gttoto Privacy Policy

1. Introduction

This Privacy Policy describes how gttoto, operating at https://gttoto.cam ("the Platform," "we," "us," or "our"), collects, uses, discloses, and protects personal information obtained from users ("you," "Player," or "User") of our online betting and gaming services. By registering an account on gttoto, accessing the Platform, or using any of our services, you acknowledge that you have read, understood, and consent to the data practices described in this Privacy Policy.

gttoto is committed to protecting the privacy and confidentiality of personal data in accordance with internationally recognized data protection principles. We process personal data lawfully, fairly, and transparently, and take appropriate technical and organizational measures to safeguard your information against unauthorized access, loss, or misuse.

This Privacy Policy should be read in conjunction with our Terms & Conditions and Responsible Gaming Policy, which together form the complete legal framework governing your use of the gttoto platform.

2. Data Controller

gttoto acts as the data controller for all personal information collected through the Platform. As data controller, we determine the purposes and means of processing your personal data. For all privacy-related inquiries, data subject access requests, or complaints regarding the handling of your personal information, please contact us using the details provided in Section 15 of this Privacy Policy.

3. Information We Collect

gttoto collects several categories of personal information depending on how you interact with the Platform. The types of data we collect include:

3.1 Information You Provide Directly

When you register an account, make deposits or withdrawals, or communicate with our customer support team, you provide the following personal data:

3.2 Information Collected Automatically

When you access or use the gttoto platform, we automatically collect technical and usage data, including:

• Device Information: Device type, operating system (Android, iOS, Windows, macOS), browser type and version, screen resolution, device identifiers
• Connection Data: IP address, internet service provider (ISP), geographic location (city and country level based on IP), timezone
• Usage Data: Pages visited, games played, bet history, session duration, clickstream data, referral source, features accessed
• Performance Data: Error logs, crash reports, response times, system diagnostics

3.3 Information from Third Parties

We may receive personal information about you from third-party sources, including:

• Payment processors and financial institutions confirming deposit or withdrawal transactions
• Identity verification service providers conducting KYC checks
• Fraud prevention and anti-money laundering (AML) database providers
• Game studios and platform providers reporting technical issues or suspected rule violations

4. How We Use Your Data

gttoto processes your personal data for the following purposes, each grounded in a legitimate legal basis as described in Section 5:

4.1 Account Management & Service Provision

We use your identity, contact, and account data to create and manage your player account, authenticate your identity when you log in, process deposits and withdrawals, apply bonuses and promotions to your account, and provide customer support services. This processing is necessary to perform our contract with you as set out in the Terms & Conditions.

4.2 Identity Verification & Compliance

We process your identity data and verification documents to comply with Know Your Customer (KYC) and anti-money laundering (AML) regulatory obligations, verify that you are at least 21 years of age, confirm your residential address within permitted jurisdictions, detect and prevent fraudulent account registrations or identity theft, and fulfill our legal responsibilities under international gaming licenses. This processing is necessary for compliance with legal obligations.

4.3 Payment Processing

We use your financial data to process deposits via BCA, BRI, BNI, Mandiri, and e-wallets (OVO, DANA, GoPay), execute withdrawal requests to your registered payment method, reconcile transactions and maintain accurate account balances, and investigate and resolve payment disputes or chargebacks. This processing is necessary to perform our contract with you.

4.4 Security & Fraud Prevention

We process device information, connection data, and usage data to detect and prevent unauthorized account access, identify patterns consistent with fraudulent activity, bonus abuse, or collusion, monitor for suspicious betting patterns or money laundering attempts, enforce our Terms & Conditions and game rules, and protect the security and integrity of the Platform. This processing is based on our legitimate interests in maintaining a secure and fair gaming environment.

4.5 Responsible Gaming

We use your account data and usage patterns to implement responsible gaming tools such as deposit limits, loss limits, and self-exclusion, identify players exhibiting signs of problem gambling and proactively reach out with support resources, enforce age restrictions and prevent underage gambling, and comply with responsible gaming regulatory requirements. This processing is necessary for compliance with legal obligations and our legitimate interest in promoting player welfare.

4.6 Platform Improvement & Analytics

We analyze usage data in aggregated and anonymized form to understand how players use the Platform, improve user experience and interface design, optimize game selection and betting markets, develop new features and services, and monitor system performance and reliability. This processing is based on our legitimate interests in improving our services.

