Privacy Policy for tot12

tot12 operates the online gaming and sports betting platform accessible at tot12.bet (the "Platform"). For the purposes of this Privacy Policy, tot12 acts as the data controller — meaning we determine the purposes and means by which your personal data is processed.

tot12 is an internationally licensed gaming platform serving English-preference players across Indonesia. Our Services include sports betting (featuring BRI Liga 1, EPL, La Liga, Serie A, Bundesliga, and the Champions League), live casino products, slot titles from Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft, and Indonesian card game variants including Capsa Susun and Sakong.

All data protection enquiries and formal complaints should be directed to our dedicated privacy contact at support@tot12.bet with the subject line "Privacy Enquiry." We aim to acknowledge all privacy-related communications within 2 business hours and to provide a substantive response within 5 business days.

tot12 collects the following categories of personal data in the course of operating the Platform. We collect only what is necessary for the specific purposes identified in Clause 4.

tot12 does not collect any special categories of sensitive personal data (such as racial or ethnic origin, health data, religious beliefs, or biometric data for identification purposes) except where a government-issued identity document submitted for KYC incidentally reveals such information. In those cases, the data is used solely for identity verification and is not separately processed, profiled, or stored for any other purpose.

tot12 collects personal data through the following channels:

• Direct submission by you: When you complete the account registration form, submit KYC documents, make a deposit or withdrawal request, contact our customer support team, or respond to a promotional survey.
• Automated technical collection: When you access the Platform, our servers and analytics tools automatically log Technical Data and Usage Data as described in Clause 2. This collection occurs regardless of whether you are logged in, though it is associated with your account once a session is authenticated.
• Payment processors: When you make a deposit via BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja, or any other supported Indonesian payment method, the payment processor confirms transaction status and transmits limited financial data (such as masked account reference numbers and transaction amounts in IDR) to tot12 for reconciliation purposes.
• Cookies and similar technologies: As described in Clause 7, tot12 uses first-party cookies and session storage to maintain your logged-in state, remember your game preferences, and deliver a consistent Platform experience across sessions.
• Third-party fraud and AML screening tools: In connection with our AML and fraud prevention obligations, tot12 may receive data signals from internationally recognised compliance screening databases. This data is used exclusively for regulatory compliance and is not used for marketing or profiling.

tot12 uses the personal data we collect for the following purposes. Each purpose is linked to a lawful legal basis as set out in Clause 5:

• Account creation and management: Processing your registration, maintaining your Account profile, authenticating your identity at login, and communicating account-related updates to you.
• Identity verification (KYC): Verifying that you are who you say you are, that you meet the 21+ age requirement, and that your identity documents are genuine and unaltered, before processing withdrawals or high-value deposits.
• Payment processing: Crediting deposits to your Account balance in IDR, processing withdrawal requests to your registered Indonesian bank account or e-wallet, and maintaining accurate transaction records.
• Fraud detection and prevention: Identifying and investigating suspicious account activity, duplicate registrations, unauthorised login attempts, and patterns indicative of bonus abuse, money laundering, or other financial crime.
• Regulatory and AML compliance: Fulfilling our obligations under applicable anti-money-laundering and counter-terrorism financing frameworks, including maintaining transaction records and, where legally required, making disclosures to relevant authorities.
• Customer support: Responding to your enquiries, resolving complaints, and escalating disputes to game studios (Pragmatic Play, Evolution Gaming, etc.) or payment processors as necessary.
• Responsible gaming monitoring: Monitoring your gameplay patterns to identify indicators of problem gambling and, where appropriate, proactively offering responsible gaming tools such as deposit limits, cooling-off periods, or self-exclusion.
• Platform personalisation: Tailoring game recommendations, promotional offers, and interface settings to your demonstrated preferences — for example, surfacing BRI Liga 1 betting markets to players who frequently wager on Indonesian football.
• Marketing communications (with consent only): Sending you information about promotions, bonuses, new game launches, and seasonal offers relevant to the Indonesian market (e.g., Idul Fitri, Ramadhan, and Chinese New Year promotions) via your preferred communication channel, where you have given explicit consent.
• Security and platform integrity: Protecting the Platform from denial-of-service attacks, unauthorised access attempts, and technical vulnerabilities that could compromise player data or game fairness.

