Privacy Policy

1. Introduction

This Privacy Policy describes how hptoto ("we", "us", "our", "Platform") collects, uses, processes, and protects personal information provided by users ("you", "Player", "User") accessing our online gambling services at https://hptoto.cam. By creating an account and using hptoto services, you consent to the data practices described in this Privacy Policy.

hptoto operates as an international online betting platform serving Indonesian players with sports betting, live casino games, slot machines, and togel lottery services. We recognize that privacy is paramount when handling sensitive personal and financial information, and we have implemented comprehensive security measures and data protection protocols aligned with international best practices including principles derived from the General Data Protection Regulation (GDPR) and other recognized data protection frameworks.

2. Information We Collect

hptoto collects several categories of personal information necessary to provide our services, comply with legal obligations, and maintain platform security. The information we collect includes:

2.1 Account Registration Information

When you create an hptoto account, we collect:

• Personal Identifiers: Full legal name, date of birth, gender, nationality
• Contact Information: Email address, mobile phone number (with Indonesian +62 country code), residential address in Indonesia
• Account Credentials: Username, password (stored in encrypted hashed format)
• Language & Currency Preferences: Preferred display language and currency (Indonesian Rupiah)

2.2 Identity Verification (KYC) Documents

To comply with regulatory requirements, prevent underage gambling, and combat fraud, we collect:

• Government-Issued ID: Scanned or photographed copy of Indonesian ID card (KTP) or passport showing full name, date of birth, photograph, and document number
• Proof of Address: Utility bill, bank statement, or government correspondence confirming residential address (required for certain verification levels)
• Selfie Verification: Photograph of you holding your ID document for facial comparison (used in enhanced security scenarios)

2.3 Financial & Transaction Data

To process deposits, withdrawals, and maintain transaction records, we collect:

• Payment Method Details: Bank account numbers (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata), e-wallet account identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja)
• Transaction History: Deposit amounts, timestamps, payment method used, withdrawal requests, processing status
• Bonus & Promotional Data: Bonuses claimed, wagering progress, promotional code usage

Important Security Note: We do not store full credit card numbers, CVV codes, or complete bank account passwords. Payment processing is handled through certified secure payment gateways that maintain PCI-DSS compliance.

2.4 Betting & Gaming Activity Data

To provide gaming services, settle bets, and detect suspicious activity, we collect:

• Bet History: All bets placed including sport/game type, stake amount, odds, bet time, settlement result
• Game Session Data: Login times, logout times, games played, session duration, game outcomes
• Balance Activity: Real-time account balance, bonus balance, pending withdrawals

2.5 Technical & Device Information

When you access hptoto, we automatically collect:

• Device Information: Device type (desktop/mobile), operating system (Windows, macOS, iOS, Android), browser type and version, screen resolution
• Network Information: IP address, internet service provider (ISP), approximate geographic location (city/region level, not precise GPS coordinates)
• Access Logs: Pages visited, timestamps, referring URLs, clickstream data
• Cookies & Tracking Technologies: Session cookies, persistent cookies, local storage data (see Section 8 for details)

2.6 Communications & Customer Support Data

When you contact our customer support team or communicate with us, we collect:

• Support Tickets: Your inquiry, our responses, chat transcripts, support ticket metadata
• Email Correspondence: Emails sent to and received from hptoto customer support or administrative addresses
• Phone/WhatsApp Records: Call recordings (with prior notice), WhatsApp message logs for quality assurance and training purposes

3. How We Use Your Data

hptoto uses your personal information for the following purposes, each of which has a lawful basis under applicable data protection laws:

3.1 Service Provision & Account Management

We use your data to create and maintain your account, process your transactions, settle your bets, and deliver the core gambling services you requested. This includes:

• Authenticating your identity when you log in
• Processing deposits from BCA, BRI, BNI, Mandiri, and e-wallets
• Executing withdrawal requests to your registered bank account or e-wallet
• Displaying your account balance, betting history, and transaction records
• Calculating winnings and applying bonus terms

Legal Basis: Contract performance – this processing is necessary to fulfill our contractual obligations to you as outlined in our Terms & Conditions.

