Privacy Policy

1. Introduction

Welcome to kototo's Privacy Policy. This document governs the collection, use, storage, and protection of personal information provided by users of our online casino and sports betting platform. By creating an account and using kototo's services, you consent to the data practices described in this policy.

kototo operates as an internationally licensed online gambling platform serving Indonesian players. We are committed to complying with applicable data protection regulations and maintaining the highest standards of privacy and security. This Privacy Policy should be read in conjunction with our Terms & Conditions and Responsible Gaming policies.

If you have any questions or concerns about how we handle your personal information, please contact our Data Protection Officer through the channels listed at the end of this document.

2. Information We Collect

2.1 Information You Provide Directly

When you register for a kototo account, we collect the following personal information:

• Identity Information: Full legal name, date of birth, gender, nationality, and government-issued ID number (KTP or passport number)
• Contact Information: Email address, phone number, residential address (street, city, postal code), and country of residence
• Account Credentials: Username, password (stored in encrypted form), and security questions
• Financial Information: Bank account details (bank name, account number, account holder name), e-wallet IDs (OVO, DANA, GoPay, ShopeePay), and transaction history
• Verification Documents: Copies of identity documents (KTP, passport), proof of address documents (utility bills, bank statements), and photographs for facial verification
• Communication Records: Content of customer support inquiries, live chat transcripts, email correspondence, and complaint records

2.2 Information Collected Automatically

When you use kototo's platform, we automatically collect certain technical and behavioral information:

• Device Information: Device type (mobile, tablet, desktop), operating system, browser type and version, screen resolution, and device identifiers
• Usage Data: Pages visited, time spent on each page, click patterns, games played, bets placed, deposit and withdrawal activity, login times, and session duration
• Location Data: IP address, geographic location (country, city), and timezone
• Performance Data: Connection speed, error logs, crash reports, and platform performance metrics

2.3 Information from Third Parties

We may receive information about you from third-party sources including:

• Payment processors (BCA, BRI, BNI, Mandiri, e-wallet providers) for transaction verification
• Identity verification services for KYC compliance
• Fraud prevention agencies for security screening
• Marketing partners (with your consent) for promotional campaigns

3. How We Use Your Information

kototo uses your personal information for the following legitimate business purposes:

3.1 Account Management and Service Delivery

• Creating and maintaining your user account
• Processing your deposits, withdrawals, and refunds
• Enabling you to place bets and play casino games
• Providing customer support and responding to your inquiries
• Sending important account notifications (security alerts, transaction confirmations, policy updates)

3.2 Legal and Regulatory Compliance

• Verifying your identity and age to comply with 21+ age restrictions
• Conducting Know Your Customer (KYC) checks to prevent identity theft and fraud
• Detecting and preventing money laundering, terrorist financing, and other financial crimes
• Complying with licensing requirements and regulatory obligations
• Responding to legal requests from law enforcement and government authorities

3.3 Security and Fraud Prevention

• Monitoring for suspicious activity, unauthorized access, and fraudulent transactions
• Detecting bonus abuse, collusion, and terms of service violations
• Protecting kototo's systems from cyber attacks and technical vulnerabilities
• Maintaining audit logs for security investigations

3.4 Marketing and Personalization (With Your Consent)

• Sending promotional emails about bonuses, special offers, and new games
• Displaying personalized game recommendations based on your playing history
• Conducting market research and user surveys to improve our services
• Retargeting advertising on third-party platforms (if you have opted in)

You can opt out of marketing communications at any time by adjusting your account preferences or clicking "unsubscribe" in promotional emails.

