Privacy Policy

1. Introduction

Welcome to dctoto's Privacy Policy. This document explains how dctoto ("we," "us," or "our") collects, uses, discloses, and protects the personal information of users ("you" or "your") who access and use our online betting platform at https://dctoto.cam (the "Website") and related services.

At dctoto, we are committed to protecting your privacy and handling your personal data with transparency and integrity. This Privacy Policy applies to all users who register for an account, visit our Website, or use any of our services, including sports betting, live casino games, slots, and togel (traditional Indonesian lottery games).

By registering with dctoto, accessing our Website, or using our services, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree with this Privacy Policy, please do not use our services.

2. Information We Collect

To provide you with a secure, personalized, and compliant betting experience, dctoto collects several types of information. The categories of personal information we collect include:

2.1 Information You Provide Directly

• Registration Information: When you create an account, we collect your full legal name, date of birth, gender, residential address, email address, mobile phone number, and username.
• Identity Verification (KYC) Documents: To comply with regulatory requirements and prevent fraud, we collect copies of your Indonesian national identity card (KTP), passport, proof of address (utility bills or bank statements), and selfie photographs holding your identification document.
• Financial Information: We collect details about your payment methods, including bank account information (bank name, account number, account holder name) and e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja) to process deposits and withdrawals.
• Communication Records: When you contact our customer support team via live chat, email, WhatsApp, or phone, we retain records of your communications to improve service quality and resolve disputes.
• Marketing Preferences: Information about your consent to receive promotional emails, SMS messages, and notifications about bonuses, tournaments, and special offers.

2.2 Information Collected Automatically

• Device and Technical Information: IP address, device type, operating system, browser type and version, screen resolution, language settings, and time zone.
• Usage Data: Information about how you interact with our Website, including pages visited, games played, bets placed, deposit and withdrawal history, login times, session duration, and clickstream data.
• Cookies and Tracking Technologies: We use cookies, web beacons, and similar technologies to enhance user experience, analyze site traffic, remember your preferences, and deliver personalized content. For details, see Section 8 (Cookies Policy).
• Location Information: We collect approximate geographic location data based on your IP address to ensure compliance with jurisdictional restrictions and provide localized services.

2.3 Information from Third Parties

• Payment Processors: We receive transaction confirmation data from payment service providers (BCA, BRI, BNI, Mandiri, e-wallet operators) to verify deposits and process withdrawals.
• Fraud Prevention Services: We may obtain information from third-party fraud detection and identity verification services to protect against unauthorized access, money laundering, and other illicit activities.
• Game Providers: Information about your gameplay activity is shared by our game providers (Pragmatic Play, Evolution Gaming, Microgaming, etc.) to track bets, winnings, and game outcomes.

3. How We Use Your Information

dctoto uses your personal information for the following purposes:

3.1 Service Provision and Account Management

• Creating, managing, and maintaining your user account
• Processing deposits, withdrawals, and other financial transactions
• Providing access to betting markets, casino games, and other platform features
• Calculating and crediting winnings, bonuses, and promotional rewards
• Verifying your identity and age (21+ requirement) through KYC procedures

3.2 Legal and Regulatory Compliance

• Complying with Know Your Customer (KYC) and Anti-Money Laundering (AML) regulations
• Preventing fraud, money laundering, underage gambling, and other illegal activities
• Detecting and investigating suspicious betting patterns, collusion, or advantage play
• Responding to legal requests from law enforcement and regulatory authorities
• Enforcing our Terms and Conditions and resolving disputes

3.3 Customer Support and Communication

• Responding to your inquiries, complaints, and support requests
• Sending account notifications (deposits confirmed, withdrawals processed, password changes, etc.)
• Providing updates about service changes, maintenance schedules, and system outages
• Delivering important notices regarding your account status or compliance requirements

3.4 Marketing and Promotions (with Consent)

• Sending promotional emails about bonuses, free bets, tournaments, and special offers
• Delivering personalized recommendations based on your gameplay preferences
• Conducting surveys and gathering feedback to improve our services
• Analyzing user behavior to optimize marketing campaigns and user acquisition strategies

Note: You can opt out of marketing communications at any time by adjusting your account preferences or clicking "unsubscribe" in promotional emails. Transactional and account-related communications cannot be opted out of.