3.2 Legal & Regulatory Compliance

We process your data to comply with legal obligations including:

• Age Verification: Confirming you are 21 years or older through KYC document review
• Anti-Money Laundering (AML): Monitoring transactions for suspicious patterns, reporting to financial authorities as required
• Know Your Customer (KYC): Verifying your identity to prevent fraud and account abuse
• Responsible Gaming Compliance: Implementing deposit limits, self-exclusion, and identifying problem gambling patterns
• Tax Reporting: Maintaining records for tax authorities where required by law

Legal Basis: Legal obligation – we are required by law to perform these checks and maintain these records.

3.3 Fraud Prevention & Security

To protect you, other players, and hptoto from fraud and abuse, we use your data to:

• Detect multi-accounting (multiple accounts created by one person)
• Identify bonus abuse, collusion, and arbitrage betting
• Monitor for unauthorized account access and suspicious login patterns
• Block access from restricted jurisdictions or known VPN/proxy services used for fraud
• Maintain blacklists of banned users who violated our Terms & Conditions

Legal Basis: Legitimate interests – we have a legitimate interest in protecting our platform, other users, and our business from fraudulent activity, which we balance against your privacy rights.

3.4 Customer Support & Communication

We use your contact information and communication history to:

• Respond to your inquiries via live chat, email, or WhatsApp
• Send transactional notifications (deposit confirmations, withdrawal status updates, bet settlements)
• Provide account-related alerts (password changes, suspicious login attempts, KYC verification status)
• Deliver important service announcements (scheduled maintenance, policy updates)

Legal Basis: Contract performance and legitimate interests – these communications are necessary to provide our services and keep you informed about your account.

3.5 Marketing & Promotions (With Your Consent)

If you have opted in to receive marketing communications, we may use your email address and phone number to send:

• Promotional offers and bonus announcements
• Newsletter updates about new games and features
• Personalized betting tips and recommendations based on your playing history
• VIP program updates and exclusive offers

Legal Basis: Consent – you can withdraw your consent and unsubscribe from marketing communications at any time via the unsubscribe link in emails or by contacting customer support.

3.6 Platform Improvement & Analytics

We analyze aggregated and anonymized data to:

• Understand how players use our platform and which features are most popular
• Optimize website performance, loading speeds, and mobile responsiveness
• Identify and fix technical bugs or user experience issues
• Develop new features and game offerings aligned with player preferences

Legal Basis: Legitimate interests – we have a legitimate interest in improving our services and user experience.

4. Data Sharing & Disclosure

hptoto does not sell, rent, or trade your personal information to third parties for their marketing purposes. We share your data only in the following limited circumstances:

4.1 Payment Service Providers

We share necessary financial information with certified payment processors and gateways that facilitate deposits and withdrawals through Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja). These providers are contractually obligated to handle your data securely and use it only for transaction processing purposes. They maintain PCI-DSS compliance and are subject to strict confidentiality obligations.

4.2 Gaming & Software Providers

Game outcomes and certain gameplay data are processed by third-party gaming software providers such as Pragmatic Play, Evolution Gaming, NetEnt, and others whose games appear on our platform. These providers receive limited data necessary for game operation (user ID, bet amount, game session data) but do not receive your personal identification information. All providers maintain relevant gaming licenses and comply with industry data protection standards.

4.3 Identity Verification Services

To verify your identity during KYC processes, we may share your government-issued ID documents and personal information with specialized identity verification service providers who use automated systems to confirm document authenticity and match facial features. These services are GDPR-compliant and delete your data after verification is complete unless required by law to retain it longer.

4.4 Legal & Regulatory Authorities

We may disclose your personal information to law enforcement, regulatory agencies, or government authorities when:

• Required by law, court order, subpoena, or other legal process
• Necessary to comply with anti-money laundering (AML) reporting obligations
• Necessary to protect the safety, rights, or property of hptoto, our users, or the public
• Necessary to detect, prevent, or investigate fraud, security breaches, or illegal activity

4.5 Business Transfers

In the event hptoto undergoes a merger, acquisition, sale of assets, or bankruptcy proceedings, your personal information may be transferred to the acquiring entity as part of the business transaction. You will be notified via email and/or prominent notice on our website of any such change in ownership or control of your personal information.

