1. Introduction
to288 ("we", "us", "our", or the "Company") is committed to protecting the privacy and personal data of all users ("you", "your", or the "User") of our online gaming platform. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you access or use the to288 website, mobile applications, and related services (collectively, the "Platform").
This Privacy Policy is designed to comply with Indonesian data protection principles and international privacy standards. By creating an account or using the Platform, you acknowledge that you have read, understood, and agree to the collection, use, and disclosure of your personal information as described in this Privacy Policy. If you do not agree with any aspect of this Privacy Policy, you must not use the Platform.
We recognize that privacy is a fundamental right, and we are dedicated to handling your personal data with the utmost care, transparency, and security. This policy applies to all Indonesian residents who are at least 21 years of age and who access to288 services within Indonesia.
2. Information We Collect
to288 collects various types of personal information to provide, maintain, and improve our services. The categories of personal data we collect include:
2.1 Account Registration Information
When you create an account with to288, we collect the following information:
- Full legal name as it appears on your government-issued identification
- Date of birth (to verify you are at least 21 years of age)
- Email address
- Mobile phone number (including country code)
- Residential address (street, city, province, postal code)
- Username and password (password is stored in encrypted form)
- Preferred currency (Indonesian Rupiah/IDR)
- Preferred language
2.2 Identity Verification (KYC) Documents
As part of our Know Your Customer (KYC) and anti-money laundering (AML) compliance obligations, we collect:
- Copies of government-issued identification documents (Indonesian ID card/KTP, passport, driver's license)
- Proof of address documents (utility bills, bank statements, rental agreements dated within the last three months)
- Photographs or scanned images showing you holding your identification document (selfie verification)
- Bank account statements or payment method ownership verification documents
2.3 Financial and Transaction Information
To process deposits, withdrawals, and maintain accurate financial records, we collect:
- Bank account details (bank name, account number, account holder name) for Indonesian banks including BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI, and Bank Permata
- E-wallet account information for OVO, DANA, GoPay, ShopeePay, and LinkAja
- Deposit amounts, dates, times, and payment methods used
- Withdrawal requests, amounts, dates, times, and destination accounts
- Betting history, wagering patterns, game play records
- Bonus claims, promotions utilized, and wagering requirement progress
- Account balance and transaction ledger
2.4 Technical and Usage Data
When you access the Platform, we automatically collect certain technical information:
- IP address and geolocation data (to verify you are accessing from within Indonesia)
- Device information (device type, operating system, browser type and version)
- Login times, session duration, pages visited
- Clickstream data and navigation paths through the Platform
- Referring website URLs
- Cookies and similar tracking technologies data
- Error logs, crash reports, and diagnostic information
2.5 Communications and Support Records
When you contact our customer support team or communicate with us, we collect:
- Live chat transcripts
- Email correspondence
- WhatsApp message history
- Phone call recordings (with your consent and notification)
- Feedback, complaints, and dispute records
3. How We Use Your Information
to288 uses the personal information we collect for the following legitimate business purposes:
3.1 Account Management and Service Delivery
- Creating and maintaining your user account
- Processing your deposits and withdrawals
- Enabling you to place bets and play casino games
- Managing your account balance and transaction history
- Processing bonus claims and tracking wagering requirements
- Administering your participation in the VIP loyalty program
3.2 Compliance and Security
- Verifying your identity, age (21+), and location within Indonesia
- Complying with Know Your Customer (KYC) and anti-money laundering (AML) regulations
- Detecting and preventing fraud, cheating, money laundering, and other illegal activities
- Enforcing our Terms & Conditions and platform rules
- Maintaining the security and integrity of the Platform
- Identifying and blocking access from prohibited jurisdictions
3.3 Customer Support and Communication
- Responding to your inquiries, questions, and support requests
- Sending you important account notifications (deposit confirmations, withdrawal approvals, security alerts)
- Providing updates about service changes, maintenance schedules, or technical issues
- Resolving disputes and handling complaints
3.4 Marketing and Promotions (With Your Consent)
- Sending promotional offers, bonuses, and marketing communications via email or SMS (only if you have opted in)
- Personalizing offers based on your gaming preferences and activity
- Informing you about new games, features, or services
- Conducting surveys to improve our services
3.5 Platform Improvement and Analytics
- Analyzing user behavior to improve Platform functionality and user experience
- Conducting research and statistical analysis
- Testing new features and game offerings
- Optimizing website performance and mobile app responsiveness
4. How We Share Your Information
to288 does not sell, rent, or trade your personal information to third parties for their marketing purposes. However, we may share your information with the following categories of recipients under specific circumstances:
4.1 Service Providers and Business Partners
- Payment Processors: We share necessary financial information with Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI, Bank Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) to process your deposits and withdrawals.
- Game Providers: We share limited data with third-party game providers such as Evolution Gaming, Pragmatic Play, NetEnt, and Microgaming to enable you to play their games on our Platform.
- Identity Verification Services: We may use third-party KYC verification services to authenticate your identity documents and prevent fraud.
- Customer Support Tools: We use third-party live chat and customer relationship management (CRM) software to provide efficient customer support.
