Privacy Policy — to388

1 Introduction

to388 is an internationally licensed online betting and gaming platform serving players across Indonesia, including Jakarta, Surabaya, Bandung, Medan, Bali, Yogyakarta, Semarang, Makassar, and Palembang. We provide sports betting — including markets for BRI Liga 1 fixtures, Champions League, EPL, and Timnas Indonesia internationals — alongside live casino games, slot gacor (high-frequency payout slots), and other online gaming products accessible at to388.cam.

As an operator that handles financial transactions and identity verification for hundreds of thousands of Indonesian players, to388 treats the protection of personal data as a core operational responsibility. This Policy has been written in plain, professional English so that every Member can clearly understand their rights and our obligations.

2 Definitions

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information that identifies or could reasonably identify a natural person, directly or indirectly — including name, date of birth, email address, phone number, IP address, device identifiers, and financial account details.
• "Processing" means any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, and deletion.
• "Member" means any natural person who holds a registered account on the to388 platform.
• "Visitor" means any person who accesses the to388 website without completing account registration.
• "Third Party" means any entity other than the Member and to388, including payment processors, identity verification providers, and regulatory authorities.
• "KYC Data" means identity and age-verification documents submitted by a Member in fulfilment of to388's Know Your Customer obligations, including government-issued ID, proof of address, and payment method verification.
• "Cookies" means small text files stored on a Member's device by the to388 website for session management, security, and analytics purposes.

3 Data Controller

to388 acts as the Data Controller in respect of all Personal Data collected through the Platform. As Data Controller, to388 determines the purposes and means of processing Personal Data and is responsible for ensuring that all processing activities comply with applicable data protection legislation.

For all data protection enquiries, correction requests, deletion requests, or formal complaints, the Data Controller can be contacted at: [email protected] (plain text — not a clickable link). We aim to acknowledge all data-related correspondence within 72 hours.

4 Data We Collect

4.1 Registration Data

When you create a to388 account, we collect the following information:

• Full legal name (as it appears on your government-issued identification).
• Date of birth (to verify that you meet the 21+ age requirement).
• Residential address in Indonesia.
• Valid Indonesian mobile phone number.
• Email address.
• Username and encrypted password hash.

4.2 KYC and Verification Data

As part of our identity verification process, we collect scanned or photographed copies of:

• Indonesian National ID Card (KTP) or valid passport.
• Proof of residential address (utility bill, bank statement, or official correspondence issued within the last three months).
• Payment method verification (e.g., a screenshot showing your name on your BCA, BRI, BNI, Mandiri, or e-wallet account).
• Selfie photographs where required for liveness checks.

4.3 Financial Data

We collect data relating to deposits and withdrawals processed via BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, OVO, DANA, GoPay, ShopeePay, and LinkAja. This includes transaction amounts in IDR, timestamps, payment method identifiers, and transaction reference numbers. to388 does not store full bank account numbers or full card numbers on its servers — sensitive payment credentials are tokenized by our payment processor partners.

4.4 Technical and Usage Data

We automatically collect the following data when you access the Platform:

• IP address and approximate geolocation derived therefrom.
• Device type, operating system, and browser version.
• Session duration, pages viewed, and features used.
• Betting and gaming activity logs, including wager amounts, game types, and outcomes.
• Login timestamps and authentication events.

4.5 Communications Data

If you contact our support team via email or live chat, we retain records of those communications — including the content of messages, timestamps, and any attachments — for quality assurance, dispute resolution, and regulatory compliance purposes.

5 How We Collect Data

to388 collects Personal Data through the following channels:

• Directly from you — when you register an account, complete KYC, make a deposit, place a bet, contact support, or update your profile settings.
• Automatically — through server logs, session cookies, and analytics tools when you browse the Platform.
• From third parties — including identity verification agencies, payment processors, and fraud-prevention services that provide supplementary data to confirm your identity and assess risk.

