Your privacy is important to us. This Privacy Policy explains what personal data toto22 collects, how we use it, who we share it with, and what rights you have over your information.
Last updated: 1 January 2026toto22 ("we", "us", "our") operates the online betting platform accessible at https://toto22.lat. We are committed to protecting and respecting the privacy of all individuals who use our Services. This Privacy Policy explains how we collect, use, disclose, transfer, and store your personal information when you access our Platform, register an account, or place bets on any of our products including sports betting, live casino, togel (Indonesia's traditional numbers lottery), and slots.
By accessing or using toto22, you acknowledge that you have read, understood, and agreed to the data practices described in this Privacy Policy. If you do not agree with this Privacy Policy, you must not use our Services. This Privacy Policy should be read in conjunction with our Terms & Conditions, which govern your use of the Platform.
This Privacy Policy applies to all Members, visitors, and users of toto22 regardless of their location, but is particularly designed to comply with data protection standards applicable to users in Indonesia and the European Economic Area where relevant.
For the purposes of applicable data protection laws, the data controller responsible for your personal information is the entity that operates toto22. Questions regarding this Privacy Policy or any data protection matters should be directed to our Data Protection Officer via email at [email protected] (plain text – not a clickable link).
We act as the data controller when we determine the purposes and means of processing your personal data. In certain circumstances, we may act as a data processor when we process data on behalf of third-party game providers or payment processors; however, in such cases, those providers are the data controllers and their privacy policies will also apply.
toto22 collects several categories of personal data depending on how you interact with our Services. The data we collect includes:
When you create an account on toto22, we collect the following information:
To comply with legal obligations and prevent fraud, we collect identity verification documents as part of our Know Your Customer (KYC) process:
We process financial information necessary to handle deposits, withdrawals, and bet settlements:
toto22 does not store full credit card numbers, CVV codes, or complete bank login credentials. Payment processing is handled by certified third-party payment gateways using tokenization for security.
When you access toto22, we automatically collect technical information through your device and browser:
When you contact our customer support team via live chat, email, or other channels, we collect:
We collect data related to your marketing preferences and engagement:
Minimal Data Collection. toto22 collects only the personal data necessary to provide our Services, comply with legal obligations, and protect both you and the Platform from fraud. We do not collect sensitive data categories such as race, religion, political opinions, health information, or biometric data beyond what is strictly required for identity verification.
toto22 uses the personal data we collect for the following purposes:
You can opt out of marketing communications at any time through your Account settings or by clicking "unsubscribe" in any marketing email. Opting out of marketing does not affect transactional emails (deposit confirmations, withdrawal updates, account alerts).
Under applicable data protection laws, toto22 must have a lawful basis for processing your personal data. We rely on the following legal bases depending on the purpose of processing:
| Purpose | Legal Basis |
|---|---|
| Account creation and service delivery | Performance of contract (Terms & Conditions) |
| KYC verification and AML compliance | Legal obligation |
| Fraud prevention and security monitoring | Legitimate interests (protecting the Platform and users from fraud) |
| Marketing communications | Consent (opt-in) or legitimate interests (existing customers, soft opt-in) |
| Analytics and platform improvement | Legitimate interests (improving user experience) |
| Customer support | Performance of contract and legitimate interests |
Where we rely on legitimate interests, we have balanced our interests against your privacy rights and have determined that processing is necessary and proportionate. You have the right to object to processing based on legitimate interests (see Section 10).
toto22 does not sell or rent your personal data to third parties for commercial purposes. However, we do share your data with carefully selected third parties in the following circumstances:
We share data with third-party service providers who perform functions on our behalf:
All service providers are contractually bound to process your data only on our instructions and to maintain appropriate security measures.
We may disclose your data to law enforcement, regulators, courts, or government agencies when:
If toto22 undergoes a merger, acquisition, sale of assets, or bankruptcy, your personal data may be transferred to the successor entity. We will notify you of any such transfer and the privacy practices of the new entity.
toto22 may share aggregated, anonymised data (not personally identifiable) with affiliates and business partners for marketing and business development purposes. Individual personal data is never shared for these purposes without your explicit consent.
