Privacy Policy

1. Introduction and Scope

98tot ("we", "us", "our") is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, store, share, and protect the personal data of individuals who visit our website at https://98tot.cam, register accounts, or use our online gaming services (collectively, the "Services").

This Privacy Policy applies to all personal data processed by 98tot in connection with the Services, including information collected through our website, mobile applications, customer support interactions, marketing communications, and any other touchpoints where you interact with 98tot. By accessing or using our Services, you acknowledge that you have read, understood, and consent to the data practices described in this Privacy Policy.

We recognize that Indonesian players value their privacy and expect their personal information to be handled with care, transparency, and in compliance with applicable data protection laws. This Privacy Policy is designed to provide you with clear, comprehensive information about your privacy rights and our data handling practices.

If you do not agree with any aspect of this Privacy Policy, please discontinue use of our Services immediately and contact us to close your account. Your continued use of 98tot Services after any modifications to this Privacy Policy constitutes acceptance of those changes.

2. Data Controller Information

For the purposes of applicable data protection laws, 98tot acts as the data controller responsible for your personal information. We determine the purposes and means of processing your personal data in connection with providing online gaming services to Indonesian players and international customers.

As the data controller, 98tot is legally obligated to process your personal data fairly, lawfully, and transparently, and to implement appropriate technical and organizational measures to protect your information from unauthorized access, loss, or misuse.

98tot operates under international gaming licenses and adheres to regulatory requirements for data protection, anti-money laundering compliance, responsible gaming, and player verification. Our data practices are designed to balance regulatory compliance obligations with respect for player privacy.

3. Personal Data We Collect

To provide the Services, comply with legal obligations, and ensure a secure gaming environment, 98tot collects various categories of personal data from players. The specific data we collect includes:

3.1 Account Registration Information

• Identity Data: Full legal name (first name and surname as they appear on government-issued identification), date of birth, gender, nationality, and citizenship status.
• Contact Information: Residential address (street address, city, postal code, province), email address, and mobile phone number.
• Login Credentials: Username, password (stored in encrypted form), and security questions/answers if applicable.

3.2 Verification and Compliance Data (KYC)

• Government-Issued Identification: Copies of Indonesian National Identity Card (KTP), passport, or driver's license, including ID number, photograph, issue date, and expiration date.
• Proof of Address: Recent utility bills, bank statements, or government correspondence showing your name and residential address.
• Selfie/Biometric Data: Facial photographs for identity verification purposes, comparing your selfie against your ID document photograph.
• Source of Funds: In limited cases, documentation demonstrating legitimate source of funds for high-value transactions or unusual activity patterns.

3.3 Financial and Transaction Data

• Payment Information: Bank account details (bank name, account number, account holder name) for Indonesian banks including BCA, BRI, BNI, Mandiri, CIMB Niaga, and others, as well as e-wallet information for OVO, DANA, GoPay, and ShopeePay.
• Transaction History: Records of all deposits, withdrawals, wagers placed, winnings, losses, bonus claims, and account balance changes.
• Payment Processing Data: Transaction IDs, payment timestamps, amounts in Indonesian Rupiah (IDR), payment method used, and transaction status.

3.4 Gaming Activity and Behavior Data

• Gameplay Records: Bets placed, games played (including slots, live casino, sports betting, togel, sabung ayam), bet amounts, game outcomes, session duration, and win/loss ratios.
• Account Activity: Login timestamps, IP addresses, device identifiers, browser type, operating system, and geographic location data.
• Responsible Gaming Data: Deposit limits set, self-exclusion periods, reality check settings, and any responsible gaming tool usage.

3.5 Communication and Support Data

• Customer Service Interactions: Live chat transcripts, email correspondence, WhatsApp messages, phone call recordings (where legally permitted and disclosed), and support ticket histories.
• Marketing Preferences: Consent status for promotional emails, SMS marketing, push notifications, and communication channel preferences.
• Survey and Feedback Data: Responses to customer satisfaction surveys, product feedback, and testimonial submissions.

3.6 Technical and Device Data

• Device Information: Device type (desktop, mobile, tablet), device manufacturer and model, operating system version, screen resolution, and installed browser type/version.
• Network Data: IP address, internet service provider (Telkomsel, XL, Indosat, etc.), connection type, and approximate geographic location based on IP.
• Cookies and Tracking Data: Cookie identifiers, session IDs, advertising IDs, and data collected through analytics tools (see Section 11 for detailed cookie policy).