3.5 Platform Improvement and Analytics

• Analyzing user behavior and gameplay patterns to enhance platform functionality
• Identifying technical issues, bugs, and performance bottlenecks
• Conducting A/B testing to improve user interface and user experience
• Developing new features, games, and services based on user preferences

3.6 Security and Fraud Prevention

• Monitoring for unauthorized access, hacking attempts, and security breaches
• Detecting and preventing fraudulent transactions and identity theft
• Implementing responsible gaming measures, including self-exclusion and deposit limits
• Maintaining audit logs for security investigations and regulatory audits

4. Legal Basis for Processing (GDPR and International Standards)

dctoto processes your personal information based on the following legal grounds:

• Contractual Necessity: Processing is necessary to fulfill our contractual obligations to provide betting services, process transactions, and maintain your account.
• Legal Obligation: Processing is required to comply with KYC/AML regulations, tax laws, and other legal requirements imposed by gaming authorities.
• Legitimate Interests: Processing serves our legitimate business interests in preventing fraud, improving services, and ensuring platform security, provided these interests do not override your fundamental rights.
• Consent: Where required by law, we obtain your explicit consent before processing personal data for marketing purposes or using certain tracking technologies.

5. How We Share Your Information

dctoto does not sell, rent, or trade your personal information to third parties for their marketing purposes. However, we may share your information in the following limited circumstances:

5.1 Service Providers and Business Partners

We share personal information with trusted third-party service providers who assist us in operating our platform, including:

• Payment Processors: Banks (BCA, BRI, BNI, Mandiri, CIMB Niaga) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) that facilitate deposits and withdrawals.
• Game Providers: Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Ezugi, and other studios that power our casino games and provide gameplay data.
• Identity Verification Services: Third-party KYC/AML compliance platforms that verify your identity documents and screen for fraud.
• Customer Support Tools: Live chat software, email management systems, and CRM platforms that help us deliver efficient support.
• Analytics and Marketing Platforms: Tools that help us analyze user behavior, optimize campaigns, and measure platform performance.

All service providers are contractually obligated to protect your data and use it only for the purposes we specify. They are prohibited from using your information for their own purposes or sharing it with third parties.

5.2 Legal and Regulatory Authorities

We may disclose your personal information to law enforcement agencies, regulatory bodies, courts, or government authorities when required by law or when we believe in good faith that disclosure is necessary to:

• Comply with legal obligations, court orders, subpoenas, or warrants
• Investigate and prevent fraud, money laundering, or other criminal activities
• Protect the rights, property, or safety of dctoto, our users, or the public
• Enforce our Terms and Conditions or defend against legal claims

5.3 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of assets, your personal information may be transferred to the acquiring entity. We will notify you via email or prominent notice on our Website before your information is transferred and becomes subject to a different Privacy Policy.

5.4 With Your Consent

We may share your information with other third parties if you provide explicit consent for such disclosure.

6. Data Retention

dctoto retains your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. Specific retention periods include:

Data Category	Retention Period	Reason
Account Information	Duration of account + 7 years	Legal compliance, dispute resolution
Transaction Records	7 years from transaction date	Tax laws, AML regulations, audits
KYC Documents	7 years from account closure	Regulatory requirements, fraud prevention
Gameplay History	5 years from last activity	Dispute resolution, responsible gaming monitoring
Marketing Communications	Until consent withdrawn + 1 year	Compliance with consent records
Support Conversations	3 years from last contact	Quality assurance, dispute resolution

After the applicable retention period expires, we securely delete or anonymize your personal information so it can no longer identify you. Anonymized data may be retained indefinitely for statistical and analytical purposes.

7. Your Privacy Rights

Under international data protection laws, you have the following rights regarding your personal information:

7.1 Right to Access

You have the right to request a copy of the personal information we hold about you. You can view most of your account information directly in your account dashboard. To request a comprehensive data export, contact our support team at [email protected].

7.2 Right to Rectification

If any personal information we hold about you is inaccurate or incomplete, you have the right to request correction. You can update most information (email, phone number, address) directly through your account settings.

7.3 Right to Erasure (Right to be Forgotten)

You have the right to request deletion of your personal information under certain circumstances, such as when the information is no longer necessary for the purposes it was collected or if you withdraw consent. Note that we may be legally required to retain certain information (transaction records, KYC documents) even after account closure.

