Privacy Policy

1. Introduction

yototo operates an online gaming platform providing sports betting, live casino games, slots, and lottery services to players in Indonesia. We recognize that privacy is important to our users and are committed to being transparent about how we collect, use, and protect personal information.

This Privacy Policy applies to all personal data processed by yototo when you register an account, access our platform, use our services, or communicate with our customer support team. By using yototo services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and disclosure of your personal information as described herein.

This Privacy Policy should be read in conjunction with our Terms & Conditions, which govern your use of the yototo platform. If you do not agree with any aspect of this Privacy Policy, you should not use our services.

2. Data Controller

For the purposes of data protection law, the data controller responsible for your personal information is yototo, operating under the legal entity and licenses held by our parent organization.

yototo is the entity that determines the purposes and means of processing your personal data. All questions, comments, or requests regarding this Privacy Policy or our data processing practices should be directed to our Data Protection Officer at the contact information provided in Section 13.

3. Information We Collect

yototo collects various types of personal information from Indonesian players to provide our services, comply with legal obligations, and improve user experience. The categories of information we collect include:

3.1 Information You Provide Directly

When you register an account with yototo, you directly provide us with the following information:

• Account Registration Data: Full name as it appears on your Indonesian National Identity Card (KTP), date of birth, email address, mobile phone number, residential address, and chosen username and password.
• Identity Verification Documents: Copies of your KTP, proof of address (utility bills, bank statements), and selfie photographs holding your KTP for Know Your Customer (KYC) verification purposes.
• Payment Information: Bank account details (bank name, account number, account holder name), e-wallet information (OVO, DANA, GoPay, ShopeePay account identifiers), and transaction records for deposits and withdrawals.
• Communication Records: Content of correspondence with our customer support team via live chat, email, or WhatsApp, including inquiries, complaints, and feedback.

3.2 Information Collected Automatically

When you access and use the yototo platform, we automatically collect certain technical and usage information:

• Device Information: Device type (desktop, mobile, tablet), operating system, browser type and version, screen resolution, and unique device identifiers.
• Connection Data: IP address, internet service provider, connection type, and approximate geographic location derived from IP address (city and region level, not precise GPS coordinates).
• Usage Data: Pages visited, time spent on each page, clickstream data, search queries within the platform, game preferences, betting patterns, and session duration.
• Gaming Activity: Bets placed (amount, type, outcome), games played, wins and losses, bonus claims and wagering progress, and account balance transactions.

3.3 Information from Third-Party Sources

In certain circumstances, yototo may receive information about you from third-party sources:

• Identity Verification Services: Data from third-party KYC verification providers used to confirm your identity and prevent fraud.
• Payment Processors: Transaction confirmation and processing details from banks and e-wallet providers.
• Affiliates and Partners: If you were referred to yototo by an affiliate partner, we may receive limited information about the referral source.

4. How We Use Your Information

yototo processes your personal information for the following purposes, each supported by a legal basis under applicable data protection law:

4.1 Account Management and Service Provision

We use your personal information to create and maintain your yototo account, authenticate your identity when you log in, process your deposits and withdrawals, credit winnings to your account, and provide customer support. This processing is necessary for the performance of our contract with you.

4.2 Legal and Regulatory Compliance

yototo is subject to various legal and regulatory obligations, including:

• KYC and AML Compliance: Verifying your identity, age, and address to prevent underage gambling, money laundering, terrorist financing, and identity fraud.
• Responsible Gaming Obligations: Monitoring gaming patterns for signs of problem gambling and implementing appropriate interventions.
• Tax Reporting: Reporting certain transactions to tax authorities where required by Indonesian or international law.
• Licensing Requirements: Maintaining records as required by our gaming licenses and responding to requests from regulatory authorities.

This processing is necessary to comply with legal obligations to which yototo is subject.

4.3 Fraud Prevention and Platform Security

We analyze account activity, IP addresses, device fingerprints, and betting patterns to detect and prevent fraudulent activities, unauthorized access, bonus abuse, and other violations of our Terms & Conditions. We use this information to protect both yototo and our legitimate player community from malicious actors. This processing is based on our legitimate interests in maintaining platform security and integrity.

