Privacy Policy

1Introduction & Scope

This Privacy Policy ("Policy") describes how aftoto ("we", "us", "our", "the Platform") collects, uses, stores, protects, and discloses personal information from users ("you", "your", "Player") who access or use our online gaming services, including our website, mobile applications, customer support channels, and all related services (collectively, the "Services").

This Policy applies to all Indonesian residents who register accounts, place bets, play games, make deposits or withdrawals, or otherwise interact with aftoto. By creating an account or using our Services, you acknowledge that you have read, understood, and agreed to the data practices outlined in this Privacy Policy. If you do not agree with any aspect of this Policy, you must discontinue use of our Services immediately.

We may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or business operations. Material changes will be communicated via email to your registered address and prominently displayed on our Platform. Your continued use of aftoto Services after such modifications constitutes acceptance of the revised Privacy Policy. We recommend reviewing this page periodically to stay informed about how we protect your information.

This Privacy Policy should be read in conjunction with our Terms & Conditions, Responsible Gaming policies, and any other legal notices published on the aftoto Platform. Together, these documents form the complete legal agreement between you and aftoto.

2Information We Collect

To provide secure, personalized gaming services and comply with legal obligations, aftoto collects several categories of personal information:

2.1 Information You Provide Directly

When you register an account and use our Services, you voluntarily provide the following information:

Account Registration Data

• Identity Information: Full legal name (as shown on Indonesian National ID / KTP), date of birth (to verify 21+ age requirement), gender, Indonesian National ID number (NIK)
• Contact Information: Email address, mobile phone number (for SMS verification and account security alerts), residential address in Indonesia
• Login Credentials: Username, password (stored in encrypted form), security questions and answers
• Financial Information: Indonesian bank account details (bank name, account number, account holder name) for deposits and withdrawals, transaction history

KYC Verification Documents

• Government-issued identification (Indonesian National ID / Kartu Tanda Penduduk)
• Proof of address documents (utility bills, bank statements, government correspondence dated within last 3 months)
• Selfie photographs holding identification documents (for identity verification)
• Additional documentation as required for enhanced due diligence or large transaction verification

Communication Records

• Customer support correspondence (live chat transcripts, email communications, phone call recordings)
• Survey responses, feedback submissions, contest entries
• Preference settings and communication opt-ins/opt-outs

2.2 Information Collected Automatically

When you access aftoto Services, we automatically collect certain technical and usage information:

Device & Technical Information

• IP address (for geolocation verification and fraud prevention)
• Device type, model, operating system (Windows, macOS, iOS, Android), browser type and version
• Screen resolution, device identifiers (IMEI, Android ID, Apple IDFA)
• Mobile carrier information, internet service provider details

Usage Data

• Login timestamps, session duration, pages visited, features used
• Games played, bet amounts, win/loss history, bonus claims
• Deposit and withdrawal patterns, payment method preferences
• Click-stream data, navigation paths through the Platform
• Search queries, filter preferences, game favorites

Cookies & Tracking Technologies

We use cookies (small text files stored on your device), web beacons, pixels, and similar tracking technologies to enhance user experience, remember preferences, analyze Platform usage, and deliver personalized content. You can control cookie settings through your browser, but disabling cookies may limit functionality. See Section 8 for detailed cookie information.

2.3 Information From Third Parties

We may receive information about you from external sources:

• Payment Processors: Transaction verification data from Indonesian banks (BCA, BRI, BNI, Mandiri, etc.) and payment gateway providers
• Identity Verification Services: Age verification, identity authentication, and fraud prevention data from third-party KYC providers
• Marketing Partners: Referral source information if you joined aftoto through an affiliate or promotional campaign (with your consent)
• Public Sources: Information from public databases, government registries, or sanction lists to comply with anti-money laundering (AML) and counter-terrorism financing (CTF) regulations

3How We Use Your Information

aftoto uses your personal information for the following legitimate business purposes:

3.1 Service Provision & Account Management

• Create, maintain, and authenticate your gaming account
• Process deposits, withdrawals, and financial transactions
• Enable gameplay, record bet history, calculate winnings, and credit your balance
• Provide customer support, respond to inquiries, and resolve disputes
• Manage bonuses, promotions, and loyalty rewards programs
• Facilitate communication regarding your account status, transactions, and Platform updates

3.2 Legal & Regulatory Compliance

• Verify your age (21+ requirement) and Indonesian residency
• Conduct Know Your Customer (KYC) and identity verification procedures
• Comply with anti-money laundering (AML), counter-terrorism financing (CTF), and responsible gaming regulations
• Detect and prevent fraud, unauthorized access, money laundering, and other illegal activities
• Maintain audit trails and records as required by law
• Respond to legal requests from law enforcement, regulatory authorities, or court orders

3.3 Platform Security & Integrity

• Monitor for suspicious activity, collusion, bonus abuse, and terms violations
• Protect against cyber attacks, unauthorized access, data breaches, and security threats
• Implement fraud detection algorithms and risk management systems
• Enforce our Terms & Conditions and maintain fair gaming standards

