Your privacy matters to us. This Privacy Policy explains in plain terms exactly what personal data to888 collects when you use our Platform, why we collect it, how we use and protect it, who we may share it with, and what rights you hold over your own information.
These six commitments summarise how to888 approaches your personal data. They are not a substitute for the full policy below — please read the complete document for binding detail.
Every byte of data exchanged between your browser and the to888 Platform travels over a 256-bit SSL-encrypted connection. This is the same standard used by major international banks, ensuring your personal and financial details are never exposed in transit.
to888 does not sell, rent, or broker your personal data to advertisers, data brokers, or any third party for their own marketing purposes. Your information is used exclusively to operate your account, process transactions, and maintain a safe gaming environment.
You have the right to access, correct, export, and request deletion of your personal data at any time. Submit a request to our support team and we will respond within 30 days. We store your data only as long as is necessary for legal and operational purposes.
KYC documents, financial records, and account data are stored on hardened, access-controlled servers. Access within to888 is role-restricted on a strict need-to-know basis. All storage systems undergo regular independent security audits.
to888 uses cookies solely to maintain session integrity, remember your preferences, and analyse aggregate Platform performance. We do not use third-party advertising cookies or cross-site tracking pixels. You can manage cookie settings through your browser at any time.
You may opt out of promotional communications from to888 at any time by updating your notification preferences in your Account settings or by contacting our support team. Transactional messages (deposit confirmations, withdrawal receipts, security alerts) cannot be disabled as they are essential to account operation.
The following terms have the meanings set out below throughout this Privacy Policy. Where a term is also defined in the to888 Terms & Conditions, the same meaning applies here unless expressly stated otherwise.
| Term | Meaning |
|---|---|
| "Platform" | The to888 website at https://to888.lat, all sub-pages, the game lobby, sportsbook, cashier, and any associated mobile-optimised interfaces. |
| "We / Us / to888" | The operator of the Platform and the data controller responsible for personal data collected through the Platform. |
| "You / Player / User" | Any individual who accesses, browses, registers on, or transacts through the Platform. |
| "Personal Data" | Any information that identifies or can reasonably be used to identify a living natural person, including but not limited to name, national identity number, email address, device identifiers, and financial account details. |
| "Processing" | Any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, and deletion. |
| "KYC" | Know Your Customer — the identity and address verification process to888 applies to all registered Accounts. |
| "Third Party" | Any natural or legal person other than you, to888, and to888's authorised data processors who act strictly on our instructions. |
| "Cookies" | Small text files placed on your device by the Platform to support session management, preference storage, and aggregate analytics. |
This Privacy Policy applies to all Personal Data collected by to888 in connection with your use of the Platform, whether you access it via a desktop browser, mobile browser, or any future native application published under the to888 brand.
This policy applies to all users of the Platform, including unregistered visitors who browse the site without creating an Account, registered Players who hold an active Account, and former Players whose Accounts have been closed but whose data is retained for the legally required retention period.
This policy does not apply to third-party websites or services that may be referenced on the Platform (e.g., game studio support portals, payment processor websites). Each third party operates under its own privacy policy, and to888 bears no responsibility for their data practices.
to888 collects the following categories of Personal Data, depending on how you interact with the Platform:
to888 collects Personal Data through the following channels:
to888 processes your Personal Data only where a valid legal basis exists. The principal legal bases we rely on are as follows:
| Legal Basis | When We Rely on It |
|---|---|
| Contract Performance | Processing your registration data, KYC documents, deposit/withdrawal records, and game activity is necessary to enter into and perform the contract between you and to888 (governed by our Terms & Conditions). |
| Legal Obligation | Processing required to comply with internationally applicable anti-money laundering (AML), counter-terrorism financing (CTF), and know-your-customer (KYC) regulations applicable to licensed gaming operators. |
| Legitimate Interests | Fraud detection, platform security, responsible gaming monitoring, abuse prevention, and aggregate analytics used to improve the Platform — where these interests are not overridden by your fundamental rights. |
| Consent | Sending you optional promotional emails, SMS messages, or WhatsApp communications about bonuses and new games — where you have explicitly opted in to receive such communications. You may withdraw consent at any time. |
| Vital Interests | In exceptional circumstances where processing is necessary to protect your vital interests, for example in a responsible gaming crisis requiring urgent support intervention. |
The Personal Data to888 holds about you is used for the following purposes:
Creating, maintaining, and securing your Account; verifying your identity and age (21+); processing login and session management; and communicating essential account notices such as security alerts, password reset requests, and deposit confirmations.
