How toto20 collects, uses, safeguards, and respects your personal information
This Privacy Policy ("Policy") describes how toto20 ("we", "us", "our", or "the Company"), operator of the online gaming platform accessible at https://toto20.world (the "Platform" or "Website"), collects, processes, stores, discloses, and protects the personal information of users ("you", "your", or "User") who access or register on the Platform.
toto20 is committed to maintaining the highest standards of data privacy and information security. We handle all personal data in accordance with applicable data-protection principles and the legitimate expectations of Indonesian residents who use our services. By creating an account on toto20 or by continuing to browse the Website, you acknowledge that you have read and understood this Policy and consent to the data-processing activities described herein.
If you do not agree with the terms of this Policy, you should discontinue use of the Platform immediately and contact our support team to request deletion of any data we may have collected.
This Policy applies to all registered Users, prospective users who have submitted an inquiry, and visitors to the toto20 Website regardless of device type. It covers data collected through the Website, customer support channels, and payment-processing interactions.
For clarity and consistency throughout this Policy, the following terms carry the meanings assigned below:
toto20 collects Personal Data through several distinct channels depending on how you interact with our Platform:
When you register an account, we collect: full legal name; date of birth; residential address in Indonesia (city, province, postal code); email address; mobile phone number; and chosen username. This information is mandatory — accounts cannot be created without it.
To comply with international gaming-platform standards and to protect Users from fraud, toto20 requires identity verification before processing your first withdrawal. During KYC, we collect: a copy of your Indonesian National Identity Card (KTP); a proof-of-address document such as a recent bank statement or utility bill issued in Indonesia; and a selfie photograph (liveness check) confirming that you are the person named on the submitted identity document. These documents are treated as Sensitive Data and are subject to the most stringent security controls available on our Platform.
Every deposit and withdrawal generates a transaction record that toto20 retains. This record includes: the payment method used (e.g., BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, or LinkAja); the transaction amount in Indonesian Rupiah (IDR); a timestamp; a unique transaction reference number; and the status of the transaction. We do not store full bank account numbers or e-wallet credentials; these are processed exclusively through encrypted connections with our payment partners.
toto20 automatically records all wagering activity on your account, including game type, bet amount, game outcome, bonus usage, and session duration. This data is used to settle bets accurately, detect suspicious patterns, administer responsible-gaming tools such as deposit and loss limits, and fulfill regulatory-reporting obligations where applicable.
When you access the Platform, our servers and analytics tools automatically collect: IP address; browser type and version; operating system; device type (desktop, tablet, mobile); pages visited and time spent; referring URL; and cookie identifiers. This data helps us maintain Platform security, optimize performance, and detect bot activity or unauthorized access attempts.
If you contact toto20 via live chat, email ([email protected]), or any other support channel, we retain the content of those communications together with your account identifier and a timestamp. Support records are used to resolve disputes, improve service quality, and train customer support agents.
If you opt in to promotional communications, we record that preference alongside your email address and, where applicable, your mobile number for SMS or messaging-app notifications. You may withdraw this consent at any time by contacting support or adjusting your account preferences.
toto20 processes your Personal Data only for the purposes listed below. We do not sell your data to third parties for their independent marketing use.
toto20 processes your Personal Data on the following legal grounds:
Processing is necessary to perform the contract you entered into when accepting our Terms & Conditions. Without processing account, KYC, and payment data, toto20 cannot provide the services you have requested.
Certain processing activities — particularly KYC verification, financial record-keeping, and anti-money-laundering screening — are required by law. Refusing to provide the necessary data will prevent us from onboarding you as a User.
toto20 processes technical and behavioral data based on our legitimate interest in maintaining Platform security, detecting fraud, and improving our services, provided that this interest does not override your fundamental privacy rights.
Where processing is not required by contract or law — for example, sending promotional emails or storing marketing preferences — we rely on your freely given, informed consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.
toto20 uses cookies and similar tracking technologies to operate and improve the Platform. Our use of cookies falls into the following categories:
You may manage cookie preferences through your browser settings. Disabling non-essential cookies will not prevent you from using core Platform features, though it may reduce personalization. Note that strictly necessary cookies cannot be disabled through browser settings while you remain logged in.
toto20 does not sell, rent, or trade your Personal Data. We may share data with the following categories of recipients strictly for the purposes outlined in this Policy:
To facilitate deposits and withdrawals, we share necessary financial information with payment-gateway partners supporting BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, and LinkAja. These partners are contractually bound to process your data solely for payment-settlement purposes and to maintain equivalent data-security standards.
Identity documents submitted during account verification are processed by specialist third-party KYC providers who cross-reference submissions against national identity databases. These providers operate under strict data-processing agreements and are prohibited from using your data for any purpose other than identity verification on behalf of toto20.
We engage cloud-hosting, content-delivery, fraud-detection, and cybersecurity vendors who may process technical data (IP addresses, device fingerprints, server logs) in the course of providing services to toto20. All such vendors are subject to data-processing agreements.
Certain game studios and live-dealer providers require limited account data (such as a pseudonymous player token) to facilitate gameplay and settle winnings accurately. No more data is shared than is necessary for this purpose.
We may disclose Personal Data to law-enforcement agencies, courts, or other governmental bodies in the Republic of Indonesia when required to do so by a valid legal order, subpoena, or regulatory directive. We will notify you of any such disclosure to the extent permitted by law.
