Privacy Policy

1. Introduction and Scope

This Privacy Policy applies to all personal data collected by Kitoto through our website, mobile-optimized platform, customer service channels, and any other touchpoints where you interact with our services. Kitoto operates as an online gambling platform serving Indonesian players with sports betting (including bandar bola or football bookmaking), live casino games, slot machines, and lottery games (including togel, Indonesia's traditional numbers lottery).

We collect and process personal data in accordance with applicable data protection principles and international privacy standards. This policy should be read in conjunction with our Terms & Conditions, which govern your use of Kitoto services. Where there is any conflict between this Privacy Policy and our Terms & Conditions, this Privacy Policy shall prevail with respect to data protection matters.

2. Data Controller Information

Kitoto is the data controller responsible for your personal data collected through the platform. For data protection inquiries, you may contact our Data Protection Officer at:

• Email: [email protected] (displayed as plain text only—not a clickable link)
• Mailing Address: Kitoto Data Protection Officer, c/o Customer Service Department
• Response Time: We aim to respond to all data protection inquiries within 72 hours

3. Information We Collect

3.1 Information You Provide Directly

When you register for a Kitoto account, we collect the following personal information:

• Identity Information: Full legal name, date of birth, nationality, and government-issued ID number (KTP number, passport number, or driver's license number)
• Contact Information: Email address, mobile phone number, residential address in Indonesia including city, postal code, and province
• Account Credentials: Username and encrypted password (we store passwords using one-way cryptographic hashing—we cannot view your actual password)
• Financial Information: Bank account details (bank name, account number, account holder name) for Indonesian banks including BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, and BSI; e-wallet account information for OVO, DANA, GoPay, ShopeePay, and LinkAja
• Verification Documents: Government-issued photo ID (front and back), proof of address (utility bill, bank statement, or government letter), and selfie photograph with ID for Know Your Customer (KYC) compliance

3.2 Information Collected Automatically

When you use the Kitoto platform, we automatically collect certain technical and behavioral information:

• Device Information: Device type (desktop, mobile, tablet), operating system (Windows, macOS, Android, iOS), browser type and version, screen resolution, and device language settings
• Connection Information: IP address, internet service provider (ISP), approximate geographic location based on IP (city and region level—we do not track precise GPS coordinates), and connection timestamps
• Usage Information: Pages visited, features used, time spent on each page, click patterns, navigation paths through the platform, search queries, and interaction with customer service (chat logs, email correspondence)
• Transaction History: Deposit amounts, withdrawal amounts, payment methods used, transaction dates and times, and transaction success/failure status
• Gaming Activity: Bets placed (sport/event/market, stake amount, odds, time), game sessions (game type, session duration, wins/losses), bonus claims and usage, and responsible gaming tool settings (deposit limits, session limits, self-exclusion periods)

3.3 Information from Third Parties

We may receive information about you from third-party sources:

• Payment Processors: Transaction confirmation data from Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) and e-wallet providers (OVO, DANA, GoPay, ShopeePay) to verify deposit and withdrawal transactions
• Identity Verification Services: Results from KYC verification checks performed by third-party identity verification providers to confirm your identity and age
• Fraud Prevention Services: Risk scores and fraud indicators from specialized anti-fraud services that help us detect suspicious account activity, multi-accounting, and payment fraud

4. How We Use Your Information

4.1 Account Management and Service Delivery

We use your personal data to:

• Create and maintain your Kitoto account
• Verify your identity and age (21+ requirement) through KYC procedures
• Process deposits and withdrawals via your chosen Indonesian payment methods
• Enable you to place bets on sports events (BRI Liga 1, EPL, La Liga, Champions League, etc.), play casino games, and participate in lottery draws
• Track your gaming activity for responsible gaming monitoring
• Provide customer support via live chat, email, and phone in Indonesian and English
• Send transactional notifications (deposit confirmations, withdrawal updates, bet settlements, account security alerts)

4.2 Legal and Regulatory Compliance

We process your data to comply with legal obligations:

• Age verification to prevent underage gambling (mandatory 21+ age requirement)
• Anti-money laundering (AML) checks and suspicious transaction reporting
• Prevention of fraud, collusion, and other illegal activities
• Record-keeping requirements under gaming regulations (transaction records retained for 7 years)
• Cooperation with law enforcement and regulatory authorities when legally required
• Tax reporting obligations where applicable

4.3 Platform Security and Fraud Prevention

We use your information to protect you and the platform:

• Detect and prevent multi-accounting (each user limited to one account)
• Identify suspicious betting patterns, bonus abuse, and collusion
• Monitor for unauthorized account access and credential theft
• Prevent payment fraud and chargeback abuse
• Enforce Terms & Conditions violations
• Protect against distributed denial-of-service (DDoS) attacks and other cybersecurity threats

4.4 Marketing and Promotions (With Your Consent)

Subject to your marketing preferences, we may use your contact information to:

• Send promotional emails about bonuses, free bets, and special offers
• Notify you of new game launches, sports betting markets, and platform features
• Provide personalized bonus offers based on your gaming preferences
• Send information about VIP program tier benefits and exclusive tournaments

Important: Marketing communications are opt-in. You can unsubscribe at any time through the link in our emails or by contacting customer support. Transactional communications (deposit confirmations, security alerts) cannot be opted out of as they are essential to service delivery.

