toky88 Privacy Policy

1. Introduction and Scope

This Privacy Policy explains how toky88 ("we", "us", "our", or "the Company") collects, uses, discloses, stores, and protects personal information obtained from users ("you", "your") of the toky88 online gaming platform accessible at https://toky88.cam and all associated services. This Privacy Policy applies to all users who access, browse, register for, or use any services provided by toky88, regardless of device, platform, or access method.

toky88 is committed to protecting your privacy and handling your personal data in accordance with international data protection standards including principles aligned with the General Data Protection Regulation (GDPR) and Indonesian data protection regulations. By creating an account, providing personal information, or using our platform, you acknowledge that you have read, understood, and consent to the data practices described in this Privacy Policy.

This Privacy Policy should be read in conjunction with our Terms & Conditions and Responsible Gaming policies, which together constitute the complete legal framework governing your relationship with toky88. If you do not agree with any aspect of this Privacy Policy, you must not create an account or use our services.

2. Information We Collect

2.1 Personal Information Provided by You

During account registration and subsequent use of the toky88 platform, we collect personal information that you voluntarily provide including but not limited to:

• Identity Information: Full legal name, date of birth, place of birth, gender, nationality, and government-issued identification numbers (Indonesian KTP number or passport number).
• Contact Information: Email address, mobile phone number, residential address including street, city, province, and postal code.
• Account Credentials: Username, password (stored in encrypted format), and security questions/answers for account recovery.
• Financial Information: Bank account details including bank name, account number, account holder name, e-wallet account information (OVO, DANA, GoPay, ShopeePay), and payment card details if applicable.
• Verification Documents: Copies of government-issued photo identification (KTP, passport), proof of address documents (utility bills, bank statements), payment method verification documents, and selfie photographs for identity confirmation.
• Communication Records: Customer support chat transcripts, email correspondence, WhatsApp messages, and any other communications between you and toky88.
• Preferences and Settings: Gaming preferences, language settings, notification preferences, deposit limits, and responsible gaming tool configurations.

2.2 Information Automatically Collected

When you access or use the toky88 platform, we automatically collect certain technical and usage information including:

• Device Information: Device type, operating system, browser type and version, screen resolution, device identifiers (IP address, device ID), and mobile network information.
• Usage Data: Pages visited, features used, time spent on platform, click patterns, games played, bet history, deposit and withdrawal transactions, session duration, and access times.
• Location Data: Geographic location derived from IP address to ensure compliance with geographic restrictions and verify you are accessing the platform from within Indonesian territory.
• Cookies and Similar Technologies: Information collected through cookies, web beacons, local storage, and similar tracking technologies. See Section 7 for detailed cookie information.
• Gaming Activity: Comprehensive records of all gaming activity including bets placed, games played, stakes wagered, winnings and losses, bonus usage, and transaction history.

2.3 Information from Third-Party Sources

We may receive information about you from third-party sources including:

• Payment Processors: Transaction verification and confirmation data from Indonesian banks (BCA, BRI, BNI, Mandiri) and e-wallet providers (OVO, DANA, GoPay).
• Identity Verification Services: Verification results from third-party KYC and identity verification providers used to confirm your identity, age, and address.
• Fraud Prevention Services: Information from fraud detection and prevention services used to protect against fraudulent account creation, payment fraud, and bonus abuse.
• Game Providers: Gaming session data, bet history, and technical information from third-party game providers (Pragmatic Play, Evolution Gaming, Microgaming, NetEnt) whose games are integrated into our platform.

3. How We Use Your Information

toky88 processes your personal information for the following legitimate business purposes:

3.1 Account Management and Service Delivery

• Creating, maintaining, and managing your user account on the toky88 platform
• Processing account registration and completing Know Your Customer (KYC) verification procedures
• Authenticating your identity during login and for sensitive account operations
• Providing access to casino games, sports betting markets, togel lottery draws, and all platform features
• Processing deposit and withdrawal requests and maintaining transaction records
• Managing account settings, preferences, and responsible gaming tool configurations