4.6 Service Providers & Contractors

We engage trusted third-party service providers to perform specific functions on our behalf including cloud hosting infrastructure, customer support platforms, email delivery services, analytics tools, and cybersecurity services. These service providers have access only to the personal information necessary to perform their functions and are contractually prohibited from using it for any other purpose. We carefully vet all service providers for security and data protection compliance.

5. Data Security Measures

hptoto implements comprehensive technical and organizational security measures to protect your personal information from unauthorized access, disclosure, alteration, or destruction:

5.1 Technical Security Controls

• 256-bit SSL/TLS Encryption: All data transmitted between your device and our servers is encrypted using bank-level SSL/TLS protocols, the same standard used by major financial institutions.
• Encrypted Data Storage: Sensitive personal information including passwords, ID documents, and payment details are encrypted at rest using AES-256 encryption.
• Password Security: User passwords are hashed using bcrypt or similar one-way cryptographic hash functions, making them unreadable even to our staff.
• Firewall Protection: Multi-layered firewall systems protect our servers from external threats and unauthorized access attempts.
• DDoS Mitigation: Advanced distributed denial-of-service attack protection ensures platform availability.
• Intrusion Detection Systems (IDS): Real-time monitoring systems detect and alert our security team to suspicious network activity.

5.2 Access Controls & Authentication

• Multi-Factor Authentication (MFA): Available for enhanced account security through email or SMS verification codes
• Role-Based Access Control: Internal staff access to personal data is strictly limited based on job function and necessity
• Access Logging: All access to personal data by staff is logged and regularly audited
• Secure Authentication: Login attempts are monitored for brute-force attacks and suspicious patterns

5.3 Organizational Security Measures

• Staff Training: All employees with access to personal data receive regular training on data protection, confidentiality, and security best practices
• Confidentiality Agreements: Employees and contractors sign strict non-disclosure agreements
• Regular Security Audits: Independent third-party security firms conduct penetration testing and vulnerability assessments
• Incident Response Plan: Documented procedures for detecting, responding to, and recovering from data breaches
• Backup & Disaster Recovery: Regular encrypted backups stored in geographically distributed data centers

5.4 Your Role in Security

While we implement extensive security measures, you also play a critical role in protecting your account:

• Use a strong, unique password and never share it with anyone
• Log out after each session, especially on shared or public devices
• Enable multi-factor authentication for enhanced protection
• Be cautious of phishing emails claiming to be from hptoto – we will never ask for your password via email
• Immediately report any unauthorized account activity to customer support

6. Data Retention Periods

hptoto retains your personal information only for as long as necessary to fulfill the purposes described in this Privacy Policy, comply with legal obligations, and resolve disputes. Specific retention periods include:

6.1 Active Account Data

While your account remains active, we retain all account information, transaction history, and betting records to provide ongoing service and maintain accurate account balances.

6.2 Closed Account Data

After voluntary account closure, we retain:

• Financial Records: 7 years (required by anti-money laundering regulations and tax laws)
• KYC Documents: 5 years after account closure (regulatory requirement)
• Betting History: 5 years (required for dispute resolution and auditing purposes)
• Support Communications: 3 years (for quality assurance and training)

6.3 Suspended or Terminated Accounts

For accounts terminated due to Terms & Conditions violations, we may retain data indefinitely to prevent re-registration by banned users and protect platform integrity.

6.4 Marketing Data

If you unsubscribe from marketing communications, we immediately stop sending promotional emails but retain a record of your email address in our suppression list to ensure we don't accidentally contact you again.

6.5 Anonymization & Aggregation

After retention periods expire, we either securely delete your personal data or anonymize it (remove all identifying information) so it can be retained indefinitely for statistical analysis and platform improvement without privacy implications.

7. Your Privacy Rights

Under applicable data protection laws, you have the following rights regarding your personal information. To exercise these rights, please contact our Data Protection team using the contact information in Section 11.

7.1 Right of Access

You have the right to request a copy of the personal information we hold about you. We will provide this information in a commonly used electronic format within 30 days of your request. Your first copy is free; we may charge a reasonable administrative fee for additional copies.

7.2 Right to Rectification

If you believe any personal information we hold about you is inaccurate or incomplete, you have the right to request correction. You can update most information directly through your account settings, or contact customer support for assistance.

