to138 Privacy Policy

1Definitions

The following terms carry specific meanings throughout this Privacy Policy:

• "to138" / "we" / "us" / "our" — the to138 online betting and gaming platform, accessible at https://to138.cam, operated by its internationally licensed entity.
• "Member" / "User" / "you" / "your" — any individual who visits, registers on, or otherwise interacts with the to138 platform.
• "Personal Data" — any information that identifies or can reasonably be used to identify a living natural person, directly or in combination with other data.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, use, disclosure, erasure, or destruction.
• "KYC Data" — identity verification documentation submitted during the Know Your Customer process, including government-issued ID images and selfie photographs.
• "Cookies" — small text files placed on your device by the platform to support functionality, analytics, and session management.
• "Data Controller" — the entity that determines the purposes and means of processing Personal Data. to138 acts as Data Controller for all member data collected through the platform.
• "Third-Party Processor" — an external service provider that processes Personal Data on behalf of to138 under a contractual data processing agreement.

2Data We Collect

to138 collects Personal Data in the following categories depending on how you interact with the platform:

3Legal Basis for Processing

to138 processes your Personal Data only where a lawful basis exists. The applicable bases are:

1. Contractual Necessity. Processing required to fulfil our obligations under the Member Agreement, including account management, payment processing, and bet settlement.
2. Legal Obligation. Processing required to comply with applicable law, including anti-money laundering (AML) regulations, KYC obligations, and financial reporting requirements.
3. Legitimate Interests. Processing that serves to138's legitimate business interests, including fraud prevention, security monitoring, platform analytics, and responsible gaming oversight — provided these interests do not override your fundamental privacy rights.
4. Consent. For optional data processing activities such as promotional email communications and participation in optional surveys. Consent may be withdrawn at any time without affecting prior processing.

4How We Use Your Data

The Personal Data we collect is used for the following purposes:

• Account Creation and Management: Registering your account, maintaining your profile, and ensuring only one account exists per individual.
• Identity Verification (KYC): Confirming your identity, age (21+), and residence in Indonesia before processing withdrawals or activating full account privileges.
• Payment Processing: Facilitating deposits and withdrawals via your nominated Indonesian bank account or e-wallet (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, LinkAja).
• Bet Settlement and Game Delivery: Recording wager outcomes, crediting winnings, and personalising the gaming experience including togel (numbers lottery), sportsbook, and casino products.
• Fraud Prevention and Security: Detecting unauthorised account access, identifying suspicious transaction patterns, and preventing money laundering or bonus abuse.
• Responsible Gaming: Monitoring for gambling harm indicators and enabling intervention tools such as deposit limits, cooling-off periods, and self-exclusion.
• Customer Support: Responding to inquiries, resolving disputes, and maintaining records of support interactions for quality assurance.
• Platform Improvement: Analysing aggregate usage data to improve platform features, page performance, and user experience.
• Legal and Regulatory Compliance: Fulfilling record-keeping, reporting, and cooperation obligations imposed by applicable regulatory authorities.
• Marketing Communications (consent only): Sending promotional offers, bonus announcements, and seasonal promotions (such as Idul Fitri, Ramadhan, or BRI Liga 1 season promotions) to members who have opted in.

5Cookies & Tracking Technologies

to138 uses cookies and similar tracking technologies to operate the platform effectively. The cookies we deploy fall into the following categories:

1. Strictly Necessary Cookies. Essential for the platform to function. These include session authentication tokens, security cookies, and load-balancing identifiers. These cannot be disabled without breaking core platform functionality.
2. Functional Cookies. Enable enhanced features such as remembering your preferred language, odds format, and last-visited game category. Disabling these may reduce platform usability.
3. Analytics Cookies. Collect aggregate, anonymised information about how members navigate the platform — for example, which game categories are visited most frequently or which pages have high exit rates. This data informs product decisions and has no individual identification purpose.
4. Security Cookies. Used to detect and prevent fraudulent activity, bot activity, and multi-account behaviour. These run transparently in the background and do not collect marketing data.

You can manage cookie preferences through your browser settings. Note that blocking strictly necessary cookies will prevent you from logging into or using core platform features.

6Data Sharing & Disclosure

to138 does not sell or rent your Personal Data. We may share data in the following limited circumstances:

1. Game Studios and Platform Providers. Game content providers such as Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Pocket Games Soft, and Spribe receive session identifiers and bet data necessary to deliver and settle game rounds. These providers do not receive your full identity profile.
2. Payment Processors. Indonesian banking partners and e-wallet providers (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, LinkAja) receive the minimum account details required to process your transaction.
3. Identity Verification Services. Third-party KYC and document verification services may process your identity documents on our behalf under strict data processing agreements.
4. Fraud Prevention and Security Partners. Anonymised or pseudonymised data may be shared with fraud detection services to identify platform-wide patterns of abuse.
5. Legal and Regulatory Authorities. to138 will disclose Personal Data to competent law enforcement authorities, regulators, or courts where required by applicable law or valid legal process, including AML reporting obligations.
6. Business Transfers. In the event of a merger, acquisition, or sale of substantially all assets, your Personal Data may be transferred to the successor entity under equivalent privacy protections.

