Privacy Policy

1. Definitions

The following definitions apply throughout this Privacy Policy:

• "lltoto," "we," "us," or "our" refers to the lltoto online betting platform accessible at https://lltoto.cam and its operating entity.
• "Platform" or "Website" refers to https://lltoto.cam and any associated mobile-optimised interfaces or services.
• "User," "you," or "your" refers to any individual who visits, registers on, or otherwise interacts with the lltoto platform.
• "Personal Data" means any information relating to an identified or identifiable natural person, including name, email address, phone number, financial details, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, and deletion.
• "KYC" (Know Your Customer) refers to the identity and address verification procedures required to comply with anti-money-laundering obligations and responsible gaming standards.
• "Cookies" means small text files stored on your device that help us operate the platform, remember preferences, and analyse usage patterns.

2. Personal Data We Collect

lltoto collects Personal Data in two broad categories: information you provide directly and information we collect automatically as you use the platform.

2.1 Data You Provide Directly

• Registration Data: Full legal name, date of birth, email address, Indonesian mobile phone number, and residential address (including city — e.g., Jakarta, Surabaya, Medan, Bandung, Bali, Makassar, Semarang).
• Identity Verification (KYC) Documents: Government-issued identification (KTP, passport, or driver's licence), proof of address (utility bill or bank statement dated within three months), and a selfie holding the submitted ID.
• Financial Data: Bank account details for BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, or Bank Permata; e-wallet identifiers for OVO, DANA, GoPay, ShopeePay, and LinkAja; deposit and withdrawal transaction records.
• Communication Data: Messages sent to customer support via live chat, email, or WhatsApp, together with timestamps and resolution notes.
• Responsible Gaming Preferences: Self-imposed deposit limits, loss limits, session time limits, time-out periods, and any self-exclusion requests you submit.

2.2 Data We Collect Automatically

• Device and Technical Data: IP address, browser type and version, operating system, device type (desktop, mobile, tablet), screen resolution, and referring URL.
• Usage Data: Pages visited, games played, bets placed, session duration, click-through paths, and feature interactions on the lltoto platform.
• Transaction Logs: Timestamps, amounts, payment methods, and outcomes of all deposit and withdrawal transactions.
• Cookies and Similar Technologies: Session cookies, persistent preference cookies, analytical cookies, and fraud-prevention fingerprinting data (see Section 7 for full details).
• Geolocation Data: Country and city-level location derived from your IP address, used to verify eligibility and comply with jurisdictional restrictions.

3. How We Collect Your Data

lltoto collects Personal Data through the following channels:

1. Direct Input: When you complete the registration form, submit KYC documents, update your account profile, or contact customer support.
2. Automated Collection: When you access or interact with the platform, our servers automatically record technical and usage data as described in Section 2.2.
3. Payment Processors: When you initiate a deposit or withdrawal, we receive transaction confirmation data from your bank or e-wallet provider. We do not store full bank account numbers or card numbers on our servers.
4. Third-Party Verification Services: KYC and age verification providers may share identity confirmation results with us to expedite the verification process.
5. Fraud Prevention Partners: Risk management systems may share device fingerprint or behavioural anomaly signals to help us protect the platform against fraud.

4. Purposes of Processing

lltoto processes your Personal Data for the following purposes:

• Account Management: Creating and maintaining your lltoto account, authenticating logins, and applying your preferences.
• Service Delivery: Processing bets, calculating odds, settling games, crediting winnings, and facilitating deposits and withdrawals through Indonesian banking and e-wallet channels.
• Identity and Age Verification: Confirming that you are at least 21 years of age and that your identity matches your registered details, in compliance with our responsible gaming obligations.
• Anti-Money Laundering (AML) Compliance: Monitoring transaction patterns to detect and report suspicious financial activity as required by applicable regulations.
• Customer Support: Responding to enquiries, investigating complaints, and resolving account or payment issues.
• Personalisation: Tailoring game recommendations, bonus offers, and promotional communications to your demonstrated interests and betting behaviour.
• Security and Fraud Prevention: Detecting unauthorised access attempts, multi-accounting, collusion, and other prohibited activities.
• Platform Improvement: Analysing aggregated usage data to enhance platform performance, fix bugs, and develop new features.
• Legal Compliance: Meeting obligations imposed by applicable laws, court orders, or regulatory bodies.
• Marketing Communications: Sending promotional emails, SMS, or push notifications about bonuses and events — only where you have given explicit consent or opted in through your account settings.

