide Directly

When you register an account, make a deposit or withdrawal, contact customer support, or participate in a promotion, you provide us with personal data. This includes:

• Full legal name as it appears on your Indonesian National Identity Card (KTP)
• Date of birth (to verify you are 21 years of age or older)
• Email address and mobile phone number
• Residential address in Indonesia
• Bank account details for Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI) or e-wallet accounts (OVO, DANA, GoPay, ShopeePay, LinkAja)
• Copies of identity documents submitted for KYC verification (KTP, proof of address)
• Profile photo if submitted for enhanced verification
• Any information you provide when contacting customer support

3.2 Data Collected Automatically

When you use the aatoto platform, we automatically collect certain technical data necessary for platform operation, security, and performance optimization:

• IP address and geographic location (country and city level)
• Device type, model, and operating system
• Browser type and version
• Session timestamps, login and logout times
• Pages and features accessed within the platform
• Betting history, game sessions, transaction records
• Connection quality and latency data

3.3 Data from Third Parties

We may receive data about you from third parties in specific circumstances:

• Identity verification providers that cross-reference your submitted KYC documents against government databases
• Payment processors that confirm the validity and ownership of your registered bank account or e-wallet
• Fraud detection services that flag unusual transaction patterns
• Responsible gaming partners that operate voluntary self-exclusion registers

4. How We Use Your Data

aatoto processes personal data only for legitimate, specified purposes. The table below summarizes our primary data uses and the legal basis for each:

Purpose	Data Used	Legal Basis
Account registration and management	Name, email, phone, date of birth, address	Contractual necessity
Identity verification (KYC)	KTP, proof of address, date of birth	Legal obligation
Processing deposits and withdrawals	Bank account details, transaction history	Contractual necessity
Fraud prevention and security	IP address, device data, transaction patterns	Legitimate interest
Responsible gaming monitoring	Betting history, session data, deposit amounts	Legal obligation / legitimate interest
Customer support	Account data, communication records	Contractual necessity
Promotional communications	Email, phone, betting preferences	Consent (opt-in)
Platform improvement and analytics	Aggregated, anonymized usage data	Legitimate interest
Regulatory compliance and reporting	Transaction records, identity documents	Legal obligation

5. Data Sharing and Disclosure

5.1 Service Providers

aatoto works with carefully selected third-party service providers who assist us in delivering our platform. These providers may process your personal data on our behalf, strictly under our instructions and subject to confidentiality agreements. Categories of providers include:

• Payment processors and banking technology partners that facilitate deposits and withdrawals to Indonesian banks and e-wallets
• KYC and identity verification vendors
• Cloud hosting and infrastructure providers
• Customer support software platforms
• Anti-frau d and transaction monitoring services
• Email and SMS communication platforms
• Analytics and performance monitoring tools

All service providers are contractually bound to process data only as directed by aatoto and to implement appropriate security measures. They are prohibited from using your data for their own purposes or sharing it with third parties without our authorization.

5.2 Legal and Regulatory Disclosure

aatoto may disclose personal data when required by law or when we believe in good faith that disclosure is necessary to:

• Comply with a legal obligation, court order, or regulatory request from gaming authorities or law enforcement
• Enforce our Terms & Conditions or investigate potential violations
• Protect the rights, property, or safety of aatoto, our users, or the public
• Detect, prevent, or address fraud, security breaches, or technical issues

5.3 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your personal data may be transferred to the successor entity. You will be notified via email and/or a prominent notice on the platform before any such transfer, and you will have the opportunity to request deletion of your data before the transfer is completed.

6. Data Retention

aatoto retains personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods include:

• Active Accounts: Personal data is retained for the lifetime of your account plus 7 years after account closure, as required by international gaming regulations and Indonesian financial record-keeping laws.
• Transaction Records: Deposit, withdrawal, and betting history is retained for 7 years after the transaction date for audit, tax, and dispute resolution purposes.
• Identity Documents: Copies of KTP and proof of address submitted for KYC are retained for 7 years after account closure or the last verification update, whichever is later.
• Marketing Communications: Email addresses and phone numbers used for promotional purposes are retained until you opt out or request deletion.
• Customer Support Records: Chat logs, emails, and support tickets are retained for 3 years after the last interaction for quality assurance and training purposes.
• Closed/Suspended Accounts: Data from accounts closed for fraud, bonus abuse, or Terms & Conditions violations is retained indefinitely to prevent future account creation by the same individual.

After the applicable retention period expires, personal data is securely deleted or anonymized so that it can no longer be associated with you as an identifiable individual.

7. Data Security

aatoto employs industry-standard technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. Our security infrastructure includes:

• Encryption: All data transmitted between your device and our servers is encrypted using 256-bit TLS/SSL encryption. Sensitive data stored in our databases (passwords, payment details) is encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data is restricted to authorized personnel who require it to perform their job functions. All access is logged, monitored, and subject to periodic audit.
• Network Security: Our servers are protected by enterprise-grade firewalls, intrusion detection systems, and DDoS mitigation services.
• Secure Development: Our development team follows secure coding practices and conducts regular security audits and penetration testing to identify and remediate vulnerabilities.
• Incident Response: We maintain a documented incident response plan to detect, contain, and respond to data breaches. In the event of a breach affecting your data, we will notify you within 72 hours in accordance with data protection regulations.
• Third-Party Audits: aatoto undergoes periodic security audits by independent third-party firms to validate the effectiveness of our security controls.

