Privacy Policy

1.1 Who We Are. s8toto is an internationally operated online betting and gaming platform accessible at s8toto.cam. For the purposes of this Privacy Policy, "s8toto", "we", "us", and "our" refer to the operating entity that controls the processing of personal data collected through the Platform.

1.2 Scope. This Policy applies to all personal data collected when you: visit or browse the s8toto website; create and operate a Player Account; make deposits or withdrawals using payment methods such as BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, or LinkAja; participate in games including sports betting, live dealer games, slots, and togel (Indonesia's traditional numbers lottery); contact our customer support team; or interact with any promotional offer.

1.3 Policy Document. This document constitutes the complete and operative Privacy Policy of s8toto. Any previous version of this Policy is superseded. The "Last Updated" date at the top of this page reflects the most recent substantive revision.

2.1 Categories of Personal Data. The following table sets out the categories of personal data s8toto may collect and process:

2.2 Special Category Data. We do not intentionally collect special category data (such as health information, religious beliefs, or political opinions). If you voluntarily disclose such information through a support interaction — for example when requesting self-exclusion on health grounds — we will treat that information with heightened confidentiality and will not use it for any purpose other than fulfilling your request.

3.1 Directly From You. The majority of data we hold is provided directly by you when you: complete the registration form; submit KYC documentation; make a deposit or withdrawal request; communicate with our support team; or update your Account preferences.

3.2 Automatically. When you access the Platform, our servers automatically log Technical Data and Usage Data. This collection is necessary for the Platform to function, for security monitoring, and for fraud prevention. Automated data collection uses server logs, session tracking, and first-party cookies (see Section 5).

3.3 From Third Parties. We may receive data about you from: (a) identity verification partners who assist us in authenticating KYC documents; (b) payment processors that confirm the completion or failure of financial transactions; (c) fraud prevention services that provide risk scores based on technical signals; and (d) our licensing authority where required for compliance purposes.

4.1 Contract Performance. We process Identity Data, Contact Data, Financial Data, Account Data, and Gaming Data because it is necessary to perform our contract with you — specifically, to operate your Account, accept and settle wagers, process deposits and withdrawals, and provide customer support.

4.2 Legal Obli gation. We process certain data categories — particularly Identity Data, Financial Data, and transaction records — because we are legally required to do so for anti-money laundering (AML) compliance, know-your-customer (KYC) obligations, and fraud prevention under the requirements of our international gaming licence.

4.3 Legitimate Interests. We process Technical Data and Usage Data on the basis of our legitimate interests in: maintaining the security and integrity of the Platform; detecting and preventing fraud, collusion, and bonus abuse; improving the performance and user experience of our services; and conducting internal analytics to understand how Players use the Platform. We balance these interests against your privacy rights and do not use this data for unsolicited marketing.

4.4 Consent. Where we send you optional promotional communications (such as bonus notifications or seasonal offers related to events like Idul Fitri or Indonesian Independence Day), we do so only where you have opted in. You may withdraw consent at any time by contacting support or updating your communication preferences in your Account settings.

4.5 Vital Interests. In exceptional circumstances, we may process personal data to protect your vital interests — for example, if you contact us in a crisis situation and we need to refer you to appropriate support services in connection with problem gambling.

5.1 What Are Cookies. Cookies are small text files placed on your device when you visit a website. s8toto uses first-party cookies only — we do not deploy third-party advertising cookies or cross-site tracking technologies.

5.2 Types of Cookies We Use.

5.3 Managing Cookies. You can control or delete cookies through your browser settings at any time. Note that disabling strictly necessary cookies will impair the functionality of the Platform — for example, you will not be able to stay logged in between pages. Functional and analytics cookies can be disabled without preventing basic access to the Platform.

6.1 Payment Processors. To facilitate deposits and withdrawals, we share the minimum necessary financial data (your account name and transaction reference) with the relevant payment provider — which may include BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, OVO, DANA, GoPay, ShopeePay, or LinkAja. These providers process your data under their own privacy policies and are contractually bound to use it solely for transaction processing.

6.2 KYC & Fraud Prevention Partners. We engage reputable third-party identity verification and fraud prevention providers. These partners receive only the data required to perform their specific function — for example, verifying that a submitted KTP scan is authentic or that a deposit source is consistent with your registered payment method.

6.3 Legal Authorities. We may disclose personal data to regulatory bodies, law enforcement agencies, or courts of competent jurisdiction where we are legally compelled to do so — for example, in response to a court order, a formal regulatory investigation, or an anti-money laundering inquiry.

6.4 Business Transfers. In the event of a merger, acquisition, or sale of the Platform, your personal data may be transferred as part of the business assets. You will be notified via email and via a prominent notice on the Platform at least 14 days before any such transfer takes effect, and you will retain the right to request deletion of your data prior to the transfer.

6.5 Aggregated & Anonymised Data. We may share anonymised, aggregated data (such as overall player activity statistics, or aggregate deposit volumes by payment channel) with business partners or for research purposes. This data cannot be used to identify any individual Player.

7.1 Cross-Border Processing. s8toto operates internationally, and your personal data may be processed on servers located outside of Indonesia. When your data is transferred to a jurisdiction that does not have data protection laws equivalent to those in your country of residence, we implement appropriate safeguards to ensure your data remains protected.

