ontoto Privacy Policy

1. Information We Collect

ontoto collects various categories of personal information to provide, maintain, and improve our services. The information we collect falls into the following categories:

1.1 Account Registration Information

When you create an ontoto account, we collect:

• Personal Identification: Full legal name, date of birth, gender, nationality
• Contact Information: Email address, mobile phone number, residential address including city and postal code
• Login Credentials: Username, password (stored in encrypted form), security questions and answers
• Account Preferences: Language preference, communication preferences, notification settings

1.2 Identity Verification (KYC) Documents

To comply with regulatory requirements and prevent fraud, we collect:

• Government-issued identification documents (Indonesian KTP or passport)
• Proof of address documents (utility bills, bank statements, government correspondence)
• Selfie photographs for identity verification purposes
• Source of funds documentation when required for enhanced due diligence

1.3 Financial Information

For processing deposits and withdrawals, we collect:

• Bank account details (account number, account holder name, bank name, branch information)
• E-wallet account information (OVO, DANA, GoPay, ShopeePay, LinkAja account numbers)
• Transaction history including deposits, withdrawals, bets placed, and winnings
• Payment processor information necessary to facilitate transactions

1.4 Usage and Behavioral Data

We automatically collect information about how you interact with ontoto:

• Betting history including sports markets, casino games played, bet amounts, and outcomes
• Session information including login times, session duration, pages visited
• Device information including device type, operating system, browser type and version
• IP address, geolocation data, and connection information
• Clickstream data showing navigation patterns through our platform

1.5 Communications

We retain records of your communications with ontoto:

• Customer support conversations via live chat, email, or phone
• Feedback, complaints, and dispute resolution correspondence
• Survey responses and promotional campaign participation
• Marketing communication preferences and opt-out requests

2. How We Collect Information

ontoto employs various methods to collect your personal information:

2.1 Direct Collection

Information you provide directly when you:

• Register for an ontoto account and complete your user profile
• Submit KYC verification documents through our secure upload portal
• Make deposits or request withdrawals through our payment system
• Contact customer support or participate in surveys
• Subscribe to newsletters or marketing communications

2.2 Automatic Collection

Information collected automatically through technology:

• Cookies: Small text files stored on your device to remember preferences and track sessions
• Web Beacons: Invisible pixels embedded in emails and web pages to track engagement
• Server Logs: Automatic recording of technical information about your connection and requests
• Analytics Tools: Third-party analytics platforms that help us understand user behavior patterns

2.3 Third-Party Sources

In some cases, we receive information from external sources:

• Identity verification service providers conducting KYC checks
• Payment processors confirming transaction details and account ownership
• Fraud prevention services providing risk assessment data
• Publicly available databases for regulatory compliance screening

3. How We Use Your Information

ontoto uses your personal data for the following legitimate business purposes:

3.1 Service Provision and Account Management

• Creating, maintaining, and securing your ontoto account
• Processing deposits, bets, and withdrawal requests
• Verifying your identity and age to comply with legal requirements (21+ only)
• Providing customer support and responding to inquiries
• Managing your account preferences and communication settings

3.2 Platform Improvement and Personalization

• Analyzing usage patterns to improve platform functionality and user experience
• Personalizing content, game recommendations, and promotional offers based on your interests
• Testing new features and conducting A/B experiments to optimize services
• Developing new products and gaming options tailored to Indonesian players

3.3 Security and Fraud Prevention

• Detecting and preventing fraudulent activities, money laundering, and bonus abuse
• Monitoring betting patterns for signs of problem gambling or match-fixing
• Investigating suspicious transactions and unauthorized account access
• Enforcing our Terms & Conditions and protecting ontoto's legal rights

3.4 Legal and Regulatory Compliance

• Complying with Know Your Customer (KYC) and Anti-Money Laundering (AML) regulations
• Meeting tax reporting obligations and financial record-keeping requirements
• Responding to legal requests from law enforcement or regulatory authorities
• Maintaining audit trails and transaction records as required by gambling licenses

3.5 Marketing and Communications

• Sending promotional offers, bonuses, and special event notifications (with your consent)
• Delivering transactional emails about your account activity, deposits, and withdrawals
• Conducting market research and gathering feedback to improve services
• Notifying you of important updates to our terms, policies, or platform features

4. Data Sharing and Disclosure

ontoto does not sell your personal data to third parties. However, we may share your information in the following limited circumstances:

4.1 Service Providers and Business Partners

We share data with trusted third-party service providers who assist in operating our platform:

Service Provider Type	Purpose	Data Shared
Payment Processors	Process deposits and withdrawals	Name, bank account details, transaction amounts
KYC Verification Services	Verify identity and age	ID documents, name, date of birth, address
Game Providers	Deliver casino and slot games	User ID, betting activity, game session data
Cloud Hosting Providers	Store data securely	All encrypted account and transaction data
Customer Support Tools	Manage support tickets	Name, email, support conversation history
Analytics Platforms	Analyze user behavior	Anonymized usage data, session information

All third-party providers are contractually obligated to maintain data confidentiality and use information solely for the purposes we specify.

4.2 Legal and Regulatory Requirements

We may disclose your information when required by law or to protect legal rights:

• In response to valid legal requests from courts, government agencies, or law enforcement
• To comply with gambling licensing requirements and regulatory audits
• To investigate or prevent illegal activities, fraud, or security threats
• To enforce our Terms & Conditions or defend against legal claims
• To protect the safety and rights of ontoto, our users, or the public

4.3 Business Transfers

In the event of a merger, acquisition, bankruptcy, or sale of assets, your personal data may be transferred to the acquiring entity. We will notify you of any such change in ownership and provide options regarding your data.