3.4 Platform Improvement & Analytics

• Analyze user behavior, preferences, and engagement patterns to improve Services
• Conduct A/B testing on features, interfaces, and user experiences
• Generate statistical reports on game performance, popular markets, and platform usage
• Optimize website speed, mobile app performance, and payment processing efficiency
• Develop new features, games, and services based on player demand

3.5 Marketing & Communications (With Consent)

• Send promotional emails about new games, bonuses, special offers (you can opt-out anytime)
• Deliver personalized recommendations based on your gaming preferences
• Notify you about changes to Terms, Privacy Policy, or important Platform updates
• Conduct surveys to gather feedback and improve player satisfaction

We will only use your information for the purposes described in this Privacy Policy or as otherwise disclosed at the point of collection. We do not sell your personal data to third parties for their marketing purposes.

4How We Share Your Information

aftoto does not sell or rent your personal information. We may share your data with trusted third parties only in the following circumstances:

4.1 Service Providers & Business Partners

We share information with third-party vendors who perform services on our behalf, subject to strict confidentiality agreements:

• Payment Processors: Indonesian banks (BCA, BRI, BNI, Mandiri) and payment gateway providers to process deposits, withdrawals, and verify account ownership
• Game Providers: Software studios supplying casino games, live dealer platforms, and sports betting data feeds
• KYC & Verification Services: Identity verification, age confirmation, and fraud prevention vendors
• Cloud Hosting Providers: Secure data storage and server infrastructure services
• Customer Support Platforms: Live chat, email, and ticketing system providers
• Analytics Services: Platform performance monitoring, user behavior analytics (anonymized where possible)

4.2 Legal & Regulatory Authorities

We may disclose your information to government authorities, law enforcement, or regulatory bodies when required by law or to:

• Comply with legal obligations, court orders, subpoenas, or regulatory requests
• Enforce our Terms & Conditions and investigate policy violations
• Protect the rights, property, safety, or security of aftoto, our players, or the public
• Detect, prevent, or investigate fraud, money laundering, or other illegal activities

4.3 Business Transfers

If aftoto undergoes a merger, acquisition, sale of assets, or bankruptcy, your personal information may be transferred to the acquiring entity as part of business assets. We will notify you via email and Platform notice before your information becomes subject to a different Privacy Policy.

4.4 With Your Consent

We may share your information with other third parties when you provide explicit consent, such as participating in promotions with sponsors or opting into affiliate marketing programs.

5Data Security & Protection Measures

aftoto implements industry-standard security measures to protect your personal information from unauthorized access, disclosure, alteration, or destruction:

5.1 Technical Security Controls

• Encryption: All data transmissions use SSL/TLS encryption (bank-level 256-bit encryption). Passwords are stored using secure one-way hashing algorithms (bcrypt).
• Firewalls: Multi-layer firewall protection prevents unauthorized network access to our servers and databases.
• Access Controls: Role-based permissions ensure only authorized personnel access personal data on a need-to-know basis.
• Secure Data Centers: Information is stored in geographically distributed, redundant data centers with physical security controls (24/7 monitoring, biometric access).
• Regular Security Audits: Third-party security firms conduct penetration testing and vulnerability assessments to identify and fix security gaps.
• DDoS Protection: Advanced mitigation systems protect against distributed denial-of-service attacks.

5.2 Organizational Security Policies

• Employee training on data privacy, security best practices, and confidentiality obligations
• Strict non-disclosure agreements with all staff and contractors with data access
• Incident response procedures for data breaches or security incidents
• Regular backup and disaster recovery protocols to prevent data loss

5.3 Your Role in Security

While we implement robust security measures, you also play a crucial role in protecting your account:

• Use a strong, unique password (minimum 8 characters, mix of uppercase, lowercase, numbers, symbols)
• Never share your login credentials with anyone
• Log out after each session, especially on shared devices
• Enable two-factor authentication (2FA) if available
• Report suspicious activity or unauthorized access immediately
• Keep your registered email and phone number secure (reset credentials if compromised)

6Data Retention & Deletion

6.1 Retention Periods

We retain your personal information for as long as necessary to fulfill the purposes described in this Privacy Policy and comply with legal obligations:

• Active Accounts: Information is retained while your account remains active and for a reasonable period thereafter to address inquiries, disputes, or legal claims.
• Closed Accounts: After account closure, we retain certain information for 5-7 years to comply with financial record-keeping, anti-money laundering, tax reporting, and audit requirements.
• Transaction Records: Financial transaction history, bet records, and KYC documents are retained for at least 5 years as required by regulatory obligations.
• Marketing Data: If you opt-out of marketing communications, we retain your contact information on a suppression list to honor your preference.

6.2 Data Deletion

After the applicable retention period expires, we securely delete or anonymize your personal information. Anonymized data (stripped of personally identifiable details) may be retained indefinitely for statistical analysis and research purposes.

6.3 Account Closure Requests

You may request account closure at any time by contacting customer support. Upon closure, we will cease using your information for marketing purposes and deactivate your login credentials. However, we must retain certain records as outlined above to comply with legal obligations. Accounts closed due to fraud, terms violations, or self-exclusion are retained longer for security and regulatory purposes.

