Privacy Policy

1. Introduction and Scope

altoto ("we", "us", "our", or "the Platform") operates the online gaming platform accessible at https://altoto.cam and is committed to protecting the privacy and personal data of every player who uses our services. This Privacy Policy explains in plain, accurate language what personal data altoto collects, why we collect it, how we use and store it, with whom we may share it, and what rights you hold over your own information.

This Policy applies to all users of altoto who are residents of Indonesia and covers data collected through the Platform, customer support interactions, email correspondence, and any other communication channel maintained by altoto. By creating an Account or continuing to use altoto, you acknowledge that you have read, understood, and agreed to the practices described in this Privacy Policy. If you do not agree, please discontinue use of the Platform and contact our support team to request Account closure.

This Privacy Policy should be read alongside our Terms & Conditions, which govern your use of the Platform as a whole. In the event of any conflict between this Policy and the Terms & Conditions concerning the handling of personal data, this Privacy Policy takes precedence.

2. Definitions

For the purpose of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information that directly or indirectly identifies a natural person, including name, national identity number, date of birth, residential address, email address, phone number, bank account details, device identifiers, and IP addresses.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, transmission, restriction, erasure, or destruction.
• "Data Controller" refers to altoto as the entity that determines the purposes and means of processing your Personal Data.
• "Third Party" means any entity other than you and altoto, including payment processors, technology providers, regulatory authorities, and fraud-prevention services.
• "KYC" or "Know Your Customer" refers to the identity and age verification process required by anti-money laundering regulations before certain Platform features (notably withdrawals) become available.
• "Cookies" means small text files stored on your device by your web browser at the instruction of the Platform, used to maintain session state, track preferences, and enable analytics.

3. Data We Collect

altoto collects Personal Data in the following categories, limited strictly to what is necessary for operating a secure, compliant, and high-quality gaming platform for Indonesian players.

3.1 Registration and Account Data

When you create an Account, we collect your full legal name as stated on your Indonesian KTP (Kartu Tanda Penduduk / National Identity Card), date of birth, email address, mobile phone number, residential address in Indonesia, preferred currency (Indonesian Rupiah, IDR), and a hashed (one-way encrypted) version of your chosen password. We do not store your password in plain text.

3.2 Identity Verification (KYC) Data

To comply with anti-money laundering (AML) and counter-terrorism financing (CTF) obligations and to verify that you are at least 21 years old, we collect copies or photographs of your KTP, and in some circumstances additional documentation such as a recent bank statement or utility bill showing your Indonesian residential address. KYC documents are processed securely and retained only as long as required by applicable regulations.

3.3 Financial and Transaction Data

When you make a deposit or request a withdrawal, we collect your Indonesian bank account details (bank name, account number, account holder name) or e-wallet identifier (OVO, DANA, GoPay, ShopeePay, or LinkAja) as applicable, transaction amount in Indonesian Rupiah (IDR), transaction date and time, and payment method used. We do not store full card numbers; any card processing is handled by PCI-DSS-compliant payment processors who transmit only tokenized references to us.

3.4 Gaming Activity Data

We record data about your gaming sessions on altoto, including games played, wagers placed, game results, bonus activity, session start and end times, and responsible gaming tool usage (deposit limits, loss limits, session timers, self-exclusion status). This data is used for account management, regulatory reporting, responsible gaming monitoring, and service improvement.

3.5 Technical and Device Data

When you access altoto, we automatically collect your IP address and approximate geographic location derived from it, browser type and version, operating system, device type (desktop, mobile, tablet), screen resolution, referral URL (the web page from which you navigated to altoto), session timestamps, and pages or sections of the Platform visited. This data is used for security monitoring, fraud prevention, and improving Platform performance for Indonesian users on local mobile networks.

3.6 Communication Data

We retain records of your communications with altoto including live chat transcripts, WhatsApp messages (where applicable), emails sent to [email protected], and any complaints or feedback submitted through the Platform. These records are retained for quality assurance, dispute resolution, and regulatory compliance purposes.

3.7 Cookies and Tracking Technologies

altoto uses cookies and similar technologies (local storage, session storage, pixel tags) to maintain your logged-in session, remember preferences such as language and game history, enable security features (CSRF tokens, session integrity checks), and perform anonymized analytics on Platform usage. You may control cookie behavior through your browser settings. Note that disabling certain cookies may affect Platform functionality, including the ability to stay logged in.