- Analytics Providers: We may share anonymized or aggregated data with analytics services to understand Platform usage and improve our services.
4.2 Legal and Regulatory Obligations
We may disclose your personal information if required to do so by law or in response to valid requests from governmental authorities, law enforcement agencies, or regulatory bodies. This includes disclosures necessary to:
- Comply with Indonesian legal obligations
- Respond to court orders, subpoenas, or legal processes
- Cooperate with investigations into suspected illegal activity, fraud, or money laundering
- Protect the rights, property, or safety of to288, our users, or the public
4.3 Business Transfers
In the event of a merger, acquisition, reorganization, sale of assets, or bankruptcy involving to288, your personal information may be transferred to the successor entity or acquiring party. We will notify you of any such change in ownership or control of your personal information.
5. Data Security
to288 employs industry-standard security measures to protect your personal information from unauthorized access, disclosure, alteration, or destruction. Our security measures include:
- 256-bit SSL Encryption: All data transmitted between your device and our servers is encrypted using bank-grade Secure Socket Layer (SSL) technology.
- Secure Data Storage: Personal information is stored on secure servers located in protected data centers with restricted physical access, 24/7 monitoring, and redundant backup systems.
- Access Controls: We implement role-based access controls, ensuring that only authorized personnel with a legitimate business need can access your personal data.
- Regular Security Audits: We conduct periodic security assessments, vulnerability scans, and penetration testing to identify and address potential security risks.
- Employee Training: All to288 employees with access to personal data receive training on data protection principles and confidentiality obligations.
- Incident Response Plan: We maintain a comprehensive incident response plan to quickly detect, contain, and remediate any security breaches.
While we strive to protect your personal information using best practices, no method of electronic storage or internet transmission is 100% secure. You acknowledge and accept that we cannot guarantee absolute security and that you use the Platform at your own risk.
6. Data Retention
to288 retains your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, comply with legal and regulatory obligations, resolve disputes, and enforce our agreements. Specific retention periods include:
- Account Information: Retained for the duration of your account's active status and for seven years following account closure to comply with financial record-keeping requirements.
- Transaction Records: Retained for seven years from the date of the transaction to comply with Indonesian tax and financial regulations.
- KYC Documents: Retained for seven years following account closure to comply with anti-money laundering regulations.
- Communications: Customer support records and communications are retained for two years to handle disputes and improve service quality.
- Technical Logs: Server logs and technical data are typically retained for one year unless needed for security investigations.
After the applicable retention period expires, we will securely delete or anonymize your personal information in accordance with our data retention schedule.
7. Your Privacy Rights
As a to288 user, you have the following rights regarding your personal information:
- Right to Access: You may request a copy of the personal information we hold about you.
- Right to Rectification: You may request correction of inaccurate or incomplete personal information. You can update most information directly through your account settings.
- Right to Erasure: You may request deletion of your personal information, subject to our legal obligations to retain certain data for regulatory compliance.
- Right to Restrict Processing: You may request that we limit how we use your personal information in certain circumstances.
- Right to Data Portability: You may request a copy of your personal information in a structured, commonly used, machine-readable format.
- Right to Object: You may object to processing of your personal information for direct marketing purposes. You can unsubscribe from marketing emails by clicking the unsubscribe link in any promotional email.
- Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time.
To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days. Please note that we may require verification of your identity before processing your request.
8. Cookies and Tracking Technologies
to288 uses cookies and similar tracking technologies to enhance your experience on the Platform, analyze usage patterns, and deliver personalized content. Cookies are small text files stored on your device that help us recognize you on subsequent visits.
We use the following types of cookies:
- Essential Cookies: Required for the Platform to function properly, including maintaining your login session and processing transactions.
- Performance Cookies: Collect anonymous information about how visitors use the Platform to help us improve functionality.
- Functional Cookies: Remember your preferences and settings to personalize your experience.
- Marketing Cookies: Track your browsing activity to deliver relevant advertisements and promotional content (only if you consent).
You can manage cookie preferences through your browser settings. However, disabling certain cookies may impact the functionality of the Platform.
9. Children's Privacy
to288 is strictly an adult-only platform. We do not knowingly collect personal information from individuals under 21 years of age. If we discover that we have inadvertently collected information from a person under 21, we will immediately delete that information and terminate the associated account. If you believe we have collected information from a minor, please contact us immediately at [email protected].
10. International Data Transfers
While to288 primarily serves Indonesian residents and stores data within secure facilities, certain service providers we work with may be located outside Indonesia. When we transfer your personal information internationally, we ensure that appropriate safeguards are in place to protect your data in accordance with this Privacy Policy and applicable data protection laws.
11. Changes to This Privacy Policy
to288 reserves the right to update or modify this Privacy Policy at any time to reflect changes in our practices, legal requirements, or service offerings. When we make material changes, we will notify you by email or through a prominent notice on the Platform. The "Last Updated" date at the top of this policy indicates when it was most recently revised. Your continued use of the Platform following any changes constitutes your acceptance of the updated Privacy Policy.
12. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data handling practices, please contact us at:
Email: [email protected]
We are committed to addressing your privacy concerns promptly and will respond to all inquiries within 48 hours.