3.5 Platform Improvement and Analytics

• Analyzing user behavior to optimize platform performance and user experience
• Identifying popular games and betting markets to inform content strategy
• Testing new features and conducting A/B experiments
• Generating aggregated, anonymized statistics for business reporting

4. Data Sharing and Third Parties

kototo does not sell your personal information to third parties. However, we may share your data with trusted service providers and partners under the following circumstances:

4.1 Essential Service Providers

• Payment Processors: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) and e-wallet providers (OVO, DANA, GoPay, ShopeePay) process your financial transactions. They receive only the information necessary to complete deposits and withdrawals.
• Identity Verification Services: Third-party KYC providers verify your identity documents against government databases to ensure compliance with age restrictions and anti-fraud regulations.
• Game Providers: Casino game studios and sports data providers receive anonymized gameplay data to deliver live dealer games, slot machines, and sports betting odds.
• Cloud Infrastructure Providers: Our platform is hosted on secure cloud servers. These providers have access to encrypted data for the purpose of maintaining server infrastructure.

4.2 Legal and Regulatory Authorities

We may disclose your information to law enforcement, regulatory bodies, or government agencies when:

• Required by law or legal process (court orders, subpoenas, regulatory audits)
• Necessary to investigate suspected illegal activity or terms of service violations
• Required to protect kototo's rights, property, or safety
• Mandated by anti-money laundering or counter-terrorism financing regulations

4.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal information may be transferred to the acquiring entity. You will be notified via email and/or prominent notice on our platform of any change in ownership or use of your personal data.

4.4 Consent-Based Sharing

With your explicit consent, we may share information with:

• Marketing partners for joint promotional campaigns
• Affiliate networks for referral program tracking
• Social media platforms for targeted advertising (if you have opted in)

5. Data Security Measures

kototo employs industry-standard security measures to protect your personal information from unauthorized access, disclosure, alteration, and destruction:

5.1 Technical Safeguards

• Encryption: All sensitive data is encrypted using 256-bit SSL/TLS encryption during transmission. Passwords are hashed using bcrypt algorithms and are never stored in plain text.
• Firewalls: Our servers are protected by advanced firewall systems that block unauthorized access attempts.
• Intrusion Detection: Real-time monitoring systems detect and respond to potential security threats 24/7.
• Regular Security Audits: Independent third-party security firms conduct penetration testing and vulnerability assessments quarterly.
• DDoS Protection: Distributed denial-of-service mitigation systems ensure platform availability during cyber attacks.

5.2 Organizational Safeguards

• Access Controls: Employee access to personal data is restricted on a need-to-know basis using role-based permissions.
• Staff Training: All kototo employees receive regular training on data protection best practices and privacy regulations.
• Confidentiality Agreements: Employees and contractors are bound by strict confidentiality clauses prohibiting unauthorized disclosure.
• Incident Response Plan: We maintain a comprehensive data breach response protocol to minimize harm in the event of a security incident.

5.3 Your Role in Security

While we implement robust security measures, you also play a critical role in protecting your account:

• Use a strong, unique password and never share it with anyone
• Enable two-factor authentication (2FA) if available
• Log out after each session, especially on shared devices
• Be cautious of phishing emails claiming to be from kototo
• Report any suspicious activity to our security team immediately

6. Cookies and Tracking Technologies

kototo uses cookies and similar tracking technologies to enhance your user experience and analyze platform performance.

6.1 What Are Cookies?

Cookies are small text files stored on your device by your web browser. They allow websites to remember your preferences, maintain your login session, and collect usage statistics.

6.2 Types of Cookies We Use

• Essential Cookies: Necessary for the platform to function. These include session cookies that keep you logged in and security cookies that protect against cross-site request forgery (CSRF) attacks.
• Performance Cookies: Collect anonymized data about how visitors use kototo, such as which pages are most popular and error rates. This helps us optimize the platform.
• Functionality Cookies: Remember your preferences (language, timezone, display settings) to provide a more personalized experience.
• Marketing Cookies: Track your activity across websites to deliver targeted advertising. These cookies are only placed with your consent.

