Privacy Policy — gmtoto Data Security Commitment

1 Introduction

gmtoto ("we", "us", "our") is committed to protecting the privacy and security of personal information provided by Members and visitors. We recognize that privacy is a fundamental right, and we handle all personal data with care, transparency, and in accordance with applicable data protection laws.

This Privacy Policy describes:

• What personal information gmtoto collects from Indonesian players;
• How gmtoto uses that information to operate the Platform, process transactions, and provide customer support;
• Who gmtoto shares information with and under what circumstances;
• How gmtoto secures personal data against unauthorized access or disclosure;
• Your rights regarding your personal information and how to exercise them.

This Policy should be read in conjunction with our Terms & Conditions (available at /terms-conditions) and our Responsible Gaming policy (available at /responsible-gaming). In the event of any conflict between this Policy and other gmtoto documentation, this Policy governs with respect to privacy and data protection matters.

2 Data Controller

For the purposes of applicable data protection law, gmtoto is the data controller responsible for the personal information collected through the Platform. Our contact details for privacy-related inquiries are provided at the end of this Policy.

gmtoto determines the purposes for which and the manner in which personal data is processed. We are committed to processing all personal data in compliance with international data protection standards and the expectations of the Indonesian player community.

3 Information We Collect

gmtoto collects personal information from Members and visitors through several channels. The categories of information collected include:

3.1 Information You Provide Directly

• Account Registration Data: When you create a gmtoto account, you provide your full legal name, date of birth, residential address in Indonesia (city: Jakarta, Surabaya, Medan, Bandung, Bali, Yogyakarta, or other), email address, mobile telephone number registered in Indonesia, and a password of your choosing.
• Identity Verification (KYC) Documents: To comply with anti-money-laundering regulations and age verification requirements, you must submit a government-issued identification document (KTP — Indonesian National Identity Card, passport, or driver's license) and proof of payment method ownership (bank statement, e-wallet screenshot, or bank card photograph).
• Payment Information: When you deposit or withdraw funds, you provide payment details including bank account numbers (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) or e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja). gmtoto does not store full bank card numbers or CVV codes; these are processed securely by our payment partners.
• Communications: When you contact gmtoto customer support at [email protected] or via live chat, we collect the content of your messages, your email address, and any additional information you choose to provide to assist with your inquiry.
• Responsible Gaming Preferences: If you set deposit limits, session time reminders, or request self-exclusion, we collect and store these preferences to ensure they are enforced across your account.

3.2 Information Collected Automatically

• Device and Technical Data: When you access gmtoto, we automatically collect information about your device including IP address, device type (mobile, desktop, tablet), operating system (Android, iOS, Windows, macOS), browser type and version, screen resolution, and time zone setting.
• Usage Data: We collect information about how you interact with the Platform including pages visited, games played, wagers placed, time spent on each page, click patterns, and navigation paths through the site. This data helps us improve user experience and identify technical issues.
• Location Data: gmtoto collects approximate geographic location data based on your IP address to ensure compliance with jurisdiction-specific regulations and to provide localized content and payment options. We do not collect precise GPS coordinates unless you explicitly grant permission.
• Cookies and Tracking Technologies: gmtoto uses cookies, web beacons, and similar tracking technologies to recognize returning visitors, remember preferences, analyze site traffic, and deliver targeted content. See Section 10 (Cookies and Tracking) for details.

3.3 Information from Third Parties

• Payment Processors: Our payment partners (Indonesian banks and e-wallet providers) share transaction confirmation data with gmtoto to process deposits and withdrawals. This includes transaction ID, amount, timestamp, and confirmation status.
• KYC Verification Services: gmtoto may use third-party identity verification services to validate the authenticity of submitted KYC documents. These services return a pass/fail result without storing your documents permanently.
• Game Providers: Live casino studios (Evolution Gaming, Ezugi) and slot game providers (Pragmatic Play, Microgaming, NetEnt, Spribe, Pocket Games Soft) share gameplay data with gmtoto including game outcomes, wager amounts, and win/loss results. This data is used for settlement, dispute resolution, and fraud detection.

4 How We Use Your Data

gmtoto uses your personal information for the following purposes:

• Account Management: To create and maintain your gmtoto account, authenticate your identity, and provide access to Platform features.
• Transaction Processing: To process deposits and withdrawals via BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja, and to maintain accurate transaction records in IDR (Indonesian Rupiah).
• Game Provision: To provide access to sports betting markets (EPL, La Liga, Serie A, Bundesliga, Champions League, BRI Liga 1, Timnas Indonesia), live casino games (baccarat, roulette, blackjack, sic bo), togel (numbers lottery), slot gacor (high-payout slot) titles, and other gambling products.
• Customer Support: To respond to inquiries, resolve disputes, and provide technical assistance via email ([email protected]) and live chat.
• KYC and Compliance: To verify that all Members are at least 21 years of age and residents of Indonesia, to comply with anti-money-laundering regulations, and to prevent fraud and identity theft.
• Responsible Gaming: To enforce deposit limits, session reminders, self-exclusion requests, and other responsible gaming tools chosen by Members.
• Platform Improvement: To analyze usage patterns, identify technical issues, optimize user experience, and develop new features based on Member behavior and feedback.
• Marketing and Promotions: To notify Members of bonus offers, promotions, and new game launches via email or in-platform notifications. Members may opt out of marketing communications at any time.
• Security and Fraud Prevention: To detect and prevent fraudulent activity, duplicate accounts, collusion, bonus abuse, chargebacks, and other prohibited conduct.
• Legal Compliance: To comply with legal obligations including tax reporting, regulatory inquiries, court orders, and law enforcement requests where legally required.

