Privacy Policy

1. Introduction

Welcome to the optoto Privacy Policy. At optoto, we are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, store, and protect your personal data when you use the optoto platform at https://optoto.cam (the "Website") and our associated services (collectively, the "Services").

This Privacy Policy applies to all Indonesian players and users who access or use our sports betting, casino gaming, lottery, and related entertainment services. By creating an account on optoto, accessing our Website, or using our Services, you acknowledge that you have read, understood, and agree to the data practices described in this Privacy Policy.

If you do not agree with our data collection, usage, or disclosure practices outlined in this Privacy Policy, you should not use the optoto platform. We take our data protection obligations seriously and have implemented appropriate technical and organizational measures to ensure your personal information remains secure, confidential, and processed in accordance with applicable international data protection regulations.

2. Data Controller

The data controller responsible for your personal information collected through the optoto platform is optoto and its authorized operators. For data protection inquiries, privacy rights requests, or concerns about how we handle your personal information, please contact our Data Protection Officer using the contact details provided in Section 14 of this Privacy Policy.

As the data controller, optoto determines the purposes and means of processing your personal data. We process your information in accordance with our legitimate business interests, legal obligations under international gaming regulations, and our contractual relationship with you as a player on our platform.

3. Information We Collect

To provide our sports betting and casino gaming services to Indonesian players, optoto collects several categories of personal information through various means when you interact with our platform:

3.1 Information You Provide Directly

When you register an account on optoto or use our Services, you voluntarily provide us with the following information:

• Account Registration Information: Full legal name, date of birth, email address, mobile phone number, residential address, chosen username, and secure password.
• Identity Verification Documents: Government-issued identification documents such as Indonesian KTP (Kartu Tanda Penduduk) or passport for age and identity verification (KYC compliance). This may include photographs, ID numbers, issue dates, and expiration dates.
• Financial Information: Bank account details (bank name, account number, account holder name) for Indonesian banks including BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, and BSI, as well as e-wallet information (OVO, DANA, GoPay, ShopeePay, LinkAja account numbers).
• Communication Data: Information you provide when contacting customer support via live chat, email, WhatsApp, or in-app messaging, including your inquiries, complaints, feedback, and our responses.
• Voluntary Information: Any additional information you choose to provide in your account profile, promotional surveys, responsible gaming self-assessments, or preference settings.

3.2 Information We Collect Automatically

When you access the optoto Website or use our Services, we automatically collect certain information about your device and usage patterns:

• Technical Information: IP address, device type (mobile, tablet, desktop), operating system, browser type and version, screen resolution, device identifiers, and mobile network information.
• Usage Data: Pages viewed, features accessed, time spent on the platform, navigation paths, referring/exit pages, date and time stamps of visits, and interaction patterns with games and betting markets.
• Gaming Activity: Sports bets placed (including bet type, stake amount, odds, outcome), casino games played, lottery numbers selected, session duration, win/loss records, bonus utilization, and responsible gaming tool usage (deposit limits, session time settings, reality check acknowledgments).
• Transaction History: Complete record of all financial transactions including deposit amounts, deposit methods, deposit timestamps, withdrawal requests, withdrawal amounts, withdrawal methods, withdrawal processing times, and transaction statuses.
• Location Data: Approximate geographic location derived from your IP address to verify compliance with jurisdictional restrictions and detect suspicious login attempts from unusual locations.

3.3 Information from Third Parties

We may receive information about you from third-party sources including:

• Payment Processors: Transaction confirmation, payment verification, and fraud detection data from Indonesian banks (BCA, BRI, BNI, Mandiri) and e-wallet providers (OVO, DANA, GoPay).
• Identity Verification Services: Age verification, identity authentication, and document validation results from third-party KYC service providers.
• Fraud Prevention Partners: Risk assessment scores, fraud alerts, and security intelligence from specialist providers who help us detect and prevent fraudulent activities, bonus abuse, and money laundering.
• Affiliate Partners: Information about how you discovered optoto if you arrived through an affiliate referral link or marketing campaign.

