Your privacy matters to us. This Privacy Policy explains exactly what personal data toto1 collects, why we collect it, how we use and protect it, and the rights you hold as a member of our platform. Please read this document in full before registering an account.
toto1 ("we", "us", "our") operates the online betting and gaming platform available at https://toto1.onl. We are committed to protecting the privacy of every member and visitor. This Privacy Policy describes how toto1 processes personal data in connection with your use of the Platform, in accordance with internationally recognised data protection principles.
This Policy applies to all personal data collected from individuals who visit the toto1 website, register an account, make deposits or withdrawals, interact with customer support, or otherwise engage with any toto1 service. It should be read alongside the toto1 Terms & Conditions, which govern the overall use of the Platform.
By registering a toto1 account or continuing to use the Platform after this Policy has been published or updated, you acknowledge that you have read and understood the practices described herein. If you do not agree with any part of this Policy, you should discontinue use of the Platform and contact us to close your account.
Throughout this Privacy Policy, the following terms carry the meanings set out below:
| Term | Meaning |
|---|---|
| "Personal Data" | Any information that identifies or could reasonably identify a natural person, directly or indirectly — including name, date of birth, national ID number, email address, IP address, device identifiers, and financial account details. |
| "Processing" | Any operation performed on personal data, including collection, storage, use, disclosure, transfer, deletion, or any combination thereof. |
| "Data Controller" | toto1, as the entity that determines the purposes and means of processing your personal data. |
| "Member" | Any individual who has completed registration and holds an active toto1 account. |
| "Visitor" | Any individual who accesses the toto1 website without having registered an account. |
| "KYC" | Know Your Customer — the identity verification process toto1 conducts to confirm a Member's identity and comply with anti-money laundering obligations. |
| "Third-Party Processor" | Any external organisation that processes personal data on toto1's behalf under a written data processing agreement, including payment processors, KYC verification providers, and game studios. |
| "Platform" | The toto1 website, mobile-optimised site, and all associated services available at https://toto1.onl. |
toto1 collects personal data across several categories. The specific data points collected depend on the nature of your interaction with the Platform:
3.1 Registration Data. When you open a toto1 account, we collect your full legal name, date of birth, residential address (including city — for example Jakarta, Surabaya, Medan, Bandung, or Bali), email address, mobile phone number, and chosen username and password (passwords are stored in hashed form only — never in plain text).
3.2 Identity Verification (KYC) Data. To satisfy our verification obligations, we may collect copies of government-issued photo identity documents such as your Indonesian National Identity Card (KTP), passport, or driving licence; proof of residential address (utility bill, bank statement dated within three months); and proof of ownership of payment methods used on the Platform.
3.3 Financial Data. We collect the details of payment methods you use to deposit and withdraw funds, including Indonesian bank account details (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) and e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja). We do not store full card numbers; only masked identifiers are retained for audit purposes.
3.4 Transaction Data. We maintain a complete record of all deposits, withdrawals, bonus claims, wagers placed, game sessions, and account balance movements associated with your account. This includes timestamps, amounts in Indonesian Rupiah (IDR), game or market identifiers, and settlement outcomes.
3.5 Technical Data. When you visit or use the Platform, we automatically collect your IP address, browser type and version, operating system, device type, device identifiers, screen resolution, referring URL, and session duration. This data is collected via server logs and first-party analytics tools.
3.6 Communications Data. If you contact toto1 via live chat, email (support@toto1.onl), or any other support channel, we retain records of those communications including message content, timestamps, and the support agent's responses. This data is used for quality assurance, dispute resolution, and compliance purposes.
3.7 Responsible Gaming Data. Where you set deposit limits, session time limits, loss limits, cooling-off periods, or activate self-exclusion via your account dashboard, we record those preferences and the dates on which they were set or modified.
toto1 collects personal data through the following channels:
toto1 processes personal data strictly for the purposes described below. We do not process data for any purpose incompatible with those stated here without first obtaining your explicit consent or being required to do so by law.
