Privacy Policy

1. Information We Collect

to888 collects several types of information to provide, maintain, protect, and improve our Services. The categories of personal data we collect include:

1.1 Information You Provide Directly

When you register an account on to888, you voluntarily provide us with the following information:

• Identity Information: Full legal name (as it appears on your Indonesian national identity card or KTP), date of birth, gender, nationality, and a photograph of your government-issued ID for verification purposes.
• Contact Information: Residential address (street address, city, province, postal code), email address, and mobile phone number.
• Financial Information: Indonesian bank account details (bank name, account number, account holder name) or e-wallet information (OVO, DANA, GoPay account ID) for processing deposits and withdrawals. Note that to888 does not store complete credit card numbers - all card transactions are processed through secure payment gateways that tokenize card data.
• Verification Documents: Clear copies of your KTP (Indonesian national identity card), proof of address (utility bill, bank statement, or government correspondence issued within the last 3 months), selfie photographs holding your ID for biometric comparison, and bank account statements or screenshots for payment method verification.
• Account Credentials: Username, password (stored in hashed form - we cannot see your actual password), and security questions/answers if you choose to set them.
• Communication Data: Any information you provide when contacting our customer support team via live chat, email, or phone, including the content of your messages, attachments, and support tickets.

1.2 Information Collected Automatically

When you access to888 services, we automatically collect certain technical and usage information:

• Device Information: Device type (mobile phone, tablet, desktop), operating system (Android, iOS, Windows, macOS), browser type and version, screen resolution, and unique device identifiers.
• IP Address and Location Data: Your internet protocol (IP) address, which provides approximate geographic location (city and province level, not precise GPS coordinates). We use this to verify you are accessing our services from Indonesia and to comply with geographic restrictions.
• Cookies and Similar Technologies: We use cookies (small text files stored on your device), web beacons, pixel tags, and local storage to remember your preferences, maintain your login session, analyze website traffic, and improve user experience. See Section 7 below for detailed information about cookies.
• Usage Data: Pages viewed, links clicked, features used, time spent on each page, navigation paths through our website, search queries entered, games played, bets placed, and other interactions with our Services.
• Transaction History: Complete records of all deposits, withdrawals, bets placed, bet outcomes, winnings, losses, bonus claims, wagering progress, and account balance changes. This information is essential for providing gaming services, processing payments, and complying with financial regulations.
• Log Files: Our servers automatically record standard log information including timestamps, HTTP requests, response codes, referring URLs, and error messages. These logs are used for troubleshooting, security monitoring, and performance optimization.

1.3 Information from Third Parties

In limited circumstances, we may receive information about you from third-party sources:

• Payment Processors: When you make a deposit or withdrawal, our Indonesian payment partners (banks and e-wallet providers) confirm transaction success or failure and may provide transaction reference numbers.
• Game Providers: Third-party game studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, etc.) provide game outcome data, RTP statistics, and session information when you play their games through to888.
• Identity Verification Services: We may use third-party KYC verification services to validate the authenticity of your identity documents and detect fraudulent documents. These services return a verification result (approved/rejected) and a confidence score.
• Publicly Available Sources: We may supplement your information with publicly available data sources to verify your identity, detect fraud, or comply with legal obligations (e.g., checking against sanctions lists or politically exposed persons databases).

2. How We Use Your Information

to888 uses the personal information we collect for the following legitimate business purposes:

2.1 Providing and Improving Services

• Create, maintain, and authenticate your account on the to888 platform
• Process deposits and withdrawals to/from your account balance
• Enable you to place bets on sports events (bandar bola markets), play slot games, participate in live casino tables, enter togel (lottery) draws, watch sabung ayam (cockfighting) streams, and access all other gaming products
• Display accurate account balance, transaction history, and betting history
• Process bonus claims, track wagering requirements, and credit promotional offers to your account
• Maintain game integrity and ensure fair play by monitoring for cheating, collusion, or advantage play
• Analyze usage patterns and user behavior to improve website design, enhance user experience, and optimize game selection
• Develop new features, products, and services based on player preferences and feedback
• Troubleshoot technical issues, fix bugs, and maintain platform stability and performance

2.2 Customer Support and Communication

• Respond to your inquiries, support tickets, and complaints via live chat, email, or phone
• Send important account notifications such as deposit confirmations, withdrawal approvals, bonus activations, and security alerts
• Provide updates about service changes, maintenance schedules, new features, and policy modifications
• Send promotional communications about bonuses, tournaments, special offers, and events (you can opt out of marketing emails at any time)
• Conduct customer satisfaction surveys to gather feedback and improve our services

