Privacy Policy

This Privacy Policy ("Policy") governs the collection, processing, storage, and transfer of personal data by toro99 ("we", "our", "us"), the online gaming platform accessible at https://toro99.cam. It applies to all visitors, registered Members, and prospective Members interacting with the Platform from any location, with particular relevance to players based in Indonesia including Jakarta, Surabaya, Medan, Bandung, Bali, Yogyakarta, Semarang, and elsewhere across the Indonesian archipelago. By accessing the Platform or registering an Account, you acknowledge that you have read, understood, and accepted the practices described in this Policy. If you do not agree with any part of this Policy, you must discontinue use of the Platform immediately.

1 Definitions

For the purposes of this Privacy Policy, the following terms shall carry the meanings set out below:

• "Personal Data" — any information relating to an identified or identifiable natural person, including but not limited to name, date of birth, residential address, email address, phone number, financial account details, and device identifiers.
• "Processing" — any operation performed on Personal Data, whether automated or manual, including collection, recording, storage, adaptation, retrieval, consultation, use, disclosure, erasure, or destruction.
• "Data Controller" — toro99, which determines the purposes and means of Processing Personal Data collected through the Platform.
• "Data Processor" — any third-party service provider that processes Personal Data on behalf of toro99 under a data-processing agreement.
• "Member" — a registered user holding a verified Account on the toro99 Platform.
• "Platform" — the toro99 website at https://toro99.cam, associated mobile interfaces, and any API integrations through which Services are delivered.
• "Consent" — a freely given, specific, informed, and unambiguous indication of the data subject's agreement to the Processing of their Personal Data.
• "Cookie" — a small data file placed on a user's device by a website to store session information, preferences, and tracking signals.

2 Data We Collect

toro99 collects Personal Data across several categories depending on how you interact with the Platform. The table below summarizes the categories of data we collect and the primary reason for collection:

2.1 Sensitive Data

toro99 does not intentionally collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, health records, or biometric data, unless strictly required for regulatory compliance (for example, documentation of a self-exclusion request under responsible gaming procedures). Where such data is provided voluntarily by a Member, it will be processed only for the specific purpose for which it was submitted and will not be retained beyond that purpose.

3 How We Collect Data

toro99 collects Personal Data through the following channels and mechanisms:

3.1 Direct Submission

Data provided by Members directly when registering an account, completing KYC verification, making a deposit or withdrawal request, contacting customer support, or participating in a promotion or survey.

3.2 Automated Collection

Technical data collected automatically as you navigate the Platform, including via cookies, web beacons, pixel tags, and server log files. This data is collected regardless of whether you are logged in, and includes IP address, browser fingerprint, device identifiers, and session activity metrics.

3.3 Third-Party Sources

In limited circumstances, toro99 may receive Personal Data from third-party partners, including:

• Payment processors (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, BSI, OVO, DANA, GoPay, ShopeePay, LinkAja) — to confirm transaction completion or flag suspicious payment activity;
• Identity verification service providers — to cross-check KTP document authenticity;
• Fraud prevention and AML screening services — to identify politically exposed persons (PEPs) or individuals appearing on international sanctions lists;
• Analytics providers — aggregated behavioral signals used for Platform improvement (personal identifiers are stripped prior to receipt).

4 Legal Basis for Processing

toro99 processes Personal Data only where a valid legal basis exists. The legal bases we rely on are as follows:

4.1 Contractual Necessity

Processing required to fulfill toro99's contractual obligations to Members — including account creation, payment processing, game delivery, bonus administration, and customer support — is carried out because it is necessary to perform the contract formed when a Member registers on the Platform.

4.2 Legal Obligation

Certain processing activities are required to comply with applicable legal obligations, including anti-money-laundering (AML) regulations, Know Your Customer (KYC) requirements, and international sanctions screening mandated by toro99's licensing authority.

4.3 Legitimate Interests

toro99 processes some data on the basis of its legitimate business interests — for example, fraud detection and prevention, Platform security monitoring, and service improvement through aggregated analytics — provided those interests are not overridden by Members' fundamental rights and freedoms.

4.4 Consent

Where toro99 relies on Consent as its legal basis — particularly for direct marketing communications — Members may withdraw that Consent at any time by updating their notification preferences in Account Settings or by contacting support. Withdrawal of Consent does not affect the lawfulness of any processing carried out prior to withdrawal.