tot12 processes your personal data under the following legal bases, consistent with internationally recognised data protection principles:

• Performance of a contract: The majority of data processing on the Platform is necessary to perform the contract between you and tot12 — i.e., to operate your Account, process your bets, and execute payment transactions in IDR. Without this processing, we cannot provide the Services.
• Legal obligation: Certain processing activities — particularly KYC verification, AML/CTF transaction monitoring, and record-keeping — are required by the laws and regulatory frameworks applicable to tot12's operating licence. This processing takes place regardless of your consent.
• Legitimate interests: tot12 processes Technical Data and certain Usage Data on the basis of our legitimate interests in operating a secure, fair, and commercially viable gaming platform. This includes fraud detection, security monitoring, and platform analytics. We have assessed that these legitimate interests are not overridden by your privacy interests.
• Consent: Marketing communications — including promotional emails, SMS notifications, and personalised in-platform offers — are sent only where you have given explicit, informed consent. You may withdraw this consent at any time without affecting the lawfulness of processing carried out prior to withdrawal, and without any adverse consequence for your Account status or access to Services.

tot12 does not sell, rent, or trade your personal data. We share data only in the following circumstances, and only to the extent strictly necessary:

• Game studio providers: When you play a game supplied by Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Pocket Games Soft, limited session data (such as Player ID, bet values, and game outcome identifiers) is transmitted to the relevant studio's game servers to operate the game in real time. Game studios receive only what is necessary to run the game and are bound by confidentiality and data security obligations.
• Payment processors: When you initiate a deposit or withdrawal via an Indonesian bank (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) or e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja), we share the minimum necessary data (your account reference, transaction amount in IDR, and payment method identifier) with the relevant processor to complete the transaction.
• KYC and AML verification services: Identity documents and identity data submitted for KYC may be processed by an internationally certified third-party identity verification provider. These providers operate under strict data processing agreements and are prohibited from using your data for any purpose other than the specific verification task.
• Regulatory and law enforcement authorities: Where tot12 is legally obligated to disclose data — for example, in response to a court order, regulatory investigation, or AML reporting obligation — we will comply with that obligation. Where legally permitted to do so, we will notify you of such a disclosure.
• Corporate transactions: In the event of a merger, acquisition, or sale of all or substantially all of tot12's assets, your personal data may be transferred to the acquiring entity. You will be notified of any such transfer and any material change to data processing practices in advance.

tot12 uses cookies and similar client-side storage technologies to operate the Platform effectively. A cookie is a small text file placed on your device by your browser when you visit the Platform. tot12 uses only first-party cookies — we do not embed third-party advertising trackers or social media pixels.

The categories of cookies we use are as follows:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication tokens (keeping you logged in during your gaming session), anti-CSRF security tokens, and load-balancing cookies. These cannot be disabled without breaking core Platform functionality.
• Functional cookies: Remember your preferences — such as your preferred sports market (e.g., BRI Liga 1 football), your favourite game studio, or your preferred language setting — so that the Platform feels consistent between sessions.
• Analytics cookies: Collect aggregated, anonymised data about how players navigate the Platform — which pages are visited most frequently, average session duration, and common drop-off points. This data is used solely to improve the Platform experience. No personally identifiable information is included in analytics reporting.