7.4 Right to Restrict Processing

You can request that we limit how we use your personal information in certain situations, such as when you contest the accuracy of the data or object to processing based on legitimate interests.

7.5 Right to Data Portability

You have the right to receive your personal information in a structured, commonly used, machine-readable format and transmit it to another service provider without hindrance.

7.6 Right to Object

You can object to processing of your personal information based on legitimate interests or for direct marketing purposes. To opt out of marketing communications, adjust your account preferences or click "unsubscribe" in promotional emails.

7.7 Right to Withdraw Consent

Where processing is based on your consent (e.g., marketing communications), you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

To exercise any of these rights, contact our Data Protection Officer at [email protected]. We will respond to your request within 30 days. In some cases, we may need to verify your identity before fulfilling your request to protect against unauthorized disclosure.

8. Cookies and Tracking Technologies

dctoto uses cookies, web beacons, and similar technologies to enhance your experience, analyze traffic, and deliver personalized content. Cookies are small text files stored on your device that help us recognize you on subsequent visits.

Types of Cookies We Use:

• Essential Cookies: Required for core platform functionality, including account login, session management, and security features. These cannot be disabled without impairing site functionality.
• Performance Cookies: Collect anonymous usage statistics to help us understand how users interact with our Website and identify areas for improvement.
• Functional Cookies: Remember your preferences (language, currency, display settings) to provide a more personalized experience.
• Marketing Cookies: Track your browsing activity across websites to deliver relevant advertisements and measure campaign effectiveness. These require your consent and can be disabled.

You can manage cookie preferences through your browser settings. Note that disabling certain cookies may limit your ability to use some features of our Website. For more information about cookies and how to control them, visit your browser's help documentation.

9. Data Security

dctoto implements robust technical, administrative, and physical security measures to protect your personal information from unauthorized access, disclosure, alteration, or destruction. Our security practices include:

• SSL/TLS Encryption: All data transmitted between your device and our servers is encrypted using 256-bit SSL (Secure Socket Layer) technology, the same standard used by banks and financial institutions.
• Secure Data Storage: Personal information is stored on secure servers located in data centers with physical access controls, surveillance, and environmental safeguards.
• Access Controls: We restrict access to personal information to authorized employees and service providers who require it to perform their duties. All personnel with access are bound by confidentiality obligations.
• Regular Security Audits: We conduct periodic security assessments and penetration testing to identify and address vulnerabilities.
• Two-Factor Authentication (2FA): Available for all user accounts to add an extra layer of security beyond passwords.
• Fraud Monitoring: Automated systems continuously monitor for suspicious activity, unauthorized access attempts, and fraudulent transactions.

10. International Data Transfers

dctoto operates internationally and may transfer your personal information to servers and service providers located outside Indonesia. When we transfer data to countries that do not provide an equivalent level of data protection, we implement appropriate safeguards such as:

• Standard contractual clauses approved by data protection authorities
• Binding corporate rules for transfers within our corporate group
• Certification under recognized data protection frameworks
• Explicit consent for transfers where required by law

11. Children's Privacy

dctoto's services are intended exclusively for individuals who are 21 years of age or older. We do not knowingly collect personal information from minors. If we discover that we have inadvertently collected information from someone under 21, we will immediately delete it and close the associated account. If you believe we have collected information from a minor, please contact us immediately at [email protected].

12. Changes to This Privacy Policy

dctoto reserves the right to update this Privacy Policy at any time to reflect changes in our practices, legal requirements, or business operations. When we make material changes, we will post the updated Privacy Policy on this page with a new "Last Updated" date and notify you via email or prominent notice on our Website.

Your continued use of dctoto's services after the updated Privacy Policy becomes effective constitutes acceptance of the changes. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

13. Contact Us

If you have questions, concerns, or complaints about this Privacy Policy or our data practices, or if you wish to exercise your privacy rights, please contact us:

• Email: [email protected]
• Subject Line: "Privacy Inquiry" or "Data Protection Request"
• Response Time: We aim to respond to all privacy inquiries within 30 days

For specific questions about data protection, you may also request to speak with our Data Protection Officer (DPO), who oversees compliance with privacy regulations and handles user rights requests.