6 How We Use Your Data

to388 uses your Personal Data exclusively for the following purposes:

Purpose	Data Categories Used
Account creation and management	Registration data, technical data
Age and identity verification (KYC)	KYC data, registration data
Processing deposits and withdrawals	Financial data, KYC data
Fraud detection and prevention	Technical data, financial data, usage data
Responsible gaming monitoring	Usage data, financial data, communications data
Customer support and dispute resolution	Communications data, registration data, financial data
Legal and regulatory compliance (AML/CTF)	All categories as required by law
Platform security and integrity monitoring	Technical data, usage data
Service improvement and analytics	Anonymized / aggregated usage data only

to388 does not use your Personal Data for behavioral advertising, profiling for marketing purposes, or sale to data brokers. Promotional communications (if any) are sent only where you have provided explicit consent and may be withdrawn at any time.

7 Legal Basis for Processing

to388 processes Personal Data under the following legal bases:

• Contractual necessity: Processing required to perform the Member agreement — including account management, payment processing, and service delivery.
• Legal obligation: Processing required to comply with applicable laws, including anti-money-laundering (AML), counter-terrorism financing (CTF), and age verification regulations.
• Legitimate interests: Processing necessary for fraud prevention, platform security, responsible gaming monitoring, and improving service quality — where these interests are not overridden by your rights.
• Consent: Where we rely on consent (e.g., for optional marketing communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing.

8 Data Sharing

to388 may share your Personal Data with the following categories of third parties:

• Payment processors: BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, OVO, DANA, GoPay, ShopeePay, and LinkAja receive transaction data necessary to process your deposits and withdrawals. Each processor operates under its own privacy policy and applicable Indonesian banking regulations.
• Identity verification providers: Third-party KYC and liveness-check providers receive copies of your identity documents to facilitate account verification. These providers are contractually bound to process your data only for verification purposes.
• Fraud and risk management services: Anonymized behavioral and technical data may be shared with specialist fraud-prevention platforms to identify suspicious patterns and protect the integrity of the Platform.
• Regulatory and law enforcement authorities: to388 will disclose Personal Data to competent authorities — including financial intelligence units — where required by law, court order, or regulatory directive. We will notify you of such disclosures where legally permitted to do so.
• Professional advisors: Legal counsel, auditors, and compliance consultants may access Personal Data on a strictly need-to-know basis and under binding confidentiality obligations.

All third-party data processors engaged by to388 are subject to data processing agreements that impose data protection standards consistent with this Privacy Policy.

9 International Data Transfers

to388 is headquartered outside Indonesia and some of our service providers operate in jurisdictions outside the Republic of Indonesia. Where Personal Data is transferred internationally, to388 ensures that appropriate safeguards are in place, including:

• Standard contractual clauses that impose equivalent data protection obligations on the receiving party.
• Transfers only to jurisdictions that maintain data protection standards recognized as adequate for the type of data being transferred.
• Technical measures (encryption in transit and at rest) that protect data regardless of the jurisdiction in which it is processed.

10 Data Retention

to388 retains Personal Data for the following periods:

• Active account data: Retained for the lifetime of your account and for a minimum of five years following account closure, to satisfy AML record-keeping obligations.
• KYC documents: Retained for a minimum of five years from the date of verification, in line with regulatory requirements.
• Transaction records: Retained for a minimum of five years from the date of each transaction.
• Support communications: Retained for two years following resolution of the relevant inquiry or dispute.
• Technical and usage logs: Retained in identifiable form for up to 12 months; thereafter retained only in anonymized, aggregated form for analytics purposes.

When the applicable retention period expires, Personal Data is securely deleted or permanently anonymized using industry-standard data destruction methods. If you request early deletion of your data, to388 will assess whether a legal obligation prevents full compliance with that request and will inform you accordingly.