7.3 Right to Erasure ("Right to be Forgotten")

You may request deletion of your personal information in certain circumstances, such as when the data is no longer necessary for the purposes it was collected or if you withdraw consent for processing based on consent. However, we may be legally required to retain certain data (financial records, KYC documents) even after you request deletion.

7.4 Right to Restriction of Processing

You can request that we limit how we use your personal information in specific situations, such as when you contest the accuracy of your data or object to processing based on legitimate interests while we investigate your objection.

7.5 Right to Data Portability

You have the right to receive your personal information in a structured, commonly used, machine-readable format and transmit it to another service provider where technically feasible.

7.6 Right to Object

You have the right to object to processing of your personal information based on our legitimate interests. If you object, we will stop processing unless we can demonstrate compelling legitimate grounds that override your interests.

7.7 Right to Withdraw Consent

Where we process your data based on consent (such as marketing communications), you can withdraw your consent at any time by unsubscribing from emails, adjusting your account preferences, or contacting customer support.

7.8 Right to Lodge a Complaint

If you believe we have violated your privacy rights or applicable data protection laws, you have the right to lodge a complaint with the relevant data protection authority in your jurisdiction.

8. Cookies & Tracking Technologies

hptoto uses cookies, web beacons, and similar tracking technologies to enhance your user experience, maintain session state, and analyze platform usage.

8.1 What Are Cookies?

Cookies are small text files placed on your device by websites you visit. They allow the website to recognize your device and remember information about your visit, such as your login session and preferences.

8.2 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for site functionality including login authentication, session management, and security features. These cannot be disabled without breaking core site functionality.
• Performance Cookies: Collect anonymous information about how visitors use our site, which pages are visited most, and error messages. This helps us improve site performance.
• Functionality Cookies: Remember your preferences such as language selection, display settings, and previously viewed games to personalize your experience.
• Advertising Cookies: Track your browsing activity to deliver relevant promotional content. You can opt out of these cookies through your browser settings or account preferences.

8.3 Managing Cookies

Most browsers allow you to control cookies through their settings. You can:

• Block all cookies
• Accept cookies only from specific websites
• Delete cookies after your browsing session
• Get notified before cookies are set

Note that blocking essential cookies will prevent you from using certain features of hptoto, including logging in and placing bets.

8.4 Third-Party Tracking

We use Google Analytics and similar services to analyze traffic and user behavior on our platform. These services use cookies and collect data such as IP addresses, browser types, and pages visited. This data is anonymized and aggregated. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

9. Children's Privacy

hptoto strictly prohibits use of our services by anyone under the age of 21. We do not knowingly collect personal information from minors. Our age verification processes including mandatory KYC identity checks are designed to prevent underage gambling.

If we become aware that a user is under 21 years of age, we will immediately:

• Permanently suspend the account
• Delete all personal information associated with the account
• Refund any deposited funds to the source account
• Void all bets and forfeit any winnings (in accordance with our Terms & Conditions)

If you believe a minor has registered an account on hptoto, please contact us immediately at [email protected] with relevant details so we can investigate and take appropriate action.

10. Changes to This Privacy Policy

hptoto reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or business operations. When we make material changes, we will:

• Update the "Last Updated" date at the top of this policy
• Notify you via email to your registered email address at least 7 days before the changes take effect
• Display a prominent notice on our website homepage and in your account dashboard

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information. Your continued use of hptoto services after changes become effective constitutes acceptance of the updated Privacy Policy.

If you do not agree with any changes to this Privacy Policy, you should cease using our services and request account closure before the effective date of the changes.

11. Contact Information & Data Protection Officer

If you have questions, concerns, or requests regarding this Privacy Policy or how we handle your personal information, please contact us:

• General Privacy Inquiries: [email protected]
• Data Protection Officer: [email protected]
• Customer Support (24/7): [email protected] or live chat on our website
• Response Time: We aim to respond to privacy inquiries within 48 hours and formal data subject requests within 30 calendar days

When contacting us about privacy matters, please include:

• Your full name and registered email address
• A clear description of your inquiry or request
• Proof of identity (to protect your information from unauthorized access)
• Specific details if exercising privacy rights (e.g., which data you want to access or delete)