6.3 Managing Cookies

You can control cookie settings through your browser preferences. Note that disabling essential cookies may impair platform functionality. Most browsers allow you to:

• View and delete existing cookies
• Block third-party cookies
• Block all cookies (not recommended for kototo)
• Delete cookies automatically when you close the browser

7. Your Privacy Rights

You have the following rights regarding your personal information:

7.1 Right of Access

You can request a copy of all personal data we hold about you. Contact our support team with your request, and we will provide the information within 30 days in a commonly used electronic format.

7.2 Right to Rectification

If any of your personal information is inaccurate or incomplete, you can request corrections. You can update most information directly through your account settings.

7.3 Right to Erasure (Right to be Forgotten)

You can request deletion of your personal data, subject to certain legal exceptions. We may be required to retain certain information for regulatory compliance (e.g., transaction records for tax and anti-money laundering purposes).

7.4 Right to Restrict Processing

You can request that we limit how we use your personal data in certain circumstances, such as while we verify the accuracy of disputed information.

7.5 Right to Data Portability

You can request that we transfer your personal data to another service provider in a structured, machine-readable format.

7.6 Right to Object

You can object to processing of your personal data for direct marketing purposes at any time. You can also object to processing based on legitimate interests by providing specific reasons.

7.7 Right to Withdraw Consent

Where we rely on your consent to process personal data, you can withdraw that consent at any time. This does not affect the lawfulness of processing that occurred before withdrawal.

7.8 Exercising Your Rights

To exercise any of these rights, contact our Data Protection Officer at the email address listed in the Contact section. We will respond to your request within 30 days.

8. Data Retention

kototo retains your personal information only as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

8.1 Active Accounts

While your account is active, we retain all personal information to provide ongoing services and maintain your transaction history.

8.2 Closed Accounts

After you close your account, we retain certain information for regulatory compliance purposes:

• Identity and Verification Data: Retained for 7 years to comply with anti-money laundering regulations
• Financial Transaction Records: Retained for 7 years for tax reporting and audit purposes
• Communication Records: Retained for 3 years for dispute resolution purposes
• Marketing Consent Records: Retained indefinitely to honor opt-out requests

8.3 Inactive Accounts

If you do not log in to your kototo account for 24 consecutive months, we may classify your account as inactive and send a notification. After 36 months of inactivity, we may close your account and begin the data retention schedule outlined above.

9. Children's Privacy

kototo's services are strictly intended for adults aged 21 and above. We do not knowingly collect personal information from individuals under 21 years of age.

If we discover that we have inadvertently collected information from someone under 21, we will:

• Immediately close the account
• Delete all associated personal data
• Refund any deposited funds to the payment source
• Implement additional safeguards to prevent future underage registrations

If you believe someone under 21 has created an account on kototo, please report it to our compliance team immediately.

10. International Data Transfers

kototo operates internationally and may transfer your personal data to servers located outside Indonesia. These transfers are necessary to provide our services and are subject to appropriate safeguards:

• Data Processing Agreements: We enter into contracts with international service providers requiring them to protect your data with equivalent security measures.
• Standard Contractual Clauses: Where applicable, we use standard contractual clauses approved by data protection authorities.
• Adequacy Decisions: We prioritize transferring data to jurisdictions recognized as providing adequate data protection.

By using kototo, you consent to the transfer of your information to countries outside Indonesia that may have different data protection laws.

11. Changes to This Policy

kototo reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or business operations. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Send you an email notification to your registered email address
• Display a prominent notice on our homepage and account dashboard

Continued use of kototo's services after changes have been posted constitutes your acceptance of the revised Privacy Policy. We encourage you to review this policy periodically to stay informed about how we protect your information.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how kototo handles your personal information, please contact us:

• Data Protection Officer Email: [email protected]
• General Support Email: [email protected]
• Live Chat: Available 24/7 on our website and mobile app
• WhatsApp Support: Available during business hours (9 AM - 11 PM WIB)

We aim to respond to all privacy-related inquiries within 5 business days. For urgent security concerns, use the live chat option for immediate assistance.