7International Data Transfers

1. to138 operates on internationally hosted infrastructure. Your Personal Data may be stored and processed in data centres located outside of Indonesia, including in jurisdictions where data protection law may differ from Indonesian standards.
2. Where data is transferred internationally, to138 implements appropriate safeguards including contractual data protection clauses, encryption in transit and at rest, and access controls that meet or exceed international best practices.
3. By registering with to138, you acknowledge and consent to the international transfer of your data under the safeguards described in this section.
4. If you have specific concerns about the jurisdiction in which your data is stored, you may contact our support team for further information.

8Data Retention

to138 retains Personal Data for no longer than is necessary for the purpose for which it was collected, subject to the following schedules:

Upon expiry of the applicable retention period, data is securely deleted from active systems and purged from backups on their next scheduled cycle.

9Security Measures

to138 implements a layered security architecture to protect your Personal Data from unauthorised access, disclosure, alteration, or destruction:

• Encryption in Transit: All data transmitted between your browser and our servers uses TLS 1.2 or higher, implementing 256-bit AES encryption.
• Encryption at Rest: Sensitive data stored in our databases — including KYC documents and financial identifiers — is encrypted at the storage layer using AES-256.
• Access Controls: Access to production systems containing Personal Data is restricted to a minimal set of authorised personnel operating on a need-to-know basis. All access is logged and audited.
• Two-Factor Authentication: Internal system access requires multi-factor authentication. Members are also offered two-factor authentication for their own accounts.
• Penetration Testing: to138 engages independent security specialists to conduct periodic penetration testing of the platform and its underlying infrastructure.
• Incident Response: In the event of a data breach that poses a risk to your rights and freedoms, to138 will notify affected members promptly and report to the relevant supervisory authority within the timeframe required by applicable law.
• Uptime and Availability: Our infrastructure maintains a 99.9% uptime SLA with automated failover mechanisms to ensure data availability and integrity.

10Your Data Rights

As a member of to138 and a data subject, you have the following rights with respect to your Personal Data. These rights may be exercised by contacting our support team at [email protected]:

All data subject requests are acknowledged within 72 hours and fulfilled within 30 calendar days of receipt. Where a request is complex or numerous, we may extend this period by a further 60 days with prior notice to you.

11Minors & Age Policy

1. The to138 platform is strictly intended for individuals who are 21 years of age or older. We do not knowingly collect Personal Data from persons under the age of 21.
2. Our registration and KYC processes are designed to identify and reject applications from underage individuals. Date of birth is a mandatory registration field and is verified against submitted KYC documentation.
3. If to138 becomes aware that Personal Data has been collected from a person under 21, that account will be immediately closed, all funds will be returned to the originating payment method, and the associated Personal Data will be deleted from our systems within 30 days.
4. If you believe a minor has registered on to138, please notify us immediately at [email protected] with relevant details so we can investigate and act promptly.

12Third-Party Services

1. The to138 platform integrates third-party services to deliver its full product offering, including game content from studios (Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Pocket Games Soft, Spribe), payment gateways, and KYC verification providers. Each of these providers operates under their own privacy policies governing their own data processing activities.
2. to138 maintains contractual data processing agreements with all third-party processors to ensure they handle member data in accordance with the same level of protection described in this policy.
3. to138 is not responsible for the privacy practices of websites or services that are entirely external to the platform. Our Privacy Policy applies exclusively to data processing activities conducted directly by or on behalf of to138.
4. Third-party game studios receive only the data necessary to deliver and settle game rounds. They do not receive your name, financial details, KTP number, or contact information unless it is specifically required for their service and you have been notified.

13Policy Amendments

1. to138 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or platform features. The date at the top of this page indicates when the policy was last revised.
2. Where a material change is made — particularly one that affects your rights or the purposes for which your data is used — to138 will provide advance notice via an in-platform notification or email to your registered address.
3. Your continued use of the platform following publication of a revised Privacy Policy constitutes your acknowledgement of the updated version. If you do not accept the revised policy, you may request account closure and data deletion.
4. Previous versions of this Privacy Policy are available upon written request to our support team.

14Contact & Data Protection Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or to138's handling of your Personal Data, please reach out to our dedicated privacy contact:

For account-related responsible gaming requests (self-exclusion, deposit limits, cooling-off), please visit our Responsible Gaming page or raise the matter directly via live chat for immediate action.

For the full set of terms governing your use of the to138 platform, please read our Terms & Conditions.