3.2 Transaction Processing and Financial Services

• Processing deposits from Indonesian banks (BCA, BRI, BNI, Mandiri) and e-wallets (OVO, DANA, GoPay, ShopeePay)
• Processing withdrawal requests to verified payment methods in your name
• Maintaining accurate financial records and account balance information
• Preventing payment fraud, money laundering, and unauthorized transactions
• Reconciling transactions with payment providers and financial institutions
• Generating transaction receipts, statements, and financial reports

3.3 Legal Compliance and Regulatory Obligations

• Verifying you are at least 21 years of age as required by Indonesian regulations
• Ensuring you are physically located within Indonesian territory during platform access
• Complying with anti-money laundering (AML) and know-your-customer (KYC) regulations
• Preventing underage gambling and ensuring compliance with age verification requirements
• Maintaining records required by gaming licenses and regulatory authorities
• Responding to lawful requests from government authorities, law enforcement, or regulatory bodies
• Investigating and reporting suspected criminal activity, fraud, or regulatory violations

3.4 Security and Fraud Prevention

• Detecting, preventing, and investigating fraudulent activity, bonus abuse, and account compromise
• Monitoring for suspicious betting patterns, collusion, and terms violations
• Protecting against cyber attacks, unauthorized access, and data breaches
• Verifying payment method ownership and preventing third-party deposit fraud
• Implementing and maintaining platform security measures and access controls

3.5 Customer Support and Communication

• Responding to customer support inquiries via live chat, email, WhatsApp, and in-app messaging
• Resolving disputes, complaints, and technical issues
• Sending transactional communications (deposit confirmations, withdrawal updates, password resets)
• Providing important account notifications and security alerts
• Sending responsible gaming communications and self-exclusion confirmations

3.6 Marketing and Promotional Communications (With Consent)

• Sending promotional offers, bonus announcements, and marketing communications if you have opted in
• Personalizing promotional content based on your gaming preferences and activity
• Conducting customer surveys and gathering feedback on platform improvements
• You may opt out of marketing communications at any time through account settings or unsubscribe links

3.7 Platform Improvement and Analytics

• Analyzing usage patterns to improve user experience and platform functionality
• Conducting research and development for new features and services
• Performing statistical analysis on gaming trends, popular games, and user behavior
• Optimizing platform performance, load times, and mobile responsiveness
• Testing new features and conducting A/B testing for user interface improvements

4. Legal Basis for Processing (GDPR Principles)

Although toky88 primarily serves Indonesian users, we adopt international best practices including GDPR-aligned principles. Our legal bases for processing personal data include:

• Contractual Necessity: Processing necessary to fulfill our contract with you (Terms & Conditions) including account creation, transaction processing, and service delivery.
• Legal Obligation: Processing required to comply with legal obligations including age verification, AML/KYC regulations, tax reporting, and regulatory compliance.
• Legitimate Interests: Processing necessary for legitimate business interests including fraud prevention, security, platform improvement, and customer support, balanced against your privacy rights.
• Consent: Processing based on your explicit consent for marketing communications, optional features, and non-essential data uses. Consent can be withdrawn at any time.

5. How We Share Your Information

toky88 does not sell, rent, or trade your personal information to third parties for marketing purposes. We only share your information in the following limited circumstances:

5.1 Service Providers and Business Partners

We share personal information with trusted third-party service providers who perform services on our behalf under strict confidentiality agreements:

• Payment Processors: Indonesian banks (BCA, BRI, BNI, Mandiri), e-wallet providers (OVO, DANA, GoPay), and payment gateway services to process deposits and withdrawals.
• Game Providers: Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and other game studios whose games you play, receiving only necessary gaming session data.
• Identity Verification Services: Third-party KYC and identity verification providers that assist with age verification, identity confirmation, and fraud detection.
• Customer Support Tools: Live chat platforms, email services, and customer relationship management (CRM) systems used to deliver support services.
• Cloud Hosting Providers: Secure cloud infrastructure providers hosting our platform, databases, and backups.
• Analytics Services: Website analytics tools that help us understand platform usage and user behavior through aggregated, anonymized data.

All service providers are contractually bound to protect your information, use it only for specified purposes, and comply with applicable data protection laws.

