Privacy Policy

This Privacy Policy applies to all personal data collected and processed by sgtoto (the "Platform"), accessible at https://sgtoto.cam. By creating an Account on sgtoto, you acknowledge that you have read, understood, and agreed to the terms of this Privacy Policy.

This Privacy Policy should be read in conjunction with our Terms & Conditions. If you do not agree with any part of this Privacy Policy, you must immediately cease use of the Platform and contact our support team to close your Account.

sgtoto is an English-language online betting platform serving the Indonesian market. We offer sports betting, live casino, togel (numbers lottery), and slot games to Members across Jakarta, Surabaya, Medan, Bandung, Bali, and the entire Indonesian archipelago.

sgtoto acts as the data controller for all personal data collected through the Platform. As data controller, we determine the purposes and means of processing your personal data and are responsible for ensuring that all data processing activities comply with applicable data protection laws.

For all data protection inquiries, including requests to exercise your data subject rights, please contact our Data Protection Officer at [email protected] with "Data Protection Inquiry" in the subject line. We will respond to all valid requests within 30 days.

sgtoto collects personal data from you at various stages of your relationship with the Platform, including during registration, identity verification (KYC), deposits and withdrawals, gameplay, customer support interactions, and promotional communications. The categories of personal data we collect are set out below.

sgtoto processes your personal data for the following purposes:

• Account Management: To create and maintain your sgtoto Account, authenticate your identity at login, and enable you to access all Platform features.
• Identity Verification & KYC Compliance: To verify that you are at least 21 years of age, that you are a resident of Indonesia (or otherwise legally permitted to use the Platform), and that you are the legitimate owner of the payment methods used to fund your Account. This is required under anti-money laundering (AML) and counter-terrorism financing (CTF) regulations.
• Processing Transactions: To process deposits, withdrawals, and internal Account transfers; to maintain accurate financial records; and to detect and prevent fraudulent transactions.
• Providing Betting & Gaming Services: To deliver sports betting markets, live casino games, togel draws, slot games, and all other Platform features; to settle bets; to credit winnings; and to track gameplay for responsible gaming monitoring.
• Fraud Prevention & Security: To monitor Account activity for suspicious or irregular patterns; to detect bonus abuse, arbitrage betting, and collusion; to protect against unauthorized Account access; and to comply with regulatory reporting obligations where fraud or money laundering is suspected.
• Customer Support: To respond to your inquiries, resolve disputes, provide technical assistance, and maintain records of all support interactions for quality assurance and training purposes.
• Marketing & Promotional Communications: To send you information about bonuses, promotions, new games, and Platform updates via email, SMS, or push notification (subject to your consent and marketing preferences). You may opt out of marketing communications at any time via your Account settings.
• Responsible Gaming Enforcement: To enforce deposit limits, loss limits, session time limits, cooling-off periods, and self-exclusion requests that you have activated; to monitor gameplay patterns for signs of problem gambling; and to provide support resources where appropriate.
• Legal & Regulatory Compliance: To comply with legal obligations including but not limited to AML/CTF requirements, tax reporting, data protection regulations, and licensing conditions imposed by gaming authorities.
• Business Analytics & Improvement: To analyze aggregate usage patterns, identify popular games and features, optimize Platform performance, conduct A/B testing, and develop new products and services. This processing is performed on anonymized or aggregated data wherever possible.

sgtoto processes your personal data on the following legal bases:

• Contractual Necessity: Processing is necessary to perform our contractual obligations to you under the Terms & Conditions, including Account creation, transaction processing, bet settlement, and customer support.
• Legal Obligation: Processing is necessary to comply with legal obligations including identity verification (KYC), AML/CTF screening, tax reporting, and regulatory audits imposed by gaming authorities and financial regulators.
• Legitimate Interests: Processing is necessary for our legitimate business interests, including fraud prevention, security monitoring, business analytics, Platform improvement, and enforcement of our Terms & Conditions, provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: Where required by law (e.g., for marketing communications or certain tracking technologies), we process your data based on your freely given, specific, informed, and unambiguous consent. You may withdraw consent at any time via your Account settings.

sgtoto does not sell, rent, or trade your personal data to third parties for their own marketing purposes. However, we do share your personal data with carefully selected third-party service providers who assist us in operating the Platform. All third-party processors are bound by strict contractual obligations to protect your data and use it only for the purposes specified by sgtoto.