2.3 Security and Fraud Prevention

• Verify your identity and age to ensure you meet eligibility requirements (21+ years old, Indonesian resident)
• Detect and prevent fraud, money laundering, terrorist financing, and other illegal activities
• Monitor account activity for suspicious patterns that may indicate unauthorized access, account takeover, or malicious behavior
• Protect against security threats, hacking attempts, DDoS attacks, and other cyber threats
• Investigate violations of our Terms and Conditions, including bonus abuse, duplicate accounts, or collusion
• Enforce responsible gaming policies, including self-exclusion requests and deposit limit settings

2.4 Legal and Regulatory Compliance

• Comply with Indonesian anti-money laundering (AML) and counter-terrorism financing (CTF) regulations
• Fulfill Know Your Customer (KYC) verification requirements mandated by financial regulators
• Respond to lawful requests from government authorities, law enforcement agencies, and courts
• Maintain accurate financial records for tax reporting and audit purposes
• Protect our legal rights and defend against legal claims or disputes
• Comply with international gaming regulations and licensing requirements

2.5 Analytics and Business Operations

• Generate aggregated, anonymized statistics about platform usage, popular games, betting trends, and user demographics for internal business analysis
• Measure the effectiveness of marketing campaigns and promotional offers
• Conduct research and development to innovate and improve our Services
• Manage relationships with game providers, payment processors, and other business partners

3. How We Share Your Information

to888 does not sell, rent, or trade your personal information to third parties for their marketing purposes. However, we may share your information with the following categories of recipients for legitimate business and legal reasons:

3.1 Service Providers and Business Partners

• Payment Processors: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI) and e-wallet providers (OVO, DANA, GoPay, ShopeePay) receive your payment information to process deposits and withdrawals on your behalf.
• Game Providers: Third-party game studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, etc.) receive limited information (username, bet amounts, session data) necessary to deliver their games through to888's platform.
• Identity Verification Services: We share your KYC documents with specialized verification services that authenticate identity documents and detect fraud.
• Cloud Infrastructure Providers: Your data is stored on secure servers provided by reputable cloud hosting companies with data centers in jurisdictions that provide adequate data protection.
• Analytics and Monitoring Services: We use third-party analytics tools to understand user behavior, track website performance, and identify technical issues. These services receive anonymized or pseudonymized usage data.
• Customer Support Software: Your support inquiries are processed through third-party helpdesk and live chat platforms that enable our support team to assist you efficiently.

All service providers are contractually obligated to maintain the confidentiality of your information, use it only for the specified purposes, and implement appropriate security measures. We conduct due diligence on all partners before sharing your data.

3.2 Legal and Regulatory Authorities

to888 may disclose your personal information to government authorities, law enforcement agencies, regulators, or courts when:

• Required by Indonesian law, regulation, legal process, or governmental request
• Necessary to comply with anti-money laundering (AML), counter-terrorism financing (CTF), or tax reporting obligations
• Responding to a valid court order, subpoena, search warrant, or similar legal process
• Necessary to protect the rights, property, or safety of to888, our users, or the public
• Investigating suspected fraud, illegal activity, or violations of our Terms and Conditions

3.3 Business Transfers

If to888 is involved in a merger, acquisition, asset sale, bankruptcy, or other business transaction, your personal information may be transferred to the acquiring entity or successors as part of that transaction. In such cases, we will notify you via email and/or prominent notice on our website before your information is transferred and becomes subject to a different privacy policy.

3.4 With Your Consent

We may share your information with third parties when you have given us explicit consent to do so. For example, if you participate in a tournament co-sponsored with a game provider, we may share your username and prize winnings with that provider (with your permission).

4. Data Security Measures

to888 implements comprehensive technical and organizational security measures to protect your personal information from unauthorized access, disclosure, alteration, destruction, or loss:

4.1 Technical Security Controls

• Encryption in Transit: All data transmitted between your device and to888 servers is encrypted using 256-bit SSL/TLS (Secure Sockets Layer / Transport Layer Security) protocols. Look for the padlock icon in your browser's address bar confirming secure connection.
• Encryption at Rest: Sensitive data stored in our databases (passwords, financial information, identity documents) is encrypted using industry-standard encryption algorithms (AES-256).
• Password Hashing: Your password is never stored in plain text. We use strong one-way hashing algorithms (bcrypt, Argon2) so even to888 personnel cannot see your actual password.
• Firewalls and Intrusion Detection: Our servers are protected by firewalls, intrusion detection systems (IDS), and intrusion prevention systems (IPS) that monitor for and block malicious activity.
• Regular Security Updates: We apply security patches and software updates promptly to protect against newly discovered vulnerabilities.
• Penetration Testing: to888 conducts regular security audits and penetration tests to identify and fix potential weaknesses before they can be exploited.
• DDoS Protection: We employ distributed denial-of-service (DDoS) mitigation services to maintain platform availability during cyber attacks.