4.7 Marketing Communications (With Consent)

Where you have provided consent, we may use your contact data to send promotional emails regarding new games, bonus offers, tournaments, or special events tailored to your gaming preferences. You may withdraw consent and unsubscribe from marketing communications at any time through the unsubscribe link in emails or by adjusting your account preferences.

5. Legal Basis for Processing

gttoto processes personal data only where we have a lawful basis to do so. Our legal bases include:

• Contractual Necessity: Processing is necessary to perform the contract between you and gttoto (account creation, payment processing, service provision)
• Legal Obligation: Processing is necessary to comply with legal requirements such as KYC, AML, age verification, tax reporting, and gaming license obligations
• Legitimate Interests: Processing is necessary for our legitimate business interests (fraud prevention, security, platform improvement, customer support) provided these interests do not override your fundamental rights
• Consent: You have provided explicit, freely given consent for specific processing activities (marketing communications, optional data collection)

Where we rely on legitimate interests, you have the right to object to such processing. Where we rely on consent, you have the right to withdraw consent at any time without affecting the lawfulness of processing conducted prior to withdrawal.

6. Data Sharing & Disclosure

gttoto does not sell personal data to third parties for marketing purposes. However, we may share your personal information with the following categories of recipients in limited circumstances:

6.1 Service Providers

We engage trusted third-party service providers to perform functions on our behalf, including payment processors (bank transfer and e-wallet providers), KYC and identity verification service providers, fraud detection and AML monitoring services, cloud hosting and data storage providers, customer support software platforms, and email communication services. These service providers are contractually obligated to process personal data only as instructed by gttoto and to maintain appropriate security safeguards.

6.2 Game Studios & Platform Providers

When you play games on gttoto, limited data (typically username, bet amounts, game session data) is shared with the relevant game studio or platform provider to enable gameplay. These providers are bound by confidentiality obligations and are prohibited from using data for purposes beyond game provision.

6.3 Legal & Regulatory Authorities

We may disclose personal data to law enforcement agencies, regulatory bodies, tax authorities, or courts when required by law, legal process, or governmental request; to enforce our Terms & Conditions or protect our rights and property; to investigate suspected fraud, money laundering, or other illegal activity; or to comply with licensing requirements imposed by gaming regulators.

6.4 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, personal data may be transferred to the acquiring entity or successor, provided that the recipient agrees to handle personal data in accordance with this Privacy Policy or a substantially similar privacy framework.

7. Data Security

gttoto employs industry-standard technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. Our security measures include:

• Encryption: All data transmitted between your device and our servers is encrypted using SSL/TLS protocols. Passwords are stored in hashed and salted form and are never stored in plain text.
• Access Controls: Access to personal data is restricted to authorized personnel on a need-to-know basis. Multi-factor authentication is required for administrative access.
• Network Security: Our infrastructure is protected by firewalls, intrusion detection systems, and regular vulnerability scanning.
• Secure Data Storage: Personal data is stored on secure servers in access-controlled data centers with redundant backup systems.
• Regular Audits: We conduct regular security audits and penetration testing to identify and remediate vulnerabilities.
• Employee Training: All employees with access to personal data receive regular training on data protection and security best practices.

While we take all reasonable measures to protect your personal data, no method of internet transmission or electronic storage is completely secure. You are responsible for maintaining the confidentiality of your account credentials and for any activity that occurs under your account.

8. Data Retention

gttoto retains personal data only for as long as necessary to fulfill the purposes for which it was collected or to comply with legal, regulatory, accounting, or reporting obligations. Our retention periods are as follows:

• Active Accounts: Personal data is retained for the duration of your account's active status plus a reasonable period thereafter.
• Closed Accounts: Following account closure, we retain identity data and transaction records for a minimum of 5 years to comply with AML and financial record-keeping requirements.
• KYC Documents: Verification documents are retained for 5 years from the date of last account activity or account closure, whichever is later.
• Marketing Data: If you consent to marketing communications, we retain contact data until you withdraw consent or for 2 years from the last account activity, whichever is sooner.
• Technical Logs: Server logs and usage data are typically retained for 12 months for security and troubleshooting purposes.

Upon expiry of applicable retention periods, personal data is securely deleted or anonymized. Where data is required to be retained for legal reasons beyond the standard retention period, we will continue to store it securely with restricted access.