Categories of Third-Party Recipients:

• Payment Processors: To facilitate deposits and withdrawals via BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, and LinkAja. These processors receive your financial data (account details, transaction amounts) necessary to execute payment instructions.
• Identity Verification Providers: To perform automated KYC checks, document verification, facial recognition, and sanctions screening. These providers receive your identity documents and personal details submitted during KYC.
• Game Providers & Software Suppliers: To deliver live casino games, slots, and other gaming content. Examples include Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, and Spribe. These providers may receive your username, bet history, and session data to operate their games on the Platform.
• Cloud Hosting & Infrastructure Providers: To host the Platform, store data securely, and ensure high availability and performance. Our hosting providers are ISO 27001 certified and implement industry-standard security controls.
• Customer Support Tools: To provide live chat, email ticketing, and telephone support. Support tool providers may access communications data and Account details necessary to resolve your inquiries.
• Marketing & Analytics Platforms: To send promotional emails, track campaign performance, and analyze user behavior. These platforms process email addresses, marketing preferences, and anonymized usage data.
• Fraud Prevention & Security Services: To detect fraudulent transactions, prevent bonus abuse, and identify collusion or bot activity. These services analyze gameplay patterns, IP addresses, and device fingerprints.
• Legal & Regulatory Authorities: Where required by law, we may disclose personal data to law enforcement agencies, tax authorities, financial intelligence units, gaming regulators, or courts in response to lawful requests, subpoenas, or court orders.

sgtoto implements robust technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. Our security controls include:

• SSL/TLS Encryption: All data transmitted between your device and the sgtoto Platform is encrypted using 256-bit SSL (Secure Socket Layer) encryption, the same standard used by major financial institutions.
• Data Encryption at Rest: All personal data stored in our databases is encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data is restricted to authorized personnel on a need-to-know basis. All access is logged and regularly audited.
• Password Security: Account passwords are hashed using bcrypt with salt, making them irreversible even in the unlikely event of a database breach.
• Two-Factor Authentication (2FA): Members can enable 2FA for an additional layer of Account security. We strongly recommend enabling this feature.
• Regular Security Audits: Our systems undergo regular penetration testing, vulnerability assessments, and security audits conducted by independent third-party security firms.
• DDoS Protection: The Platform is protected by enterprise-grade DDoS (Distributed Denial of Service) mitigation to ensure availability during attack attempts.
• Incident Response Plan: In the unlikely event of a data breach, sgtoto maintains a comprehensive incident response plan to contain the breach, assess its impact, notify affected Members, and report to relevant authorities as required by law.

sgtoto retains your personal data for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our Terms & Conditions. Specific retention periods are as follows:

• Active Account Data: Retained for the duration of your membership plus 7 years after Account closure to comply with AML/CTF record-keeping requirements and tax regulations.
• KYC Documents: Retained for 7 years after Account closure as required by financial services regulations.
• Financial Transaction Records: Retained for 10 years after the transaction date to comply with tax and accounting regulations.
• Bet History & Gameplay Data: Retained for 5 years after the bet is settled to facilitate dispute resolution and comply with gaming license conditions.
• Communications Data: Retained for 3 years after the communication date for customer service quality assurance and dispute resolution purposes.
• Marketing Data: Retained until you withdraw consent or for 2 years after your last interaction with marketing communications, whichever is earlier.
• Self-Exclusion Data: Retained permanently to prevent you from re-opening an Account during the exclusion period and to honor your self-exclusion request indefinitely if you do not request reactivation.