5.2 Legal Requirements and Regulatory Compliance

We may disclose your personal information when required by law or regulatory obligation:

• To comply with valid legal processes including court orders, subpoenas, or government requests
• To regulatory authorities overseeing online gaming operations and licensing compliance
• To law enforcement agencies investigating suspected criminal activity, fraud, or money laundering
• To tax authorities as required by Indonesian tax reporting obligations
• When we believe disclosure is necessary to protect the rights, property, or safety of toky88, our users, or the public

5.3 Business Transfers

If toky88 undergoes a merger, acquisition, reorganization, or sale of assets, your personal information may be transferred to the successor entity as part of the business transaction. You will be notified via email and prominent platform notice of any such transfer and any resulting changes to privacy practices.

5.4 With Your Consent

We may share your information with third parties not covered above when we have obtained your explicit consent to do so. Such consent requests will clearly explain the purpose and scope of information sharing.

6. Data Security Measures

toky88 implements comprehensive technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction:

6.1 Technical Security Controls

• Encryption: All data transmission between your device and our servers is protected by 256-bit SSL/TLS encryption, the same security standard used by banks and financial institutions.
• Secure Storage: Personal data is stored in encrypted format on secure servers with restricted access controls and regular security audits.
• Password Protection: User passwords are hashed using industry-standard cryptographic algorithms and never stored in plain text.
• Firewall Protection: Multi-layer firewall systems protect our infrastructure against external attacks and unauthorized access attempts.
• Intrusion Detection: Real-time monitoring systems detect and respond to suspicious activity, potential breaches, and security threats.
• Regular Security Audits: Independent security firms conduct periodic penetration testing and vulnerability assessments.

6.2 Organizational Security Measures

• Access Controls: Employee access to personal data is strictly limited on a need-to-know basis with role-based permissions.
• Confidentiality Agreements: All employees and contractors sign strict confidentiality agreements prohibiting unauthorized data disclosure.
• Security Training: Staff receive regular training on data protection, security best practices, and privacy obligations.
• Incident Response Plan: Documented procedures for detecting, responding to, and recovering from security incidents and data breaches.
• Data Minimization: We collect only the minimum personal information necessary for specified purposes and retain it only as long as required.

6.3 Your Security Responsibilities

While we implement robust security measures, you also play a crucial role in protecting your account:

• Choose a strong, unique password and never share it with anyone
• Enable two-factor authentication if available on your account
• Do not share your account credentials or allow others to access your account
• Log out after each session, especially on shared or public devices
• Keep your contact information current so you receive important security notifications
• Report suspected unauthorized access or security concerns immediately to [email protected]
• Be vigilant against phishing emails or messages impersonating toky88 – we will never ask for your password via email

7. Cookies and Tracking Technologies

The toky88 platform uses cookies and similar tracking technologies to enhance user experience, analyze platform usage, and deliver certain functionality. Cookies are small text files stored on your device by your web browser.

7.1 Types of Cookies We Use

Cookie Type	Purpose	Duration
Essential Cookies	Required for basic platform functionality including login, session management, security, and navigation. Cannot be disabled without preventing platform use.	Session or up to 1 year
Functional Cookies	Remember your preferences, settings, and choices to provide enhanced personalized experience.	Up to 1 year
Analytics Cookies	Collect aggregated information about how users interact with our platform to improve performance and user experience.	Up to 2 years
Performance Cookies	Monitor platform performance, identify technical issues, and optimize loading times.	Up to 1 year

7.2 Managing Cookie Preferences

You can control cookie settings through your browser preferences. Most browsers allow you to refuse cookies, delete existing cookies, or receive notification when cookies are being set. However, disabling essential cookies may prevent you from accessing certain platform features or services. Consult your browser's help documentation for specific instructions on managing cookies.

8. Data Retention

toky88 retains personal information only as long as necessary to fulfill the purposes outlined in this Privacy Policy, comply with legal obligations, resolve disputes, and enforce our agreements.

• Active Accounts: Personal data is retained throughout the active account period and for the duration required to provide services.
• Closed Accounts: After voluntary account closure, we retain certain information for 5 years to comply with legal obligations including financial record-keeping, tax reporting, and regulatory requirements.
• Transaction Records: Financial transaction records are retained for 7 years as required by Indonesian financial regulations and anti-money laundering laws.
• Communication Records: Customer support communications are retained for 3 years for dispute resolution and quality assurance purposes.
• Marketing Consent Records: Records of your marketing consent or opt-out preferences are maintained indefinitely to ensure compliance with your preferences.