Initiating and confirming deposits from and withdrawals to your registered Indonesian bank account (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata) or e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja); reconciling transaction records; and investigating disputed transactions.
Verifying your identity, age, and address in compliance with our licence conditions and internationally recognised AML/CTF standards; screening your details against applicable sanctions lists; and retaining verification records for the legally required period.
Delivering sportsbook markets, casino games, live dealer tables, and slot titles; processing bet placement and settlement; calculating and crediting winnings; and maintaining your gameplay history for dispute resolution and regulatory audit purposes.
Monitoring your account activity for indicators of problem gambling; enforcing self-imposed deposit limits, loss limits, session time limits, cool-off periods, and self-exclusion orders; and proactively contacting you if our system identifies patterns consistent with gambling harm.
Detecting and investigating suspected fraud, account takeovers, duplicate account registration, bonus abuse, and money laundering activity; blocking or limiting accounts where a threat is identified; and sharing relevant data with law enforcement or regulatory authorities where legally required.
Responding to your inquiries submitted via live chat, WhatsApp, or email; resolving disputes; and maintaining support ticket records for quality assurance and training purposes.
Sending you promotional offers, bonus notifications, new game announcements, and seasonal promotions (e.g., Idul Fitri cashback offers, Ramadhan reload bonuses, Independence Day promotions) — but only where you have explicitly consented to receive such communications and only via the channels you have opted into.
Analysing aggregate, anonymised usage data to understand how Players navigate the Platform, which games and markets are most popular, and where technical issues arise — with the goal of continuously improving the user experience.
to888 does not sell your Personal Data. We share it only in the following defined circumstances and only to the minimum extent necessary for each purpose:
We engage carefully selected third-party service providers who process data strictly on our behalf and under binding data processing agreements, including:
to888 may disclose your Personal Data to law enforcement agencies, regulatory authorities, courts, or other government bodies where we are required or legally permitted to do so — for example, in response to a valid court order, a regulatory audit, or a law enforcement investigation into money laundering or fraud.
In the event that to888's business or assets are acquired by, merged with, or transferred to another entity, your Personal Data may form part of the assets transferred. You will be notified of any such transfer and any material change to this Privacy Policy in advance of the transfer taking effect, to the extent reasonably practicable.
We may share your Personal Data with any third party where you have given your specific, informed, and freely given consent to that disclosure.
to888 operates as an internationally licensed gaming platform. Your Personal Data may be transferred to, stored on, and processed by servers located outside of Indonesia — including in the jurisdiction where to888 holds its operating licence and in the countries where our cloud infrastructure and third-party service providers are based.
Wherever Personal Data is transferred internationally, to888 implements appropriate safeguards to ensure your data receives a level of protection consistent with internationally recognised privacy standards, including:
By using the Platform and providing your Personal Data, you acknowledge and consent to these international transfers, subject to the safeguards described above.
to888 retains your Personal Data for no longer than is necessary for the purposes for which it was collected, taking into account our legal obligations, dispute resolution needs, and legitimate business interests. The following retention guidelines apply:
| Data Category | Standard Retention Period |
|---|---|
| Account & Identity Data | Duration of Account plus a minimum of 5 years following Account closure, in accordance with AML/KYC regulatory requirements. |
| KYC Documents | 5 years following Account closure or the date of the last transaction, whichever is later. |
| Financial & Transaction Records | 5 years following the date of the transaction, for audit and regulatory compliance purposes. |
| Gameplay & Betting History | 3 years following Account closure or the date of the last recorded wager, whichever is later. |
| Support Ticket Transcripts | 2 years following resolution of the support interaction. |
| Marketing Consent Records | Retained for the duration of your consent plus 3 years thereafter, as evidence of the consent given. |
| Anonymised Analytics Data | Indefinitely — once Personal Data has been irreversibly anonymised, the retention limit no longer applies, as it can no longer be used to identify you. |
| Self-Exclusion Records | A minimum of 6 years following the self-exclusion order, to prevent circumvention of the self-exclusion period. |
Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised in accordance with our data disposal procedures.
to888 uses the following categories of cookies and similar technologies on the Platform:
These cookies are essential for the Platform to function. They maintain your login session, remember your language preference, and store your shopping cart state in the cashier. You cannot opt out of these cookies without losing core Platform functionality.
to888 uses first-party analytics tools to measure aggregate, anonymised Platform performance — page load times, navigation paths, error rates, and feature adoption. This data contains no personally identifiable information and is used solely to improve the Platform.