After the applicable retention period expires, your personal data is securely deleted or anonymized such that it can no longer be associated with you.

Under applicable data protection laws, you have the following rights regarding your personal data:

• Right of Access: You have the right to request a copy of the personal data we hold about you. You can view much of this data directly in your Account dashboard. For a full data export, contact our Data Protection Officer.
• Right to Rectification: If you believe any personal data we hold about you is inaccurate or incomplete, you have the right to request correction. You can update most Account details yourself via your Account settings.
• Right to Erasure ("Right to be Forgotten"): In certain circumstances, you have the right to request deletion of your personal data. However, this right is subject to legal limitations — we cannot delete data we are legally required to retain (e.g., financial transaction records for AML compliance).
• Right to Restrict Processing: You have the right to request that we restrict processing of your personal data in certain circumstances, such as while we verify the accuracy of disputed data.
• Right to Data Portability: You have the right to receive personal data you provided to us in a structured, commonly used, and machine-readable format, and to request transmission of that data to another service provider where technically feasible.
• Right to Object: You have the right to object to processing of your personal data where we rely on legitimate interests as the legal basis, unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where we process personal data based on your consent (e.g., marketing communications), you have the right to withdraw that consent at any time via your Account settings. Withdrawal of consent does not affect the lawfulness of processing prior to withdrawal.
• Right to Lodge a Complaint: If you believe we have processed your personal data unlawfully, you have the right to lodge a complaint with your local data protection authority.

To exercise any of these rights, contact our Data Protection Officer at [email protected] with "Data Subject Rights Request" in the subject line. We will respond to all valid requests within 30 days, subject to identity verification.

sgtoto uses cookies and similar tracking technologies to enhance your experience on the Platform, analyze usage patterns, and deliver personalized content and advertising. A cookie is a small text file stored on your device by your web browser when you visit a website.

Types of Cookies We Use:

• Strictly Necessary Cookies: Essential for the Platform to function. These cookies authenticate your login session, remember your language preference, and enable secure transactions. You cannot disable these cookies without making the Platform unusable.
• Performance & Analytics Cookies: Collect anonymized data about how visitors use the Platform, including pages visited, time on site, and error messages encountered. This helps us improve Platform performance and user experience.
• Functionality Cookies: Remember your preferences such as favorite game filters, display settings, and previously selected bet types to provide a more personalized experience.
• Marketing & Advertising Cookies: Track your browsing activity to deliver targeted promotional offers and measure the effectiveness of our marketing campaigns. These cookies may be set by third-party advertising networks.

You can manage cookie preferences through your browser settings. Most browsers allow you to block or delete cookies. However, disabling certain cookies may impair Platform functionality. Note that strictly necessary cookies cannot be disabled without preventing you from using core Platform features.

The sgtoto Platform may contain links to third-party websites, including payment processors, game providers, and social media platforms. This Privacy Policy applies only to personal data collected by sgtoto. When you click on a third-party link, you leave the sgtoto Platform and are subject to the privacy policies of that third-party site.

sgtoto is not responsible for the privacy practices, content, or security of third-party websites. We encourage you to review the privacy policies of any external sites you visit. Third-party game providers (e.g., Evolution Gaming, Pragmatic Play) may collect additional data during gameplay under their own privacy policies.

sgtoto reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data processing practices, legal requirements, or business operations. The "Last Updated" date at the top of this page indicates when the Policy was most recently revised.

Material changes that significantly affect your rights will be communicated via email to the address registered on your Account and/or via prominent notice on the Platform homepage. Continued use of the Platform following publication of an updated Privacy Policy constitutes your acceptance of those changes.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact our Data Protection Officer:

For general customer support inquiries unrelated to data protection, please use our live chat feature (available 24/7) or email [email protected] with an appropriate subject line.