Privacy Policy

This Privacy Policy ("Policy") describes how Indosatoto ("we", "us", "our", "the Platform") collects, uses, stores, discloses, and otherwise processes personal data belonging to users ("you", "User", "Player") who access or use the website located at https://indosatoto.cam and all associated services, features, and content provided thereon.

By registering an account, making a deposit, placing a bet, or otherwise using any feature of the indosatoto platform, you acknowledge that you have read and understood this Policy and you consent to the processing of your personal data as described herein. If you do not agree with this Policy, you must not use the platform.

This Policy forms part of indosatoto's wider legal framework and should be read alongside our Terms & Conditions and our Responsible Gambling Policy.

The following terms carry the meanings assigned to them throughout this Policy:

• "Personal Data" means any information that identifies or could reasonably be used to identify a natural person, including but not limited to: name, identification number, contact details, IP address, device identifiers, and financial account information.
• "Processing" means any operation performed on Personal Data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, restriction, erasure, or destruction.
• "Data Controller" means indosatoto, as the entity that determines the purposes and means of processing Personal Data collected through this platform.
• "Data Processor" means a third party that processes Personal Data on behalf of indosatoto strictly in accordance with our documented instructions, such as a payment service provider or KYC verification partner.
• "KYC" means Know Your Customer — the identity verification process required to comply with anti-money laundering (AML) obligations under our international licensing framework.
• "Consent" means a freely given, specific, informed, and unambiguous indication of your wishes by which you agree to the processing of your Personal Data for a stated purpose.
• "Cookie" means a small text file placed on your device by our platform to facilitate session management, preference storage, and usage analytics.

Indosatoto collects Personal Data through multiple touchpoints during your interaction with the platform. The categories of data collected, and the circumstances under which they are collected, are set out below.

When you create an account, we collect:

• Full legal name as it appears on your official identification document
• Date of birth (for mandatory age verification — players must be 21 years of age or older)
• Residential address, including city and postcode (e.g., Kuala Lumpur, Petaling Jaya, Johor Bahru, Penang, Shah Alam)
• Email address and mobile phone number
• Username and encrypted password (passwords are never stored in plain text)
• Preferred currency (MYR is the default for Malaysian users)

To comply with our anti-money laundering (AML) obligations, we collect copies of:

• Malaysian National Identity Card (MyKad) or valid international passport
• Proof of residential address (utility bill, bank statement, or official government correspondence dated within three months)
• Proof of payment method ownership (e.g., screenshot of Touch 'n Go eWallet, Maybank, CIMB, or Public Bank account registered in your name)

We record all financial transactions on the platform, including:

• Deposit and withdrawal amounts, timestamps, and reference numbers
• Payment method type (e.g., DuitNow QR, FPX, GrabPay, Boost, Touch 'n Go eWallet, BTC/USDT)
• Account balance history and bonus credit/debit records

• Games played, bets placed, wager amounts, and outcomes
• Sports betting activity including markets selected (e.g., Liga Super Malaysia, EPL, UFC)
• Session duration and in-platform navigation patterns
• Bonus usage, wagering requirement progress, and promotional participation

• IP address and approximate geolocation (country/region level)
• Browser type, operating system, and device type
• Referring URL and pages visited on the platform
• Session tokens and authentication logs

• Support enquiries submitted via email or live chat
• Correspondence records including dispute submissions and complaint history
• Marketing preference selections and opt-in/opt-out records

Indosatoto processes your Personal Data for the following purposes:

Indosatoto does not use automated decision-making processes that produce legal or similarly significant effects on users without human review. Where profiling is used to identify responsible gambling risk patterns, this is done to protect users — not to restrict their access unfairly.

Indosatoto processes Personal Data on the basis of one or more of the following lawful grounds, consistent with international data protection standards and our licensing obligations:

• Contractual Necessity: Processing is necessary to perform our contractual obligations to you — including account creation, game provision, and payment processing — as set out in the Terms & Conditions.
• Legal Obligation: Processing is required to comply with our AML, KYC, and responsible gambling obligations under our international gaming licence and applicable financial crime prevention regulations.
• Legitimate Interests: Processing is carried out to pursue indosatoto's legitimate business interests in fraud prevention, platform security, abuse detection, and service improvement, provided that such interests are not overridden by your fundamental rights and freedoms.
• Consent: Where processing is based on your consent — such as for receiving personalised promotional communications or marketing emails — you may withdraw your consent at any time by updating your communication preferences in your account settings or by contacting support.

Indosatoto does not sell your Personal Data to any third party. We may share your data only in the circumstances described below, and strictly on a need-to-know basis:

We engage trusted third-party service providers who process data on our behalf under binding data processing agreements. These include payment processors (for MYR transactions via FPX, DuitNow, Touch 'n Go eWallet, Boost, and GrabPay), KYC verification partners, fraud detection providers, customer support software providers, and platform analytics tools. All processors are contractually prohibited from using your data for their own purposes.

We may disclose your Personal Data to our international licensing authority, law enforcement agencies, financial intelligence units, or other regulatory bodies where we are legally required to do so — for example, in response to a court order, a subpoena, a suspicious transaction report under AML obligations, or a request from a licensed gambling regulator.