4.2 Organizational Security Practices

• Access Controls: Access to personal data is restricted on a need-to-know basis. Only authorized employees with legitimate business reasons can access your information, and all access is logged and monitored.
• Employee Training: All to888 staff receive regular training on data protection, privacy principles, security best practices, and recognizing social engineering attempts.
• Confidentiality Agreements: Employees and contractors sign strict confidentiality agreements prohibiting unauthorized disclosure of user information.
• Secure Development Practices: Our development team follows secure coding standards, conducts code reviews, and performs security testing before deploying new features.
• Incident Response Plan: We maintain a comprehensive data breach response plan to quickly detect, contain, and remediate security incidents. In the event of a data breach affecting your information, we will notify you and relevant authorities as required by law.
• Physical Security: Our data centers have physical security controls including 24/7 surveillance, biometric access controls, and environmental monitoring.

4.3 User Responsibilities

While to888 implements robust security measures, you also play a critical role in protecting your account:

• Choose a strong, unique password containing uppercase and lowercase letters, numbers, and special characters
• Never share your password with anyone, including to888 staff (we will never ask for your password)
• Log out after each session, especially on shared or public computers
• Enable two-factor authentication (2FA) if offered by the platform
• Keep your email account secure, as it's used for account recovery
• Be cautious of phishing emails pretending to be from to888 - always verify the sender's email address
• Report suspicious account activity immediately to [email protected]

5. Data Retention

to888 retains your personal information only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements.

5.1 Retention Periods

Data Category	Retention Period	Reason
Account Information	Duration of account + 7 years	Legal compliance, dispute resolution
Transaction History	7 years after transaction	AML/CTF regulations, tax law
KYC Documents	7 years after account closure	Indonesian financial regulations
Betting History	7 years after bet settlement	Gaming regulations, dispute resolution
Marketing Consent	Until consent withdrawn + 2 years	Regulatory compliance, proof of consent
Support Communications	3 years after last interaction	Service quality, dispute resolution
Website Usage Logs	6-12 months	Security monitoring, analytics
Cookie Data	As specified in cookie settings	User preferences, session management

5.2 Secure Deletion

When personal information is no longer needed, to888 securely deletes or anonymizes it in accordance with data protection best practices. Deletion methods include:

• Permanent removal from active databases with overwriting to prevent recovery
• Removal from backup systems according to our backup retention schedule
• Anonymization or pseudonymization for data that must be retained for statistical or regulatory purposes

Note that certain information may persist in backup systems for a limited time after deletion from active systems, but these backups are not accessible for operational purposes and are securely destroyed according to our backup retention policy.

6. Your Privacy Rights

As a to888 user, you have certain rights regarding your personal information. These rights may vary depending on your jurisdiction, but generally include:

6.1 Right to Access

You have the right to request confirmation of whether to888 is processing your personal data and to access a copy of that data. You can view most of your information directly in your account dashboard (profile, transaction history, betting history). For additional information, contact [email protected] with your request.

6.2 Right to Rectification

If your personal information is inaccurate or incomplete, you have the right to request correction or completion. You can update your contact information, address, and preferences through your account settings. For changes to identity information (name, date of birth), contact customer support with supporting documentation.

6.3 Right to Erasure ("Right to be Forgotten")

Under certain circumstances, you may request deletion of your personal data. However, this right is not absolute - we may be required to retain certain information to comply with legal obligations (AML/CTF regulations require 7-year retention of financial records), resolve disputes, or enforce our agreements. To request account deletion, contact customer support. Note that account deletion is typically permanent and cannot be reversed.

6.4 Right to Restrict Processing

You may request that to888 restrict processing of your personal data in specific situations, such as when you contest the accuracy of the data or object to processing. During the restriction period, we may store your data but not use it except with your consent or for legal claims.

6.5 Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format (e.g., CSV, JSON) and to transmit that data to another service provider. Contact customer support to request a data export.

6.6 Right to Object

You may object to processing of your personal data for direct marketing purposes at any time. Click the "unsubscribe" link in any marketing email or adjust your communication preferences in your account settings. You may also object to processing based on legitimate interests by contacting us with your reasons.

