Privacy Policy — drtoto

This Privacy Policy applies to all personal data collected, processed, stored, or otherwise handled by drtoto in connection with the operation of the Platform at https://drtoto.cam and any associated mobile or desktop applications. It applies to all Members and visitors, whether or not they hold a registered account.

For the purposes of this Privacy Policy:

drtoto collects personal data across several categories, depending on how you interact with the Platform:

2.1 Registration & Account Data

• Full legal name as it appears on your official government-issued identity document.
• Date of birth (used to verify you are at least 21 years of age, as required for Platform access).
• Email address (used for account management, notifications, and support communications).
• Mobile phone number (used for two-factor authentication and account security alerts).
• Indonesian residential address.
• Username and encrypted password hash.

2.2 Identity Verification (KYC) Data

• Scanned copy or photograph of your Indonesian national identity card (KTP) or valid passport.
• Proof of address documentation (utility bill, bank statement, or official correspondence).
• Facial verification photograph where required for enhanced due-diligence checks.

2.3 Financial Data

• Indonesian bank account details (bank name — e.g., BCA, BRI, BNI, Mandiri, CIMB Niaga — account number, and account holder name) for processing deposits and withdrawals.
• E-wallet identifiers for OVO, DANA, GoPay, ShopeePay, or LinkAja where used as a payment method.
• Transaction history: deposit amounts, withdrawal amounts, dates, and reference numbers.
• Wallet balance records.

2.4 Gaming Activity Data

• Wager history: game type, event, stake amount, odds, and outcome for all bets placed on sports markets (BRI Liga 1, EPL, Champions League, etc.), live casino tables, slot titles, togel (Indonesia's traditional numbers lottery) draws, and other Platform products.
• Session duration, login timestamps, and access frequency.
• Bonus and promotion usage records.

2.5 Technical & Device Data

• IP address and approximate geolocation derived from it.
• Device type, operating system, and browser version.
• Referrer URL and navigation path through the Platform.
• Cookie identifiers and similar tracking technology data (see Section 8).

2.6 Communications Data

• Content of support tickets, live chat transcripts, and email correspondence sent to or received from [email protected].
• Survey responses and feedback submitted voluntarily through the Platform.

drtoto collects personal data through the following channels:

• Directly from you: When you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, participate in promotions, or otherwise interact with Platform features.
• Automatically: Through cookies, web beacons, server logs, and similar technologies when you browse or use the Platform (see Section 8 for full details).
• From third-party payment providers: When you initiate a transaction via BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, or LinkAja, the payment provider may share transaction confirmation data with drtoto to verify and credit your account.
• From identity verification services: Where drtoto uses a third-party KYC provider to authenticate your identity documents or perform sanctions screening, that provider may supply data confirming your identity status.
• From fraud detection services: Risk management and anti-fraud tools may generate risk-score data based on your behavioral and device signals.

drtoto processes your personal data only where a legitimate legal basis exists. The table below summarizes our primary processing activities:

Where we rely on your consent as the legal basis for processing — for example, for marketing communications — you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. Withdrawal of consent can be made by contacting [email protected].

drtoto does not sell, rent, or trade your personal data to any third party for their own marketing purposes. We may share your data only in the following limited circumstances:

5.1 Service Providers (Processors)

We engage trusted third-party processors to perform specific functions on our behalf, including payment gateway providers (e.g., services that facilitate BCA, BRI, DANA, and GoPay transactions), KYC verification platforms, fraud detection vendors, cloud hosting providers, and customer support software vendors. All processors are bound by written data processing agreements that restrict their use of your data to the specific service they provide for drtoto.

5.2 Game Content Providers

Certain Platform games are delivered by third-party studios (in cluding live casino providers and slot developers). When you launch a game, minimal session data (account identifier, wallet balance) may be passed to the provider to enable gameplay. These providers operate under strict data protection contracts and do not use your data for any purpose beyond enabling the game session.

5.3 Legal & Regulatory Authorities

drtoto may disclose your personal data to law enforcement agencies, financial intelligence units, or regulatory authorities where legally required to do so — for example, in response to a valid court order, subpoena, or statutory request under anti-money laundering regulations. We will disclose only the minimum data necessary to comply with the legal obligation.

5.4 Business Transfers

In the event of a merger, acquisition, corporate restructuring, or sale of all or substantially all of drtoto's assets, your personal data may be transferred to the acquiring entity as part of the transaction. In such a scenario, Members will be notified in advance, and the acquiring entity will be bound to honor the commitments made in this Privacy Policy unless you are given the opportunity to opt out.

5.5 With Your Consent

Where you have given explicit consent, we may share your data with additional third parties (for example, a co-branded promotion partner). Such sharing will be clearly disclosed at the point of data collection, and your consent may be withdrawn at any time.

drtoto retains your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. Specific retention periods by data category are as follows:

• Account & registration data: Retained for the duration of your active account, plus six (6) years following account closure, to comply with financial record-keeping obligations and to defend potential legal claims.
• KYC documents: Retained for six (6) years following account closure, in accordance with international anti-money laundering regulations.
• Financial & transaction data: Retained for seven (7) years following the transaction date, to satisfy tax and audit requirements.
• Gaming activity data: Retained for five (5) years to allow resolution of disputes, bonus-abuse investigations, and responsible gaming monitoring.
• Communications data: Support tickets and correspondence are retained for three (3) years following the date of the last interaction.
• Technical & log data: Server logs and IP records are retained for twelve (12) months unless needed for an active security investigation.
• Marketing consent records: Retained until consent is withdrawn, plus three (3) years to demonstrate compliance.