4. How We Collect Your Data

98tot collects personal data through multiple channels and methods during your interaction with our Services:

• Direct Data Provision: Information you voluntarily provide when creating an account, completing your player profile, submitting KYC documents, contacting customer support, or participating in surveys.
• Automated Data Collection: Information automatically collected when you access our website or use our Services, including IP addresses, device identifiers, browsing behavior, and gameplay activity through cookies, server logs, and analytics tools.
• Third-Party Sources: Data received from payment processors (for transaction verification), fraud prevention services, identity verification providers, and credit reference agencies (where legally permitted in anti-money laundering investigations).
• Public Sources: In limited circumstances, publicly available information from government databases or social media profiles may be consulted to verify identity or investigate suspected fraudulent activity.

5. How We Use Your Personal Data

98tot processes your personal data for specific, legitimate purposes related to providing online gaming services, complying with legal obligations, and improving player experience. We use your personal data for the following purposes:

5.1 Service Provision and Account Management

• Creating, maintaining, and managing your 98tot player account
• Processing deposits, withdrawals, and financial transactions
• Enabling gameplay across slots, live casino, sports betting, and other gaming products
• Processing bonus claims and applying promotional offers
• Providing customer support and responding to inquiries
• Implementing responsible gaming tools such as deposit limits and self-exclusion

5.2 Verification and Compliance

• Verifying your identity and age to comply with 21+ age restriction requirements
• Conducting Know Your Customer (KYC) and anti-money laundering (AML) checks
• Preventing fraud, money laundering, underage gambling, and other illegal activities
• Complying with regulatory obligations under international gaming licenses
• Investigating suspicious account activity or Terms of Service violations

5.3 Security and Fraud Prevention

• Detecting and preventing unauthorized account access
• Identifying patterns indicative of fraud, collusion, or bonus abuse
• Monitoring for multi-accounting and other prohibited activities
• Securing financial transactions and protecting against payment fraud
• Maintaining the integrity and fairness of gaming outcomes

5.4 Marketing and Communications

• Sending promotional offers, bonuses, and marketing communications (where you have consented)
• Personalizing content and offers based on gaming preferences and behavior
• Conducting player satisfaction surveys and collecting feedback
• Notifying you of important account updates, policy changes, or Service-related information

5.5 Analytics and Service Improvement

• Analyzing website traffic, user behavior, and gameplay patterns to improve Services
• Testing new features, games, and platform enhancements
• Optimizing website performance and mobile application functionality
• Understanding player preferences to tailor game offerings for Indonesian market

6. Legal Basis for Processing

Under applicable data protection laws, 98tot processes your personal data based on one or more of the following legal grounds:

• Contractual Necessity: Processing is necessary to fulfill our contractual obligations to provide gaming services as outlined in our Terms and Conditions.
• Legal Obligation: Processing is required to comply with legal and regulatory requirements, including KYC/AML obligations, age verification laws, and gaming license conditions.
• Legitimate Interests: Processing is necessary for 98tot's legitimate business interests in preventing fraud, maintaining platform security, improving services, and conducting marketing activities, provided such interests do not override your fundamental privacy rights.
• Consent: In certain cases (particularly for marketing communications and non-essential cookies), we rely on your explicit, freely-given consent, which you may withdraw at any time.

7. Data Sharing and Third Parties

98tot does not sell your personal data to third parties. However, we may share your personal information with carefully selected third parties in the following circumstances:

7.1 Service Providers and Business Partners

• Payment Processors: Banks, e-wallet providers, and payment gateway services that facilitate deposits and withdrawals.
• Identity Verification Services: KYC service providers that verify your identity documents and conduct anti-money laundering checks.
• Game Providers: Software suppliers such as Pragmatic Play, Evolution Gaming, NetEnt, and others who provide gaming content on our platform.
• Technology Infrastructure Providers: Cloud hosting services, content delivery networks, and IT service providers who maintain our platform infrastructure.
• Customer Support Tools: Live chat platforms, email service providers, and customer relationship management systems.
• Analytics and Marketing Services: Analytics platforms, advertising networks, and email marketing services (only where you have consented to marketing).