| Purpose | Data Categories Used |
|---|---|
| Account creation & management | Registration data, technical data |
| Identity verification (KYC) | KYC data, registration data, financial data |
| Processing deposits & withdrawals | Financial data, transaction data, KYC data |
| Delivering gaming & sportsbook services | Transaction data, technical data |
| Fraud prevention & AML compliance | All categories |
| Customer support & dispute resolution | Communications data, transaction data, registration data |
| Responsible gaming monitoring | Responsible gaming data, transaction data |
| Platform security & abuse prevention | Technical data, transaction data |
| Personalisation & service improvement | Technical data, transaction data (aggregated/anonymised) |
| Legal & regulatory compliance | All categories (as required by applicable law) |
5.1 Marketing Communications. toto1 may send you promotional emails or in-platform notifications about bonuses, seasonal promotions (such as Idul Fitri, Ramadhan, Chinese New Year / Imlek, and Indonesian Independence Day offers), and new Platform features. You may opt out of marketing communications at any time by clicking the unsubscribe link in any marketing email or by updating your communication preferences in your account dashboard. Opting out of marketing will not affect transactional or security communications.
toto1 processes your personal data under one or more of the following legal bases:
7.1 No Sale of Data. toto1 does not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes. Full stop.
7.2 Third-Party Processors. toto1 shares personal data with the following categories of Third-Party Processors, solely to the extent necessary for the purposes described in Section 05:
All Third-Party Processors are bound by written data processing agreements that prohibit them from using your data for any purpose beyond the specific service they provide to toto1.
7.3 Legal Disclosures. toto1 may disclose personal data to law enforcement agencies, regulatory bodies, or courts where required by a valid legal process, court order, or statutory obligation. toto1 will, where legally permitted, notify the affected Member of any such disclosure request.
7.4 Business Transfers. In the event of a merger, acquisition, or sale of all or substantially all of toto1's assets, personal data held by toto1 may be transferred to the acquiring entity. Members will be notified of any such transfer via email and via an in-Platform notification at least 30 days before the transfer takes effect, with the opportunity to close their account if they do not consent.
toto1 retains personal data only for as long as necessary to fulfil the purposes described in Section 05, subject to the following minimum retention periods:
| Data Category | Retention Period |
|---|---|
| Registration & KYC data | Minimum 5 years from account closure (AML compliance requirement) |
| Transaction records | Minimum 5 years from the date of each transaction |
| Customer support communications | 3 years from the date of each interaction |
| Technical / server log data | 12 months from collection, then deleted or fully anonymised |
| Responsible gaming records | Duration of self-exclusion period plus 2 years |
| Marketing preference data | Until opt-out, then 1 year (suppression list maintenance) |
Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Anonymised, aggregated data (from which no individual can be identified) may be retained indefinitely for statistical and service-improvement purposes.
9.1 Technical Safeguards. toto1 implements the following technical security controls to protect your personal data against unauthorised access, disclosure, alteration, or destruction:
9.2 Organisational Safeguards. Access to Member personal data within toto1 is restricted on a strict need-to-know basis. All personnel with access to personal data are subject to confidentiality obligations. toto1 conducts periodic data protection training for all relevant staff.
9.3 Data Breach Response. In the event of a personal data breach that poses a risk to Member rights and freedoms, toto1 will notify affected Members via their registered email address within 72 hours of becoming aware of the breach, describing the nature of the breach, the data affected, and the remediation steps taken.
toto1 uses cookies and similar tracking technologies to operate the Platform, remember your preferences, analyse usage patterns, and detect fraudulent or abusive behaviour. The categories of cookies we use are as follows:
| Cookie Type | Purpose | Required? |
|---|---|---|
| Essential | Session management, login authentication, CSRF protection, fraud detection | Yes — cannot be disabled |
| Functional | Remembering language, display preferences, and responsible gaming settings | Optional |
| Analytics | Aggregated, anonymised usage statistics to improve Platform performance | Optional |
| Security | Bot detection, login anomaly monitoring, device fingerprinting for fraud prevention | Yes — cannot be disabled |
10.1 Cookie Control. You may manage optional cookie categories via your browser settings. Disabling functional or analytics cookies will not affect your ability to place bets, make deposits, or access your account, but may reduce the personalisation of your experience. Disabling essential or security cookies may prevent the Platform from functioning correctly.
10.2 No Third-Party Advertising Cookies. toto1 does not deploy third-party advertising or retargeting cookies. We do not share browsing data with advertising networks, social media platforms, or data brokers.
As a Member or Visitor whose personal data is processed by toto1, you hold the following rights. To exercise any of these rights, contact us via live chat from your account dashboard or by email at support@toto1.onl. toto1 will respond to verified requests within 30 days.
Request a copy of the personal data toto1 holds about you, the purposes for which it is processed, and the categories of recipients with whom it has been shared.
Request correction of any inaccurate or incomplete personal data toto1 holds about you. You may also update certain details directly via your account dashboard profile settings.