In the event of a merger, acquisition, asset sale, or corporate restructuring involving toto20, your Personal Data may be transferred to the acquiring entity, subject to equivalent privacy protections. We will notify affected Users of any such transfer and the identity of the new data controller.
toto20 retains Personal Data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by law. The following retention periods apply as a general guideline:
When Personal Data is no longer required, it is securely deleted or irreversibly anonymized so that it can no longer be attributed to any identifiable individual.
toto20 implements a comprehensive set of technical and organizational security measures to protect your Personal Data against unauthorized access, accidental loss, alteration, or disclosure.
All data transmitted between your device and the toto20 Platform is encrypted using industry-standard Transport Layer Security (TLS). Sensitive data stored on our servers — including KYC documents and financial records — is encrypted at rest using AES-256 encryption.
Access to Personal Data within toto20 is restricted to employees and contractors who require it to perform their job functions. All internal access is governed by role-based permissions, multi-factor authentication, and audit logging to ensure accountability.
We operate real-time fraud-monitoring systems that analyze login behavior, transaction patterns, and device fingerprints to detect and block unauthorized access attempts before any damage occurs.
toto20 conducts periodic internal security reviews and engages independent cybersecurity specialists to perform external penetration testing and vulnerability assessments of our infrastructure and applications.
In the unlikely event of a data breach that poses a material risk to your rights and interests, toto20 will notify affected Users without undue delay and take all reasonable steps to contain the breach, assess its scope, and mitigate potential harm. We will document all breach incidents in accordance with applicable regulatory requirements.
While toto20 implements robust security measures, the security of your account also depends on you. Never share your password with anyone, always use a strong and unique password, and log out of your account when accessing the Platform from a shared device. If you suspect your account has been compromised, contact our support team immediately.
As a User of toto20, you have the following rights in respect of your Personal Data. To exercise any of these rights, please contact our support team at [email protected] with a clear description of your request and sufficient information to verify your identity.
We will respond to all verifiable data-subject requests within 30 calendar days. If your request is complex or involves a high volume of data, we may extend this period by a further 60 days and will notify you accordingly.
toto20 primarily stores and processes data on servers located within or accessible from Indonesia. However, certain third-party service providers — including cloud-infrastructure vendors, KYC specialists, and game studios — may process data in data centers located in other countries. When such transfers occur, toto20 ensures that appropriate safeguards are in place, including standard contractual clauses, data-processing agreements, and, where applicable, adequacy determinations ensuring that the receiving jurisdiction provides a comparable level of data protection.
By using the toto20 Platform, you acknowledge that your Personal Data may be transferred to and processed in countries outside Indonesia for the limited purposes described in this Policy. In all cases, toto20 remains responsible for ensuring that your data receives equivalent protection to that provided under this Policy.
The toto20 Platform may reference third-party brands, game studios (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft), and payment networks in informational content. toto20 does not operate external websites and does not include outbound links to third-party platforms in its navigation or footers. However, if any third-party service is accessed in connection with your use of toto20, that service operates under its own privacy policy, for which toto20 bears no responsibility. We encourage you to review the privacy practices of any third-party service provider before sharing your information with them.
toto20 services are strictly restricted to individuals aged 21 years or older. We do not knowingly collect Personal Data from persons under this age threshold. If we discover that a minor has registered an account or submitted Personal Data, we will immediately suspend the account, delete all associated data, and refund any deposits to the source payment method after completing the necessary verification. If you believe a minor has accessed or registered on the Platform, please notify us immediately at [email protected] so that we can investigate and take appropriate action.
toto20 reserves the right to update, modify, or replace this Privacy Policy at any time to reflect changes in our data-processing practices, new regulatory requirements, or improvements to our services. When material changes are made, we will update the "Last Revised" date at the top of this page and, where appropriate, notify registered Users by email or via an in-Platform notification at least 14 days before the changes take effect.
Your continued use of the Platform after the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not agree with the revised Policy, you should stop using the Platform and contact our support team to request account closure and data deletion.
For any questions, concerns, or requests relating to this Privacy Policy or our data-processing practices, please reach out to the toto20 privacy team through the following channel:
We are committed to addressing all privacy-related inquiries promptly, professionally, and in full compliance with applicable data-protection obligations. When contacting us regarding a data-subject request, please include your registered account username and the email address associated with your account to allow us to verify your identity and locate your records efficiently.
By registering an account on toto20 and accepting our Terms & Conditions, you confirm that you have read and understood this Privacy Policy and consent to the collection and processing of your Personal Data as described herein. You also confirm that you are at least 21 years of age and a resident of the Republic of Indonesia.
Our support team is available around the clock to address any concerns about how your data is handled. Reach us at any time via live chat or email.
Six principles that guide how toto20 handles your personal information
Every byte of data transmitted between your device and toto20 is protected by TLS encryption. Sensitive records stored on our servers use AES-256 encryption at rest.
toto20 never sells, rents, or trades your Personal Data to third-party marketers. Your information is used solely to deliver and improve our own services.
Internal access to your data is governed by role-based permissions and multi-factor authentication. Only authorized personnel with a demonstrable need can view your records.
We retain data only for as long as legally required or operationally necessary. When retention periods expire, data is securely deleted or irreversibly anonymized.
Promotional communications are sent only to Users who have explicitly opted in. You can withdraw consent at any time with immediate effect — no questions asked.
Independent penetration tests and vulnerability assessments are conducted periodically to ensure our infrastructure meets current best-practice security standards.
Explore our related policy pages or reach out to our 24/7 support team — we are always here to help.