Privacy Policy – toko56

1 Definitions

The following terms have specific meanings throughout this Privacy Policy. Terms not defined here carry the meanings assigned to them in the toko56 Terms & Conditions.

• "Personal Data" — Any information that identifies or could reasonably be used to identify a living individual, including name, national identity number, email address, payment details, device identifiers, and IP address.
• "Processing" — Any operation performed on Personal Data, including collection, storage, use, disclosure, erasure, or any combination of these, whether by automated or manual means.
• "Data Controller" — The entity that determines the purposes and means of processing Personal Data. For the purposes of this Policy, the Data Controller is toko56 as operated under toko56.cam.
• "Data Processor" — Any third party that processes Personal Data on behalf of toko56 under a contractual data-processing agreement.
• "Member" — Any registered user holding an active account on the toko56 platform.
• "Consent" — A freely given, specific, informed, and unambiguous indication of agreement by the Member to the processing of their Personal Data for stated purposes.
• "KYC Data" — Documents and information submitted by a Member as part of the Know Your Customer identity-verification process, including a copy of the Indonesian National Identity Card (KTP) and associated selfie photographs.
• "Sensitive Data" — A subset of Personal Data that warrants heightened protection, including financial information, identity documents, and any data that, if disclosed, could cause significant harm to the individual.

2 Data Controller

toko56, operated under the domain toko56.cam, acts as the Data Controller in respect of all Personal Data collected from Members and visitors to the platform. As Data Controller, toko56 is responsible for ensuring that Personal Data is collected lawfully, used fairly, stored securely, and not retained for longer than necessary.

toko56 is an internationally operated online gaming platform. While our primary market is Indonesia, our data-protection practices are aligned with internationally recognized privacy standards, reflecting our commitment to responsible and transparent data governance for all Members regardless of their location within the Indonesian archipelago — whether in Jakarta, Surabaya, Bandung, Bali, Medan, Makassar, or elsewhere.

3 Data We Collect

toko56 collects Personal Data through multiple touchpoints across the Member lifecycle. The categories of data collected and their respective sources are set out in the table below.

3.1 Data We Do Not Collect

toko56 does not collect or store full payment card numbers, CVV codes, or any other full payment card credentials. All payment card interactions (where applicable) are processed directly by PCI-DSS-certified payment processors. We do not knowingly collect Personal Data from individuals under 21 years of age.

4 Legal Basis for Processing

toko56 processes your Personal Data only where a valid legal basis exists. The primary legal bases on which we rely are as follows:

• Contractual Necessity: Processing is required to fulfill our obligations under the toko56 Terms & Conditions — including operating your account, processing deposits and withdrawals, and settling bets.
• Legal Obligation: Processing is necessary to comply with applicable anti-money-laundering (AML) regulations, KYC requirements, fraud-prevention obligations, and any other legal requirements imposed by our licensing authority.
• Legitimate Interests: Processing is conducted in pursuit of toko56's legitimate business interests — including platform security, fraud detection, responsible gaming monitoring, and service improvement — provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: Where we send you direct marketing communications or deploy non-essential cookies, we rely on your explicit consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

5 How We Use Your Data

toko56 uses the Personal Data it collects for the following specific and documented purposes. We do not use your data for any purpose incompatible with those listed here without first obtaining your additional consent.

5.1 Account Management & Platform Operation

We use Registration Data and Financial Data to create and maintain your Member account, authenticate your identity at login, process your deposits and withdrawal requests via your nominated BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI, OVO, DANA, GoPay, ShopeePay, or LinkAja account, and ensure your account balance is accurately maintained in Indonesian Rupiah (IDR / Rp).

5.2 Identity Verification & Fraud Prevention

KYC Data is used solely to verify that you are a real individual aged 21 or over and that your registered payment method belongs to you. This data is also cross-referenced with internal fraud-detection systems designed to identify suspicious account activity, unauthorized access attempts, and potential money-laundering patterns.

5.3 Responsible Gaming Monitoring

Betting & Gaming Activity data is analyzed to identify behavioral patterns that may indicate problem gambling. Where such patterns are detected, toko56 may proactively reach out to the Member, apply protective account limits, or flag the account for a responsible gaming review — all in accordance with our Responsible Gaming commitments.

5.4 Customer Support

Communication Data is retained to provide effective customer support, to review and resolve complaints, to train our support team, and to maintain an audit trail of all Member interactions for dispute-resolution purposes.

5.5 Marketing & Promotions

Where you have opted in to receive marketing communications, we may use your contact details and gaming preferences to send you information about relevant promotions — including seasonal bonuses tied to Indonesian cultural events such as Idul Fitri, Ramadhan, Nyepi, or Indonesian Independence Day. You may unsubscribe from marketing communications at any time by contacting our support team.

5.6 Platform Security & Technical Operations

Technical & Device Data is used to maintain platform security, diagnose and resolve technical issues, detect bot activity or automated abuse, and optimize the toko56 platform for performance across the range of devices commonly used by Indonesian Members.

6 Data Sharing & Disclosure

toko56 does not sell, rent, or trade your Personal Data to any third party for their own commercial purposes. We share your data only in the limited circumstances described below, and always subject to appropriate contractual safeguards.

6.1 Service Providers (Data Processors)

We share data with carefully selected third-party service providers who process data on our behalf under binding data-processing agreements. These include payment gateway operators (for processing IDR transactions), identity-verification (KYC) technology providers, cloud infrastructure and hosting providers, customer support software platforms, and fraud detection and risk-management services.

6.2 Game Studios & Content Providers

Game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Pocket Games Soft, and Spribe may receive session-level technical identifiers to enable seamless game loading and session continuity. These providers do not receive your full Personal Data and are contractually prohibited from using any data received for independent marketing or profiling purposes.

6.3 Legal & Regulatory Disclosure

We may disclose your Personal Data to regulatory authorities, law enforcement agencies, or courts where we are legally required to do so — for example, in connection with an AML investigation, a court order, or a licensing authority audit. In such cases, we will disclose only the minimum data necessary to satisfy the legal requirement.

6.4 Business Transfers

In the event that toko56 undergoes a merger, acquisition, or sale of assets, Member Personal Data may be transferred to the successor entity as part of that transaction. We will notify affected Members via email prior to any such transfer and will ensure the successor entity is bound by privacy obligations at least equivalent to those in this Policy.

7 Cookies & Tracking Technologies

toko56 uses cookies and similar tracking technologies to deliver a functional, secure, and personalized experience on the platform. The categories of cookies we deploy are described below.

You may configure your browser to block or delete cookies at any time. Note that disabling Strictly Necessary cookies will impair your ability to log in and use core platform features. Blocking Analytics cookies will not affect your gameplay experience.

8 Data Retention

toko56 retains Personal Data only for as long as is necessary to fulfill the purposes for which it was collected or to comply with applicable legal, regulatory, and audit obligations. Our standard retention periods are as follows:

• Active Account Data: Retained for the duration of your membership and for 5 years following permanent account closure.
• KYC & Identity Documents: Retained for a minimum of 5 years following account closure, in accordance with internationally recognized AML record-keeping standards.
• Financial Transaction Records: Retained for 5 years from the date of each transaction, in line with standard financial audit requirements.
• Customer Support Communications: Retained for 3 years from the date of the relevant interaction.
• Responsible Gaming Records: Self-exclusion and limit-setting records are retained for the duration of the exclusion period plus 5 years, to prevent re-registration during an active exclusion.
• Marketing Consent Records: Retained for 3 years from the date consent was given or last renewed.
• Technical & Device Logs: Retained for up to 12 months for security-monitoring purposes.

Upon expiry of the applicable retention period, Personal Data is securely deleted or permanently anonymized so that it can no longer be linked to any individual Member.

9 Data Security

toko56 implements a layered security framework to protect your Personal Data against unauthorized access, accidental loss, disclosure, or destruction. Our security measures include, but are not limited to:

• SSL/TLS Encryption: All data transmitted between your browser and the toko56 platform is encrypted using industry-standard SSL/TLS protocols. The padlock icon in your browser confirms that your connection is secure at all times.
• Data Encryption at Rest: Sensitive data — including KYC documents and financial records — is stored using AES-256 encryption on secured, access-controlled infrastructure.
• Access Controls: Access to Personal Data within toko56's internal systems is restricted to authorized personnel on a strict need-to-know basis, enforced through role-based access control (RBAC) and multi-factor authentication (MFA).
• Intrusion Detection: Our infrastructure is monitored around the clock by automated intrusion-detection systems designed to identify and respond to anomalous activity in real time.
• Third-Party Security Audits: toko56 undergoes periodic security assessments and penetration testing conducted by independent third-party security specialists.
• Incident Response: In the event of a data breach that poses a risk to your rights or freedoms, toko56 will notify affected Members promptly and will take immediate remedial action to contain the incident and prevent recurrence.

10 Your Rights

As a Member of toko56, you hold the following rights in respect of your Personal Data. To exercise any of these rights, please contact our support team at the email address provided in Section 15. We will respond to all verifiable requests within 30 days.

11 Minors & Age Restriction

toko56 is strictly an adults-only platform. We do not knowingly collect, store, or process Personal Data from any individual under the age of 21. Our registration process includes an age declaration requirement, and KYC verification is used to confirm that all Members meet the 21+ threshold before withdrawal privileges are granted.

If toko56 discovers — through KYC review, a parental complaint, or any other means — that an account has been registered by an individual under 21 years of age, we will immediately suspend the account, delete all associated Personal Data to the extent permitted by law, and return any deposited funds to the source payment method following a verification review.

Parents or guardians who believe a minor has registered on toko56 are encouraged to contact our support team immediately. We take all such reports seriously and will act swiftly in every case.

12 International Data Transfers

As an internationally operated platform, some of the service providers that toko56 engages — including cloud infrastructure providers and game studio technology partners — may process data in jurisdictions outside Indonesia. Where such transfers occur, toko56 ensures that adequate safeguards are in place, including:

• Contractual data-transfer clauses that require recipient parties to apply data-protection standards equivalent to those described in this Policy.
• Transferring data only to jurisdictions recognized as providing an adequate level of data protection, or where equivalent contractual guarantees have been established.
• Minimizing the scope of data transferred internationally to only what is strictly necessary for the provision of the relevant service.

13 Third-Party Services

The toko56 platform integrates third-party services — including game content from studios such as Pragmatic Play, Evolution Gaming, and Spribe, and payment processing via local Indonesian banking and e-wallet networks — that operate under their own independent privacy policies. toko56 is not responsible for the privacy practices of these third parties in respect of data that they independently collect about you.

We recommend that you review the privacy policies of any third-party service you use in connection with your toko56 membership. Our platform does not contain links to external third-party websites; any data shared with third parties by toko56 is governed by the contractual safeguards described in Section 6.

14 Policy Amendments

toko56 reserves the right to update this Privacy Policy at any time to reflect changes in our data-processing practices, legal obligations, or platform features. When material changes are made, registered Members will be notified via email or an on-platform notification at least 7 days before the revised Policy takes effect.

The "Last Updated" date at the top of this page indicates when the Policy was most recently revised. Your continued use of the toko56 platform after the effective date of any amendment constitutes your acceptance of the updated Privacy Policy. If you do not agree with any changes, you must cease using the platform and request account closure before the effective date.

15 Contact & Complaints

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way toko56 handles your Personal Data, please contact our dedicated support team. We are available 24 hours a day, 7 days a week, in both English and Bahasa Indonesia, and are committed to resolving all privacy-related queries promptly and transparently.

If you are not satisfied with our response to a privacy complaint, you have the right to escalate your concern to the relevant data-protection authority or regulatory body in your jurisdiction. For additional information on your rights, see Section 10 above.

For questions about our gaming terms, please review our Terms & Conditions. For responsible gaming tools and support resources, please visit our Responsible Gaming page.