Privacy Policy

Introduction

to188 ("we", "us", "our", or the "Platform") is committed to protecting the privacy and personal data of every user who accesses our online gaming services at https://to188.cam. This Privacy Policy describes in plain terms what personal information to188 collects, why we collect it, how we use it, who we may share it with, and what rights you hold over your own data.

This Policy applies to all visitors, registered members, and former members of the to188 Platform, regardless of the device or browser used to access our services. By creating an Account or continuing to use the Platform after this Policy has been posted, you acknowledge that you have read and understood its contents and consent to the data practices described herein.

If you are a resident of Indonesia, additional rights under Indonesian Personal Data Protection Law (UU PDP) may apply to you. Where relevant, we identify these rights separately. For any privacy-related questions not answered in this document, please contact our Data Protection team at [email protected].

The following definitions apply throughout this Privacy Policy:

• "Account" — the personal gaming account created by a User to access to188 services.
• "Data Controller" — to188, the entity that determines the purposes and means of processing personal data.
• "Data Processor" — a third party that processes data on behalf of to188 under a written data-processing agreement.
• "Personal Data" — any information that identifies or could reasonably be used to identify a natural person, including name, email address, phone number, payment details, and IP address.
• "Processing" — any operation performed on Personal Data, including collection, storage, use, disclosure, and deletion.
• "User" — any individual who visits, registers on, or uses the to188 Platform.

to188 collects personal data in three primary ways: data you provide directly, data generated automatically through your use of the Platform, and data received from third-party service providers.

2.1 Data You Provide Directly

2.2 Data Collected Automatically

When you access the Platform, our servers and analytics tools automatically record the following technical data:

• Device and browser information: device type, operating system version, browser type and version, screen resolution.
• Network data: IP address, approximate geographic location derived from IP (city/province level), internet service provider.
• Session data: pages visited, time spent on each page, click paths, games played, wagers placed, session start and end times.
• Cookie data: session cookies, preference cookies, security tokens. See Section 8 for our full Cookie Policy.

2.3 Data from Third Parties

We may receive supplementary personal data from the following third-party sources to enhance security and compliance:

• Payment processors: Transaction confirmation, payment status, and fraud signals from Indonesian banks and e-wallet providers.
• Identity verification services: Document authenticity confirmation from licensed KYC verification providers.
• Fraud prevention services: Risk scores, flagged IP addresses, and device fingerprints from third-party anti-fraud platforms.

to188 processes your personal data only for specified, explicit, and legitimate purposes. The table below outlines each purpose and its legal basis:

to188 does not sell, rent, or trade your personal data. We share personal data only in the following limited circumstances:

4.1 Service Providers (Data Processors)

We engage carefully selected third-party service providers who process data on our behalf under strict contractual data-processing agreements. These providers may include:

• Payment processors: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) and e-wallet operators (OVO, DANA, GoPay, ShopeePay) to execute deposit and withdrawal transactions.
• KYC and identity verification partners: Licensed identity verification services to validate government-issued ID documents.
• Cloud hosting and security providers: Encrypted server infrastructure providers that store Platform data under strict security agreements.
• Customer support software providers: Live chat and ticketing platform providers that process support conversation data.
• Fraud detection services: Anti-fraud and risk-scoring platforms that analyze transaction patterns and device fingerprints.

All service providers are contractually prohibited from using your personal data for any purpose other than performing the specific service they provide to to188.

4.2 Legal and Regulatory Disclosure

to188 may disclose personal data to law enforcement agencies, regulatory authorities, courts, or government bodies when required to do so by applicable law, regulation, legal process, or enforceable governmental request. We will notify you of such disclosure to the extent permitted by law.

4.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of to188's assets, your personal data may be transferred to the acquiring entity. You will be notified of any such transfer and your continued use of the Platform after notice constitutes acceptance of the new entity's privacy practices.

4.4 With Your Consent

We may share your personal data with other third parties where you have given explicit informed consent for that specific sharing purpose. You may withdraw such consent at any time.

to188 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, and in accordance with legal obligations. Our general retention schedule is as follows:

• Account data: Retained for the lifetime of your Account plus 5 years after permanent closure to satisfy AML and regulatory requirements.
• KYC and identity documents: Retained for 5 years after Account closure in compliance with anti-money laundering regulations.
• Transaction records: Retained for a minimum of 5 years as required by financial record-keeping regulations.
• Customer support communications: Retained for 3 years to support dispute resolution and service improvement.
• Session and behavioral data: Retained for 24 months, then anonymized for aggregate analytics purposes.
• Marketing preferences: Retained until you opt out or request deletion, at which point marketing data is deleted within 30 days.

After the relevant retention period expires, personal data is securely deleted or anonymized so that it can no longer be linked to an individual.

