At totoxl, your privacy is a fundamental right, not an afterthought. This Privacy Policy explains exactly what personal data we collect, why we collect it, how it is used and protected, and what rights you hold as a Member of our platform. We are committed to handling your information with transparency, care, and full accountability.
totoxl's data practices are built on six foundational commitments that govern every decision we make about your personal information.
We tell you clearly what data we collect, why we collect it, and how it is used — before we collect it. No hidden clauses, no surprise data uses.
Your data is collected for specific, explicit purposes. We do not repurpose data beyond those stated objectives without obtaining fresh consent from you.
We collect only the data we genuinely need to deliver and improve the totoxl service. We do not harvest unnecessary information or retain data longer than required.
All personal data is protected by 256-bit SSL encryption in transit and AES-256 encryption at rest. Access is restricted on a strict need-to-know basis across our team.
You have the right to access, correct, export, and delete your personal data at any time. Our support team processes all data rights requests within 30 days.
totoxl does not sell, rent, or trade your personal information to any third party for their marketing or commercial purposes — period.
This Privacy Policy applies to all personal data collected and processed by totoxl in connection with the operation of the totoxl Platform at totoxl.cam, including all associated mobile interfaces, customer support channels, email communications, and promotional activities.
This Policy covers data relating to:
This Policy is specifically relevant to Indonesian players and is written to reflect the data practices applicable to Members primarily located in Indonesia, including those using Indonesian banking channels (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja).
In this Privacy Policy, the following terms carry the meanings defined below:
| Term | Meaning |
|---|---|
| "Personal Data" | Any information relating to an identified or identifiable natural person, including name, email address, device identifiers, and financial transaction records. |
| "Processing" | Any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, and deletion. |
| "Controller" | totoxl, as the entity that determines the purposes and means of processing Personal Data. |
| "Processor" | A third-party service provider that processes Personal Data on behalf of totoxl under a binding data processing agreement. |
| "Consent" | A freely given, specific, informed, and unambiguous indication of the data subject's agreement to the processing of their Personal Data. |
| "Member" / "You" | Any individual who registers or attempts to register an Account on the totoxl Platform. |
totoxl collects Personal Data through several distinct channels. The categories and specific data points collected in each context are set out below.
3.1 Registration Data. When you create an Account, we collect your full legal name, date of birth, residential address (including city — Jakarta, Surabaya, Bandung, Medan, Bali, Yogyakarta, or other Indonesian cities as applicable), email address, and mobile phone number. This data is required to create and maintain your Account and verify your eligibility.
3.2 KYC & Identity Verification Data. When you submit KYC documentation, we collect copies of government-issued identity documents (such as your Indonesian National Identity Card / KTP, passport, or SIM), proof-of-address documents, and selfie photographs taken for verification purposes. This data is processed to comply with our anti-money-laundering (AML) and know-your-customer (KYC) obligations.
3.3 Financial & Transaction Data. We collect details of all deposits and withdrawals made through your Account, including transaction amounts (in IDR), timestamps, payment method identifiers (e.g., the last four digits of a BCA or BRI account number, or the registered mobile number of an OVO or GoPay account), and transaction status records.
3.4 Betting & Gaming Activity Data. We maintain records of all bets, wagers, game sessions, and outcomes associated with your Account. This includes sportsbook activity (football markets, mix parlay accumulators, and other events), live casino sessions, togel (Indonesia's traditional numbers lottery) draw entries, slot game sessions, and any other gaming activity on the Platform.
3.5 Technical & Device Data. We automatically collect certain technical data when you access the Platform, including your IP address, browser type and version, operating system, device type, screen resolution, referring URL, and session duration. This data is used for security monitoring, fraud detection, and Platform performance optimisation.
3.6 Communications Data. When you contact our support team via live chat, email, or WhatsApp, we retain records of those communications — including the content of messages, timestamps, and agent responses — for quality assurance, training, and dispute resolution purposes.
3.7 Voluntarily Provided Data. Any additional information you choose to provide — for example, when completing a responsible gaming self-assessment or submitting a formal complaint — is also collected and stored in connection with your Account record.
totoxl processes your Personal Data on the following legal bases:
| Legal Basis | Application |
|---|---|
| Contractual Necessity | Processing required to perform the contract between you and totoxl — including Account management, payment processing, and bet settlement. |
| Legal Obligation | Processing required to comply with applicable laws — including AML regulations, KYC requirements, and licensing conditions imposed by our regulatory authority. |
| Legitimate Interests | Processing for fraud prevention, security monitoring, responsible gaming enforcement, and Platform improvement — where our legitimate interests are not overridden by your privacy rights. |
| Consent | Processing for optional marketing communications and non-essential analytics cookies — only where you have provided explicit consent, which may be withdrawn at any time. |
totoxl uses the Personal Data it collects for the following purposes:
totoxl does not sell, rent, or trade your Personal Data to any third party for commercial or marketing purposes. We share your data only in the following strictly defined circumstances:
6.1 Service Providers (Processors). We engage trusted third-party service providers to assist in delivering the totoxl Platform. These include payment gateway operators (connecting to BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, OVO, DANA, GoPay, ShopeePay, and LinkAja), identity verification and KYC service providers, cloud infrastructure and data hosting providers, customer support software providers, and fraud detection and cybersecurity specialists. All such providers are bound by data processing agreements that prohibit them from using your data for any purpose beyond the specific service they deliver to totoxl.