4. Legal Basis and Purposes for Processing

altoto processes your Personal Data on the following legal bases, in accordance with Indonesian data protection principles and international best practice:

• Contractual Necessity: Processing your Account data, transaction data, and gaming activity data is necessary to perform the contract (Terms & Conditions) between you and altoto and to deliver the services you have requested.
• Legal Obligation: Processing KYC documents and transaction records is required to comply with anti-money laundering regulations, age verification obligations, and reporting duties to relevant Indonesian regulatory authorities.
• Legitimate Interests: Processing technical and device data for fraud prevention, security monitoring, and service improvement is in our legitimate interest and does not unduly prejudice your rights and freedoms.
• Consent: Where we send promotional emails or use non-essential cookies, we rely on your prior consent, which you may withdraw at any time.

5. How We Use Your Personal Data

altoto uses your Personal Data for the following specific purposes, and no others without prior notice:

• Creating, maintaining, and managing your Account on the Platform
• Verifying your identity and age (21+) as required by our eligibility rules
• Processing deposits via BCA, BRI, BNI, Mandiri, and other supported Indonesian banks and e-wallets
• Processing withdrawal requests to your verified Indonesian bank account or e-wallet
• Calculating, crediting, and tracking bonus entitlements and wagering requirements
• Providing 24/7 customer support in Indonesian and English
• Sending transactional notifications (deposit confirmations, withdrawal updates, security alerts)
• Sending promotional communications about altoto offers and events, if you have opted in
• Detecting and preventing fraud, collusion, money laundering, and Terms violations
• Monitoring responsible gaming indicators and enforcing self-exclusion or limit settings
• Complying with applicable laws, regulatory requirements, and court orders
• Analyzing aggregated, anonymized usage data to improve Platform performance and user experience

6. Data Sharing and Third-Party Disclosure

altoto does not sell, rent, or trade your Personal Data to any third party for commercial purposes. We share Personal Data only in the following carefully controlled circumstances:

6.1 Payment Processors

To process deposits and withdrawals through Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI, Bank Permata) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja), we share the minimum necessary transaction and identity data with our contracted payment processing partners. These partners are contractually bound to use your data only for payment processing and to maintain equivalent data protection standards.

6.2 KYC and Identity Verification Providers

We use accredited third-party identity verification services to validate your KTP documents and confirm your age and residency. These providers receive your KYC documents solely for verification purposes and are prohibited from retaining or using your data beyond that purpose.

6.3 Regulatory and Law Enforcement Authorities

altoto may disclose Personal Data to Indonesian government agencies, regulatory authorities, tax authorities, or law enforcement bodies when required to do so by law, regulation, court order, or lawful governmental request. We will notify you of such disclosure where legally permitted to do so.

6.4 Fraud Prevention and Security Services

We share technical data (IP addresses, device fingerprints, transaction patterns) with fraud prevention and cybersecurity service providers to detect and prevent fraudulent activity, money laundering, and unauthorized access attempts. These providers act as data processors under contract with altoto.

6.5 Business Transfers

In the event that altoto undergoes a merger, acquisition, restructuring, or sale of assets, your Personal Data may be transferred to the successor entity as part of that transaction. You will be notified via email and/or prominent notice on the Platform prior to any such transfer, and you will have the opportunity to request Account closure before the transfer takes effect.

7. International Data Transfers

altoto's primary servers are located in secure data centers with international certifications. In some circumstances, Personal Data may be transferred to and processed in countries outside Indonesia — for example, where our technology or payment processing partners are based. When such transfers occur, altoto ensures that appropriate safeguards are in place, including contractual clauses that require recipient parties to protect your data to a standard at least equivalent to this Privacy Policy. By using altoto, you consent to such international data transfers where necessary for the provision of services.

8. Data Retention

altoto retains your Personal Data for as long as your Account is active and for a period thereafter as required by law or legitimate business necessity. Specifically:

• Account and KYC Data: Retained for a minimum of 5 years after Account closure, as required by Indonesian anti-money laundering regulations.
• Transaction Records: Retained for a minimum of 5 years from the date of transaction, consistent with financial record-keeping obligations.
• Gaming Activity Logs: Retained for 3 years for responsible gaming monitoring and dispute resolution purposes.
• Communication Records: Retained for 2 years from the date of each interaction for quality assurance and dispute resolution.
• Technical and Device Data: Retained for 12 months for security monitoring and fraud prevention purposes.
• Marketing Consent Records: Retained for the duration of your Account plus 3 years after closure to demonstrate compliance with consent requirements.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymized so that it can no longer be associated with you as an individual. Anonymized, aggregated data may be retained indefinitely for statistical and analytical purposes.