5. Legal Basis for Processing

lltoto relies on the following legal bases to process your Personal Data:

• Contractual Necessity: Processing required to fulfil our agreement with you — principally account management, bet processing, and payment handling.
• Legal Obligation: Processing mandated by applicable law, including KYC verification, AML monitoring, and regulatory reporting.
• Legitimate Interests: Processing carried out for our legitimate business interests — fraud prevention, security monitoring, and platform analytics — where those interests are not overridden by your rights.
• Consent: Marketing communications and non-essential cookies are processed only where you have given freely withdrawable, informed consent.

6. Sharing and Disclosure

lltoto does not sell, rent, or trade your Personal Data to third parties for their own marketing purposes. We share data only in the following circumstances:

6.1 Service Providers

We engage carefully vetted third-party processors to operate elements of our platform, including payment processing partners for BCA, BRI, BNI, Mandiri, and e-wallet providers; KYC and identity verification bureaus; cloud hosting and data storage providers; fraud detection and risk management systems; customer support platform providers; and email and SMS communication services. These processors are contractually bound to handle your data only on our instructions and to maintain appropriate security standards.

6.2 Game and Content Providers

Where you play games supplied by licensed third-party studios, limited technical data (such as session tokens and game-round IDs) may be shared with those providers to facilitate game delivery and settle outcomes. These providers are not permitted to use your data for any purpose beyond game operation.

6.3 Financial Institutions

When you deposit or withdraw funds, necessary transaction data is shared with your chosen bank (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, or Bank Permata) or e-wallet provider (OVO, DANA, GoPay, ShopeePay, or LinkAja) to execute the payment. We share only the minimum data required to complete the transaction.

6.4 Legal and Regulatory Disclosure

We may disclose Personal Data to law enforcement agencies, regulators, or courts where required by applicable law, valid legal process, or court order. We will notify you of such disclosure where legally permitted to do so.

6.5 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of lltoto's assets, your Personal Data may be transferred to the successor entity. You will be notified via email and a prominent notice on the platform prior to any such transfer, and you will have the opportunity to request deletion of your data before the transfer takes effect.

7. Cookies and Tracking Technologies

lltoto uses cookies and similar technologies to operate the platform efficiently, remember your preferences, and gather analytics that help us improve the experience for all users.

7.1 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for core platform functionality — session management, login state, shopping-cart-equivalent bet-slip retention, and security tokens. These cannot be disabled without breaking the platform.
• Preference Cookies: Remember your settings such as preferred language, odds format (decimal, fractional, or Indonesian format), time-zone display (WIB / WITA / WIT), and UI layout choices.
• Analytical Cookies: Collect aggregated, anonymised data about how users navigate the platform — which pages are most visited, where users encounter errors, and how long sessions last — to guide product improvements.
• Marketing Cookies: Track whether you arrived via a promotional link and help us attribute registrations and deposits to specific campaigns. Used only with your consent.
• Fraud Prevention Cookies: Generate device fingerprints used by our risk management systems to detect multi-accounting and other prohibited behaviours. These operate on a legitimate-interests basis.

7.2 Managing Your Cookie Preferences

You may control non-essential cookies through your browser settings. Most browsers allow you to block or delete cookies via their privacy or security menus. Please note that disabling certain cookies may degrade platform functionality — for example, preference cookies that remember your odds-format selection. Strictly necessary and fraud-prevention cookies cannot be disabled without preventing access to the platform.

8. Data Retention

lltoto retains your Personal Data for as long as necessary to fulfil the purposes set out in this policy or as required by law:

• Active Account Data: Retained for the lifetime of your account plus five (5) years after account closure, to meet statutory accounting and AML record-keeping obligations.
• KYC Documents: Retained for a minimum of five (5) years after the end of the business relationship, consistent with standard financial-services compliance requirements.
• Transaction Records: Retained for five (5) years from the date of each transaction.
• Customer Support Communications: Retained for two (2) years from the date of resolution, unless the communication relates to a dispute that remains open.
• Marketing Consent Records: Retained for the duration of your consent and for one (1) year after withdrawal, as evidence of lawful processing.
• Analytical and Log Data: Aggregated and anonymised within thirteen (13) months of collection; individual log records are deleted after six (6) months unless required for an active investigation.

When data is no longer required, lltoto will securely delete or anonymise it in accordance with industry-standard data destruction procedures.