6.2 Game Content Providers. Our platform integrates games from certified third-party studios including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Pocket Games Soft, and Spribe. These studios may receive session-level data (such as a pseudonymous player token and stake amounts) to enable gameplay. They do not receive your full identity or contact information.
6.3 Regulatory & Legal Disclosure. We may disclose your Personal Data to our licensing authority, law enforcement agencies, financial intelligence units, or other competent authorities where required to do so by law, court order, or our regulatory obligations. We will notify you of any such disclosure where legally permitted to do so.
6.4 Business Transfers. In the event of a merger, acquisition, restructuring, or sale of all or part of totoxl's business, your Personal Data may be transferred to the acquiring entity, subject to the same privacy protections described in this Policy. You will be notified of any such transfer in advance.
6.5 Aggregated Data. We may share aggregated, anonymised statistical data with partners, researchers, or the public for general analytical or reporting purposes. This data cannot be used to identify any individual Member.
totoxl uses cookies and similar tracking technologies to operate and improve the Platform. The types of cookies we use are as follows:
| Cookie Type | Purpose | Can Be Disabled? |
|---|---|---|
| Essential Cookies | Required for core Platform functionality including login sessions, security tokens, and load balancing. Without these, the Platform cannot function. | No — always active |
| Functional Cookies | Remember your preferences such as language settings, display options, and game lobby filters to personalise your experience. | Yes — via browser settings |
| Analytics Cookies | Collect anonymised data on how Members navigate the Platform to help us understand usage patterns and improve the service. | Yes — opt out available |
| Security Cookies | Support our fraud detection systems by flagging unusual login patterns or session anomalies for review. | No — required for security |
You can manage or delete cookies at any time through your browser settings. Note that disabling functional or analytics cookies will not affect your ability to use the core Platform services, but may reduce the personalisation of your experience. For detailed browser-specific instructions on managing cookies, please refer to your browser's help documentation.
totoxl retains your Personal Data for as long as is necessary to fulfil the purposes for which it was collected, to comply with applicable legal obligations, and to resolve any outstanding disputes. The following retention periods apply as a general guide:
Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised in accordance with our data destruction procedures.
totoxl implements a multi-layered security architecture to protect your Personal Data against unauthorised access, disclosure, alteration, and destruction. Our technical and organisational measures include:
As a Member of the totoxl Platform, you hold the following rights in respect of your Personal Data. To exercise any of these rights, please contact our support team using the details in Clause 14. We will respond to all valid requests within 30 calendar days.
Where you have provided consent for a specific processing activity (such as marketing emails), you may withdraw that consent at any time without affecting the lawfulness of any processing carried out prior to withdrawal.
The totoxl Platform is strictly intended for adults aged 21 years and older. We do not knowingly collect Personal Data from any individual under the age of 21. Our registration process includes explicit age declaration, and KYC verification requires documentary proof of date of birth.
If we become aware that an Account has been created by or on behalf of a person under 21 years of age, we will immediately suspend that Account, void any associated transactions, and securely delete all Personal Data collected in connection with that Account, except where retention is required by law.
If you believe that a minor has registered an Account on the totoxl Platform, please contact us immediately using the details in Clause 14 so that we can investigate and take appropriate action without delay.
totoxl operates as a licensed international platform. As a result, your Personal Data may be processed by our staff or third-party service providers located in countries outside Indonesia. Where such international transfers occur, totoxl ensures that adequate data protection safeguards are in place, including:
By using the totoxl Platform and providing us with your Personal Data, you acknowledge and consent to the transfer of your data to other countries for the purposes described in this Privacy Policy, subject to the safeguards described above.
totoxl reserves the right to amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or Platform features. When material changes are made, we will notify registered Members via email or a prominent on-Platform notification at least 7 days before the updated Policy takes effect.
The version number and "Last updated" date displayed at the top of this page identify the currently applicable edition of this Policy. We encourage you to review this page periodically to stay informed of how we protect your data.
Your continued use of the totoxl Platform after the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the revised Policy, you must cease using the Platform and contact support to arrange Account closure and exercise any applicable data rights.
If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data by totoxl, please contact our Data Protection team through any of the following channels:
When contacting us about a data rights request, please include your registered Account email address and a description of the right you wish to exercise. We may ask you to verify your identity before processing the request to ensure your data is protected throughout the process.
Our support team is available around the clock to assist with any privacy concern or data rights request. You can also explore our FAQ, review our Terms & Conditions, or return to the homepage.