Privacy Policy

1 Introduction

dototo operates https://dototo.cam (the "Platform"), an online sports betting and casino service serving players across Indonesia, including Jakarta, Surabaya, Medan, Bandung, Bali, and Yogyakarta. As the operator of the Platform, dototo acts as the data controller for all personal information collected from registered users and visitors.

We understand that privacy is a fundamental concern for online players, particularly when financial transactions and identity verification are involved. This Privacy Policy has been drafted to provide complete transparency about our data practices, written in plain and accessible English rather than opaque legal boilerplate.

This Policy should be read in conjunction with our Terms & Conditions, which govern your use of the Platform and are incorporated by reference. Our Responsible Gaming policy also contains relevant provisions relating to how we use behavioral data to protect players who may be at risk.

2 Definitions

The following terms are used throughout this Privacy Policy:

• "Personal Data" — any information that identifies or can reasonably be used to identify a natural person, directly or in combination with other data.
• "Processing" — any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.
• "Data Controller" — dototo, the entity that determines the purposes and means of Processing Personal Data.
• "Data Processor" — a third party that Processes Personal Data on behalf of dototo, under documented instructions.
• "User" / "You" — any natural person who accesses the Platform, whether as a registered account holder or an anonymous visitor.
• "KYC Data" — identity verification documents and information submitted as part of the Know Your Customer process, including the Indonesian KTP (Kartu Tanda Penduduk).
• "Cookies" — small text files placed on your device by the Platform to store session and preference information.
• "AML" — Anti-Money Laundering; the set of legal and procedural obligations requiring dototo to monitor, record, and report certain financial transactions.

3 Data We Collect

dototo collects the following categories of Personal Data:

3.1 Registration Data

• Full legal name
• Date of birth
• Email address
• Indonesian mobile phone number
• Username and encrypted password
• City and province of residence (e.g., Jakarta, Surabaya, Bandung)

3.2 Identity Verification (KYC) Data

• Indonesian KTP (Kartu Tanda Penduduk) number and scanned copy
• Selfie photograph holding the KTP for liveness verification
• Proof of address documents (if additionally requested)

3.3 Financial Data

• Bank account numbers associated with BCA, BRI, BNI, Mandiri, CIMB Niaga, or OCBC NISP
• E-wallet identifiers for OVO, DANA, GoPay, ShopeePay, or LinkAja
• Deposit and withdrawal transaction records including amounts, timestamps, and reference numbers
• Account balance history

3.4 Behavioral and Gaming Data

• Betting history, game session records, and wagering patterns
• Login timestamps, session durations, and IP addresses
• Device type, operating system, browser type, and screen resolution
• In-platform navigation paths and feature usage patterns
• Responsible gaming tool usage, including deposit limit settings and self-exclusion requests

3.5 Communications Data

• Customer support chat transcripts and email correspondence
• Survey responses and feedback submissions
• Promotional opt-in preferences and communication history

3.6 Technical Data

• IP address and approximate geolocation derived from IP
• Cookie identifiers and session tokens
• Referral source URL (the page from which you arrived at dototo)
• Error logs and platform performance metrics associated with your session

4 How We Collect Data

dototo collects Personal Data through the following channels:

• Directly from you — when you register an account, complete KYC verification, make a deposit or withdrawal, contact our support team, or respond to a survey.
• Automatically through the Platform — via cookies, server logs, and analytics tools that record your interactions with the website each time you access it.
• From payment service providers — Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP) and e-wallet operators (OVO, DANA, GoPay) may share transaction confirmation data with us when you initiate a deposit or withdrawal.
• From identity verification services — third-party KYC providers may return verification results and risk scores based on the documents you submit.
• From fraud prevention partners — we receive signals and flags from industry fraud-sharing networks to protect the integrity of the Platform.

5 How We Use Your Data

The table below summarizes the primary purposes for which dototo uses your Personal Data:

dototo does not use your Personal Data for automated decision-making that produces legal or similarly significant effects on you, except where required for fraud prevention or AML compliance, in which case you have the right to request human review of any automated decision affecting your account.

6 Legal Basis for Processing

dototo relies on the following legal bases when processing your Personal Data:

• Contract Performance: Processing is necessary to deliver the services you have contracted with us to receive — including account management, bet placement, and payment processing.
• Legal Obligation: We are required by applicable AML regulations, international gaming licensing conditions, and financial reporting standards to collect, verify, and retain certain categories of data.
• Legitimate Interest: dototo processes certain data where we have a legitimate business interest that is not overridden by your privacy rights — for example, detecting fraud, improving Platform security, and analyzing aggregate usage patterns.
• Consent: Where we rely on your consent — such as for sending promotional emails or SMS notifications — you have the right to withdraw that consent at any time by updating your communication preferences in Account settings or contacting support.

7 Data Sharing & Disclosure

dototo does not sell your Personal Data. We share data only in the circumstances described below, and only to the minimum extent necessary for the stated purpose:

• Payment Processors: Indonesian bank partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP) and e-wallet operators (OVO, DANA, GoPay) receive the financial data necessary to execute your transactions.
• KYC and Identity Verification Providers: Third-party identity verification services receive your KYC documents solely for the purpose of verifying your identity. These providers are contractually bound to process data only as instructed by dototo.
• Game Content Providers: Providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive your session token and account identifier to deliver game content. They do not receive your full personal profile.
• Fraud Prevention Networks: Aggregated, pseudonymized risk signals may be shared with industry fraud-prevention organizations to protect the broader online gaming ecosystem.
• Legal and Regulatory Authorities: We will disclose Personal Data to law enforcement agencies, financial intelligence units, or regulatory bodies when required to do so by a valid legal order or when we believe disclosure is necessary to prevent or investigate illegal activity.
• Business Transfers: In the event of a merger, acquisition, or sale of substantially all of dototo's assets, your Personal Data may be transferred to the acquiring entity. You will be notified of any such transfer and the applicable privacy terms.