Request deletion of your personal data where it is no longer necessary for the purposes it was collected, subject to toto1's legal retention obligations under AML and financial regulations.
Request that toto1 restricts processing of your data — for example, while the accuracy of data you have contested is being verified — without requiring full deletion.
Request a machine-readable export of personal data you have provided to toto1 (registration data, transaction history) in a structured, commonly used format such as CSV or JSON.
Object to processing carried out on the basis of legitimate interests — including direct marketing, profiling for personalisation, or automated decision-making that significantly affects you.
11.1 Identity Verification for Rights Requests. To protect Member privacy, toto1 will verify your identity before processing any data rights request. You may be asked to confirm your registered email address, provide a one-time code sent to that address, or supply a copy of your identity document if the request involves sensitive data categories.
11.2 Response Timeframe. toto1 will acknowledge your request within 5 WIB business days and provide a substantive response within 30 calendar days. Where a request is complex or toto1 receives a high volume of requests simultaneously, the response period may be extended by a further 30 days, with notice provided to you.
The toto1 Platform is strictly intended for adults aged 21 years and above. toto1 does not knowingly collect or process personal data from individuals under the age of 21. Registration requires confirmation that the applicant is 21 or older, and KYC verification cross-checks the date of birth provided against identity documents.
If toto1 discovers or is notified that personal data belonging to an individual under 21 has been collected — whether through a fraudulent registration or any other means — that data will be deleted immediately, the associated account will be permanently closed, and any funds held in that account will be returned to the verified payment source.
If you are a parent or guardian and believe your child has registered a toto1 account, please contact us immediately via live chat or at support@toto1.onl. We will prioritise the review and take appropriate action within 24 hours of receiving your report.
toto1 operates as an international platform and some of our Third-Party Processors — including cloud infrastructure providers, KYC verification vendors, and game studio partners — may process data in jurisdictions outside Indonesia. Where such transfers occur, toto1 ensures that appropriate safeguards are in place, including:
By using the Platform, you acknowledge that your data may be processed outside Indonesia in accordance with the safeguards described above. If you have questions about a specific transfer, contact our support team who will provide further details on request.
14.1 Right to Update. toto1 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform functionality. The most current version will always be published at https://toto1.onl/privacy-policy with the effective date updated at the top of the document.
14.2 Notification of Material Changes. Where a change is material — meaning it meaningfully affects how we collect, use, or share your personal data — toto1 will provide at least 14 days' advance notice via email to your registered address and via an in-Platform notification banner. Non-material clarifications or formatting changes may be published without prior notice.
14.3 Continued Use. Your continued use of the Platform after the effective date of any updated Privacy Policy constitutes your acknowledgment of the revised practices. If you do not accept any change, you should discontinue use and contact support to close your account and request deletion of your data where legally permissible.
For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact toto1 through any of the following channels:
toto1's support team includes Indonesian-speaking agents available at all hours. All formal data protection requests should be submitted in writing to the email address above. You will receive a written acknowledgment within 5 WIB business days.
Privacy at toto1 is not a checkbox — it is a core operational principle. Here is what that means in practice for every Indonesian member on our Platform.
Every byte of data exchanged between your device and toto1 is protected by TLS 1.3. Your KYC documents, financial account numbers, and personal details are stored with AES-256 encryption at rest — the same standard used by global financial institutions.
toto1 will never sell, rent, or trade your personal data to any third party for marketing or commercial gain. Your data is shared only with the processors necessary to operate the Platform — and always under strict contractual controls.
You hold six enforceable data rights: access, rectification, erasure, restriction, portability, and objection. Submit a request via live chat or email and our team will provide a substantive response within 30 calendar days — no runaround, no delays beyond legal requirements.
toto1 collects only the data genuinely required to operate a safe, compliant betting platform. We do not build advertising profiles, we do not track your activity off-platform, and we do not deploy third-party retargeting or behavioural advertising cookies.
In the unlikely event of a data breach that affects your rights or freedoms, toto1 commits to notifying you within 72 hours of becoming aware — describing exactly what happened, which data was affected, and the steps taken to contain and remediate the incident.
Personal data is not kept indefinitely. toto1 publishes explicit retention periods for every data category and enforces automated deletion schedules. When the retention window closes, data is securely deleted or fully anonymised — not archived in perpetuity.
Your data is secure, your rights are protected, and our support team is available 24/7. Explore toto1's full range of games and sports markets, or review our other policies for complete peace of mind.