At the end of the applicable retention period, personal data will be securely deleted or irreversibly anonymized such that it can no longer be associated with an identifiable individual.

drtoto implements robust technical and organizational measures designed to protect your personal data against unauthorized access, accidental loss, alteration, or destruction. These measures include:

• Encryption: All data transmitted between your device and the Platform is encrypted using 256-bit SSL/TLS protocols. Payment credentials and passwords are never transmitted or stored in plain text.
• Access controls: Access to personal data is restricted to authorized employees and contractors on a strict need-to-know basis. All personnel with access to personal data are bound by confidentiality agreements.
• Secure hosting: Platform infrastructure is hosted in ISO 27001-certified data centers with physical security controls including 24/7 surveillance, biometric access, and redundant power and network connectivity.
• Intrusion detection: Real-time monitoring systems detect and alert on suspicious activity, unauthorized login attempts, and potential data breaches.
• Regular audits: drtoto conducts regular internal security audits and engages independent third-party penetration testers to identify and remediate vulnerabilities.
• Incident response: A documented data breach response plan is maintained, ensuring that any confirmed breach is investigated, contained, and reported to affected Members and relevant authorities within 72 hours where required by law.

While drtoto takes all reasonable measures to protect your personal data, no method of electronic transmission or storage is 100% secure. You also have a responsibility to protect your account by using a strong password, enabling two-factor authentication where available, and never sharing your credentials with any third party.

drtoto uses cookies and similar tracking technologies to enhance your experience on the Platform. A cookie is a small text file placed on your device by a web server. Cookies allow the Platform to recognize your device on subsequent visits and enable certain functionalities.

8.1 Types of Cookies We Use

• Essential cookies: Required for the Platform to function. These include session cookies that maintain your login state and shopping-cart-style cookies that preserve your bet slip between page loads. These cannot be disabled without breaking core functionality.
• Performance cookies: Collect anonymous information about how you use the Platform — which pages you visit, how long you stay, and where you encounter errors. This data helps us improve site performance and identify technical issues.
• Functional cookies: Remember your preferences such as language selection, preferred odds format (decimal, fractional), and timezone (WIB, WITA, WIT).
• Targeting cookies: Track your activity across sessions to deliver personalized promotions and relevant bonus offers based on your gaming history. These cookies require your consent and can be disabled via browser settings.

8.2 Managing Cookies

Most modern browsers allow you to control cookie behavior through their settings menu. You can set your browser to block all cookies, accept only first-party cookies, or prompt you each time a cookie is set. Note that disabling essential cookies will prevent you from logging in and using core Platform features. Disabling performance and targeting cookies will not affect functionality but may reduce the personalization of your experience.

8.3 Third-Party Tracking

drtoto does not permit third-party advertising networks or social media platforms to place tracking pixels or cookies on the Platform for behavioral advertising purposes. Any third-party analytics tools we use (such as server-log analysis software) operate under strict data processing agreements and do not use your data for their own purposes.

As a Member whose personal data is processed by drtoto, you hold the following rights under internationally recognized data protection principles:

To exercise any of these rights, please contact our Data Protection Officer at [email protected]. We will respond to your request within thirty (30) calendar days. In certain circumstances, drtoto may be legally required to refuse a data subject request — for example, where erasure would prevent us from complying with anti-money laundering record-keeping obligations. Where we refuse a request, we will explain the legal basis for the refusal.

If you are not satisfied with how drtoto has handled your data rights request, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction.

The drtoto Platform is strictly intended for individuals aged 21 and above. drtoto does not knowingly collect or process personal data from any individual under the age of 21. If you are under 21, you are prohibited from registering an account, accessing the Platform, or providing any personal data to drtoto.

drtoto employs multiple age verification mechanisms, including date-of-birth validation at registration, mandatory KYC document verification before first withdrawal, and ongoing behavioral monitoring for signals of underage access. Where we have reason to believe that a Member is under 21, the account will be immediately suspended and any balance forfeited pending verification.

If a parent or guardian becomes aware that their child has provided personal data to drtoto without permission, they should contact [email protected] immediately. Upon confirmation, the account will be permanently closed and all associated personal data will be securely deleted within seven (7) calendar days.

drtoto's primary data processing infrastructure is located within secure, certified data centers. However, some of our service providers (payment processors, KYC vendors, cloud hosting providers) may process your personal data on servers located outside Indonesia. Where such international transfers occur, drtoto ensures that appropriate safeguards are in place:

• All cross-border data transfers are governed by written data processing agreements that include standard contractual clauses approved by international data protection authorities.
• Processors located in jurisdictions without an adequacy decision must implement supplementary security measures, including encryption in transit and at rest, pseudonymization, and access controls.
• Members will be notified if data is transferred to a jurisdiction where drtoto cannot guarantee an equivalent level of data protection, and explicit consent will be sought where required by law.

drtoto reserves the right to amend or update this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or business operations. When material changes are made, we will notify Members by displaying a prominent notice on the Platform for a minimum period of fourteen (14) days prior to the revised policy taking effect.

We will also send an email notification to all registered Members whose email address is verified and current. The "Last Updated" date at the top of this document reflects the date of the most recent revision. Continued use of the Platform following the effective date of any changes constitutes your acceptance of the revised Privacy Policy.

If you do not agree with any changes, you must cease using the Platform and may request account closure and data deletion by contacting [email protected] before the new policy takes effect.

If you have any questions, concerns, or complaints about this Privacy Policy, or if you wish to exercise any of your data subject rights, please contact drtoto's Data Protection Officer through the following channel:

drtoto aims to acknowledge all privacy-related inquiries within 24 hours (WIB) and to provide a substantive response within thirty (30) calendar days of receipt. If your request is particularly complex or we receive an unusually high volume of requests, we may extend this period by an additional thirty (30) days — in which case we will inform you of the delay and the reasons for it.