7.2 Legal and Regulatory Authorities

We may disclose your personal data to government authorities, law enforcement agencies, regulatory bodies, or courts when required by law, legal process, or to comply with gaming license obligations. This includes reporting suspicious financial transactions to anti-money laundering authorities or responding to lawful requests for information in criminal investigations.

7.3 Business Transfers

If 98tot undergoes a merger, acquisition, asset sale, or other corporate restructuring, your personal data may be transferred to the acquiring entity, subject to appropriate confidentiality obligations and data protection safeguards.

7.4 Data Sharing Safeguards

All third parties with whom we share personal data are contractually obligated to maintain confidentiality, process data only for specified purposes, implement appropriate security measures, and comply with applicable data protection laws. We conduct due diligence on third-party service providers to ensure they meet our privacy and security standards.

8. Data Security Measures

98tot implements comprehensive technical and organizational security measures to protect your personal data against unauthorized access, loss, alteration, disclosure, or destruction. Our security measures include:

• Encryption: All data transmitted between your device and our servers is protected by 256-bit SSL/TLS encryption. Sensitive data such as passwords and payment information is encrypted at rest using industry-standard encryption algorithms.
• Access Controls: Personal data is accessible only to authorized 98tot employees and service providers who require access to perform their job functions. Access is granted on a need-to-know basis and is protected by role-based permissions.
• Authentication: Multi-factor authentication (MFA) is available for player accounts and is mandatory for administrative access to systems containing personal data.
• Network Security: Firewalls, intrusion detection systems, and regular security monitoring protect our infrastructure from unauthorized access attempts and cyberattacks.
• Regular Security Audits: Independent third-party security audits and penetration testing are conducted periodically to identify and remediate vulnerabilities.
• Incident Response: We maintain a comprehensive data breach response plan to quickly detect, contain, and mitigate any security incidents, with protocols for notifying affected individuals and regulatory authorities as required by law.
• Employee Training: All 98tot employees receive regular training on data protection, privacy policies, and security best practices.

While we implement robust security measures, no method of internet transmission or electronic storage is 100% secure. You also play a role in protecting your personal data by maintaining the confidentiality of your account credentials, using strong passwords, enabling two-factor authentication, and logging out after each session.

9. Data Retention and Deletion

98tot retains your personal data for as long as necessary to fulfill the purposes for which it was collected, comply with legal and regulatory obligations, resolve disputes, and enforce our Terms and Conditions.

9.1 Retention Periods

• Active Accounts: Personal data associated with active accounts is retained for the duration of the account relationship and as long as you continue using our Services.
• Closed Accounts: After voluntary account closure, most personal data is deleted within 90 days, except for information we are legally required to retain (see below).
• Legal and Regulatory Requirements: Financial transaction records, KYC documentation, and certain account activity logs are retained for minimum periods specified by gaming regulations, anti-money laundering laws, and tax regulations—typically 5-7 years from the date of account closure.
• Fraud Prevention: Data related to detected fraud, Terms violations, or self-excluded players may be retained indefinitely to prevent future abuse and protect other players.

9.2 Data Deletion Procedures

When retention periods expire and there is no longer a legal or business need to retain personal data, we securely delete or anonymize the information using industry-standard data destruction methods. Anonymized data (from which all personally identifiable information has been permanently removed) may be retained indefinitely for statistical analysis and service improvement purposes.

10. Your Privacy Rights

Under applicable data protection laws, you have certain rights regarding your personal data. 98tot respects these rights and provides mechanisms for you to exercise them:

10.1 Right of Access

You have the right to request a copy of the personal data we hold about you. You can access most account information directly through your player account dashboard. For comprehensive data access requests, contact our support team.

10.2 Right to Rectification

You can update inaccurate or incomplete personal information through your account settings or by contacting customer support. It is your responsibility to ensure your account information remains current and accurate.

10.3 Right to Erasure ("Right to be Forgotten")

You may request deletion of your personal data by closing your account. Note that we are legally obligated to retain certain data (financial records, KYC documents) for specified periods even after account closure, but such data will be securely stored and not used for any other purpose.

10.4 Right to Restrict Processing

You may request restriction of processing in specific circumstances, such as when contesting data accuracy or objecting to processing. During the restriction period, we will store but not actively process the relevant data.

