Data Protection
extoto is committed to protecting your personal information. This Privacy Policy explains how we collect, use, store, and safeguard your data in compliance with Indonesia's data protection standards.
Your Privacy Matters: extoto respects your right to privacy and handles your personal data with the highest standards of care. This Privacy Policy should be read in conjunction with our Terms & Conditions. By using the extoto platform, you acknowledge that you have read and understood this Privacy Policy.
This Privacy Policy applies to all personal data collected by extoto through the extoto.cam website, mobile applications, and any related services (collectively, "the Platform"). extoto operates as an online betting and gaming platform serving Indonesian residents and is committed to transparent data handling practices that comply with applicable Indonesian data protection regulations, including the Personal Data Protection Law and relevant implementing regulations.
We collect and process personal data only to the extent necessary to provide our services, ensure platform security, comply with legal and regulatory obligations, and improve user experience. This Privacy Policy explains what data we collect, why we collect it, how we use it, who we share it with, and what rights you have regarding your personal information.
If you have any questions about this Privacy Policy or our data handling practices, please contact our Data Protection team using the contact details provided at the end of this document.
For the purposes of data protection law, extoto is the data controller responsible for the personal data you provide to us through the Platform. extoto determines the purposes and means of processing your personal data and is accountable for ensuring that processing complies with applicable data protection laws.
As the data controller, extoto is responsible for responding to your requests regarding access, correction, deletion, or portability of your personal data. All such requests should be directed to our Data Protection contact at: [email protected]
extoto collects several categories of personal data to operate the Platform, provide services, and fulfill legal obligations. The specific data we collect depends on how you interact with the Platform.
When you create an account on the extoto platform, we collect:
To comply with Know Your Customer (KYC) and anti-money-laundering regulations, we collect:
When you deposit or withdraw funds, we collect:
To provide gaming services and detect fraud or abuse, we collect:
When you access the Platform, we automatically collect:
When you contact our customer support team, we collect:
extoto processes your personal data for specific, legitimate purposes. We do not use your data for purposes beyond those described below without obtaining your additional consent.
| Purpose | Description |
|---|---|
| Account Management | Creating, maintaining, and administering your extoto account; authenticating your identity when you log in; enabling account recovery. |
| Service Delivery | Processing your bets, managing your account balance, calculating winnings, applying bonuses, enforcing wagering requirements, and delivering all gaming services. |
| Payment Processing | Processing deposits and withdrawals; verifying payment methods; preventing fraudulent transactions; complying with financial regulations. |
| Identity Verification (KYC/AML) | Verifying your age (21+ requirement); confirming your identity and residency; complying with anti-money-laundering and counter-terrorist-financing obligations; preventing duplicate accounts. |
| Fraud Prevention & Platform Security | Detecting and preventing fraud, collusion, bonus abuse, account takeover, and other prohibited activities; investigating suspicious transactions; enforcing our Terms & Conditions. |
| Responsible Gaming | Administering deposit limits, loss limits, session timers, and self-exclusion settings; identifying patterns of problem gambling; providing support resources. |
| Customer Support | Responding to your inquiries, complaints, and support requests; resolving disputes; improving support quality through training and evaluation. |
| Legal Compliance | Complying with applicable laws, regulations, and regulatory directives; responding to lawful requests from government authorities; maintaining records required by law. |
| Platform Improvement | Analyzing usage patterns to improve user experience; identifying technical issues; optimizing platform performance; developing new features. |
| Marketing & Promotions | Sending promotional offers, bonus notifications, and platform updates (only with your consent, which can be withdrawn at any time). |
extoto processes your personal data on one or more of the following legal bases:
extoto does not sell, rent, or trade your personal data to third parties for their marketing purposes. We share your data only in the limited circumstances described below:
We share transaction data with Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) to process deposits and withdrawals. These providers process data in accordance with their own privacy policies and applicable financial regulations.
We share limited technical and session data with licensed game studios (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming) to deliver casino games, slots, and live dealer experiences. These providers do not receive your identity verification documents or financial account details.
We may share identity verification documents with specialized KYC service providers who assist with document verification, age confirmation, and fraud screening. These providers are bound by strict confidentiality agreements and data protection obligations.
We disclose personal data to Indonesian government authorities, financial crime agencies, or international regulators when required by law, court order, or regulatory directive. This includes tax authorities, anti-money-laundering agencies, and licensing bodies.
In the event of a merger, acquisition, reorganization, or sale of assets, your personal data may be transferred to the acquiring entity, subject to this Privacy Policy and applicable data protection law. You will be notified of any such transfer.
Third-Party Links: The extoto platform may contain links to external websites operated by third parties (e.g., payment processors, support resources). extoto is not responsible for the privacy practices of these third-party sites. We encourage you to review their privacy policies before providing any personal data.
extoto implements comprehensive technical and organizational measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. Our security measures include:
While extoto employs robust security measures, no system is entirely immune to risk. You are responsible for maintaining the confidentiality of your account credentials and for notifying us immediately if you suspect unauthorized access to your account.
extoto retains your personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with legal and regulatory obligations, and resolve disputes. Specific retention periods are as follows:
After the applicable retention period expires, personal data is securely deleted or anonymized such that it can no longer be associated with an identifiable individual.