4.4 Marketing and Communications

With your consent, yototo may use your email address, mobile phone number, or in-platform messaging to send you promotional offers, bonus notifications, tournament invitations, and other marketing communications tailored to your gaming preferences. You may withdraw consent and opt out of marketing communications at any time by clicking the unsubscribe link in emails or contacting customer support.

4.5 Platform Improvement and Analytics

We analyze aggregated and anonymized usage data to understand how Indonesian players interact with our platform, identify popular games and features, optimize user interface design, and improve overall service quality. This processing is based on our legitimate interests in enhancing user experience and maintaining a competitive gaming platform.

5. Data Sharing and Disclosure

yototo does not sell your personal information to third parties. However, we may share your data with the following categories of recipients for specific purposes:

5.1 Service Providers

We engage third-party service providers to perform functions on our behalf, including:

• Payment Processors: Banks, e-wallet providers, and payment gateway operators that process your deposits and withdrawals.
• Identity Verification Services: Third-party KYC providers that verify your identity documents and conduct fraud screening checks.
• Game Providers: Software developers such as Pragmatic Play, Evolution Gaming, Microgaming, and others whose games you play on our platform. These providers receive limited data necessary for game functionality.
• Customer Support Tools: Live chat software and email management systems used by our customer support team.
• Analytics Providers: Services that help us understand platform usage patterns through aggregated, anonymized data analysis.

All service providers are bound by contractual obligations to process your data only as instructed by yototo and to maintain appropriate security measures.

5.2 Legal and Regulatory Authorities

yototo may disclose your personal information to law enforcement agencies, regulatory bodies, courts, or other governmental authorities when:

• Required by law, court order, or legal process.
• Necessary to comply with licensing conditions or regulatory requirements.
• Reasonably necessary to detect, prevent, or address fraud, security issues, or illegal activities.
• Required to protect yototo's rights, property, or safety, or that of our users or the public.

5.3 Business Transfers

In the event of a merger, acquisition, corporate restructuring, or sale of assets, your personal information may be transferred to the acquiring entity. We will notify you via email and prominent notice on our platform before your data is transferred and becomes subject to a different privacy policy.

6. Data Security Measures

yototo employs industry-standard technical and organizational measures to protect your personal information against unauthorized access, disclosure, alteration, or destruction:

6.1 Technical Security

• Encryption: All data transmitted between your device and yototo servers is protected by 256-bit SSL (Secure Socket Layer) encryption, the same standard used by major Indonesian banks.
• Secure Storage: Personal data is stored on secure servers with restricted access, protected by firewalls and intrusion detection systems.
• Payment Security: Payment information is processed through PCI-DSS (Payment Card Industry Data Security Standard) compliant providers, ensuring card and bank account data never passes through yototo systems.
• Access Controls: Employee access to personal data is restricted on a need-to-know basis and protected by multi-factor authentication.

6.2 Organizational Security

• Employee Training: All yototo staff members handling personal data receive regular training on data protection principles and security protocols.
• Confidentiality Agreements: Employees and contractors are bound by confidentiality obligations regarding player data.
• Security Audits: We conduct regular internal security assessments and engage independent third-party firms to perform penetration testing and security audits.
• Incident Response: yototo maintains a data breach response plan to quickly detect, investigate, and mitigate any security incidents.

6.3 Your Security Responsibilities

While yototo implements robust security measures, account security also depends on your actions:

• Choose a strong, unique password and never share it with anyone.
• Log out of your account after each session, especially on shared devices.
• Be wary of phishing emails or messages claiming to be from yototo asking for your password or sensitive information.
• Keep your registered email account and mobile phone secure, as these are used for account recovery.
• Report any suspected unauthorized account access immediately to customer support.

7. Data Retention

yototo retains your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy and comply with legal obligations:

• Active Accounts: Personal data is retained for the duration of your active account and for a reasonable period after account closure to address any residual disputes, audits, or legal requirements.
• Legal Retention Requirements: Certain data, particularly related to financial transactions and KYC verification, must be retained for specific periods (typically 5-7 years) under anti-money laundering regulations and licensing conditions.
• Marketing Data: If you opt out of marketing communications, we will retain a minimal record of your opt-out preference to ensure we do not inadvertently contact you again.
• Dispute Resolution: Data related to disputes, complaints, or investigations is retained until the matter is resolved and any appeal period has expired.

After the applicable retention period expires, personal data is securely deleted or anonymized in a manner that prevents recovery or reconstruction.

