Privacy Policy

1 Introduction

This Privacy Policy ("Policy") sets out how totp12 ("totp12", "we", "us", "our"), operating the website at https://totp12.net, collects, processes, stores, and protects the personal data of individuals ("Player", "User", "you") who visit the website, register an account, or use any of the services offered on the platform. This Policy forms part of, and should be read alongside, the totp12 Terms & Conditions and Responsible Gaming Policy.

totp12 is committed to handling your personal data lawfully, transparently, and in a manner that respects your privacy rights. By registering an account on totp12 or otherwise providing personal information to us, you acknowledge that you have read and understood this Policy and consent to the collection and use of your data as described herein.

If you do not agree with any part of this Policy, you should discontinue use of the platform and may request account closure and deletion of your personal data by contacting our support team at [email protected].

2 Definitions

• "Personal Data" means any information that identifies or can be used to identify a living individual, either directly (e.g., full name, national identity number) or indirectly (e.g., IP address, device fingerprint combined with other data).
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, modification, retrieval, use, disclosure, or deletion.
• "Data Controller" means totp12, the entity that determines the purposes and means of processing Personal Data collected through the platform.
• "Data Processor" means any third party engaged by totp12 to process Personal Data on our behalf, under our documented instructions.
• "KYC Data" means identity verification documents and information collected as part of the Know Your Customer process, including government-issued identity documents, proof of address, and payment method verification.
• "Cookies" means small data files placed on your device by a website to store session information, preferences, and tracking data.
• "WIB" means Western Indonesia Time (UTC+7), the default time zone applied to data processing timestamps and customer support interactions on the totp12 platform.

3 Data We Collect

totp12 collects the following categories of personal data:

Category	Examples	Required?
Identity Data	Full legal name, date of birth, nationality, KTP / passport number	Mandatory (KYC)
Contact Data	Email address, mobile phone number	Mandatory
Financial Data	Bank account name and number (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP), e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja), transaction history in IDR	Mandatory (payments)
Account Data	Username, hashed password, account preferences, self-exclusion and deposit limit settings	Mandatory
Gaming & Betting Data	Bet history, game session duration, wager amounts, win/loss records, bonus usage	Automatic
Technical Data	IP address, device type, browser version, operating system, session tokens, geolocation data	Automatic
Communications Data	Live chat transcripts, email correspondence, support ticket content	When applicable
Marketing Preferences	Opt-in/opt-out status for promotional emails and SMS notifications	Optional

We do not collect sensitive personal data such as racial or ethnic origin, religious beliefs, health data, or biometric data unless specifically required by applicable law and with your explicit consent.

4 How We Collect Data

We collect Personal Data through the following means:

• Account Registration: When you create a totp12 account, you voluntarily provide Identity Data, Contact Data, and initial Account Data.
• KYC Verification: When you submit identity documents to complete the Know Your Customer verification process prior to withdrawal or when prompted by our compliance team.
• Deposits and Withdrawals: When you make financial transactions on the platform, Financial Data including bank account and e-wallet details is captured and stored.
• Platform Usage: Gaming & Betting Data and Technical Data are captured automatically as you browse the site, launch games, place bets, and interact with the platform interface.
• Customer Support: Communications Data is collected when you interact with our support team via live chat, email, or any other channel.
• Cookies and Tracking Technologies: Technical Data and session-level behavioural data are collected automatically through first-party and third-party cookies as described in Section 7.

5 Purpose & Legal Basis for Processing

totp12 processes your Personal Data only where a valid legal basis exists. The primary purposes and corresponding legal bases are set out below:

• Contract Performance: Processing Identity Data, Contact Data, Financial Data, and Account Data to operate your account, process deposits and withdrawals in IDR, settle bets, and provide customer support is necessary to perform the contract between you and totp12.
• Legal Obligation: Processing KYC Data and transaction records to comply with anti-money laundering (AML) and counter-terrorist financing (CTF) obligations, and to enforce the 21+ age restriction, is required by law.
• Legitimate Interests: Processing Technical Data and Gaming & Betting Data for fraud detection, platform security, responsible gaming monitoring, and product improvement constitutes a legitimate interest of totp12, provided it does not override your fundamental privacy rights.
• Consent: Processing Contact Data for direct marketing communications (promotional emails, bonus notifications, seasonal promotions) is carried out only where you have given explicit opt-in consent. You may withdraw this consent at any time via your Account settings or by emailing our support team.