4. How We Use Your Information

optoto processes your personal data for the following specific purposes, each directly related to providing you with secure, legal, and responsible gaming services:

4.1 Account Management and Service Provision

• Create, maintain, and administer your optoto player account
• Verify your age (21+ requirement) and identity through KYC procedures
• Authenticate your login attempts and secure your account access
• Process your deposits and withdrawals through Indonesian banks and e-wallets
• Enable you to place sports bets, play casino games, and participate in lottery draws
• Track and display your gaming history, transaction records, and account balance
• Provide customer support and respond to your inquiries via live chat, email, or WhatsApp

4.2 Regulatory Compliance and Legal Obligations

• Comply with international gaming license requirements and regulatory reporting obligations
• Conduct anti-money laundering (AML) checks and suspicious transaction monitoring
• Verify that you meet eligibility requirements (age, jurisdiction, legal capacity)
• Maintain audit trails for regulatory inspections by licensing authorities
• Respond to valid legal requests from law enforcement or governmental authorities
• Enforce our Terms & Conditions and detect violations of prohibited activities

4.3 Fraud Prevention and Security

• Detect and prevent fraudulent account creation, identity theft, and payment fraud
• Identify bonus abuse, collusion between players, and syndicated betting patterns
• Monitor for unusual account activity, suspicious login locations, and potential security breaches
• Protect optoto and other players from cheating, exploitation, and illegal activities
• Maintain the integrity of our gaming platform and betting markets

4.4 Responsible Gaming and Player Protection

• Enforce responsible gaming tools including deposit limits, loss limits, and session time restrictions
• Process self-exclusion requests and maintain exclusion records
• Monitor gaming patterns for signs of problem gambling behavior
• Deliver reality check reminders showing session duration and profit/loss
• Provide access to responsible gaming resources and support contacts

4.5 Platform Improvement and Analytics

• Analyze user behavior to improve website navigation, game selection, and feature design
• Understand player preferences to optimize odds, betting markets, and game offerings
• Test new features and conduct A/B testing to enhance user experience
• Troubleshoot technical issues and improve platform performance and stability
• Generate aggregate, anonymized statistics for business intelligence (no individual identification)

4.6 Marketing and Communications

• Send promotional offers, bonus announcements, and new game notifications (opt-out available)
• Deliver important account notifications including deposit confirmations, withdrawal updates, and security alerts
• Communicate platform updates, new features, and changes to terms or policies
• Send personalized recommendations based on your gaming preferences

5. Legal Basis for Processing

Under international data protection principles, optoto must have a valid legal basis to process your personal information. We rely on the following legal grounds:

• Contractual Necessity: Processing your personal data is essential to perform our contract with you (the Terms & Conditions you accepted when registering). This includes account management, payment processing, and service delivery.
• Legal Obligations: We must process certain data to comply with international gaming regulations, anti-money laundering laws, age verification requirements, and tax reporting obligations.
• Legitimate Interests: We process data based on our legitimate business interests including fraud prevention, platform security, business analytics, and marketing communications, balanced against your privacy rights.
• Consent: For certain optional processing activities such as marketing communications and non-essential cookies, we obtain your explicit consent, which you may withdraw at any time.

6. Data Sharing and Disclosure

optoto does NOT sell your personal data to third parties. We only share your information with carefully selected partners and service providers under strict contractual obligations to protect your privacy. Data sharing is limited to the following categories:

6.1 Payment Service Providers

We share necessary financial information with Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) to process your deposits and withdrawals. These providers process data in accordance with their own privacy policies and Indonesian banking regulations.

6.2 Identity Verification Services

To comply with KYC requirements, we share identity documents and personal details with third-party identity verification specialists who authenticate your government-issued ID, verify your age, and conduct fraud checks. These providers are bound by strict confidentiality agreements.

6.3 Gaming Regulators and Licensing Authorities

We disclose player information to international gaming regulators and licensing authorities as required by our gaming licenses, including periodic reporting, audit requests, and investigations into specific accounts or activities.

6.4 Law Enforcement and Legal Compliance

We may disclose personal data to law enforcement agencies, governmental authorities, or courts when compelled by valid legal process (court orders, subpoenas, warrants) or when necessary to prevent serious crime, protect public safety, or defend our legal rights.