Under Indonesian data protection law, you have the following rights regarding your personal data. To exercise any of these rights, please contact us using the details in Section 14.
You have the right to request confirmation of whether extoto processes your personal data and to obtain a copy of that data. We will provide this information in a commonly used electronic format within 30 days of your request.
If your personal data is inaccurate or incomplete, you have the right to request correction. You can update most account information directly through your extoto account dashboard. For KYC data corrections, please contact support with updated documentation.
You may request deletion of your personal data where: (a) it is no longer necessary for the purposes for which it was collected; (b) you withdraw consent and there is no other legal basis for processing; (c) you object to processing and there are no overriding legitimate grounds; or (d) the data was unlawfully processed. This right is subject to extoto's legal obligations to retain certain data (see Section 8).
You may request that extoto limit the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or object to processing. During the restriction period, extoto will store the data but not process it except with your consent or for legal claims.
Where processing is based on your consent or contract performance and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller.
You have the right to object to processing of your personal data where extoto relies on legitimate interests as the legal basis. extoto will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is necessary for legal claims.
Where processing is based on your consent (e.g., marketing communications), you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted before withdrawal.
If you believe extoto has violated your data protection rights, you have the right to lodge a complaint with the relevant Indonesian data protection supervisory authority.
extoto uses cookies and similar tracking technologies to enhance user experience, analyze platform usage, and deliver personalized content. A cookie is a small text file stored on your device that allows us to recognize your browser and remember certain information.
You can manage cookie preferences through your browser settings. Most browsers allow you to block or delete cookies. However, disabling essential cookies will impair platform functionality and may prevent you from accessing certain features. For more information on cookie management, consult your browser's help documentation.
extoto's primary data processing infrastructure is located within data centers that serve the Indonesian market. However, some of our service providers (such as cloud hosting providers, game studios, and payment processors) may process data in jurisdictions outside Indonesia.
Where personal data is transferred internationally, extoto ensures that appropriate safeguards are in place, including standard contractual clauses, data processing agreements, and reliance on providers certified under recognized data protection frameworks. These safeguards ensure that your personal data receives a level of protection consistent with Indonesian data protection standards.
The extoto platform is strictly restricted to individuals aged 21 years or older. extoto does not knowingly collect, process, or retain personal data from individuals under the age of 21. If we become aware that personal data has been collected from an individual under 21, we will take immediate steps to delete that data and permanently close the associated account.
Parents or guardians who believe their child has provided personal data to extoto should contact us immediately at [email protected]. We will investigate and take appropriate action, including reporting suspected underage gambling to relevant authorities as required by law.
Age Verification: extoto employs robust age verification measures including KYC checks using Indonesian national identity cards (KTP). Attempting to circumvent age verification or providing false identity information is a serious violation and will result in permanent account closure and forfeiture of all funds.
extoto reserves the right to update this Privacy Policy from time to time to reflect changes in our data handling practices, legal obligations, or platform features. Material changes will be communicated to registered users via email and a prominent notice on the extoto platform no less than 14 days before the changes take effect.
The version number and effective date at the top of this document identify the current version. We encourage you to review this Privacy Policy periodically to stay informed of how we protect your personal data. Your continued use of the Platform after the effective date of an updated Privacy Policy constitutes your acceptance of the changes.
If you have questions, concerns, or requests regarding this Privacy Policy or extoto's data handling practices, please contact our Data Protection team:
For formal data subject requests (access, rectification, erasure, portability), please submit your request via email with "Data Subject Request" in the subject line. Include your registered username, email address, and a clear description of your request. We will acknowledge receipt within 3 business days and respond substantively within 30 days.
If you are not satisfied with our response to a privacy-related complaint, you have the right to escalate the matter to the Indonesian data protection supervisory authority.
extoto implements multiple layers of protection to safeguard your personal data at every stage of collection, storage, and processing.
All data transmitted between your device and extoto servers is protected by 256-bit SSL/TLS encryption — the same standard used by major Indonesian banks for online banking.
Personal data is stored in secure, access-controlled data centers with physical security, 24/7 monitoring, and redundant backup systems to prevent data loss.
Your personal data is accessible only to authorized extoto staff who require access to perform their duties. All access is logged and audited for compliance.
extoto will never sell, rent, or trade your personal information to third parties for marketing purposes. Your data is used solely to provide our services and comply with legal obligations.
We retain personal data only as long as legally required (typically 7 years for financial records), then securely delete or anonymize it in accordance with data protection best practices.
You have the right to access, correct, delete, or export your personal data at any time. We respond to all data subject requests within 30 days as required by Indonesian law.
Our Data Protection team is available 24/7 to answer any questions about how we handle your personal information. You can also review our full Terms & Conditions for additional platform policies.