5 Legal Basis for Processing

gmtoto processes personal data on the following legal bases:

• Contractual Necessity: Processing is necessary to perform the contract between you and gmtoto as set out in the Terms & Conditions. This includes account creation, transaction processing, game provision, and customer support.
• Legal Obligation: Processing is necessary to comply with legal requirements including KYC/AML regulations, tax reporting, and responses to lawful government requests.
• Legitimate Interests: Processing is necessary for gmtoto's legitimate business interests including fraud prevention, security monitoring, platform improvement, and direct marketing (subject to opt-out rights).
• Consent: In certain cases, gmtoto relies on your explicit consent (e.g., marketing emails, precise location tracking). You may withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

6 Data Sharing and Disclosure

gmtoto does not sell or rent your personal information to third parties. We share personal data only in the following limited circumstances:

6.1 Service Providers

gmtoto engages trusted third-party service providers to support Platform operations. These providers have access to personal data only to the extent necessary to perform their functions and are contractually obligated to protect it. Service providers include:

• Payment processors (Indonesian banks: BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata; e-wallets: OVO, DANA, GoPay, ShopeePay, LinkAja);
• KYC verification services;
• Game content providers (Evolution Gaming, Ezugi, Pragmatic Play, Microgaming, NetEnt, Spribe, Pocket Games Soft);
• Cloud hosting and server infrastructure providers;
• Customer relationship management (CRM) platforms;
• Email delivery services;
• Analytics and fraud detection tools.

6.2 Legal Requirements

gmtoto may disclose personal information if required to do so by law or in response to valid legal process including court orders, subpoenas, or government inquiries. We may also disclose information to enforce our Terms & Conditions, protect the rights and safety of gmtoto, our Members, or the public, or to detect and prevent fraud and illegal activity.

6.3 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, personal data may be transferred to the acquiring entity as part of the transaction. Members will be notified via email or prominent notice on the Platform before personal information becomes subject to a different privacy policy.

6.4 With Your Consent

gmtoto may share personal information with third parties for purposes not described in this Policy if we first obtain your explicit consent.

7 Data Security Measures

gmtoto employs industry-standard security measures to protect personal information from unauthorized access, disclosure, alteration, or destruction. Our security practices include:

• 256-Bit SSL/TLS Encryption: All data transmitted between your device and gmtoto servers is encrypted using 256-bit SSL (Secure Sockets Layer) or TLS (Transport Layer Security) protocols. This includes login credentials, payment details, and KYC documents.
• Secure Data Centers: Member personal information is stored on secure servers located in jurisdictions with robust data protection laws. Physical access to these servers is restricted and monitored.
• Access Controls: Access to personal data is limited to authorized gmtoto employees and contractors who require it to perform their duties. All personnel are subject to confidentiality obligations.
• Password Hashing: Member passwords are hashed using strong cryptographic algorithms (bcrypt with salt). gmtoto staff cannot view your password in plaintext.
• Two-Factor Authentication (2FA): gmtoto offers optional two-factor authentication to add an extra layer of security to your account. We strongly encourage all Members to enable 2FA.
• Regular Security Audits: gmtoto conducts regular security assessments, vulnerability scans, and penetration testing to identify and remediate potential security weaknesses.
• Incident Response Plan: In the event of a data breach affecting Member personal information, gmtoto has an incident response plan to contain the breach, assess the impact, notify affected Members, and report to relevant authorities as required by law.

Despite these measures, no internet-based system is completely secure. gmtoto cannot guarantee absolute security, and Members are responsible for maintaining the confidentiality of their login credentials and notifying us immediately of any suspected unauthorized access.

8 Data Retention

gmtoto retains personal information only as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements.

• Active Accounts: Personal information associated with active accounts is retained for the duration of the account relationship.
• Closed Accounts: After account closure (whether initiated by the Member or gmtoto), personal data is retained for up to 7 years to comply with financial record-keeping requirements, tax obligations, and to support potential dispute resolution or legal claims.
• KYC Documents: Identity verification documents (KTP, passport, bank statements) are retained for 7 years post-account closure in accordance with anti-money-laundering regulations.
• Transaction Records: Deposit, withdrawal, and wager records are retained for 7 years to comply with financial auditing and tax reporting requirements.
• Marketing Opt-Outs: If you opt out of marketing communications, gmtoto retains your email address on a suppression list indefinitely to ensure we do not inadvertently re-add you to marketing campaigns.
• Self-Exclusion Records: Self-exclusion requests are retained permanently to prevent re-opening of excluded accounts and to maintain the integrity of responsible gaming programs.