6.5 Fraud Prevention Partners

We share limited data with specialized fraud detection and prevention services who analyze patterns across multiple gaming platforms to identify fraudulent activities, bonus abuse rings, and money laundering schemes.

6.6 Service Providers and Infrastructure Partners

We engage third-party service providers for website hosting, data storage, customer support platforms, email delivery, analytics tools, and IT security services. These providers access personal data only to perform contracted services on our behalf and are contractually prohibited from using your data for their own purposes.

6.7 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of assets, your personal data may be transferred to the acquiring entity. We will notify affected players via email and provide options to close accounts if desired before such transfer occurs.

7. Data Security Measures

optoto implements comprehensive technical and organizational security measures to protect your personal data from unauthorized access, disclosure, alteration, or destruction:

7.1 Technical Security Measures

• Encryption: All data transmission between your device and our servers uses 256-bit SSL/TLS encryption (the same standard used by banks). Sensitive data at rest is encrypted using industry-standard encryption algorithms.
• Secure Infrastructure: Our servers are hosted in internationally certified data centers with physical security controls including 24/7 surveillance, biometric access controls, and redundant power and network systems.
• Firewalls and Intrusion Detection: Advanced firewall configurations and intrusion detection systems monitor for and block unauthorized access attempts, malware, and cyberattacks.
• Regular Security Audits: Independent security firms conduct periodic penetration testing, vulnerability assessments, and security audits of our platform.
• Two-Factor Authentication: Optional two-factor authentication (2FA) adds an extra layer of account security beyond passwords.

7.2 Organizational Security Measures

• Access Controls: Personal data access is restricted on a "need-to-know" basis. Only authorized optoto personnel with legitimate business reasons can access player information.
• Employee Training: All staff handling personal data receive mandatory training on data protection principles, security protocols, and confidentiality obligations.
• Incident Response Plan: We maintain a documented data breach response plan to quickly detect, contain, and remediate security incidents, with mandatory notification to affected players within 72 hours of discovering a breach.
• Vendor Management: Third-party service providers undergo security assessments and are bound by contractual data protection obligations equivalent to our own standards.

7.3 Your Security Responsibilities

While we implement strong security measures, protecting your account also requires your cooperation:

• Choose a strong, unique password and never share it with others
• Enable two-factor authentication in your account settings
• Keep your email and mobile phone contact information current
• Log out after using optoto on shared or public devices
• Immediately notify customer support if you suspect unauthorized account access
• Beware of phishing emails pretending to be from optoto (always verify sender authenticity)

8. Data Retention

optoto retains your personal data only as long as necessary to fulfill the purposes outlined in this Privacy Policy or as required by legal obligations:

• Active Accounts: We retain all personal data for the duration your account remains active plus a reasonable period to address potential disputes or regulatory inquiries.
• Closed Accounts: After voluntary account closure, we retain your data for a minimum of 5 years to comply with international gaming regulations, anti-money laundering laws, and tax reporting requirements.
• Transaction Records: Financial transaction history must be retained for at least 7 years per international financial record-keeping standards.
• Self-Exclusion Records: Self-exclusion requests are retained permanently to prevent excluded players from reopening accounts prematurely and to protect vulnerable individuals.
• Marketing Data: If you opt out of marketing communications, we retain minimal data (email address and opt-out preference) indefinitely to honor your preference and prevent future contact.
• Legal Holds: Data subject to ongoing legal proceedings, regulatory investigations, or disputes is retained until the matter is fully resolved.

After applicable retention periods expire, we securely delete or anonymize your personal data so it can no longer be associated with you individually. Anonymized, aggregated data may be retained indefinitely for statistical analysis without privacy implications.

9. Your Privacy Rights

Under international data protection standards, you have the following rights regarding your personal data held by optoto:

9.1 Right of Access

You have the right to request a copy of all personal data we hold about you. We will provide this information in a structured, commonly used electronic format within 30 days of your verified request.

9.2 Right to Rectification

If any personal data we hold is inaccurate or incomplete, you have the right to request correction. You can update most information directly in your account settings, or contact customer support for assistance.

9.3 Right to Erasure ("Right to be Forgotten")

You may request deletion of your personal data, subject to important limitations: we cannot delete data we are legally required to retain for regulatory compliance, anti-money laundering obligations, or ongoing legal proceedings. We can delete or anonymize data beyond these requirements upon request.