8. Your Privacy Rights

Under applicable data protection laws, Indonesian players using yototo services have the following rights regarding their personal information:

8.1 Right of Access

You have the right to request confirmation of whether yototo processes your personal data and to obtain a copy of that data. To exercise this right, contact our Data Protection Officer at [email protected] with your account details. We will respond within 30 days and provide your data in a commonly used electronic format.

8.2 Right to Rectification

If you believe any personal information we hold about you is inaccurate or incomplete, you have the right to request correction. Many details can be updated directly through your account settings. For information you cannot modify yourself, contact customer support with documentation supporting the correct information.

8.3 Right to Erasure

In certain circumstances, you may request deletion of your personal data. This right is not absolute and may be limited by legal obligations requiring yototo to retain certain records (e.g., financial transaction history for regulatory compliance). Account closure does not automatically delete your data if retention is legally required.

8.4 Right to Restrict Processing

You may request that yototo limit how we process your personal data in specific situations, such as when you contest the accuracy of data or object to processing based on legitimate interests while we verify the lawfulness of continued processing.

8.5 Right to Data Portability

Where technically feasible, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to request transmission of that data to another service provider. This right applies to data you provided to yototo based on consent or contract performance.

8.6 Right to Object

You may object to processing of your personal data based on legitimate interests. yototo will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is necessary for legal claims.

8.7 Right to Withdraw Consent

Where processing is based on your consent (e.g., marketing communications), you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted before withdrawal.

8.8 How to Exercise Your Rights

To exercise any of these rights, contact yototo's Data Protection Officer at [email protected] or through the contact methods provided in Section 13. We may require verification of your identity before processing requests. There is no fee for exercising your rights unless requests are manifestly unfounded or excessive, in which case we may charge a reasonable administrative fee.

9. Cookies and Tracking Technologies

yototo uses cookies and similar tracking technologies to enhance platform functionality, analyze usage, and personalize user experience.

9.1 Types of Cookies We Use

• Essential Cookies: Necessary for platform operation, including session management, authentication, and security features. These cookies cannot be disabled without breaking core functionality.
• Performance Cookies: Collect anonymized data about how you use our platform, helping us identify errors, optimize load times, and improve user experience.
• Functional Cookies: Remember your preferences, such as language settings and display options, to provide a more personalized experience.
• Analytics Cookies: Track aggregated usage patterns to understand player behavior and inform platform improvements.

9.2 Managing Cookies

Most web browsers automatically accept cookies, but you can modify your browser settings to decline cookies or alert you when cookies are being sent. Note that disabling certain cookies may limit platform functionality and prevent access to some features. Consult your browser's help documentation for instructions on managing cookies.

10. International Data Transfers

yototo operates internationally and may transfer your personal data to countries outside Indonesia, including to jurisdictions where our servers, service providers, or business partners are located. Some of these countries may have data protection laws that differ from Indonesian law.

When transferring data internationally, yototo implements appropriate safeguards, including:

• Standard contractual clauses approved by data protection authorities.
• Transfer to countries recognized as providing adequate data protection.
• Ensuring service providers maintain security standards consistent with this Privacy Policy.

11. Children's Privacy

yototo services are strictly intended for individuals aged 21 years and older. We do not knowingly collect personal information from anyone under the age of 21. Our KYC verification procedures are designed to prevent underage registration.

If we become aware that a person under 21 has provided us with personal information, we will immediately delete that information and permanently close the account. If you believe a minor has accessed yototo services, please contact us immediately at [email protected].

12. Changes to This Policy

yototo may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other operational needs. Material changes will be communicated to registered players via email and prominently announced on our platform at least 30 days before taking effect.

The "Last Updated" date at the top of this policy indicates when it was most recently revised. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information. Continued use of yototo services after changes become effective constitutes acceptance of the updated policy.

13. Contact Information

If you have questions, concerns, or complaints about this Privacy Policy or yototo's data protection practices, please contact our Data Protection Officer:

• Email: [email protected]
• General Support Email: [email protected]
• Response Time: Privacy inquiries are prioritized and typically responded to within 48 hours during WIB business days.

For data subject access requests or to exercise your privacy rights, please include your full name, registered email address, account username (if applicable), and a clear description of your request. We may require additional information to verify your identity before processing requests.

How yototo Protects Your Privacy