7Your Privacy Rights

Depending on your location and applicable data protection laws, you may have the following rights regarding your personal information:

7.1 Access & Portability

• Right to Access: Request a copy of the personal information we hold about you, including account details, transaction history, and KYC documents.
• Right to Data Portability: Receive your data in a structured, commonly used, machine-readable format for transfer to another service provider.

7.2 Correction & Updating

• Right to Rectification: Correct inaccurate or incomplete information through your account settings or by contacting support.
• You can update contact information (email, phone number, address) directly in your account dashboard.

7.3 Deletion & Restriction

• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data, subject to legal retention requirements (financial records, KYC documents must be retained for 5-7 years).
• Right to Restriction: Limit how we process your information, such as objecting to marketing communications or data analytics.

7.4 Objection & Consent Withdrawal

• Right to Object: Object to processing of your data for direct marketing purposes (you can opt-out anytime via email unsubscribe links or account settings).
• Right to Withdraw Consent: If processing is based on consent, you may withdraw it at any time (though this doesn't affect past processing).

7.5 Exercising Your Rights

To exercise these rights, contact our Data Protection Officer via email at [email protected] (displayed as plain text). We will respond to your request within 30 days and may require identity verification to prevent unauthorized data access. If we cannot fulfill your request, we will explain the reason (e.g., legal obligation to retain data).

8Cookies & Tracking Technologies

aftoto uses cookies and similar technologies to enhance user experience, secure accounts, analyze Platform usage, and deliver personalized content.

8.1 What Are Cookies?

Cookies are small text files stored on your device when you visit websites. They help websites remember your preferences, login status, language settings, and browsing history.

8.2 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for Platform functionality (login authentication, session management, security). These cannot be disabled.
• Functional Cookies: Remember your preferences (language, currency display, game favorites, interface settings).
• Performance Cookies: Collect anonymous usage data (pages visited, click patterns, error messages) to improve Platform performance.
• Marketing Cookies: Track referral sources, measure campaign effectiveness, and deliver personalized promotions (with your consent).

8.3 Managing Cookies

You can control cookie settings through your browser preferences (Chrome, Firefox, Safari, Edge all offer cookie management tools). Disabling cookies may limit Platform functionality - for example, you may need to log in repeatedly or lose personalized settings. You cannot disable strictly necessary cookies while using aftoto Services.

8.4 Third-Party Cookies

Some cookies are set by third-party service providers (analytics platforms, payment processors, game providers). These providers have their own privacy policies governing cookie usage. We recommend reviewing their policies for details.

9International Data Transfers

aftoto primarily serves Indonesian residents and stores data within secure facilities. However, some service providers (cloud hosting, payment processors, game studios) may be located outside Indonesia, which may involve transferring your data to countries with different data protection laws.

When we transfer data internationally, we implement appropriate safeguards such as:

• Standard contractual clauses approved by data protection authorities
• Ensuring third-party vendors maintain adequate data protection standards
• Encryption of data in transit and at rest
• Regular audits of third-party security practices

By using aftoto Services, you consent to the transfer of your information to third-party service providers necessary for Platform operation, subject to the protections described in this Privacy Policy.

10Children's Privacy (21+ Policy)

aftoto Services are strictly intended for adults aged 21 years or older. We do not knowingly collect personal information from individuals under 21. Our KYC verification process is designed to prevent underage registration.

If we discover that we have inadvertently collected information from someone under 21, we will immediately delete their account and all associated personal data. If you believe a minor has registered on aftoto, please contact us immediately at [email protected] (plain text email display).

Parents and guardians should monitor minors' internet usage and ensure they do not access online gambling platforms. We recommend using parental control software to block access to gaming sites for underage individuals.

11Changes to This Privacy Policy

aftoto reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal requirements, business operations, or technological advancements. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Send email notification to your registered address
• Display a prominent notice on the Platform homepage and account dashboard
• For significant changes, request your re-consent before continuing to use Services

Your continued use of aftoto after the effective date of changes constitutes acceptance of the revised Privacy Policy. We encourage you to review this page periodically to stay informed about how we protect your information.

Previous versions of the Privacy Policy are archived and available upon request for transparency and reference purposes.

12Contact Us & Data Protection Officer

If you have questions, concerns, or requests regarding this Privacy Policy or how aftoto handles your personal information, please contact us:

General Privacy Inquiries

• Email: [email protected] (plain text - not clickable)
• Customer Support: Live chat available through your account dashboard during WIB business hours
• Response Time: We aim to respond to all privacy inquiries within 7 business days

Data Subject Rights Requests

To exercise your privacy rights (access, correction, deletion, portability, objection), please email our Data Protection Officer at [email protected] (plain text display). Include your full name, registered email address, and a clear description of your request. We may require identity verification before processing requests to prevent unauthorized access.

Complaints & Regulatory Authorities

If you believe aftoto has violated your privacy rights or mishandled your personal data, you have the right to lodge a complaint with relevant data protection authorities or consumer protection agencies in Indonesia. We encourage you to contact us first so we can address your concerns directly.