6.7 Right to Withdraw Consent

Where processing is based on consent (e.g., marketing communications), you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.

6.8 Exercising Your Rights

To exercise any of these rights, contact to888 at [email protected] with "Privacy Rights Request" in the subject line. Include your full name, account username, and a detailed description of your request. We will respond to legitimate requests within 30 days. We may request additional information to verify your identity before processing the request to protect against unauthorized access to your data.

7. Cookies and Similar Technologies

to888 uses cookies and similar tracking technologies to enhance your experience, analyze platform usage, and deliver personalized content. This section explains what cookies are, how we use them, and how you can control them.

7.1 What Are Cookies?

Cookies are small text files stored on your device (computer, smartphone, tablet) when you visit a website. Cookies allow the website to recognize your device on subsequent visits and remember your preferences, login status, and browsing history.

7.2 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for website functionality. These cookies enable core features like account login, session management, security, and load balancing. Without these cookies, you cannot use to888 services. They do not store personally identifiable information and cannot be disabled.
• Performance Cookies: Collect anonymous information about how visitors use our website (pages visited, time spent, error messages encountered). This helps us improve website performance and user experience. Examples: Google Analytics, internal analytics tools.
• Functionality Cookies: Remember your choices and preferences (language, currency display format, timezone) to provide enhanced features and personalized content. These cookies make your visits more convenient.
• Targeting/Advertising Cookies: Track your browsing activity to deliver relevant promotional offers and bonuses. These cookies may be set by third-party advertising partners (with your consent) to build a profile of your interests.

7.3 Other Tracking Technologies

In addition to cookies, to888 may use:

• Web Beacons/Pixels: Tiny transparent images embedded in emails or web pages that track whether you opened an email or viewed a page.
• Local Storage: HTML5 local storage allows websites to store data on your device for longer periods than traditional cookies. Used for caching game assets and improving load times.
• Session Storage: Temporary storage cleared when you close your browser. Used for maintaining state during your session.

7.4 Managing Cookies

You can control cookies through your browser settings:

• Block all cookies (note: this will prevent you from using to888 services)
• Block third-party cookies while allowing first-party cookies
• Delete existing cookies from your device
• Receive notifications before cookies are set

Browser-specific instructions: Chrome (Settings > Privacy and Security > Cookies), Firefox (Options > Privacy & Security), Safari (Preferences > Privacy), Edge (Settings > Privacy).

Note that disabling cookies may impair certain features and functionality of to888. For example, you may not be able to stay logged in or save preferences.

8. International Data Transfers

to888 primarily serves Indonesian players and stores data in secure data centers located in jurisdictions with adequate data protection laws. However, some of our service providers and partners may be located in other countries, which may result in international data transfers.

When we transfer personal information outside Indonesia, we ensure appropriate safeguards are in place, including:

• Transferring data only to countries recognized as providing adequate data protection
• Using standard contractual clauses approved by data protection authorities
• Ensuring service providers comply with international data protection standards
• Implementing technical and organizational security measures during transfer

If you have questions about international data transfers, contact [email protected].

9. Children's Privacy

to888 services are intended exclusively for adults aged 21 years and older. We do not knowingly collect personal information from individuals under 21 years of age. Our Terms and Conditions explicitly prohibit minors from creating accounts or using our services.

If you are a parent or guardian and believe your child has provided personal information to to888, please contact us immediately at [email protected]. We will promptly investigate and delete any such information from our systems.

We implement age verification procedures during registration and KYC to prevent underage access. If our verification processes detect an underage user, the account will be immediately suspended and any funds will be returned to the source (less any winnings, which will be forfeited).

10. Changes to This Privacy Policy

to888 reserves the right to modify, amend, or update this Privacy Policy at any time to reflect changes in our practices, legal requirements, or business operations. When we make changes, we will:

• Update the "Last Updated" date at the top of this Privacy Policy
• Post the revised Privacy Policy on our website
• For material changes that significantly affect your privacy rights, notify you via email or prominent notice on our website

Your continued use of to888 services after changes are posted constitutes acceptance of the revised Privacy Policy. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

If you do not agree with any changes, you may close your account by contacting customer support. However, note that we may still retain certain information as required by law or legitimate business interests (see Section 5: Data Retention).

11. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or to888's data protection practices, please contact us:

When contacting us about privacy matters, please provide your full name, account username (if applicable), and a detailed description of your inquiry or request. This helps us respond more efficiently and accurately.