toto6 Privacy Policy

1. Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" — any information relating to an identified or identifiable natural person, including but not limited to name, date of birth, national identity number, email address, IP address, device identifiers, and financial account details.
• "Processing" — any operation performed on personal data, including collection, storage, use, transmission, alteration, restriction, erasure, or destruction.
• "Data Controller" — the entity that determines the purposes and means of processing personal data. For toto6, this is the Company operating the platform at toto6.cam.
• "Data Processor" — a third party that processes personal data on behalf of toto6, strictly in accordance with toto6's documented instructions and applicable data protection law.
• "KYC" — Know Your Customer; the mandatory identity and age verification process required before processing withdrawals or as otherwise determined by toto6's compliance obligations.
• "Cookie" — a small text file placed on your device by the toto6 platform to enable session management, analytics, and certain functional features.
• "Sensitive Data" — personal data that warrants heightened protection, including government-issued identity document numbers, financial account details, and biometric data submitted for KYC purposes.

2. Data Controller

2.1 toto6, operating the platform at toto6.cam, acts as the Data Controller for all personal data collected from Members and visitors to the platform. As Data Controller, toto6 is responsible for determining the lawful basis for processing, ensuring data accuracy, and upholding Member rights under applicable data protection legislation.

2.2 toto6 operates under an international gaming license and processes personal data in compliance with applicable international data protection standards, including principles equivalent to those established under the EU General Data Protection Regulation (GDPR) where those principles represent the recognized international standard of best practice.

2.3 For all data protection inquiries, including the exercise of data subject rights, please contact toto6's designated data protection contact at [email protected] (plain text — not a clickable link), with the subject line "Data Protection Request".

3. Personal Data We Collect

3.1 toto6 collects the following categories of personal data:

Category	Examples	Purpose
Identity Data	Full legal name, date of birth, gender, nationality, KTP / passport / SIM number	Account registration, KYC verification, age verification (21+)
Contact Data	Email address, phone number, city of residence (Jakarta, Surabaya, Bandung, Bali, etc.)	Account communications, support, transaction notifications
Financial Data	Bank account number and name (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI), e-wallet account (OVO, DANA, GoPay, ShopeePay, LinkAja)	Processing deposits and withdrawals in IDR, fraud prevention
Technical Data	IP address, device type, browser type and version, operating system, session tokens	Platform security, fraud detection, service optimization
Usage Data	Pages visited, games played, bet history, session duration, click patterns	Service improvement, responsible gaming monitoring, personalization
KYC Documents	Scanned or photographed identity documents, selfies with ID, utility bills, bank statements	Regulatory compliance, AML checks, withdrawal processing
Communications Data	Live chat transcripts, email correspondence, support ticket content	Customer support, dispute resolution, quality assurance

3.2 toto6 does not collect special categories of sensitive personal data (such as health records, religious beliefs, political opinions, or racial or ethnic origin) unless these are voluntarily disclosed by a Member in the context of a responsible gaming self-exclusion request, in which case they are processed solely for the purpose of administering that request.

4. How Personal Data Is Collected

4.1 toto6 collects personal data through the following channels:

• Direct submission: Information you provide when registering an account, completing KYC, making a deposit or withdrawal, contacting support, or participating in a promotion.
• Automated technical collection: Data collected automatically when you visit or use the toto6 platform, including IP addresses, device fingerprints, session cookies, and browsing behavior within the platform.
• Third-party providers: Identity verification data returned by toto6's KYC service providers; fraud risk scores from payment processing partners; geolocation data from IP intelligence services used to enforce jurisdiction restrictions.
• Payment processors: Transaction confirmation data from banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) sufficient to match deposits and withdrawals to the correct Member account.