4.5 Analytics and Platform Improvement

We analyze aggregated and anonymized data to:

• Understand how users navigate and use the platform
• Identify technical issues, bugs, and performance bottlenecks
• Optimize user interface and user experience based on behavior patterns
• Develop new features and services that meet Indonesian player needs
• Measure effectiveness of marketing campaigns and promotional offers

This analytics data is anonymized and cannot be traced back to individual users.

5. Legal Basis for Processing (Data Protection Principles)

Under international data protection standards, we process your personal data based on the following legal grounds:

• Contract Performance: Processing necessary to provide gambling services you requested by creating an account
• Legal Obligation: Processing required by gaming regulations, anti-money laundering laws, and age verification requirements
• Legitimate Interests: Processing necessary for fraud prevention, platform security, and business operations, balanced against your privacy rights
• Consent: Processing for marketing communications and optional features, where you have provided explicit opt-in consent

6. How We Share Your Information

6.1 Service Providers and Business Partners

We share personal data with trusted third-party service providers who assist in operating the Kitoto platform:

Category	Purpose	Examples
Payment Processors	Process deposits and withdrawals	Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon), e-wallet providers (OVO, DANA, GoPay, ShopeePay)
Identity Verification	Perform KYC checks	Third-party identity verification services that validate government IDs and perform age verification
Game Providers	Deliver casino and slot games	Evolution Gaming, Pragmatic Play, and other licensed game studios integrated into the platform
Customer Support Tools	Provide live chat and email support	Customer service platform providers that enable our 24/7 Indonesian-speaking support team
Fraud Prevention	Detect suspicious activity	Specialized anti-fraud services that identify multi-accounting, payment fraud, and bonus abuse
Cloud Infrastructure	Host platform and databases	Secure cloud hosting providers with data centers employing enterprise-grade security

All third-party service providers are contractually bound to protect your data and use it only for the specific purposes we authorize. They are prohibited from selling your data or using it for their own marketing.

6.2 Legal Disclosure Requirements

We may disclose your personal data when required by law or to protect our legal rights:

• In response to valid legal process (subpoenas, court orders, government requests)
• To comply with gaming regulations and licensing requirements
• To report suspected money laundering or terrorist financing to relevant authorities
• To enforce our Terms & Conditions and investigate terms violations
• To protect the safety and security of Kitoto, our users, or the public
• In connection with a business transfer (merger, acquisition, bankruptcy) where a successor entity would assume our data protection obligations

6.3 Information We Do Not Share

Kitoto does not and will never:

• Sell your personal data to third parties for their own marketing purposes
• Share your information with external advertising networks or data brokers
• Rent or lease customer lists
• Disclose your gambling activity to social media platforms or public databases
• Provide your financial information (bank accounts, e-wallet details) to anyone except the payment processor necessary to complete your transaction

7. Data Security Measures

7.1 Technical Safeguards

Kitoto employs industry-standard security technologies to protect your data:

• SSL/TLS Encryption: All data transmitted between your device and our servers is encrypted using 256-bit SSL/TLS encryption, the same technology used by banks
• Password Hashing: Passwords are hashed using bcrypt with unique salts—we cannot view or recover your actual password
• Database Encryption: Sensitive data fields (ID numbers, payment details) are encrypted at rest in our databases
• Firewall Protection: Multi-layer firewalls protect our servers from unauthorized external access
• DDoS Mitigation: Advanced systems detect and mitigate distributed denial-of-service attacks
• Regular Security Audits: Independent security firms conduct penetration testing and vulnerability assessments quarterly

7.2 Organizational Safeguards

We implement strict internal policies and procedures:

• Access Controls: Employee access to personal data is limited based on job function necessity (principle of least privilege)
• Staff Training: All employees receive data protection training and sign confidentiality agreements
• Secure Development: Security-by-design principles guide our software development lifecycle
• Incident Response Plan: We maintain a documented breach response protocol to address security incidents swiftly
• Vendor Management: Third-party service providers undergo security assessments before engagement

7.3 Your Security Responsibilities

You play a crucial role in protecting your account:

