bamtoto Privacy Policy

This page describes what we collect when you use bamtoto and how we keep that data protected. Account setup requires your email, identity documents for KYC, and payment details—those form the foundation of your account relationship with us. We explain below where that information flows, who can access it, and what rights you hold over your own data.

Our data practices are shaped by our regional licensing obligations and the need to serve users across supported jurisdictions in Indonesia. We operate our systems from data centres that may sit outside your home region, and we work with payment processors, identity verification services, and customer support platforms to deliver the bamtoto experience. Understanding these flows and your options is the purpose of this policy.

We take your privacy seriously not because regulation demands it, but because account holders trust us with their financial details, gaming history, and personal documents. That trust is irreplaceable, and we've structured our data handling to reflect it.

What We Collect and Why

We collect your email address at account opening. We also collect your full name, date of birth, national ID number, and a photograph of your ID document (or passport) as part of KYC verification—this is a legal requirement under the licensing framework that governs bamtoto. We store your phone number, residential address, and payment method details (account numbers for DANA, e-wallet, mobile banking, or bank virtual accounts). We record your account activity—the bets you place on Liga 1 or Piala AFF fixtures, the slots sessions you start, the live-dealer tables you join—and the balance movements resulting from deposits, withdrawals, and settlement. We also collect your IP address, browser type, and device information when you access our platform.

How We Use Your Data

We use your email and payment details to process deposits and withdrawals. When you fund your bamtoto account via local payment or a online payment virtual account, we send your transaction details to our payment processor to execute the transfer and confirm receipt. We use your name, ID, and address to verify your identity—this typically completes within one business day. We use your gaming activity to detect unusual patterns (sudden large bets, rapid successive transactions) that may signal account compromise or fraud; our team in Jakarta and Bandung reviews flagged accounts and contacts you if intervention is needed. We use your IP address and device information to prevent account takeovers and to detect if your account is being accessed from outside supported jurisdictions. We also use aggregated, anonymised activity data to improve platform performance—for example, measuring which payment methods are fastest or which game categories draw the most interest.

Third-Party Data Processors

Our payment flows pass through external processors: for e-wallets like e-wallet and mobile banking, we route your transaction details through the wallet provider's API; for bank transfers and virtual accounts, we work with local payment, online payment, e-wallet, and mobile banking to confirm your deposit and set up your unique account reference. We use a third-party KYC service to validate your identity documents. Our customer support platform (chat, email, and ticket system) is hosted on external infrastructure. These third parties operate under data-processing agreements with us that require them to protect your data and use it only for the specified service. We do not control how third parties store or retain data beyond the terms of those agreements, though we audit them regularly.

Cookies and Tracking

We use cookies to keep you logged into your bamtoto account across sessions and to remember your language preference (en-ID). We also use analytics cookies to track page performance and user behaviour in aggregate. These cookies are not used to identify you personally or to build a profile for advertising purposes. You can disable cookies in your browser settings; however, disabling them will impair your ability to use bamtoto.

Your Rights and Data Contact

You have the right to request a copy of the personal data we hold about you. You can contact our data team in Jakarta, Surabaya, or Medan via the support channels listed below, and we will provide a copy of your data in a portable format within 30 days. You have the right to correct inaccurate data—for example, if your address is outdated, you can update it in your account settings or request correction from support. You have the right to request deletion of your data once your account is closed and any financial obligations are settled. We may retain certain data for longer periods if required by regulatory compliance or to defend against legal claims.

Data breaches are rare, but we undertake to notify you within 72 hours of discovering unauthorised access to your account or our systems. We also maintain cyber insurance and conduct annual security audits. If you believe your account has been compromised, contact our support team immediately; we can reset your password, review your transaction history, and suspend activity if needed.

Our data protection officer and legal team are reachable at [email protected]For account-specific data questions or requests to access, correct, or delete your information, reach out to our customer support team in Jakarta, Bandung, or Surabaya during extended hours around major holidays such as Idul Fitri and Idul Adha. We aim to respond to all data requests within 10 business days.

Data Retention and Jurisdiction

We retain your account data, identity documents, and transaction history for as long as your account is active and for a minimum of five years after closure to comply with anti-money-laundering regulations. Some data (IP logs, analytics) may be purged sooner. Our servers are located outside Indonesia, though we maintain backup systems across multiple regions. This means your data may be transferred to and processed in jurisdictions outside your home region. By using bamtoto, you consent to this cross-border data processing. If you do not consent, you should not open an account or should request account closure and data deletion once your account balance is zero.