6 Data Sharing

6.1 Internal Sharing

Personal Data may be accessed by totp12 staff whose roles require it — including compliance, customer support, fraud prevention, and finance teams — on a strict need-to-know basis. All staff are bound by confidentiality obligations.

6.2 Service Providers (Data Processors)

totp12 engages third-party service providers to deliver specific platform functions. These providers act as Data Processors under binding data processing agreements and may not use your data for their own purposes. Categories of service providers include:

• Payment processing partners facilitating IDR transactions via BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, OVO, DANA, GoPay, ShopeePay, and LinkAja.
• Game content studios (e.g., Pragmatic Play, Evolution Gaming, Spribe, Pocket Games Soft, Microgaming, NetEnt) who receive anonymised session tokens to deliver game content and settle outcomes.
• Identity verification and KYC service providers who process identity documents to confirm player eligibility.
• Cloud hosting and infrastructure providers responsible for storing encrypted platform data.
• Fraud detection and cybersecurity vendors who analyse Technical Data to protect platform integrity.

6.3 Legal Disclosures

totp12 may disclose Personal Data to law enforcement agencies, regulatory authorities, or courts where required by a valid legal order, warrant, or regulatory direction. We will notify affected players of any such disclosure to the extent permitted by law.

6.4 Business Transfers

In the event that totp12 undergoes a merger, acquisition, or sale of all or part of its business assets, Personal Data held on the platform may be transferred to the acquiring entity as part of that transaction, subject to equivalent privacy protections being maintained. Players will be notified of any such transfer via email and platform notice at least 30 days in advance where feasible.

6.5 No Sale of Data

totp12 does not sell, lease, or otherwise commercially transfer your Personal Data to any third party for their independent marketing or profiling purposes.

7 Cookies & Tracking Technologies

totp12 uses cookies and similar tracking technologies to deliver a functional, secure, and personalised platform experience. The categories of cookies used are as follows:

Cookie Type	Purpose	Duration
Strictly Necessary	Maintain your login session, load balancing, security tokens, and fraud prevention checks. These cookies cannot be disabled without breaking core platform functionality.	Session / up to 24 hours
Functional	Remember your language preferences, display settings, responsible gaming reminder configurations, and recent game selections.	Up to 12 months
Analytics	Measure page performance, navigation patterns, feature engagement, and error rates to improve the platform. Data is aggregated and anonymised where possible.	Up to 24 months
Marketing	Track referral source and campaign attribution to assess the effectiveness of totp12 promotional activity. These cookies are only set with your consent.	Up to 30 days

You can manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair your ability to log in and use the platform. For analytics and marketing cookies, you may opt out at any time via your Account settings without affecting core platform access.

8 Data Retention

totp12 retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, and to comply with applicable legal and regulatory retention obligations. The general retention periods applied are:

• Account Data and Identity Data: Retained for the duration of your active account relationship with totp12, plus a minimum of 5 years following account closure to satisfy AML and regulatory record-keeping requirements.
• Financial Transaction Data: Retained for a minimum of 5 years from the date of each transaction, consistent with internationally recognised financial record-keeping standards.
• KYC Documents: Retained for a minimum of 5 years from the date of verification or from the date of account closure, whichever is later.
• Gaming & Betting Data: Retained for 3 years following the relevant gaming session or bet settlement, except where a dispute is outstanding, in which case data is retained until the dispute is fully resolved.
• Customer Support Communications: Retained for 2 years from the date of the last interaction in a support thread.
• Marketing Preference Records: Retained for the duration of your account and for 2 years after opt-out, to demonstrate compliance with consent obligations.

At the end of the applicable retention period, Personal Data is securely deleted or anonymised such that it can no longer be associated with you as an individual.