After retention periods expire, personal data is securely deleted or anonymized so it can no longer identify you. Aggregated, anonymized data may be retained indefinitely for statistical and analytical purposes.

9. Your Privacy Rights

Subject to applicable law, you have the following rights regarding your personal information:

9.1 Right to Access

You have the right to request access to the personal information we hold about you. You may request a copy of your data by contacting our Data Protection team at [email protected]. We will provide the information in commonly used electronic format within 30 days of verified request.

9.2 Right to Rectification

You have the right to request correction of inaccurate or incomplete personal information. You can update most account information directly through your account settings. For information you cannot update yourself, contact customer support with documentation supporting the correction.

9.3 Right to Erasure ("Right to Be Forgotten")

You may request deletion of your personal data, subject to legal limitations. We cannot delete information we are legally required to retain (transaction records, regulatory compliance data) or information necessary for legitimate legal claims. To request data deletion, close your account and contact [email protected] with your erasure request.

9.4 Right to Data Portability

You have the right to receive personal data you provided to us in structured, machine-readable format and to transmit that data to another service provider. Contact [email protected] to request data portability.

9.5 Right to Object

You may object to processing of your personal data for direct marketing purposes at any time. Use the unsubscribe link in marketing emails or adjust preferences in your account settings. For objections to other processing activities, contact our Data Protection team with specific grounds for your objection.

9.6 Right to Restrict Processing

You may request restriction of processing in certain circumstances, such as while disputing data accuracy or objecting to processing. Restricted data will not be processed except with your consent or for legal purposes.

9.7 Right to Withdraw Consent

Where processing is based on your consent (such as marketing communications), you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.

9.8 Exercising Your Rights

To exercise any privacy rights, contact us at [email protected] with your request. Include your full name, registered email address, and specific right you wish to exercise. We will verify your identity before processing requests and respond within 30 days. We do not charge fees for legitimate requests unless they are manifestly unfounded, excessive, or repetitive.

10. International Data Transfers

While toky88 primarily serves users in Indonesia, some personal data may be transferred to and processed in countries outside Indonesia where our service providers, data centers, or business partners are located. When we transfer data internationally, we ensure appropriate safeguards are in place including:

• Standard contractual clauses approved by regulatory authorities
• Adequacy decisions recognizing equivalent data protection standards
• Certification schemes demonstrating compliance with international data protection principles
• Explicit consent for transfers where legally required

We take all reasonable steps to ensure personal data transferred internationally receives adequate protection equivalent to that provided within Indonesia.

11. Children's Privacy

The toky88 platform is strictly for adults aged 21 years and older in accordance with Indonesian law. We do not knowingly collect personal information from individuals under 21 years of age. If we become aware that we have inadvertently collected information from someone under the legal gambling age, we will immediately delete such information and permanently close the associated account.

Parents and guardians are encouraged to monitor their children's internet usage and use parental control software to prevent minors from accessing online gaming platforms. If you believe we have collected information from a minor, please contact us immediately at [email protected] so we can take appropriate action.

12. Changes to This Privacy Policy

toky88 reserves the right to modify, amend, or update this Privacy Policy at any time to reflect changes in our practices, technology, legal requirements, or business operations. Changes will be effective immediately upon posting to the website with an updated "Last Updated" date at the top of this policy.

Material changes that significantly affect how we collect, use, or share your personal information will be communicated via email to your registered email address and through prominent notice on the platform. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

Your continued use of the toky88 platform after any changes to this Privacy Policy constitutes acceptance of the revised policy. If you do not agree with changes, you must cease using the platform and may request account closure.

13. Contact Information and Data Protection Officer

For questions, concerns, or requests regarding this Privacy Policy, data protection practices, or exercising your privacy rights, please contact us:

• Email: [email protected] (displayed as plain text, not clickable)
• Data Protection Inquiries: Address emails to "Data Protection Team" in subject line
• Privacy Rights Requests: Address emails to "Privacy Rights Request" in subject line
• Live Chat Support: Available 24/7 through the website for general privacy questions

We aim to respond to all privacy inquiries and rights requests within 30 days. For complex requests or high volumes, we may extend this period by an additional 60 days with notification and explanation of the delay.