7.2 Safeguards. Appropriate safeguards may include: standard contractual clauses approved by a recognised data protection authority; data processing agreements that impose obligations on recipients equivalent to those applicable to us; or transfers to recipients in jurisdictions that have been assessed as providing an adequate level of protection.

7.3 Payment Channel Transfers. When you use a local Indonesian payment channel such as OVO, DANA, or GoPay, transaction data is processed by that provider within Indonesia. When you use a bank transfer via BCA, BRI, BNI, or Mandiri, data is processed in accordance with Bank Indonesia's applicable regulations and each bank's own privacy policy.

8.1 Retention Principle. We retain personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. When data is no longer needed, it is securely deleted or anonymised.

8.2 Retention Periods by Category.

8.3 Early Deletion. You may request early deletion of certain data categories (see Section 9.4). Where deletion is not possible due to a legal obligation to retain data, we will inform you of the specific legal basis and the earliest date on which deletion can occur.

As a Player on s8toto, you hold the following rights with respect to the personal data we process about you. To exercise any of these rights, please contact our Data Support team via the email address listed in Section 13. We will respond to verified requests within 30 calendar days.

• Right of Access (9.1) — You may request a copy of all personal data we hold about you, along with information about how it is used and with whom it is shared. We will provide this in a clear, structured format at no charge.
• Right to Rectification (9.2) — If any data we hold about you is inaccurate or incomplete, you have the right to request correction. Please note that changes to core identity data (name, date of birth) may require supporting documentation.
• Right to Erasure (9.3) — Also known as the "right to be forgotten", you may request deletion of your personal data where it is no longer necessary for the purpose it was collected, where you withdraw consent (and no other legal basis applies), or where it has been unlawfully processed. This right is subject to our legal retention obligations under AML law.
• Right to Restrict Processing (9.4) — You may ask us to pause the processing of your data while you contest its accuracy, while you object to our legitimate interests assessment, or while you await the outcome of an erasure request.
• Right to Data Portability (9.5) — You may request a machine-readable export of the personal data you have provided to us directly (such as Account Data and transaction history), in a commonly used format such as CSV or JSON.
• Right to Object (9.6) — You may object to the processing of your data where we rely on legitimate interests as our legal basis. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent (9.7) — Where processing is based on your consent (such as receiving promotional emails), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

10.1 Age Restriction. The s8toto Platform is strictly for adults aged 21 and above. We do not knowingly collect personal data from individuals under the age of 21. Registration is not permitted for minors, and our age verification process is designed to identify and reject underage applicants.

10.2 Inadvertent Collection. If we become aware that we have inadvertently collected personal data from a person under 21 years of age, we will immediately suspend the associated Account, delete the data without delay, and refund any deposits made, subject to identity verification of the parent or guardian.

10.3 Parental Guidance. We strongly encourage parents and guardians in Indonesia to make use of parental control tools available through their internet service provider or device manufacturer to prevent minors from accessing online gambling sites. If you believe a minor in your household has registered on s8toto, please contact our support team immediately.

11.1 Technical Safeguards. s8toto implements a comprehensive set of technical security measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include:

• 256-bit SSL/TLS encryption for all data in transit between your device and our servers.
• AES-256 encryption for sensitive data at rest, including identity documents and financial records.
• Role-based access controls (RBAC) ensuring that only authorised personnel can access specific data categories — for example, only our compliance team can access KYC documents.
• Multi-factor authentication (MFA) required for all administrative access to systems holding personal data.
• Regular third-party penetration testing and vulnerability assessments of our infrastructure.
• Automated intrusion detection and real-time alerting for anomalous access patterns.

11.2 Organisational Safeguards. In addition to technical controls, s8toto maintains organisational safeguards including: staff data protection training, data minimisation policies, a documented incident response plan, and contractual obligations binding all third-party processors to equivalent security standards.

11.3 Breach Notification. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, s8toto will notify affected Players without undue delay and within 72 hours of becoming aware of the breach. Notification will include the nature of the breach, the categories of data affected, the likely consequences, and the steps we have taken to mitigate harm.

12.1 Right to Amend. s8toto reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or operational structure. The "Last Updated" date at the top of this page will be revised accordingly.

12.2 Notification of Material Changes. Where we make material changes to this Policy — for example, adding a new category of data collected, changing the purposes for which data is used, or adding new third-party processors — we will notify registered Players via email at least seven (7) days before the changes take effect. We will also display a prominent notice on the Platform during this period.

12.3 Continued Use. Your continued use of the Platform after the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. If you do not agree with the revised terms, you should cease using the Platform and may request closure of your Account and deletion of your data (subject to our legal retention obligations).

13.1 Data Enquiries. For any questions about this Privacy Policy, to exercise your data rights, or to raise a concern about how your personal data is being handled, please contact our support team using the details below:

13.2 Complaints. If you believe s8toto has not handled your personal data in accordance with this Policy or applicable data protection law, you have the right to lodge a formal complaint. Please submit your complaint in writing via email with the subject line "Formal Privacy Complaint". We will acknowledge receipt within 48 hours and provide a substantive response within 14 business days.

13.3 Escalation. If you are not satisfied with our response to a formal complaint, you may escalate the matter to the relevant data protection authority or dispute resolution body designated by our licensing jurisdiction.