As a to188 user and a resident of Indonesia, you are entitled to the following rights with respect to your personal data:

6.1 Right of Access

You may request a complete copy of all personal data to188 holds about you. We will provide this information in a structured, commonly used, machine-readable format within 30 days of receiving your verified request.

6.2 Right to Correction

If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or complete it. You may update basic Account information (email address, phone number) directly within your Account settings. For corrections to identity documents or payment data, please contact customer support.

6.3 Right to Erasure ("Right to Be Forgotten")

Subject to legal retention obligations (see Section 5), you may request that to188 delete your personal data after permanently closing your Account. We will process erasure requests within 30 days. Note that data subject to AML retention requirements (minimum 5 years post-closure) cannot be deleted early, but will be quarantined from active processing systems.

6.4 Right to Restrict Processing

You may request that to188 restrict the processing of your personal data in certain circumstances, such as while we investigate a complaint about data accuracy or a data-sharing objection.

6.5 Right to Data Portability

You may request that to188 provide your personal data in a portable format (JSON or CSV) so that you can transfer it to another service provider, where technically feasible.

6.6 Right to Object

You may object to processing based on legitimate interests or direct marketing at any time. Upon receipt of an objection, to188 will stop the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests.

6.7 How to Exercise Your Rights

To exercise any of the rights listed above, submit a written request to [email protected] with the subject line "Privacy Rights Request". We may need to verify your identity before actioning the request. We will respond within 30 calendar days.

to188 employs a layered security architecture to protect your personal data against unauthorized access, disclosure, alteration, and destruction. Our key security measures include:

• TLS 1.3 / 256-bit SSL encryption: All data transmitted between your device and our servers is encrypted in transit.
• Encrypted data storage: Personal data and payment records are stored in AES-256 encrypted databases on access-controlled servers.
• Password hashing: Account passwords are hashed using bcrypt with salting — plain-text passwords are never stored.
• Access controls: Employee access to personal data is restricted by role and requires multi-factor authentication (MFA). Access logs are audited regularly.
• Network security: Firewalls, intrusion detection systems (IDS), and DDoS mitigation protect our server infrastructure.
• Regular security audits: to188 undergoes periodic penetration testing and security audits conducted by independent cybersecurity firms.
• Incident response: We maintain a documented data breach response procedure. In the event of a breach affecting your personal data, you will be notified within 72 hours of our becoming aware of it.

While we implement industry-leading security measures, no online system can guarantee absolute security. You are also responsible for maintaining the confidentiality of your Account password and for logging out of shared devices. Notify us immediately at [email protected] if you suspect unauthorized access to your Account.

to188 uses cookies and similar technologies to operate the Platform, remember your preferences, and analyze usage patterns. Below is a breakdown of the cookies we use:

You may control cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair core Platform functionality, including login sessions. to188 does not use third-party advertising cookies or cross-site tracking technologies.

to188 strictly prohibits use of the Platform by individuals under the age of 21. We do not knowingly collect personal data from anyone under 21 years of age. If we become aware that an Account has been registered by a minor, we will immediately close the Account, forfeit any remaining balance, and permanently delete all associated personal data to the extent not retained by legal obligation.

If you are a parent or guardian and believe your child (under 21) has created a to188 Account, please contact us immediately at [email protected]. We take underage gambling extremely seriously and will act on all such reports within 24 hours.

to188 operates servers in multiple jurisdictions. By using the Platform, you acknowledge that your personal data may be transferred to and processed in countries outside Indonesia. Where such transfers occur, to188 implements appropriate safeguards including:

• Data processing agreements that bind recipient parties to equivalent data protection standards.
• Standard contractual clauses that provide enforceable protections for transferred personal data.
• Transfer only to jurisdictions that maintain adequate data protection laws or frameworks recognized by international data protection authorities.

If you have questions about the specific safeguards applied to any international transfer of your personal data, contact us at [email protected].

to188 may update this Privacy Policy periodically to reflect changes in our data practices, legal obligations, or Platform features. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page.
• Post a prominent notice on the Platform informing users of the change.
• Send an email notification to all registered users summarizing the key changes.

Material changes will take effect 14 days after the notice is posted to give you time to review the updated Policy. Your continued use of the Platform after the effective date constitutes acceptance of the revised Privacy Policy. If you do not accept the changes, you must close your Account before the effective date.

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way to188 handles your personal data, please contact our Data Protection team through the following channels:

• Email: [email protected]
• Live Chat: Available 24/7 on the Platform
• Response Time: We aim to respond to all privacy-related inquiries within 3 business days and to formal rights requests within 30 calendar days.
• Support Language: Indonesian and English

If you are not satisfied with our response to a privacy complaint, you may lodge a complaint with the relevant data protection authority in your jurisdiction.