8 International Data Transfers

dototo's primary data processing infrastructure is located within secure, internationally recognized data center facilities. Some of our third-party service providers — including KYC verification partners and game content providers — may process data in jurisdictions outside Indonesia.

Where Personal Data is transferred internationally, dototo takes appropriate safeguards to ensure that the receiving entity provides a comparable level of data protection, including through contractual data processing agreements that impose obligations equivalent to those described in this Privacy Policy.

By using the Platform, you acknowledge that your Personal Data may be transferred to and processed in jurisdictions outside your country of residence for the purposes described in this Policy.

9 Cookies & Tracking Technologies

dototo uses cookies and similar technologies (including local storage and session tokens) to operate the Platform effectively. The following categories of cookies are in use:

dototo does not deploy third-party advertising or cross-site tracking cookies. You may manage or delete cookies through your browser settings; however, disabling strictly necessary cookies will impair your ability to log in and use the Platform.

10 Data Retention

dototo retains your Personal Data for as long as your Account is active and for a period thereafter as required by applicable legal obligations. Specific retention periods are as follows:

• Account and Registration Data: Retained for the duration of your account plus 5 years following account closure, to satisfy AML record-keeping requirements.
• KYC Documents: Retained for a minimum of 5 years from the date of verification, or longer if required by the applicable regulatory framework.
• Financial Transaction Records: Retained for 7 years from the date of each transaction in compliance with financial reporting standards.
• Customer Support Communications: Retained for 3 years from the date of the last interaction, to support dispute resolution.
• Behavioral and Analytics Data: Aggregated analytics data is retained indefinitely in anonymized form. Individual session logs are retained for up to 24 months.
• Marketing Consent Records: Retained for the duration of your consent plus 3 years, to demonstrate compliance with consent obligations.

When data is no longer required, it is securely deleted or anonymized using industry-standard data destruction processes. Physical media containing Personal Data is degaussed and physically destroyed prior to disposal.

11 Your Rights

As a data subject, you hold the following rights with respect to your Personal Data held by dototo. To exercise any of these rights, contact our support team at [email protected]. We will respond to all valid requests within 30 days.

12 Security Measures

dototo implements a multi-layered security architecture to protect your Personal Data against unauthorized access, disclosure, alteration, and destruction:

• Transport Security: All data in transit is encrypted using TLS 1.3 with 256-bit AES encryption. HTTP connections are automatically redirected to HTTPS.
• At-Rest Encryption: Sensitive data stored in our databases — including KYC records and financial data — is encrypted at rest using AES-256.
• Password Security: Passwords are hashed using bcrypt with a high work factor. We do not store passwords in recoverable form.
• Access Controls: Strict role-based access controls limit which staff members can access Personal Data. All access events are logged and regularly audited.
• Two-Factor Authentication: dototo supports two-factor authentication (2FA) for player accounts and mandates it for all internal staff systems.
• Penetration Testing: The Platform undergoes regular third-party penetration testing and vulnerability assessments to identify and remediate security weaknesses proactively.
• Incident Response: dototo maintains a documented data breach response procedure. Affected users will be notified within 72 hours of a confirmed breach that poses a risk to their rights and freedoms.

13 Minors & Age Restriction

dototo strictly prohibits use of the Platform by individuals under the age of 21. We do not knowingly collect Personal Data from individuals under 21 years of age. All account registrations are subject to age verification through the KYC process, which requires submission of a valid Indonesian KTP confirming the holder is 21 or older.

If dototo discovers or is notified that an Account is held by or has been used by an individual under 21, we will immediately suspend the Account, delete all associated Personal Data to the extent permitted by legal retention obligations, and return any remaining balance at our discretion after investigation.

Parents and guardians are encouraged to use parental control software and to educate minors about the risks of gambling. If you believe a minor has registered on our Platform, please contact us immediately at [email protected].

14 Third-Party Links & Services

The Platform may contain references to third-party services — for example, payment processor portals accessed during a deposit or withdrawal flow. These third-party services operate under their own privacy policies, and dototo is not responsible for their data practices.

dototo does not embed third-party advertising networks, social media tracking pixels, or retargeting scripts on the Platform. Any links to external sites are provided solely for informational convenience and do not constitute an endorsement of those sites' privacy or security practices.

We strongly encourage you to review the privacy policy of any third-party service before providing it with your Personal Data.

15 Policy Amendments

dototo reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory guidance. When material changes are made, we will update the "Last Updated" date at the top of this page and, where appropriate, notify registered users via email or a prominent in-platform notice.

We encourage you to review this Privacy Policy periodically. Your continued use of the Platform following the publication of an updated Policy constitutes your acceptance of the revised terms. If you do not agree with any changes, you must stop using the Platform and contact support to request account closure.

Previous versions of this Privacy Policy are available upon request by contacting our support team. The current version is always accessible at https://dototo.cam/privacy-policy.

16 Contact & Data Protection Officer

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data, please contact the dototo Data Protection team:

If you are unsatisfied with our response to a privacy concern, you may have the right to escalate your complaint to the relevant supervisory authority in your jurisdiction. dototo will cooperate fully with any such authority in the resolution of your complaint.