9.4 Right to Restriction of Processing

You have the right to request that we limit how we process your data in certain circumstances, such as when you contest the accuracy of the data or object to processing based on legitimate interests.

9.5 Right to Data Portability

You can request a machine-readable copy of personal data you provided to us (such as account information and transaction history) to transfer to another service provider.

9.6 Right to Object

You may object to processing of your data for direct marketing purposes at any time (we will immediately cease such processing). You may also object to processing based on legitimate interests, though we may continue if we demonstrate compelling legitimate grounds.

9.7 Right to Withdraw Consent

Where processing is based on your consent (such as optional marketing communications), you may withdraw consent at any time. This does not affect the lawfulness of processing before withdrawal.

9.8 How to Exercise Your Rights

To exercise any of these rights, contact our Data Protection Officer using the details in Section 14. We will respond within 30 days after verifying your identity. If you are dissatisfied with our response, you have the right to lodge a complaint with the data protection supervisory authority in your jurisdiction.

10. Cookies and Tracking Technologies

The optoto Website uses cookies and similar tracking technologies to enhance your user experience, analyze platform usage, and deliver personalized content. Cookies are small text files stored on your device when you visit our Website.

10.1 Types of Cookies We Use

• Essential Cookies: Strictly necessary for website functionality including secure login, session management, and load balancing. These cannot be disabled without breaking core features.
• Performance Cookies: Collect anonymous information about how visitors use the site (pages visited, time spent, error messages) to help us improve performance.
• Functional Cookies: Remember your preferences (language, currency, display settings) to provide a more personalized experience.
• Advertising Cookies: Track your activity across websites to deliver targeted advertisements and measure campaign effectiveness (used only with your consent).

10.2 Managing Cookie Preferences

You can manage cookie preferences through our cookie consent banner when you first visit the site, or at any time through your browser settings. Note that disabling certain cookies may limit website functionality. Most browsers allow you to refuse cookies, delete existing cookies, or receive warnings before cookies are stored.

11. International Data Transfers

As an international gaming platform licensed outside Indonesia, optoto may transfer and process your personal data in countries other than Indonesia. These countries may have different data protection laws than Indonesian law. However, we ensure that all international data transfers are protected by appropriate safeguards including:

• Standard Contractual Clauses approved by international data protection authorities
• Transfers to countries with adequacy decisions recognizing equivalent data protection standards
• Binding corporate rules for intra-group data transfers
• Explicit consent for specific transfers where required

Regardless of where your data is processed, we apply the same high standards of data protection described in this Privacy Policy.

12. Children's Privacy

The optoto platform is strictly prohibited for anyone under the age of 21. We do not knowingly collect personal information from minors under 21 years of age. Our age verification procedures during KYC are designed to detect and prevent underage account creation.

If we discover that we have inadvertently collected personal data from a person under 21, we will immediately delete the account, void all bets, forfeit all funds in accordance with our Terms & Conditions, and delete all associated personal information from our systems. Parents or guardians who believe their child has created an account on optoto should contact us immediately at the details provided in Section 14.

13. Changes to This Privacy Policy

optoto reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or business operations. When we make material changes, we will notify you by:

• Sending an email notification to the email address registered on your account
• Displaying a prominent notice on the optoto Website
• Updating the "Last Updated" date at the top of this Privacy Policy

Your continued use of the optoto Services after notification of changes constitutes acceptance of the updated Privacy Policy. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information. Material changes will take effect 30 days after notification to give you time to review the updated policy.

14. Contact Information

For any questions, concerns, or requests regarding this Privacy Policy, your personal data, or your privacy rights, please contact our Data Protection Officer:

• Email: [email protected] (displayed as plain text per site requirements)
• Subject Line: Please use "Data Privacy Inquiry" or "Privacy Rights Request" for prompt routing
• Live Chat: Available 24/7 through the chat widget on our website
• WhatsApp Support: Available 08:00-02:00 WIB daily

We aim to respond to all privacy inquiries within 30 days. For complex requests requiring additional verification or investigation, we may extend this period by an additional 30 days with notification.