11 Security Measures

to388 applies a layered security model to protect your Personal Data against unauthorized access, disclosure, alteration, and destruction:

• Transport security: All data exchanged between your device and our servers is encrypted via TLS 1.3. We enforce HTTPS across all Platform domains and subdomains.
• Storage security: Personal Data at rest is encrypted using AES-256. Database access is restricted by role-based access controls and requires multi-factor authentication.
• Network security: Our infrastructure is protected by enterprise-grade firewalls, DDoS mitigation services, and continuous intrusion detection monitoring.
• Access controls: Access to Personal Data by to388 staff is granted on a strict need-to-know basis, governed by internal access policies and logged for audit purposes.
• Third-party audits: Our security posture undergoes independent penetration testing and compliance review on an annual basis.

In the event of a Personal Data breach that is likely to result in a risk to your rights, to388 will notify affected Members without undue delay and will implement remediation measures immediately upon discovery.

12 Cookies & Tracking Technologies

12.1 Types of Cookies We Use

to388 uses the following categories of cookies:

• Strictly necessary cookies: Required for core Platform functionality — including maintaining your login session, CSRF protection tokens, and load-balancing identifiers. These cookies cannot be disabled without impairing Platform functionality.
• Analytics cookies: Used to collect aggregated, anonymized data about how Visitors and Members navigate the Platform, enabling us to identify and fix usability issues. Individual users are not identified from analytics data.
• Preference cookies: Store non-sensitive preferences such as your preferred odds format and display settings between sessions.

12.2 Managing Cookies

You may configure your browser to block or delete cookies at any time. Please note that disabling strictly necessary cookies will prevent you from logging in to your to388 account. Browser-level cookie settings are the primary control mechanism; to388 does not use a separate cookie consent manager widget.

12.3 No Cross-Site Tracking

to388 does not use third-party advertising cookies, cross-site tracking pixels, or any technology that tracks your browsing behavior on websites other than to388.cam.

13 Your Privacy Rights

As a Member of to388, you have the following rights with respect to your Personal Data. To exercise any of these rights, contact us at [email protected] with the subject line "Data Rights Request":

• Right of access: You may request a copy of all Personal Data we hold on you, along with information about how it is used and with whom it is shared.
• Right to rectification: You may request correction of any Personal Data that is inaccurate or incomplete. For registration data, you can update most fields directly in your account settings.
• Right to erasure: You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected. This right is subject to our legal data retention obligations.
• Right to restriction of processing: You may request that we limit the processing of your Personal Data in certain circumstances — for example, while a rectification request is under review.
• Right to data portability: You may request a structured, machine-readable copy of the Personal Data you provided to us directly, where technically feasible.
• Right to object: You may object to processing carried out under our legitimate interests. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your rights.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted prior to withdrawal.

to388 will respond to all data rights requests within 30 calendar days of receipt. In complex cases, this period may be extended by a further 30 days with prior written notice to you.

14 Minors

to388 is strictly intended for individuals who are 21 years of age or older. We do not knowingly collect Personal Data from anyone under the age of 21. If we become aware that Personal Data has been collected from a minor, we will immediately suspend the associated account, delete the data without delay, and report the matter to our compliance team.

If you are a parent or guardian and believe that your child has registered on to388, please contact us immediately at [email protected] so that we can take prompt remedial action.

15 Policy Amendments

to388 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform functionality. Material changes will be communicated to Members via the email address registered on their account at least 7 days before the changes take effect. Non-material clarifications will be reflected by an updated effective date at the top of this document.

Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. If you do not accept the revised terms, you should cease using the Platform and close your account prior to the effective date.

16 Contact & Complaints

For all privacy-related enquiries, data rights requests, or formal complaints regarding to388's data practices, please contact:

• Email: [email protected] — subject line: "Privacy Enquiry" or "Data Rights Request" (plain text — not a clickable link).
• Response time: to388 aims to acknowledge all privacy correspondence within 72 hours and provide a substantive response within 30 calendar days.
• Escalation: If you are not satisfied with our response, you have the right to escalate your complaint to the relevant data protection authority in your jurisdiction.

to388 takes every privacy complaint seriously. Our compliance team investigates all formal complaints thoroughly and will keep you informed of progress throughout the resolution process.