5. Purposes of Processing & Legal Basis

5.1 toto6 processes personal data only where a valid legal basis exists. The applicable legal bases and corresponding processing purposes are:

• Performance of contract: Processing necessary to create and maintain your toto6 account, process deposits and withdrawals in Indonesian Rupiah (IDR), settle wagers, and provide customer support.
• Legal obligation: Processing necessary to comply with anti-money laundering (AML) requirements, KYC verification obligations, fraud prevention duties, and any lawful order from a competent authority.
• Legitimate interests: Processing necessary to detect and prevent fraud, maintain platform security, conduct internal analytics to improve services, and enforce toto6's Terms & Conditions — where such interests are not overridden by your fundamental rights.
• Consent: Processing of optional data for personalized promotional communications, where you have given explicit, freely withdrawable consent. You may withdraw consent at any time by contacting [email protected].

6. Data Sharing with Third Parties

6.1 toto6 does not sell, rent, or trade your personal data to any third party for commercial purposes. Personal data is shared only in the following limited and controlled circumstances:

• Payment processors and banks: Financial data necessary to execute deposits and withdrawals is shared with the relevant Indonesian bank (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI) or e-wallet provider (OVO, DANA, GoPay, ShopeePay, LinkAja) to complete the transaction.
• KYC and identity verification providers: Identity documents and personal identifiers are shared with toto6's certified KYC service partners solely for the purpose of verifying your identity and age.
• Fraud detection and cybersecurity providers: Technical data (IP address, device fingerprint, behavioral patterns) is shared with security service providers to detect and prevent unauthorized access and fraudulent activity.
• Game content providers: Limited session and wager data is shared with certified game studios (Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, Pocket Games Soft) to facilitate gameplay and resolve game-related disputes.
• Legal and regulatory authorities: Personal data will be disclosed to competent authorities, regulators, or law enforcement agencies where toto6 is legally required to do so, or where disclosure is necessary to protect the rights, property, or safety of toto6 or its Members.
• Business transfers: In the event of a merger, acquisition, or sale of the toto6 business, personal data may be transferred to the acquiring entity, subject to equivalent data protection commitments.

6.2 All third-party Data Processors engaged by toto6 are bound by contractual data processing agreements that restrict their use of personal data to the specific purpose for which it was shared, and that require them to implement appropriate technical and organizational security measures.

7. International Data Transfers

7.1 As an international online gaming platform, toto6 may transfer personal data to servers or service providers located outside of Indonesia. Where such transfers occur, toto6 takes appropriate steps to ensure that your personal data continues to receive an equivalent level of protection, including:

• Executing standard contractual clauses or equivalent transfer mechanisms with the recipient entity.
• Selecting service providers located in jurisdictions that maintain adequate data protection standards recognized at the international level.
• Applying contractual restrictions and technical safeguards (encryption, access controls, pseudonymization) to data in transit and at rest.

7.2 By registering a toto6 account, you acknowledge and consent to the international transfer of your personal data as described in this section, subject always to the protections outlined above.

8. Data Retention

8.1 toto6 retains personal data for the minimum period necessary to fulfill the purpose for which it was collected, or as required by applicable law. The following retention schedules apply:

• Active account data: Retained for the duration of your toto6 account plus a minimum of five (5) years following account closure, in compliance with anti-money laundering record-keeping requirements.
• KYC and identity documents: Retained for a minimum of five (5) years from the date of submission or the date of account closure, whichever is later.
• Transaction records: Retained for a minimum of five (5) years from the date of the transaction.
• Support communications: Retained for three (3) years from the date of the last communication in a given thread.
• Technical and usage data (logs): Retained for thirteen (13) months from the date of collection, after which they are aggregated and anonymized.
• Marketing consent records: Retained for the duration of your consent, plus three (3) years after withdrawal of consent, for compliance audit purposes.

8.2 Upon expiry of the applicable retention period, personal data is securely and irreversibly deleted or anonymized in accordance with toto6's data destruction procedures.

9. Security Measures

9.1 toto6 implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, destruction, and disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and toto6's servers.
• AES-256 encryption for sensitive data stored at rest, including identity documents and financial account details.
• Role-based access controls ensuring that toto6 personnel can access personal data only to the extent necessary for their specific job function.
• Multi-factor authentication requirements for all staff accessing production systems containing Member data.
• Regular penetration testing and vulnerability assessments conducted by independent cybersecurity specialists.
• 24/7 intrusion detection and anomaly monitoring on toto6's infrastructure.
• Formal incident response procedures, including notification protocols for data breaches that pose a risk to Member rights.