10.5 Right to Data Portability

You may request a machine-readable copy of certain personal data you provided to 98tot, which you can transfer to another service provider. Contact support to initiate a data portability request.

10.6 Right to Object

You may object to processing of your personal data for direct marketing purposes at any time by opting out through your account settings or unsubscribing from marketing emails. You may also object to processing based on legitimate interests grounds by contacting us with your specific concerns.

10.7 Right to Withdraw Consent

Where processing is based on consent (e.g., marketing communications), you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing conducted prior to withdrawal.

10.8 How to Exercise Your Rights

To exercise any of these rights, contact our support team via email at [email protected], live chat, or WhatsApp. We will respond to your request within 30 days, providing verification of your identity to protect against unauthorized access to your personal data. Some rights are subject to legal limitations or exceptions, which we will explain if applicable to your request.

11. Cookies and Tracking Technologies

98tot uses cookies and similar tracking technologies to enhance your experience, analyze website usage, and deliver personalized content. Cookies are small text files stored on your device when you visit our website.

11.1 Types of Cookies We Use

• Essential Cookies: Necessary for website functionality, including maintaining your login session, remembering your language preferences, and ensuring secure transactions. These cookies cannot be disabled without impairing core Services.
• Performance and Analytics Cookies: Collect information about how you use our website, including pages visited, time spent, and error messages encountered, helping us improve performance and user experience.
• Functionality Cookies: Remember your preferences and settings (e.g., preferred odds format, favorite games) to provide enhanced personalization.
• Advertising and Marketing Cookies: Used to deliver relevant advertisements and measure effectiveness of marketing campaigns. These cookies may track your browsing across multiple websites.

11.2 Cookie Management

You can control cookie settings through your browser preferences, including blocking or deleting cookies. However, disabling essential cookies may impair website functionality and prevent you from using certain Services. Most modern browsers provide cookie management tools allowing you to accept, reject, or selectively allow cookies. Consult your browser's help documentation for specific instructions.

12. International Data Transfers

98tot operates internationally and may transfer your personal data to countries outside Indonesia for processing and storage. When transferring data internationally, we ensure appropriate safeguards are in place to protect your personal data in accordance with applicable laws, including:

• Utilizing data processing agreements incorporating standard contractual clauses approved by regulatory authorities
• Ensuring third-party service providers in recipient countries implement adequate data protection measures
• Conducting transfer impact assessments to identify and mitigate risks associated with international data transfers

Despite differences in data protection laws across jurisdictions, 98tot maintains consistent privacy standards globally and commits to protecting your personal data regardless of where it is processed.

13. Children's Privacy Protection

98tot Services are strictly intended for adults aged 21 years and older, in compliance with Indonesian gambling age restrictions. We do not knowingly collect personal data from individuals under 21 years of age. Our registration process requires date of birth disclosure, and we conduct age verification through KYC documentation before allowing withdrawals.

If we discover that we have inadvertently collected personal data from a minor, we will immediately delete such information and permanently close the account. If you believe a minor has provided personal data to 98tot, please contact us immediately at [email protected] so we can take appropriate action.

Parents and guardians are encouraged to monitor their children's internet usage and use parental control software to prevent minors from accessing age-restricted content including online gambling websites.

14. Policy Changes and Updates

98tot reserves the right to modify this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or business operations. When material changes are made, we will notify you via email to your registered email address and post a prominent notice on our website for at least 30 days.

The "Last Updated" date at the top of this Privacy Policy indicates when the most recent changes were made. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data.

Your continued use of 98tot Services after Privacy Policy changes take effect constitutes acceptance of the updated terms. If you do not agree with changes, you must discontinue use of Services and may request account closure.

15. Contact Information

If you have questions, concerns, or complaints regarding this Privacy Policy or our data practices, or if you wish to exercise your privacy rights, please contact us through the following channels:

• Email: [email protected] (dedicated privacy inquiries should include "Privacy Request" in the subject line)
• Live Chat: Available 24/7 through the website with Indonesian-speaking support agents
• WhatsApp: Available 24/7 for urgent privacy concerns

We take all privacy inquiries seriously and aim to respond within 30 days. For complex requests, we may require additional time and will inform you of any delays. We may request identity verification before processing certain requests to protect against unauthorized access to your personal data.

If you are not satisfied with our response to a privacy complaint, you may have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction.