Privacy Policy

Definitions

For the purposes of this Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person ("data subject"), including but not limited to name, email address, phone number, IP address, device identifiers, and financial account details.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, and deletion.
• "Controller" means togeli, the entity that determines the purposes and means of processing your Personal Data.
• "Processor" means a third party that processes Personal Data on behalf of togeli under a written data processing agreement.
• "Consent" means a freely given, specific, informed, and unambiguous indication of your wishes, by which you agree to the processing of your Personal Data for a stated purpose.
• "KYC" ("Know Your Customer") means the identity verification process used to confirm your identity, age, and ownership of payment methods in compliance with anti-money-laundering obligations.
• "Member" means any registered user of the togeli Platform.

Scope & Application

This Policy applies to all Personal Data collected by togeli from Members, prospective Members, and visitors to the Platform, regardless of the device or method used to access it. It covers data collected through the togeli website, mobile browser interface, customer support channels (live chat, email, WhatsApp), and any togeli promotional campaigns.

This Policy is intended to be read by individuals located in Indonesia. togeli primarily serves Members who are residents of Indonesia and processes data with reference to that context. Where Indonesian data protection regulations apply, togeli processes data in a manner consistent with those requirements.

Personal Data We Collect

togeli collects the following categories of Personal Data:

We do not collect special categories of Personal Data (including health data, racial or ethnic origin, religious beliefs, or political opinions) unless explicitly required for responsible gaming purposes (for example, a Member voluntarily disclosing a gambling-related health concern to our support team in the context of a self-exclusion request).

How We Collect Your Data

togeli collects Personal Data through the following means:

• Direct collection: Information you provide when registering an account, completing KYC, making a deposit or withdrawal, contacting customer support, or participating in a promotion.
• Automated collection: Technical data gathered automatically when you access the Platform, including IP address, browser fingerprint, device identifiers, session duration, and clickstream data collected via server logs and analytics tools.
• Third-party sources: Identity and fraud-screening data received from KYC verification providers; transaction confirmation data received from payment processors including BCA, BRI, BNI, Mandiri, CIMB Niaga, GoPay, OVO, DANA, ShopeePay, and LinkAja; geolocation data derived from your IP address.
• Cookies and similar technologies: Data collected via cookies, web beacons, pixel tags, and local storage objects as described in Section 9 of this Policy.

Purpose & Legal Basis for Processing

togeli processes your Personal Data only where a valid legal basis exists. The table below sets out the primary purposes for which we process data and the corresponding legal basis for each:

Where we rely on Consent as the legal basis (for example, sending promotional SMS or email communications), you may withdraw your consent at any time by updating your communication preferences in account settings or by contacting our support team. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Data Sharing & Disclosure

togeli does not sell, rent, or otherwise transfer your Personal Data to third parties for their own commercial purposes. We may share your data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate contractual safeguards:

• KYC and Identity Verification Providers: Third-party services that verify the authenticity of identity documents and screen against sanctions and politically-exposed-persons (PEP) lists. These providers act as Processors under a data processing agreement with togeli.
• Payment Processors: Banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI, Bank Permata) and e-wallet providers (GoPay, OVO, DANA, ShopeePay, LinkAja) require certain transaction and identity details to facilitate deposits and withdrawals. Data shared is limited to what is strictly required for each transaction.
• Game Content Providers: Studios such as Pragmatic Play, Evolution Gaming, Spribe, Pocket Games Soft, and Microgaming may receive session identifiers and anonymised gaming data necessary to deliver their content on our Platform. They do not receive personally identifiable information beyond what is required for game provisioning.
• Fraud Prevention and Security Services: Providers that assist in detecting and preventing fraudulent activity, account takeovers, and money laundering.
• Legal and Regulatory Authorities: togeli will disclose Personal Data to law enforcement agencies, courts, regulators, or government bodies when required to do so by applicable law, a valid court order, or a regulatory directive. Where permitted by law, we will notify affected Members of such disclosure.
• Professional Advisors: Lawyers, auditors, and compliance consultants who are bound by professional confidentiality obligations.

In the event of a corporate restructuring, merger, acquisition, or sale of assets, your Personal Data may be transferred to the acquiring entity, provided that the receiving party agrees to process your data in a manner consistent with this Policy.

International Data Transfers

togeli's primary servers are located in secure, internationally recognised data centre facilities. Some of our third-party service providers — including KYC verification platforms and game content studios — may process data in jurisdictions outside Indonesia. Where such transfers occur, togeli ensures that appropriate safeguards are in place, which may include:

• Standard contractual clauses (SCCs) incorporated into data processing agreements.
• Data processing agreements that require the recipient to maintain security standards equivalent to those described in this Policy.
• Processing only with service providers that operate under equivalent data protection frameworks recognised by international standards.

By using the togeli Platform, you acknowledge that your Personal Data may be transferred to and processed in countries outside Indonesia. togeli takes all reasonable steps to ensure that any such transfer is conducted lawfully and with appropriate protections in place.

Data Retention

togeli retains Personal Data for as long as is necessary to fulfil the purpose for which it was collected, to comply with legal and regulatory obligations, and to resolve disputes. The following general retention periods apply:

• Account and Identity Data: Retained for the duration of your active membership and for a minimum of five (5) years following account closure, in compliance with anti-money-laundering record-keeping requirements.
• Financial Transaction Data: Retained for a minimum of five (5) years from the date of each transaction, as required by applicable financial regulations.
• Gaming History: Retained for a minimum of three (3) years from the date of each session, for dispute resolution and responsible gaming audit purposes.
• Customer Support Communications: Retained for two (2) years from the date of the last communication in each support thread, unless the communication relates to a formal dispute or legal matter, in which case retention may be extended accordingly.
• Technical and Log Data: Retained for up to twelve (12) months, after which it is anonymised or deleted.
• Marketing Consent Records: Retained for the duration of your membership and for one (1) year following the withdrawal of consent, for compliance audit purposes.