4.4 Aggregated and Anonymized Data

We may share aggregated, non-personally identifiable data for research, marketing, or business intelligence purposes. This data cannot be used to identify individual users.

5. Data Security Measures

ontoto implements comprehensive security measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction:

5.1 Technical Security

• SSL/TLS Encryption: All data transmitted between your device and our servers is protected by 256-bit SSL encryption
• Database Encryption: Sensitive data including passwords and financial information is encrypted at rest
• Firewall Protection: Multi-layered firewalls prevent unauthorized network access
• DDoS Protection: Advanced systems defend against distributed denial-of-service attacks
• Intrusion Detection: Real-time monitoring systems detect and respond to security threats

5.2 Organizational Security

• Access Controls: Data access is restricted to authorized personnel on a need-to-know basis
• Employee Training: Regular security awareness training for all staff handling personal data
• Background Checks: Thorough vetting of employees with access to sensitive information
• Incident Response Plan: Documented procedures for identifying, responding to, and recovering from data breaches

5.3 Account Security Best Practices

We encourage you to protect your account by:

• Creating a strong, unique password and changing it regularly
• Never sharing your login credentials with anyone
• Logging out after each session, especially on shared devices
• Contacting us immediately if you suspect unauthorized account access
• Keeping your registered email and phone number secure and up-to-date

6. Data Retention and Storage

6.1 Retention Periods

ontoto retains your personal data for as long as necessary to fulfill the purposes described in this policy and comply with legal obligations:

• Active Accounts: Data is retained for the duration of account activity plus 5 years after last login for regulatory compliance
• Closed Accounts: Data is retained for 7 years after account closure to meet legal, tax, and audit requirements
• Transaction Records: Financial transaction history is retained for 10 years as required by anti-money laundering regulations
• KYC Documents: Identity verification records are retained for 7 years after account closure
• Marketing Data: Promotional communication records are deleted within 2 years if you unsubscribe

6.2 Data Storage Location

Your data is stored on secure servers located in jurisdictions with strong data protection laws. We use internationally recognized cloud hosting providers with ISO 27001 certification and redundant backup systems to ensure data availability and integrity.

6.3 Data Deletion

After the applicable retention period expires, we securely delete or anonymize your personal data using industry-standard methods including data overwriting and cryptographic erasure. Some data may be retained in anonymized form for statistical and research purposes.

7. Your Privacy Rights

You have the following rights regarding your personal data held by ontoto:

7.1 Right to Access

You may request a copy of the personal data we hold about you. We will provide this information in a structured, commonly used, and machine-readable format within 30 days of your request.

7.2 Right to Correction

If your personal information is inaccurate or incomplete, you have the right to request corrections. You can update most information directly through your account settings or by contacting customer support.

7.3 Right to Deletion (Right to be Forgotten)

You may request deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected. However, we may be required to retain certain data to comply with legal obligations or resolve disputes.

7.4 Right to Restrict Processing

You may request that we limit how we use your personal data in specific situations, such as while we investigate a complaint you have raised about data accuracy.

7.5 Right to Data Portability

You have the right to receive your personal data in a portable format and transmit it to another service provider where technically feasible.

7.6 Right to Object

You may object to processing of your personal data for direct marketing purposes at any time. You can opt out of marketing communications by clicking "unsubscribe" in any promotional email or updating your communication preferences in your account settings.

7.7 Right to Withdraw Consent

Where we rely on your consent to process personal data, you have the right to withdraw that consent at any time. This will not affect the lawfulness of processing based on consent before withdrawal.

7.8 How to Exercise Your Rights

To exercise any of these rights, please contact our Data Protection Officer at [email protected]. We will respond to your request within 30 days. You may be required to verify your identity before we process your request.

8. Cookies and Tracking Technologies

8.1 What Are Cookies

Cookies are small text files placed on your device when you visit ontoto. They help us recognize your device, remember your preferences, and improve your user experience.

8.2 Types of Cookies We Use

Cookie Type	Purpose	Duration
Essential Cookies	Enable core functionality like login sessions and security features	Session or 1 year
Performance Cookies	Collect anonymous data about how users interact with the platform	2 years
Functional Cookies	Remember your preferences like language and display settings	1 year
Targeting Cookies	Deliver relevant promotional content based on your interests	1 year

8.3 Managing Cookies

Most web browsers allow you to control cookies through settings. You can block or delete cookies, but this may affect platform functionality and your user experience. Essential cookies cannot be disabled without preventing access to certain features.

8.4 Third-Party Cookies

Some cookies are placed by third-party services we use, such as analytics providers and game developers. These parties have their own privacy policies governing cookie use.

9. International Data Transfers

ontoto primarily operates to serve Indonesian residents. However, some of our service providers and data storage facilities may be located outside Indonesia. When we transfer your data internationally, we ensure adequate protection through:

• Contractual agreements requiring recipient parties to maintain equivalent data protection standards
• Use of approved standard contractual clauses for international transfers
• Selection of service providers in jurisdictions recognized for strong data protection laws
• Implementation of additional technical safeguards such as encryption during transfer

By using ontoto services, you consent to the transfer, storage, and processing of your data in jurisdictions outside Indonesia as necessary to provide our services.

10. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data handling practices, please contact us:

• Email: [email protected] or [email protected]
• Live Chat: Available 24/7 through our website
• Response Time: We aim to respond to all privacy inquiries within 48 hours

For specific data protection requests (access, correction, deletion), please include your registered email address and account username to help us verify your identity and process your request efficiently.