These cookies remember your preferences (e.g., preferred sports market, favourite game lobby view, default stake amount) to provide a more personalised experience on your next visit. They do not track you across other websites.
to888 does not deploy third-party advertising cookies, social media tracking pixels, cross-site behavioural tracking technologies, or any tracking technology that follows you outside of the Platform. Your browsing activity on other websites is of no interest or visibility to to888.
You may manage or delete cookies at any time through your browser settings. Note that disabling cookies beyond the functional category may impact your experience — for example, you may need to log in again on each visit and your preferences will not be saved. Instructions for managing cookies in the most common browsers are available on the respective browser's help page.
to888 implements a layered security architecture to protect your Personal Data against unauthorised access, accidental loss, disclosure, alteration, and destruction. Our principal security measures include:
Subject to applicable law and any overriding regulatory obligations (such as AML retention requirements), you have the following rights regarding your Personal Data held by to888:
| Right | What It Means |
|---|---|
| Right of Access | Request a copy of the Personal Data to888 holds about you, along with information about how it is used and with whom it is shared. |
| Right to Rectification | Request correction of any inaccurate or incomplete Personal Data we hold about you. |
| Right to Erasure | Request deletion of your Personal Data where it is no longer necessary for the purpose it was collected, where you have withdrawn consent, or where processing is unlawful — subject to our legal retention obligations. |
| Right to Restriction | Request that we limit our processing of your Personal Data in certain circumstances, for example while a rectification request is being investigated. |
| Right to Data Portability | Receive a copy of your Personal Data in a structured, commonly used, machine-readable format, and transmit it to another controller where technically feasible. |
| Right to Object | Object to processing carried out on the basis of our legitimate interests, including profiling. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests. |
| Right to Withdraw Consent | Withdraw your consent to marketing communications at any time. This does not affect the lawfulness of processing carried out prior to withdrawal. |
To exercise any of these rights, please contact our Data Privacy team at [email protected] with the subject line "Data Privacy Request." We will acknowledge your request within 5 business days and respond in full within 30 calendar days. Complex or multiple requests may take up to 60 days; we will inform you of any extension within the initial 30-day window.
The Platform is strictly intended for adults aged 21 and above. to888 does not knowingly collect Personal Data from any person under the age of 21. If you are under 21, you must not attempt to register an Account or use the Platform in any way.
If to888 discovers that Personal Data has been collected from a person under the age of 21 — whether through a false declaration of age, a parent or guardian's account being accessed by a minor, or any other means — we will immediately close the Account, void all associated wagers, and securely delete all Personal Data related to that individual. Winnings generated through an Account held by an underage individual will not be paid out.
If you are a parent or guardian and believe your child under the age of 21 has created an Account on to888, please contact us immediately at [email protected]. We will act swiftly to investigate and close the Account.
The Platform may contain references to, or display information from, third-party services such as game studio support portals, payment provider help pages, or sports data feeds. Navigating to any third-party website is entirely at your own risk and subject to that third party's own privacy policy and terms of use.
to888 has no control over, and accepts no responsibility for, the content, privacy practices, or data security standards of any third-party website or service. The presence of a reference to a third party on the Platform does not constitute an endorsement by to888 of that third party's privacy practices.
to888 reserves the right to amend this Privacy Policy at any time. The revised version will be published on the Platform with an updated effective date. Where an amendment materially affects how we process your Personal Data or substantively changes your rights, we will notify you via the email address registered on your Account at least 14 days before the change takes effect.
Your continued use of the Platform after the effective date of any amendment constitutes your acknowledgement of the revised policy. If you do not agree with the updated policy, you should cease using the Platform and close your Account prior to the effective date. Instructions for closing your Account are available from our support team at [email protected].
This Privacy Policy is governed by the laws of the jurisdiction in which to888 holds its operating licence. Any dispute arising out of or in connection with this policy, including any question regarding its existence, validity, or termination, that cannot be resolved through our internal process shall be referred to binding arbitration under the rules of an internationally recognised arbitration body selected by to888 in its reasonable discretion.
to888 acknowledges that users accessing the Platform from Indonesia are subject to Indonesian law. to888 applies internationally recognised data protection and privacy standards that are designed to meet or exceed the requirements of applicable frameworks across the jurisdictions it serves.
For any questions, concerns, or requests relating to this Privacy Policy or to888's data practices, please reach out through the following channels. All data-related inquiries are handled by our dedicated Data Privacy team:
We aim to acknowledge all privacy-related inquiries within 5 business days and resolve them within 30 calendar days of receipt.
Now that you understand how to888 handles your personal data, you can explore the Platform with confidence. Browse our games, review our FAQ, or log in to your Account.