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised using industry-standard methods. Anonymised data (which can no longer be linked to any individual) may be retained indefinitely for statistical and business analysis purposes.

Cookies & Tracking Technologies

togeli uses cookies and similar tracking technologies to operate the Platform effectively, enhance user experience, and gather analytics data. Cookies are small text files placed on your device when you visit the Platform.

The following categories of cookies are used on the togeli Platform:

• Strictly Necessary Cookies: Essential to the operation of the Platform. These cookies enable core functionality such as user authentication, session management, and security features. They cannot be disabled without disrupting the Platform's basic operation.
• Functional Cookies: These remember your preferences (such as language settings and display options) to provide a more personalised experience. Disabling these cookies may affect certain non-essential features.
• Analytics Cookies: Used to collect anonymised data about how Members use the Platform, including pages visited, time spent, and navigation paths. This data helps us identify areas for improvement and optimise the user experience.
• Security Cookies: Used to detect and prevent fraudulent activity, including bot detection, CSRF protection, and session integrity checks. These are strictly necessary for Platform security.

Your Data Rights

As a data subject, you have the following rights with respect to your Personal Data held by togeli. To exercise any of these rights, please submit a written request to [email protected] with the subject line "Data Rights Request — [Your Username]". togeli will respond within thirty (30) calendar days of receiving a valid request.

• Right of Access: You have the right to request a copy of the Personal Data we hold about you and to receive information about how it is processed.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete Personal Data held about you. You may also update certain profile details directly within your account settings.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (and no other legal basis applies), or where processing is unlawful. This right is subject to overriding legal obligations that require us to retain certain data (for example, AML record-keeping requirements).
• Right to Restrict Processing: You may request that we restrict the processing of your Personal Data in certain circumstances — for example, while you contest the accuracy of the data or while a complaint is under review.
• Right to Data Portability: Where processing is based on your consent or on contract performance, you have the right to receive your Personal Data in a structured, commonly used, machine-readable format and to transmit it to another controller.
• Right to Object: You have the right to object to processing based on legitimate interests, including profiling for fraud detection purposes, where your particular circumstances justify the objection. You have an absolute right to object to processing for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time without detriment to your account status. Withdrawal does not affect the lawfulness of prior processing.

Children's Privacy

The togeli Platform is strictly intended for adults aged 21 years and older. We do not knowingly collect Personal Data from individuals under the age of 21. If togeli discovers, through KYC verification or other means, that a Member is under 21 years of age, the account will be immediately suspended, all funds will be frozen pending investigation, and the Personal Data associated with the account will be deleted in accordance with our data retention obligations, except where retention is required for legal or fraud-prevention purposes.

If you believe that a minor has registered an account on togeli, please notify us immediately at [email protected]. We will treat all such reports with the highest priority and take immediate action.

Security Measures

togeli implements a comprehensive set of technical and organisational security measures designed to protect your Personal Data against unauthorised access, accidental loss, destruction, alteration, and disclosure. These measures include:

• Encryption: All data transmitted between your device and the togeli Platform is encrypted using TLS 1.3. Sensitive data stored in our databases is encrypted at rest using AES-256.
• Access Controls: Access to Personal Data is restricted to authorised togeli personnel who require it to perform their job functions. All access is role-based, logged, and subject to regular review.
• Two-Factor Authentication (2FA): togeli strongly recommends that all Members enable 2FA on their accounts. 2FA adds an additional layer of security by requiring a time-sensitive verification code in addition to your password.
• Penetration Testing: togeli engages independent cybersecurity specialists to conduct regular penetration tests and vulnerability assessments of the Platform infrastructure.
• Incident Response: In the event of a confirmed data breach that is likely to result in a risk to your rights, togeli will notify affected Members without undue delay and take immediate remediation steps.
• Staff Training: All togeli employees who handle Personal Data receive regular data protection training and are bound by confidentiality obligations.

Third-Party Links

The togeli Platform does not contain links to third-party websites. In the event that any future feature or content references an external resource, this Policy will be updated to reflect the implications for data privacy. togeli is not responsible for the privacy practices of any third-party service — including payment providers such as BCA, BRI, BNI, Mandiri, GoPay, OVO, or DANA — when you interact directly with those services outside the togeli Platform. We encourage you to review the privacy policies of all third parties with whom you share your data independently.

Changes to This Policy

togeli reserves the right to update or amend this Privacy Policy at any time. Material changes — defined as changes that meaningfully alter how we collect, use, or share your Personal Data, or that affect your rights as a data subject — will be communicated to Members via registered email and an in-platform notification no fewer than seven (7) calendar days before the changes take effect.

Non-material changes (such as typographical corrections, formatting updates, or minor clarifications that do not alter the substance of any section) may take effect immediately upon publication. The "Last Updated" date and version number at the top of this Policy will always reflect the most recent revision. The current version of this Policy is always available at https://togeli.cam/privacy-policy.

Your continued use of the togeli Platform following the effective date of any amendment to this Policy constitutes your acceptance of the revised terms. If you do not agree with the updated Policy, you must cease using the Platform and may request account closure by contacting our support team.

Contact & Data Protection Officer

If you have any questions, concerns, or complaints regarding this Privacy Policy or togeli's data processing practices, please contact our Data Protection team using the details below. We are committed to resolving all privacy-related enquiries promptly and transparently.

If you are not satisfied with our response to a privacy complaint, you have the right to escalate your concern to the relevant data protection authority or regulatory body applicable in your jurisdiction. togeli will cooperate fully with any such regulatory enquiry.