While we implement robust security measures, no method of transmission over the internet or electronic storage is 100% secure. You are responsible for maintaining the confidentiality of your account credentials and should contact us immediately if you suspect unauthorized access to your account.

8. Your Privacy Rights

Under international data protection principles and Indonesian consumer protection laws, you have the following rights regarding your personal data:

8.1 Right of Access

You have the right to request a copy of the personal data we hold about you. You can download most of your account data directly from your account settings. For a comprehensive data export, contact our support team at [email protected] with the subject line "Data Access Request." We will respond within 14 business days.

8.2 Right to Rectification

If any personal data we hold about you is inaccurate or incomplete, you have the right to request correction. You can update your email, phone number, and address directly in your account settings. To update your registered name or bank account, contact support with proof of the correct information.

8.3 Right to Deletion

You may request deletion of your personal data by closing your account and submitting a deletion request to support. Please note that we may be required to retain certain data for legal compliance purposes (transaction records, KYC documents) even after account closure. Deletion requests are processed within 30 days.

8.4 Right to Restriction

You may request that we restrict the processing of your data in certain circumstances, such as while we verify the accuracy of disputed data or assess whether we have legitimate grounds to continue processing it.

8.5 Right to Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format (e.g., CSV, JSON) and to transmit it to another service provider. Contact support to request a data portability export.

8.6 Right to Object

You may object to processing of your data for direct marketing purposes at any time by clicking the "unsubscribe" link in promotional emails or adjusting your communication preferences in account settings. You may also object to processing based on legitimate interests by contacting support with your specific concerns.

8.7 Right to Withdraw Consent

Where we process your data based on your consent (e.g., marketing communications), you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted before withdrawal.

8.8 How to Exercise Your Rights

To exercise any of the above rights, contact aatoto customer support at [email protected] with your full name, registered email address, and a description of your request. We may request additional verification (such as answering security questions) to confirm your identity before processing the request. We will respond to all valid requests within 14 business days.

9. Cookies and Tracking Technologies

aatoto uses cookies and similar tracking technologies to enhance your experience on our platform, analyze usage patterns, and deliver personalized content. A cookie is a small text file stored on your device by your web browser.

9.1 Types of Cookies We Use

• Essential Cookies: Required for basic platform functionality such as maintaining your login session, processing transactions, and remembering your language preference. These cookies cannot be disabled.
• Performance Cookies: Collect anonymous data about how you use the platform (pages visited, time spent, features used) to help us optimize performance and identify technical issues.
• Functional Cookies: Remember your preferences (e.g., odds format, time zone, favorite games) to provide a personalized experience.
• Analytics Cookies: Used by third-party analytics platforms (e.g., Google Analytics) to generate aggregated statistics about platform usage. These cookies do not directly identify you.

9.2 Managing Cookies

You can control and delete cookies through your browser settings. Most browsers allow you to refuse cookies or delete existing cookies. Please note that disabling essential cookies will impair platform functionality and you may not be able to use certain features. Disabling non-essential cookies will not affect core functionality but may reduce personalization.

10. International Data Transfers

aatoto is licensed and regulated internationally, and our technical infrastructure may be located in jurisdictions outside Indonesia. When we transfer personal data outside Indonesia, we ensure that it receives an equivalent level of protection through:

• Contractual agreements with third-party processors that incorporate standard data protection clauses
• Ensuring the recipient jurisdiction is recognized as having adequate data protection standards
• Implementing technical safeguards such as encryption during transit and at rest

By using aatoto, you consent to the international transfer of your personal data as described in this section.

11. Children's Privacy

aatoto services are strictly intended for adults aged 21 years and older. We do not knowingly collect personal data from individuals under 21. If we become aware that we have inadvertently collected data from a minor, we will take immediate steps to delete that data and close the associated account. If you believe a minor has registered an account on aatoto, please contact us immediately at [email protected].

12. Changes to This Privacy Policy

aatoto reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or platform features. When we make material changes, we will notify you by:

• Posting a prominent notice on the aatoto homepage and login page
• Sending an email notification to your registered email address
• Requiring you to review and accept the updated Policy before your next login

The "Last Updated" date at the top of this Policy indicates when it was most recently revised. We encourage you to review this Policy periodically. Continued use of the platform after changes are posted constitutes your acceptance of the updated Policy.

13. Contact Information and Complaints

If you have questions about this Privacy Policy, concerns about how your data is being processed, or wish to file a complaint, please contact aatoto's Data Protection Officer:

• Email: [email protected] (Subject: Privacy Inquiry)
• Live Chat: Available 24/7 on the aatoto platform

We will acknowledge your inquiry within 48 hours and provide a substantive response within 14 business days. If you are not satisfied with our response, you have the right to file a complaint with the relevant data protection authority in your jurisdiction.