Third-Party Accountability. We carefully vet all third-party service providers and require them to sign data processing agreements that mandate GDPR-equivalent security standards. If a third party breaches their obligations, we take immediate action to protect your data and hold them accountable.
toto22 employs industry-standard technical and organisational measures to protect your personal data from unauthorised access, disclosure, alteration, or destruction:
You are responsible for maintaining the security of your account credentials. We recommend:
While we implement robust security measures, no system is completely secure. If a data breach occurs, we will notify affected users and relevant authorities in accordance with applicable data breach notification laws.
toto22 retains your personal data only for as long as necessary to fulfil the purposes for which it was collected or to comply with legal obligations:
| Data Category | Retention Period |
|---|---|
| Account registration data | Active account duration + 7 years after closure (AML requirement) |
| KYC documents (ID, proof of address) | 7 years after account closure (AML/CFT legal obligation) |
| Transaction and bet history | 7 years after transaction date (AML and tax reporting requirement) |
| Marketing consent and communications | Until consent withdrawn + 30 days for processing |
| Customer support records | 3 years after last interaction |
| Technical logs (IP, device data) | 90 days (fraud monitoring) or 13 months (analytics) |
| Closed/dormant account data | 7 years from closure (legal obligation) |
After the retention period expires, personal data is securely deleted or anonymised such that it can no longer identify you. Anonymised data may be retained indefinitely for statistical and business intelligence purposes.
toto22 uses cookies and similar tracking technologies to enhance your experience, analyse site usage, and deliver personalised content. A cookie is a small text file stored on your device that allows us to recognise you on return visits.
Some cookies are placed by third-party services we use, including:
These third parties have their own privacy policies governing how they use cookie data.
You can control cookies through your browser settings. Most browsers allow you to block or delete cookies, but doing so may limit your ability to use certain features of toto22. To manage cookies in popular browsers:
Under applicable data protection laws, you have the following rights regarding your personal data:
You have the right to request a copy of the personal data we hold about you. To exercise this right, contact [email protected] (plain text) with the subject line "Data Access Request". We will provide your data in a structured, commonly used, machine-readable format (typically PDF or CSV) within 30 days.
If your personal data is inaccurate or incomplete, you can request correction. You can update most information directly through your Account settings, or contact support for assistance.
You may request deletion of your personal data in certain circumstances:
However, we may be unable to delete your data if we have a legal obligation to retain it (e.g., AML compliance, tax reporting, or ongoing legal disputes).
You may request that we limit how we use your data in certain situations:
You have the right to receive your personal data in a portable format and transmit it to another service provider where technically feasible. This applies to data you provided to us with your consent or under a contract.
You may object to processing based on legitimate interests at any time. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests. You can object to marketing communications at any time by clicking "unsubscribe" in emails or adjusting your Account preferences.
Where processing is based on your consent (e.g., marketing), you can withdraw consent at any time. Withdrawal does not affect the lawfulness of processing conducted before withdrawal.
If you believe we have mishandled your personal data, you have the right to lodge a complaint with your local data protection supervisory authority. In Indonesia, this is the Ministry of Communication and Information Technology (Kominfo). Within the EU, contact your national data protection authority.
To exercise any of these rights, email [email protected] with your request. We may require identity verification before processing your request to prevent unauthorised access to your data.
toto22 is strictly an adult-only service. You must be at least 21 years of age to register an account or use our Services. We do not knowingly collect, use, or store personal data from individuals under 21. If we become aware that a user is underage, we will immediately suspend the account, delete all associated personal data, and refund any deposited funds to the payment method used.
Parents or guardians who believe their child has provided personal data to toto22 should contact us immediately at [email protected] so we can take corrective action.
Your personal data may be transferred to, stored, and processed in jurisdictions outside of Indonesia, including countries that may not offer the same level of data protection as Indonesian law. When we transfer data internationally, we ensure appropriate safeguards are in place:
By using toto22, you acknowledge and consent to the transfer of your personal data to international service providers necessary to deliver our Services.
toto22 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or business operations. When we make material changes, we will notify you by:
We encourage you to review this Privacy Policy periodically. Continued use of the Services after changes are published constitutes acceptance of the updated Privacy Policy. If you do not agree with the changes, you must cease using toto22 and close your account.
If you have questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact our Data Protection Officer:
We're Here to Help. Your privacy matters to us. Whether you want to exercise your data rights, understand how we use your information, or simply have a question about this policy, our team is available around the clock to provide clear, helpful answers.
We've built our data practices around transparency, security, and respect for your rights. Here's what that means in practice.
All data in transit uses TLS 1.3. Data at rest is encrypted with AES-256. Your passwords are hashed with bcrypt, making them unreadable even to our own staff.
We never sell, rent, or trade your personal data to third parties for commercial purposes. Your data is used exclusively to deliver our Services and comply with legal obligations.
Marketing communications are opt-in only. You can unsubscribe at any time through Account settings or email links. We respect your inbox.
Request deletion of your personal data at any time, subject to legal retention requirements. We'll action your request within 30 days.
Request a full copy of your personal data in machine-readable format at no charge. We'll deliver it within 30 days.
All service providers sign data processing agreements requiring GDPR-equivalent security. We audit compliance annually.
Read our FAQ for quick answers, review our Terms & Conditions for the full legal framework, or contact our support team directly for personalised assistance with any privacy concern.