• Choose a strong, unique password (minimum 8 characters, mix of letters, numbers, symbols)
• Never share your password with anyone, including customer service representatives
• Log out after each session, especially on shared or public devices
• Keep your contact information updated so we can notify you of suspicious activity
• Report suspected unauthorized access immediately to [email protected]
• Use secure, private internet connections—avoid public WiFi when accessing your account

8. Data Retention

We retain your personal data for different periods depending on data type and legal requirements:

• Active Accounts: Data retained for the duration of your account's active status plus 7 years after account closure
• Transaction Records: Deposit, withdrawal, and bet history retained for 7 years to comply with financial regulations
• KYC Documents: Verification documents retained for 7 years after account closure per anti-money laundering regulations
• Customer Support Records: Chat logs and email correspondence retained for 3 years for quality assurance and dispute resolution
• Marketing Data: Deleted within 30 days of unsubscribe request or account closure
• Anonymized Analytics: Aggregated analytics data may be retained indefinitely as it cannot identify individuals

After retention periods expire, data is securely deleted or anonymized beyond recovery.

9. Your Data Protection Rights

9.1 Access Rights

You have the right to request a copy of all personal data we hold about you. You can access most of your data directly through your account dashboard, including profile information, transaction history, betting history, and bonus records. For a comprehensive data export, contact our Data Protection Officer.

9.2 Correction Rights

You have the right to correct inaccurate personal data. You can update your contact information (email, phone, address) directly in account settings. Changes to identity information (name, date of birth) require verification due to regulatory requirements—contact customer support with supporting documentation.

9.3 Deletion Rights (Right to be Forgotten)

You have the right to request deletion of your personal data, subject to legal limitations. We must retain certain data for 7 years to comply with financial regulations and anti-money laundering laws. After this retention period, data will be permanently deleted. To request account closure and data deletion, contact [email protected].

9.4 Portability Rights

You have the right to receive your personal data in a structured, commonly used format (CSV or JSON) and transmit it to another service. Contact our Data Protection Officer to request a data portability export.

9.5 Objection and Restriction Rights

You have the right to object to processing of your personal data for marketing purposes (opt-out anytime) or processing based on legitimate interests. You can restrict processing while we investigate a data accuracy dispute. Note that objecting to or restricting essential processing (account management, KYC verification, transaction processing) may prevent us from providing gambling services.

9.6 Exercising Your Rights

To exercise any of these rights, contact our Data Protection Officer at [email protected] with your request. We will respond within 30 days. We may need to verify your identity before fulfilling requests to prevent unauthorized data disclosure. There is no fee for exercising your rights unless requests are manifestly unfounded or excessive.

10. Cookies and Tracking Technologies

Kitoto uses cookies and similar technologies to improve platform functionality and user experience:

• Essential Cookies: Required for core platform functions (login, session management, shopping cart). Cannot be disabled.
• Functional Cookies: Remember your preferences (language, currency display, theme). Enhance user experience but not strictly necessary.
• Analytics Cookies: Collect anonymized data about platform usage to identify improvement opportunities. Help us understand which features are used and which need work.
• Security Cookies: Detect suspicious activity and protect against fraud. Essential for platform security.

You can manage cookie preferences through your browser settings, though disabling essential cookies will impair platform functionality. We do not use third-party advertising cookies or tracking pixels.

11. International Data Transfers

While Kitoto primarily serves Indonesian players and processes data within secure regional data centers, some third-party service providers (cloud hosting, fraud prevention tools) may be located outside Indonesia. When data is transferred internationally, we ensure adequate protections through:

• Contractual clauses requiring equivalent data protection standards
• Verification that destination countries provide adequate data protection
• Use of service providers certified under recognized data protection frameworks

12. Children's Privacy

Kitoto services are strictly for adults 21 years and older. We do not knowingly collect personal data from individuals under 21. Our KYC verification process is specifically designed to prevent underage account creation. If we discover an account belongs to someone under 21, we will immediately close it and delete associated data. Parents should use device-level parental controls to prevent minors from accessing gambling websites.

13. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our data practices, legal requirements, or business operations. Material changes will be communicated via email to registered users and highlighted prominently on the platform at least 30 days before taking effect. The "Last Updated" date at the top of this policy indicates the most recent revision. Continued use of Kitoto services after changes take effect constitutes acceptance of the updated policy. We recommend reviewing this policy periodically.

14. Contact and Complaints

For privacy-related questions, concerns, or complaints, contact our Data Protection Officer:

• Email: [email protected] (displayed as plain text only—not a clickable link)
• Subject Line: Include "Privacy Inquiry" or "Data Protection Request" for faster routing
• Response Time: We aim to respond to all privacy inquiries within 72 hours

If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.