You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent you from logging in to your Account. Analytics and functional cookies may be disabled without affecting core functionality, though some personalisation features may cease to work as expected.

tot12 retains personal data for the minimum period necessary to fulfill the purpose for which it was collected, subject to the following retention schedule:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where data has been anonymised, it may be retained indefinitely for aggregate statistical purposes, as it no longer constitutes personal data.

tot12 implements a layered information security framework to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our technical and organisational security measures include:

• Encryption in transit: All data transmitted between your browser and tot12 servers is encrypted using TLS 1.2 or higher (256-bit SSL). This applies to all pages, including login, deposit, withdrawal, and KYC document upload flows.
• Encryption at rest: Sensitive personal data — including KYC documents, financial data, and hashed authentication credentials — is encrypted at rest using AES-256 encryption on tot12's database infrastructure.
• Access controls: Access to personal data within tot12 is restricted on a strict need-to-know basis. Customer support agents, compliance officers, and technical staff access only the data necessary for their specific function. All internal access events are logged and auditable.
• Multi-factor authentication: tot12's internal systems require multi-factor authentication (MFA) for all staff accessing production data environments. Players are strongly encouraged to enable MFA on their own accounts via the Account security settings.
• Regular security assessments: tot12 conducts periodic vulnerability assessments and penetration tests of the Platform infrastructure. Critical vulnerabilities are remediated within defined SLA timeframes.
• Incident response: tot12 maintains a documented data breach response procedure. In the event of a breach that poses a risk to your rights and freedoms, we will notify affected players without undue delay and take immediate steps to contain and investigate the incident.

As a user of the tot12 Platform, you hold the following rights in respect of your personal data. To exercise any of these rights, contact support@tot12.bet with the subject line "Data Rights Request." We will respond within 5 business days and action your request within 30 calendar days, or notify you if additional time is required.

tot12 operates globally and your personal data may be stored on or processed by servers located outside of Indonesia. In particular, game studio partners such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft maintain game server infrastructure in various international jurisdictions.

Wherever your data is transferred internationally, tot12 ensures that appropriate safeguards are in place to protect it to a standard at least equivalent to the protections described in this Privacy Policy. These safeguards include:

• Standard contractual clauses incorporating internationally recognised data protection obligations in all agreements with third-party data processors.
• Requiring third-party processors to maintain their own documented information security policies and to notify tot12 promptly of any security incident affecting tot12 player data.
• Periodic review of third-party processor compliance with their data protection obligations.

If you would like further information about the specific safeguards in place for any particular international data transfer, please contact support@tot12.bet.

The tot12 Platform is strictly for adults aged 21 years and above. tot12 does not knowingly collect or process personal data from individuals under the age of 21. Age verification is a mandatory step in the KYC process, and Accounts found to belong to individuals under 21 will be suspended immediately, with all balances withheld pending investigation.

If you are a parent or guardian and believe that a minor in your care has registered an account with tot12 , please contact us immediately at support@tot12.bet with the subject line "Minor Account Report." We will investigate the report promptly, suspend the account, and permanently delete all personal data associated with the minor's account, subject to any mandatory regulatory retention obligations that legally prevent immediate deletion.

tot12 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory guidance, or Platform features. The "Last Updated" date at the top of this page will always reflect the most recent revision.

Where a change is material — meaning it significantly affects the way we collect or use your personal data, or reduces your rights under this policy — we will notify you in advance by email to the address registered on your Account, and by a prominent notice on the Platform, at least 14 days before the change takes effect. Non-material changes (such as typographical corrections, clarifications, or changes that expand your rights) may be made without prior notice.

Your continued use of the Platform after the effective date of any change constitutes your acceptance of the revised Privacy Policy. If you do not agree to the revised terms, you must cease using the Platform and may request account closure by contacting support@tot12.bet.

We recommend that you review this Privacy Policy periodically — at least once per quarter — to stay informed of how tot12 handles your personal data. All previous versions of this policy are available on request.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way tot12 processes your personal data, please contact our privacy team using the details below. All communications are handled in English.

If you are not satisfied with our response to a privacy complaint, or if you believe that tot12 is processing your personal data in a manner inconsistent with applicable data protection principles, you have the right to escalate your complaint to the relevant supervisory authority or seek remedies through applicable dispute resolution mechanisms in your jurisdiction.

tot12 takes all privacy complaints seriously. We are committed to resolving concerns fairly, transparently, and promptly. Your trust in the Platform depends on our consistent adherence to the principles set out in this policy, and we do not take that responsibility lightly.