9 Data Security

totp12 implements a layered security framework to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure. Key measures include:

• Transport Layer Security (TLS 1.3): All data transmitted between your device and totp12 servers is encrypted in transit using current TLS standards.
• AES-256 Encryption at Rest: Stored personal and financial data is encrypted using AES-256, the same standard used by international financial institutions.
• Access Controls: Role-based access controls restrict internal access to Personal Data on a strict need-to-know basis. All internal access is logged and audited.
• Two-Factor Authentication (2FA): Available for player accounts to provide an additional layer of protection beyond username and password.
• Penetration Testing: The totp12 platform undergoes regular third-party security assessments to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: In the event of a confirmed personal data breach that poses a risk to your rights, totp12 will notify affected players within 72 hours of becoming aware of the breach, and will take immediate remediation steps.

While totp12 takes all reasonable technical and organisational precautions, no internet-based platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your own login credentials and for notifying us immediately if you suspect any unauthorised access to your Account.

10 International Data Transfers

totp12 operates as an internationally hosted platform. Personal Data collected from players in Indonesia may be processed and stored on servers located outside Indonesia. Where such international transfers occur, totp12 ensures that appropriate safeguards are in place, including:

• Binding contractual clauses with Data Processors that impose equivalent data protection obligations to those set out in this Policy.
• Transfer only to service providers whose data protection standards have been assessed and approved by totp12's compliance team.
• Processing agreements that prohibit sub-processors from further transferring data without totp12's prior written authorisation.

By using the totp12 platform, you acknowledge that your Personal Data may be transferred to and processed in countries outside your country of residence. totp12 takes all reasonable steps to ensure that such transfers are carried out securely and lawfully.

11 Your Rights

As a player on the totp12 platform, you hold the following rights in relation to your Personal Data. To exercise any of these rights, contact our support team via live chat or email at [email protected]. We will respond within 14 business days of receiving your verified request.

• Right of Access: You may request a copy of the Personal Data totp12 holds about you, along with information about how it is used and with whom it has been shared.
• Right of Rectification: If any Personal Data held by totp12 is inaccurate or incomplete, you may request that it be corrected. Account details such as email address and phone number can be updated directly within your Account settings.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to totp12's legal retention obligations under AML and financial regulation. Erasure requests cannot be fulfilled where data must be retained by law.
• Right to Restrict Processing: You may request that totp12 restricts the processing of your Personal Data in certain circumstances, for example where you contest the accuracy of data held while a correction request is being verified.
• Right to Data Portability: You may request a structured, machine-readable copy of Personal Data you have provided to totp12, to transfer to another service provider where technically feasible.
• Right to Object: You may object to processing of your Personal Data for direct marketing purposes at any time. You may also object to processing based on legitimate interests, though totp12 may continue processing where compelling legitimate grounds override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time via your Account settings or by notifying support. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

12 Minors

The totp12 platform is strictly intended for adults aged 21 years and older. totp12 does not knowingly collect Personal Data from individuals under the age of 21. Age verification is conducted as part of the KYC process, and access is denied to any individual who cannot demonstrate they meet the minimum age requirement.

If totp12 becomes aware that Personal Data has been collected from a person under the age of 21 — whether through a falsified date of birth or any other means — that account will be immediately suspended, all funds will be frozen pending investigation, and the data will be deleted in accordance with applicable law and this Policy. If you are a parent or guardian and believe your child has registered on the platform, please contact us immediately at [email protected].

13 Third-Party Links

The totp12 platform may contain references to game studios, payment method brands, and sports leagues. This Policy applies solely to Personal Data processed by totp12 in connection with the totp12 platform. totp12 has no control over, and accepts no responsibility for, the privacy practices of any third-party websites or services. We encourage you to read the privacy policies of any third-party service before providing your Personal Data to them.

14 Changes to This Policy

totp12 reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or platform functionality. Material changes will be communicated to registered players via email notification and a prominent notice on the totp12 website at least 7 days before the revised Policy takes effect. The "Last updated" date at the top of this page will be revised accordingly.

Your continued use of the totp12 platform following the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not agree with the revised Policy, you must cease using the platform and may request account closure and data deletion as described in Section 11.

15 Contact

For questions, requests, or complaints relating to this Privacy Policy or totp12's data processing practices, please contact our Data Protection team using the details below. Email addresses are provided as plain text and are not clickable links.

Email: [email protected]

Our support team is available 24 hours a day, 7 days a week via live chat on the platform, with Indonesian-speaking agents available at all times during WIB business hours. For formal data subject access requests, please email with the subject line "Data Request — [Your Registered Email]" and include sufficient identity verification details so that we can process your request securely.