9. Data Security

altoto implements industry-standard technical and organizational security measures to protect your Personal Data against unauthorized access, accidental loss, destruction, alteration, or disclosure. Our security framework includes:

• SSL/TLS Encryption: All data transmitted between your device and altoto servers is encrypted using 256-bit SSL/TLS protocols, the same standard used by major international banks.
• Password Hashing: Passwords are stored using a strong one-way cryptographic hashing algorithm (bcrypt). altoto staff cannot view your password in plain text.
• Access Controls: Access to Personal Data is restricted on a strict need-to-know basis. Only staff with a legitimate operational reason can access specific data categories, and all access is logged and audited.
• Two-Factor Authentication: We strongly recommend enabling two-factor authentication (2FA) on your Account. altoto may require 2FA for high-value withdrawal requests.
• Regular Security Audits: Our systems undergo periodic independent security assessments, penetration testing, and vulnerability scanning to identify and remediate weaknesses proactively.
• Data Center Security: Our servers are hosted in facilities with physical access controls, redundant power supplies, and 24/7 monitoring.

Despite our best efforts, no method of electronic transmission or storage is completely secure. In the unlikely event of a data breach that affects your Personal Data, altoto will notify you and relevant authorities within the timeframes required by applicable law and will take immediate steps to contain and remediate the breach.

10. Your Rights Over Your Personal Data

As an altoto player and data subject, you hold the following rights in relation to your Personal Data. To exercise any of these rights, please contact our support team at [email protected] (plain text — not a clickable link). We will respond to verified requests within 30 calendar days.

10.1 Right of Access

You may request a copy of the Personal Data we hold about you, including the categories of data collected, the purposes for which it is processed, and the third parties with whom it has been shared. We will provide this information in a structured, commonly used, machine-readable format where technically feasible.

10.2 Right to Rectification

If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request correction. You may update certain data directly through your Account settings; for data that cannot be self-corrected (such as KYC document details), please contact our support team.

10.3 Right to Erasure

You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (and no other legal basis applies), or where the data has been processed unlawfully. Please note that this right is subject to our legal retention obligations — for example, we cannot erase KYC or transaction records that we are legally required to retain for regulatory compliance.

10.4 Right to Restriction of Processing

In certain circumstances — such as while a dispute about data accuracy is being resolved — you may request that we restrict the processing of your Personal Data to storage only, without further use.

10.5 Right to Withdraw Consent

Where we process your Personal Data on the basis of your consent (for example, marketing emails or non-essential cookies), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal. To withdraw consent for marketing communications, update your preferences in Account settings or contact support.

10.6 Right to Lodge a Complaint

If you believe that altoto has processed your Personal Data in a manner that violates applicable data protection law, you have the right to lodge a complaint with the relevant Indonesian data protection authority or seek redress through the legal channels available in Indonesia.

11. Children and Minors

altoto strictly prohibits use of the Platform by any person under the age of 21. We do not knowingly collect Personal Data from individuals under 21. If we become aware that a minor has accessed the Platform or provided us with Personal Data, we will immediately suspend the Account, delete the associated data, and refund any deposits (net of any bonuses) to the verified payment method. Parents and guardians who believe their child may have accessed altoto should contact us immediately at [email protected] so that we can take swift corrective action.

12. Cookies Policy

altoto uses the following categories of cookies on the Platform. You can manage your cookie preferences through your browser settings at any time, though disabling certain cookies may limit Platform functionality.

• Strictly Necessary Cookies: Essential for the Platform to function. These maintain your login session, carry security tokens, and enable core features. They cannot be disabled without breaking the Platform.
• Functional Cookies: Remember your preferences such as preferred game categories and notification settings to personalize your experience across sessions.
• Analytics Cookies: Collect anonymized data about how users interact with the Platform, which pages they visit most, and where they encounter errors. This helps us improve the Platform for all Indonesian players. No personally identifiable information is included in analytics data.
• Security Cookies: Help detect and prevent fraudulent activity, bot traffic, and unauthorized access attempts by analyzing behavioral patterns during your session.

altoto does not use third-party advertising cookies or behavioral tracking cookies that serve advertisements on other websites. We do not participate in cross-site tracking or retargeting advertising networks.

13. Third-Party Links

The altoto Platform does not contain links to third-party websites. All navigation within altoto remains within the https://altoto.cam domain. If you independently navigate to a third-party site, altoto has no control over that site's privacy practices, and this Privacy Policy does not apply to any external website.

14. Changes to This Privacy Policy

altoto may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or Platform features. The "Last Updated" date at the top of this document will be revised whenever changes are made. For material changes — those that significantly affect how we use your Personal Data or your rights — we will notify you by email to your registered address and/or through a prominent notice on the Platform at least 14 days before the changes take effect. Your continued use of altoto after the effective date of a revised Policy constitutes your acceptance of the updated terms. If you do not agree to the changes, you may request Account closure before the effective date.

15. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data, please reach out to our data protection team through the following channels. Note that email addresses are displayed as plain text only and are not clickable links.

• Email: [email protected]
• Live Chat: Available 24/7 through the Platform interface
• Response Time: We aim to acknowledge all data-related requests within 3 business days and to resolve them fully within 30 calendar days