9.2 Notwithstanding the above, no method of electronic transmission or storage is completely secure. toto6 cannot guarantee absolute security of your data and encourages you to use a strong, unique password for your toto6 account and to enable two-factor authentication in your account settings.

9.3 In the event of a data breach that is likely to result in a risk to the rights and freedoms of affected Members, toto6 will notify the affected Members without undue delay via the email address registered to their account, and will provide details of the nature of the breach, the data involved, and the steps toto6 has taken to contain and remediate the incident.

10. Cookies & Tracking Technologies

10.1 toto6 uses cookies and similar tracking technologies on the platform to ensure core functionality, improve the user experience, and gather analytical insights. The categories of cookies used are:

• Strictly necessary cookies: Required for the platform to function. These include session authentication tokens, security cookies, and load-balancing cookies. These cannot be disabled without breaking platform functionality.
• Functional cookies: Enable features such as language preferences, remembered login state (if you select "Remember Me"), and your last-visited game category. These persist across browser sessions for your convenience.
• Analytics cookies: Collect anonymized or pseudonymized data about how Members navigate and use the platform, enabling toto6 to identify areas for improvement. toto6 uses first-party analytics only — no third-party advertising trackers are deployed.

10.2 You may manage cookie preferences through your browser settings. Please note that disabling cookies beyond the strictly necessary category may affect certain features of the toto6 platform. toto6 does not currently respond to browser-level "Do Not Track" signals, as no universally accepted standard for such signals has been established.

11. Minors — Strictly 21+

11.1 The toto6 platform is strictly intended for adults aged 21 and over. toto6 does not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory step in the KYC process.

11.2 If toto6 discovers or has reasonable grounds to believe that personal data has been collected from an individual under the age of 21, that account will be immediately suspended, all associated balances will be frozen pending investigation, and all personal data associated with the underage account will be securely deleted following the conclusion of any legally required retention period.

11.3 If you are a parent or guardian and believe that your minor child has registered a toto6 account, please contact [email protected] immediately.

12. Exercising Your Data Rights

12.1 To exercise any of the data rights described in the "Your Rights Over Your Personal Data" section above — including access, rectification, erasure, restriction, portability, and objection — please submit a written request to toto6 at [email protected] with the subject line "Data Rights Request".

12.2 To protect the security of your account, toto6 will verify your identity before processing any data rights request. You may be asked to confirm your registered email address, provide the last four digits of your registered bank account, or complete an additional verification step.

12.3 toto6 will respond to all data rights requests within thirty (30) calendar days of receipt of a verified request. Where a request is complex or voluminous, toto6 may extend this period by an additional sixty (60) days and will notify you of the extension within the initial 30-day window.

12.4 Data rights requests are processed free of charge for one request per 12-month period per Member. Subsequent requests within the same period may incur a reasonable administrative fee, of which you will be notified in advance.

13. Amendments to This Policy

13.1 toto6 reviews and updates this Privacy Policy periodically to reflect changes in data processing practices, applicable law, or operational requirements. Material changes will be communicated to Members via email notification to the registered account address at least fourteen (14) days before the revised Policy takes effect.

13.2 The effective date of the current version of this Privacy Policy is stated at the top of the document. Continued use of the toto6 platform after the effective date of any amendment constitutes your acceptance of the revised Policy.

13.3 The current version of this Privacy Policy is always available at toto6.cam/privacy-policy. toto6 recommends that you review this page periodically to remain informed of any updates.

14. Contact & Data Protection Inquiries

For all privacy-related questions, data rights requests, or concerns regarding toto6's data handling practices, please contact us through the following channel:

• Email: [email protected] — subject line: "Data Protection Request" (plain text — not a clickable link)
• Live Chat: Available 24/7 on toto6.cam, with Indonesian-speaking support agents available during peak hours (18:00–02:00 WIB).
• Response Time: All privacy inquiries are acknowledged within 24 hours and resolved within 30 calendar days.

We also encourage you to review our Terms & Conditions and our Responsible Gaming page for a complete picture of how toto6 operates and supports its Members.