In the event of a merger, acquisition, corporate restructuring, or sale of assets involving indosatoto, your Personal Data may be transferred to the acquiring entity as part of the transaction, provided that the receiving entity agrees to process your data in a manner consistent with this Policy.

Where a user has requested self-exclusion or where we have identified indicators of problem gambling behaviour, we may share limited data with our responsible gambling compliance partners solely for the purpose of enforcing self-exclusion across affiliated platforms, as required under our licensing obligations.

Indosatoto uses cookies and similar tracking technologies to operate key platform functions, remember your preferences, and analyse aggregate usage patterns. We do not use third-party advertising cookies or cross-site tracking technologies.

You can manage or disable non-essential cookies through your browser settings at any time. Please note that disabling essential cookies will prevent you from logging in and using core platform features. Continued use of the platform after being presented with our cookie notice constitutes acceptance of our cookie practices as described above.

Indosatoto retains your Personal Data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and our licensing obligations. The following general retention periods apply:

• Account and Registration Data: Retained for the duration of your active account and for a minimum of five (5) years following account closure, in accordance with AML record-keeping requirements.
• KYC Documents: Retained for a minimum of five (5) years from the date of verification, or longer where required under our licensing authority's directives.
• Transaction Records: Retained for a minimum of five (5) years from the date of each transaction.
• Gameplay and Betting History: Retained for a minimum of three (3) years from the date of each gaming session or bet placement.
• Communications and Support Records: Retained for a minimum of two (2) years from the date of last interaction.
• Marketing Consent Records: Retained for the duration of your active consent plus three (3) years from withdrawal, to demonstrate compliance.

Upon expiry of the applicable retention period, your data will be securely deleted or anonymised so that it can no longer be associated with your identity.

Indosatoto implements a layered set of technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• Transport Layer Security (TLS 1.2+) encryption for all data transmitted between your device and our servers
• AES-256 encryption for sensitive data stored at rest, including identity documents and financial records
• Multi-factor authentication (MFA) available for user accounts and enforced for all internal administrative access
• Role-based access controls ensuring that staff can only access data strictly necessary for their operational function
• Regular penetration testing and vulnerability assessments conducted by independent security professionals
• Automated intrusion detection and real-time anomaly monitoring across all platform infrastructure
• Secure disposal procedures for physical and digital data upon expiry of the retention period

Indosatoto is operated under international licensing, and your Personal Data may be stored and processed on servers located outside of Malaysia — including in jurisdictions within Europe, Southeast Asia, and other regions where our service providers and licensing authority operate.

Where data is transferred to third-party processors located outside Malaysia, indosatoto ensures that appropriate safeguards are in place, including:

• Contractual data protection clauses in all agreements with third-party processors
• Transfer to processors operating in jurisdictions that provide an adequate level of data protection as recognised under applicable international standards
• Technical and organisational security measures commensurate with the sensitivity of the data being transferred

By using the indosatoto platform, you acknowledge and consent to the transfer of your Personal Data to servers and processors located outside of Malaysia for the purposes described in this Policy.

Indosatoto respects your rights over your Personal Data. Subject to applicable law and our legal obligations, you may exercise the following rights by contacting our support team at [email protected]:

We will respond to all verified data rights requests within 30 calendar days of receipt. In cases of complexity or volume, this period may be extended by a further 60 days with notice to you. We may need to verify your identity before processing any request to protect your data from unauthorised access.

Indosatoto is strictly an adult platform. The minimum age to register and use this platform is 21 years. We do not knowingly collect Personal Data from persons under the age of 21.

Age verification is a mandatory step in our KYC process. All accounts are required to submit a valid government-issued identification document confirming that the account holder is 21 years of age or older before deposits and withdrawals can be processed. Accounts found to belong to persons under 21 will be immediately closed, and any associated funds will be forfeited in accordance with our Terms & Conditions and licensing obligations.

If you are aware that a minor has submitted Personal Data to indosatoto, please contact us immediately at [email protected] so that the relevant data can be identified and securely deleted without delay.

The indosatoto platform does not contain links to third-party websites or external services as a general policy. In the event that any reference to a third-party service appears on the platform — such as a payment processor interface or a licensing authority portal — please note that indosatoto is not responsible for the privacy practices or content of those third-party services.

We encourage you to review the privacy policies of any third-party services you interact with in connection with your use of the indosatoto platform, particularly your chosen payment method provider (e.g., Touch 'n Go eWallet, Maybank, CIMB, GrabPay, or Boost).

Indosatoto reserves the right to update or amend this Privacy Policy at any time. When we make material changes to this Policy, we will notify registered users via the email address associated with their account and/or by posting a prominent notice on the platform for a minimum of 14 days before the revised Policy takes effect.

The "Last Updated" date at the top of this page reflects the date on which the most recent version of this Policy became effective. Your continued use of the platform after that date constitutes your acceptance of the revised Policy. If you do not agree with any changes, you must cease using the platform and may request account closure by contacting our support team.

We recommend reviewing this Policy periodically so you remain informed of how we handle your Personal Data.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data, please contact our Data Protection team through the following channel: