LEGAL REFERENCE

How toto 868 Handles Your Account Data

This is our privacy policy in plain language. We're toto 868, and this page sets out what we collect when you open an account with us, how we...

Account dataWallet recordsCookie settingsYour choicesLast updated 2024

Account access Read FAQ

Our Privacy Posture and Your Rights

We collect what we need to run your account — your name, contact details, device fingerprint, wallet identifiers and session logs — and nothing we can't justify. Where local law permits, we retain transactional records for the period required by Indonesian financial rules and our licensing obligations. You can ask us to export your data, correct it, or close your account and

have records erased once retention windows expire. Third parties only see your data when a payment rail, identity check or regulator legitimately needs it. We never sell your details on, and our marketing channels are opt-in from the moment you confirm your email with us.

Service availability is jurisdiction-dependent. Users are responsible for checking local law before access.

SUPPORT

Privacy Contact Paths

If anything on this page is unclear, or you want to action a data request, reach our privacy team directly through the...

TRUST MARKERS

Why You Can Trust This Policy

This policy is reviewed by people, not just templates. Here's what stands behind it.

Legal Review

Our policy text is reviewed each quarter by counsel familiar with Indonesian data protection rules, so the wording you read matches the obligations we actually carry inside the business.

Named Data Officer

A dedicated privacy lead owns this page. They sign off every change, log every incident, and are the person who answers when you raise a formal data subject request through our inbox.

Encrypted Storage

Account records, wallet identifiers and verification documents sit in encrypted storage with access logging. Only staff with a justified role reason can open your file, and every view is recorded.

Audit Trail

Every change to your account — email update, password reset, wallet link to DANA or OVO — leaves a timestamped trail you can request a copy of whenever you want.

Vendor Vetting

Payment processors, KYC partners and analytics providers we work with sign data processing terms before they touch a single record. We publish their categories in this policy.

Breach Discipline

If something goes wrong, we notify affected account holders and the relevant Indonesian authority inside the windows the law sets. No quiet patches, no buried disclosures.

Consistency Across Our Policy Pages

Our terms, cookie notice and this privacy policy are written to line up. Here's how the pieces map together.

Terms of Service

Sets the contract for using the lobby. This privacy policy sits underneath those terms and explains the data side of the same relationship.

Cookie Notice

Lists every cookie we drop, who sets it and how long it lives. This policy explains the broader why; the cookie notice handles the granular what.

KYC Policy

Describes the documents we ask for at verification. This policy explains how long we keep those documents and who inside the business may view them.

AML Policy

Covers transaction monitoring obligations. Data collected under AML rules is referenced here but governed by the retention rules that policy sets.

Marketing Preferences

You control marketing from your account settings. This policy explains the lawful basis we rely on for each channel you switch on or off.

Complaints Procedure

If a privacy answer doesn't satisfy you, the complaints procedure tells you who to escalate to next, inside the brand and outside it.

Data Retention Schedule

A separate schedule lists exact retention windows per record type. This policy summarises it; the schedule is the source of truth we audit against.

What Shapes This Policy Page

This page is a working document, not a wall of fine print. These are the structural elements you'll notice as you read it on desktop or...

Plain-Language Sections

We've split the policy into short labelled blocks so you can scan for the part you care about — collection, retention, sharing or your rights — without reading every line first.

Version Stamp

Each policy revision carries a date at the top. If we change anything material, we mark the section with a change note so returning readers can spot what's new.

Indonesia Context

Wording is tuned to Indonesian data protection expectations. Where rules differ for supported regions, we flag the difference inline rather than burying it in a footnote.

Your Rights Block

A dedicated block summarises access, correction, deletion, portability and objection rights so you don't have to hunt across paragraphs to find what you can ask us to do.

Linked Definitions

Technical terms — controller, processor, retention window — link out to short definitions. The policy stays readable; the depth is one tap away when you need it.

Print-Friendly Layout

You can print or save this page as a PDF and the structure holds. We keep a copy of every prior version on file should you ever need to compare.

Privacy Questions We Hear Often

Your name, date of birth, email, phone, a device identifier and the wallet you link — DANA, OVO, GoPay or QRIS. Verification documents are added later when we run the identity check on your account.

Active accounts: for the life of the account. Closed accounts: the retention windows set by Indonesian financial and licensing rules, typically several years for transaction records, shorter for marketing data you opted into separately.

Yes, where retention rules don't oblige us to keep it. Send a deletion request from your registered email and we'll confirm what we can remove immediately and what stays under legal hold.

Payment processors handling DANA, OVO, GoPay or QRIS movements, KYC partners running identity checks, and regulators when they make a lawful request. We don't sell your data to advertisers or list brokers.

Yes, for session handling, security and limited analytics. Our cookie notice lists each one. You can adjust non-essential cookies from the consent banner whenever you visit, including changing your mind later.

Most fields — email, phone, address — you can edit inside account settings. Sensitive fields like name or date of birth need a quick chat with support and a supporting document so we can verify the change.

We notify affected account holders directly and tell the Indonesian authority within the legal window. The notice explains what was exposed, what we've done, and the steps you should take on your side.