After the applicable retention period expires, personal data is securely deleted or anonymized such that it can no longer be associated with an individual Member.

9 Your Privacy Rights

As a gmtoto Member, you have the following rights regarding your personal information:

• Right of Access: You have the right to request a copy of the personal information gmtoto holds about you. We will provide this information in a structured, commonly used, and machine-readable format (typically PDF or CSV) within 30 days of your request.
• Right to Rectification: If you believe any personal information gmtoto holds about you is inaccurate or incomplete, you have the right to request correction. You can update most account information directly through your gmtoto account dashboard.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal information. gmtoto will comply unless we are required to retain the data to comply with legal obligations (e.g., financial record-keeping, AML regulations) or to establish, exercise, or defend legal claims.
• Right to Restriction of Processing: You may request that gmtoto restrict processing of your personal information in certain circumstances (e.g., while we verify the accuracy of disputed data).
• Right to Data Portability: You have the right to receive your personal information in a portable format and to request that gmtoto transmit it directly to another service provider where technically feasible.
• Right to Object: You may object to processing of your personal information for direct marketing purposes at any time. You may also object to processing based on legitimate interests, in which case gmtoto will cease processing unless we have compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing conducted prior to withdrawal.
• Right to Lodge a Complaint: If you believe gmtoto has violated your data protection rights, you have the right to lodge a complaint with a relevant data protection authority in your jurisdiction.

To exercise any of these rights, contact gmtoto at [email protected] (displayed as plain text, not a clickable link). We will respond to all requests within 30 days. Requests may require identity verification to ensure we are disclosing information only to the rightful account holder.

10 Cookies and Tracking Technologies

gmtoto uses cookies, web beacons, and similar tracking technologies to enhance user experience, analyze site traffic, and deliver personalized content. A cookie is a small text file stored on your device by your web browser. Cookies do not contain personal information themselves but may be linked to personal information stored on gmtoto servers.

Types of Cookies We Use:

• Essential Cookies: These cookies are necessary for the Platform to function. They enable core features such as secure login, session management, and payment processing. Essential cookies cannot be disabled without breaking core Platform functionality.
• Performance Cookies: These cookies collect anonymous information about how visitors use the Platform including most-visited pages, time spent on each page, and error messages encountered. This data helps gmtoto optimize site performance and identify technical issues.
• Functionality Cookies: These cookies remember your preferences (language, time zone, preferred payment method) and provide personalized features. They enhance user experience but are not essential to Platform operation.
• Marketing Cookies: These cookies track your activity across the Platform to deliver targeted promotional content and measure the effectiveness of marketing campaigns. Marketing cookies may be set by gmtoto or by third-party advertising partners.

Managing Cookies:

Most web browsers allow you to control cookies through browser settings. You can typically:

• View and delete cookies stored on your device;
• Block all cookies (though this may impair Platform functionality);
• Block only third-party cookies;
• Receive a notification before a cookie is set.

Refer to your browser's help documentation for instructions on managing cookies. Note that disabling essential cookies will prevent you from using certain Platform features including account login and transaction processing.

Do Not Track (DNT):

Some browsers support a "Do Not Track" preference that requests websites not track your browsing activity. gmtoto does not currently respond to DNT signals because there is no industry-wide standard for implementing DNT. We honor explicit opt-out requests for marketing cookies as described above.

11 Children's Privacy

gmtoto is strictly intended for adults aged 21 and over. We do not knowingly collect personal information from individuals under 21 years of age. If you are under 21, you may not register for a gmtoto account or use any Platform features.

If gmtoto becomes aware that we have inadvertently collected personal information from a person under 21, we will take immediate steps to delete that information and close the associated account. Balances in accounts verified to belong to minors will be forfeited in full.

Parents and guardians who believe their child has provided personal information to gmtoto should contact us immediately at [email protected] (plain text). We will investigate and take appropriate action.

12 Changes to This Privacy Policy

gmtoto reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or Platform features. Material changes will be communicated to Members via email or prominent notice on the Platform at least 30 days before the changes take effect.

The "Last Updated" date at the top of this Policy indicates the most recent revision. We encourage Members to review this Policy periodically to stay informed about how gmtoto protects personal information.

Continued use of the Platform after a revised Privacy Policy becomes effective constitutes acceptance of the changes. If you do not agree with the revised Policy, you must cease using the Platform and may close your account by contacting [email protected] (plain text).

13 Contact Us About Privacy

If you have questions, concerns, or requests regarding this Privacy Policy or gmtoto's data handling practices, please contact us:

gmtoto is committed to transparent, responsible data stewardship. Your trust is our most valuable asset, and we work every day to earn and maintain it.