9. Data Security

lltoto employs a layered security architecture to protect your Personal Data against unauthorised access, loss, alteration, or disclosure:

• Encryption in Transit: All data transmitted between your browser or app and our servers is protected by 256-bit SSL/TLS encryption. Look for the padlock icon and "https" in your browser's address bar when using lltoto.
• Encryption at Rest: Sensitive data fields — including KYC documents, financial details, and passwords — are encrypted at rest using AES-256 encryption within our database infrastructure.
• Access Controls: Internal access to Personal Data is restricted on a strict need-to-know basis. Staff undergo background checks and receive regular data-protection training.
• Two-Factor Authentication (2FA): Optional for users; mandatory for all lltoto internal staff accounts with access to production systems.
• Regular Security Audits: Our platform undergoes periodic third-party penetration testing and vulnerability assessments to identify and remediate potential weaknesses before they can be exploited.
• Incident Response: In the event of a data breach that is likely to result in a risk to your rights and freedoms, lltoto will notify affected users within 72 hours of becoming aware of the incident, consistent with international best practices.

10. Your Rights

As a user of the lltoto platform, you hold the following rights with respect to your Personal Data. To exercise any of these rights, contact our support team at [email protected]. We will respond within 30 days of receiving a valid request.

• Right of Access: You may request a copy of the Personal Data we hold about you, together with information about how it is used and with whom it has been shared.
• Right to Rectification: If any Personal Data we hold is inaccurate or incomplete, you may request that we correct or update it. Some data (e.g., registered name) may require re-verification of KYC documents.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected. This right is subject to our legal retention obligations — for example, we cannot delete transaction records within the mandatory five-year retention window.
• Right to Restrict Processing: You may ask us to suspend processing of your data in certain circumstances — for example, while a dispute regarding its accuracy is resolved.
• Right to Data Portability: Where processing is based on your consent or contractual necessity and carried out by automated means, you may request your data in a structured, machine-readable format (such as CSV or JSON).
• Right to Object: You may object at any time to processing based on our legitimate interests, including profiling for personalisation purposes. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing emails), you may withdraw that consent at any time via your account settings or by contacting support, without affecting the lawfulness of processing prior to withdrawal.

11. Minors and Age Verification

The lltoto platform is strictly intended for adults aged 21 years or older. We do not knowingly collect Personal Data from anyone under 21. Age verification is a mandatory step in the registration and KYC process: you are required to declare your date of birth and to provide a government-issued document confirming that you meet the minimum age requirement.

If we become aware that a user under the age of 21 has created an account, we will immediately suspend the account, void all bets and transactions, and permanently delete the associated Personal Data. Any funds deposited by an underage user will be returned to the originating payment method after identity confirmation.

Parents and guardians who believe a minor in their care has accessed lltoto should contact us immediately at [email protected] so that we can take swift remedial action.

12. Third-Party Links and Services

The lltoto platform does not include outbound links to external websites. However, our payment flows may redirect you briefly to your bank's or e-wallet provider's secure interface (e.g., BCA's internet banking portal, the OVO or GoPay in-app authorisation screen). Once you leave the lltoto environment, your data is governed by that third party's own privacy policy. lltoto is not responsible for the privacy practices or content of third-party services accessed during payment flows.

Game content delivered by third-party studios (e.g., Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft) operates within the lltoto platform environment. These studios receive only the minimum technical data necessary to run the game session; they do not receive your full profile, KYC documents, or financial details.

13. Changes to This Policy

lltoto may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will:

1. Update the "Last Updated" date at the top of this page.
2. Display a prominent notice on the lltoto platform for at least 14 days following the change.
3. Send an email notification to your registered address if the changes materially affect how we process your data.

Your continued use of the platform after the effective date of any updated policy constitutes acceptance of the revised terms. If you do not agree with a material change, you may close your account and request deletion of your data before the change takes effect.

14. Contact and Complaints

For any questions, requests, or concerns regarding this Privacy Policy or the way lltoto handles your Personal Data, please contact our Data Protection team:

• Email: [email protected]
• Live Chat: Available 24 hours a day, 7 days a week via the lltoto platform.
• Response Time: We aim to acknowledge all privacy-related requests within 48 hours and to provide a substantive response within 30 days.

If you are not satisfied with our response, you have the right to escalate your complaint to the relevant data protection authority in your jurisdiction. Indonesian residents may refer disputes to the Kementerian Komunikasi dan Informatika (Ministry of Communication and Information Technology) or to a competent court.