9. Your Rights

You have the following rights in relation to your personal data. To exercise any of these rights, please contact us at the email address provided in Section 15:

9.1 Right of Access

You have the right to request a copy of the personal data we hold about you, including details of the purposes of processing, categories of data, and recipients of data.

9.2 Right to Rectification

You have the right to request correction of inaccurate or incomplete personal data. You may update certain information directly through your account settings.

9.3 Right to Erasure (Right to be Forgotten)

You may request deletion of your personal data where: the data is no longer necessary for the purposes for which it was collected; you withdraw consent (where processing is based on consent); you object to processing based on legitimate interests and no overriding legitimate grounds exist; or the data has been unlawfully processed. This right is subject to our legal obligations to retain certain data (e.g., transaction records for AML compliance).

9.4 Right to Restrict Processing

You may request that we limit the processing of your personal data in certain circumstances, such as while we verify the accuracy of disputed data or assess the legitimacy of a processing objection.

9.5 Right to Data Portability

Where processing is based on consent or contractual necessity and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller.

9.6 Right to Object

You have the right to object to processing based on legitimate interests or for direct marketing purposes. Upon receiving an objection to marketing, we will cease such processing immediately.

9.7 Right to Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted prior to withdrawal.

9.8 Right to Lodge a Complaint

If you believe that gttoto has processed your personal data unlawfully or in violation of your rights, you have the right to lodge a complaint with the relevant data protection authority in your jurisdiction.

We will respond to all data subject access requests within 30 days. In complex cases, we may extend this period by an additional 60 days and will notify you of the extension and the reasons for delay.

10. Cookies & Tracking Technologies

gttoto uses cookies and similar tracking technologies to enhance your browsing experience, remember your preferences, analyze site traffic, and improve platform performance. Cookies are small text files stored on your device when you visit a website.

Types of Cookies We Use:

• Essential Cookies: Required for core platform functionality, including session management, authentication, and security. These cookies cannot be disabled.
• Functional Cookies: Enable features such as language preference, timezone settings, and account preferences.
• Performance Cookies: Collect anonymous usage statistics to help us understand how players interact with the Platform and identify areas for improvement.
• Analytics Cookies: Used to track user behavior in aggregate form for analytics purposes. We may use third-party analytics services to process this data.

You can control cookie settings through your browser preferences. Disabling cookies may affect certain features and functionality of the gttoto platform. For more information about cookies and how to manage them, visit www.allaboutcookies.org.

11. Third-Party Services

The gttoto platform may contain links to third-party websites or integrate third-party services (such as payment gateways or game providers). This Privacy Policy applies only to data collected by gttoto. We are not responsible for the privacy practices or content of third-party sites or services. We encourage you to review the privacy policies of any third-party services before providing personal data.

12. International Data Transfers

gttoto operates internationally and may transfer personal data to servers and service providers located outside Indonesia, including jurisdictions that may not provide the same level of data protection as Indonesian law. Where we transfer data internationally, we implement appropriate safeguards such as standard contractual clauses, adequacy decisions, or other legally recognized transfer mechanisms to ensure your data remains protected in accordance with this Privacy Policy.

13. Protection of Minors

gttoto is strictly prohibited for use by persons under 21 years of age. We do not knowingly collect personal data from individuals under 21. If we become aware that we have inadvertently collected personal data from a minor, we will take immediate steps to delete such information and close the associated account. If you believe that we have collected data from a person under 21, please contact us immediately at the email address provided in Section 15.

14. Changes to this Privacy Policy

gttoto reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or business operations. Material changes will be communicated to registered users via email or through an in-platform notification at least 7 days before the changes take effect. The "Effective Date" at the top of this page indicates when the Privacy Policy was last revised. Continued use of the gttoto platform after the effective date of changes constitutes acceptance of the revised Privacy Policy. We encourage you to review this page periodically to stay informed of how we protect your data.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, or if you wish to exercise any of your data subject rights described in Section 9, please contact us:

• Email: [email protected] (plain text — not a clickable link)
• Subject Line: Please use "Privacy Inquiry" or "Data Subject Request" in the subject line to ensure your message is routed to our data protection team
• Response Time: We will respond to privacy inquiries and data subject requests within 30 days of receipt

For general customer support inquiries unrelated to privacy or data protection, please use the live chat feature available 24/7 on the gttoto platform or visit our FAQ page for answers to common questions.