5 How We Use Your Data

toro99 uses the Personal Data we collect for the following specific, documented purposes:

• Account Management: Creating, maintaining, securing, and closing Member accounts;
• Identity Verification: Conducting KYC and age-verification checks to confirm eligibility (21+ only) and comply with AML requirements;
• Payment Processing: Facilitating deposits and withdrawals through Indonesian banking partners and e-wallet providers in IDR;
• Game & Betting Services: Delivering sports betting markets (including BRI Liga 1, EPL, Champions League coverage) , live casino, slots, and other gaming content available on the Platform;
• Bonus & Promotion Administration: Validating eligibility, crediting rewards, and enforcing wagering requirements;
• Customer Support: Responding to inquiries, resolving disputes, and maintaining communication records;
• Responsible Gaming: Monitoring play patterns to identify potential problem gambling indicators and enforcing self-imposed limits or exclusions;
• Fraud Prevention & Security: Detecting unauthorized access, collusive play, bonus abuse, and financial fraud;
• Legal & Regulatory Compliance: Meeting reporting obligations to licensing and regulatory authorities;
• Platform Improvement: Analyzing aggregated usage data to enhance the Member experience, fix bugs, and develop new features;
• Marketing Communications: Sending promotional offers, bonus notifications, and seasonal campaigns (Idul Fitri, Ramadhan, Indonesian Independence Day, and other relevant occasions) to Members who have opted in.

6 Data Sharing & Disclosure

toro99 does not sell, rent, or trade Personal Data to third parties for their own independent marketing purposes. We share Personal Data only in the following defined circumstances:

6.1 Service Providers (Data Processors)

toro99 engages carefully selected third-party service providers who process Personal Data solely on our behalf and under binding data-processing agreements. These include payment gateway operators, identity verification services, cloud hosting providers, customer support platform vendors, and fraud-detection software providers. All processors are contractually prohibited from using the data for any purpose beyond delivering the specified service.

6.2 Game Content Providers

Game studios integrated into the Platform — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft — may receive pseudonymized session data (e.g., player session tokens, bet history for the relevant game session) necessary to deliver their game content. These providers operate under their own data-processing agreements with toro99 and are not permitted to link session tokens back to personally identifiable information.

6.3 Regulatory & Law Enforcement Authorities

toro99 may disclose Personal Data to competent authorities when required to do so by law, court order, or binding regulatory direction from our licensing authority. We will notify the affected Member prior to disclosure wherever legally permitted to do so.

6.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of toro99's business, Personal Data held by toro99 may be transferred to the acquiring entity as part of that transaction. Members will be notified of any such transfer and of any material change to the processing of their data arising from it, with a minimum of thirty (30) days' advance notice.

6.5 With Your Explicit Consent

toro99 may share your Personal Data with additional third parties where you have provided explicit, informed Consent for such sharing. You may revoke this Consent at any time by contacting our support team.

7 Cookies & Tracking Technologies

toro99 uses cookies and similar tracking technologies to operate the Platform effectively, understand how Members interact with our services, and deliver a personalized experience. The categories of cookies we deploy are as follows:

You can manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent you from logging in or using core Platform features. Clearing cookies will log you out of your current session. toro99 does not use third-party advertising networks that track your activity across unaffiliated websites.

8 Data Retention

toro99 retains Personal Data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law or regulatory mandate. Our standard retention schedule is as follows:

• Active Account Data: Retained for the duration of the Member's active relationship with toro99;
• Closed Account Data: Core identity and financial transaction records retained for a minimum of five (5) years following account closure, in compliance with AML and financial record-keeping requirements;
• KYC Documentation: Retained for five (5) years from the date of submission or the date the Member relationship ends, whichever is later;
• Customer Support Correspondence: Retained for three (3) years from the date of the most recent interaction;
• Marketing Preference Records: Retained for the duration of the Member relationship plus two (2) years to evidence compliance with opt-in/opt-out history;
• Technical / Log Data: Retained for up to twelve (12) months, unless required for an active security investigation.

At the end of the applicable retention period, Personal Data is securely deleted or irreversibly anonymized so that it can no longer be linked back to an individual Member.

9 Data Security

toro99 implements a comprehensive set of technical and organizational security measures designed to protect Personal Data against unauthorized access, accidental loss, alteration, disclosure, or destruction. Our security framework includes:

• SSL/TLS Encryption: All data transmitted between your device and the Platform is encrypted using 256-bit SSL/TLS protocols, ensuring communications cannot be intercepted in transit;
• Encryption at Rest: Sensitive data stored in our databases — including financial account details and identity documents — is encrypted using AES-256 encryption;
• Access Controls: Personal Data is accessible only to authorized personnel on a strict need-to-know basis, enforced through role-based access control (RBAC) systems and multi-factor authentication (MFA);
• Regular Security Audits: toro99 engages independent cybersecurity firms to conduct penetration testing and vulnerability assessments on a regular schedule;
• Intrusion Detection Systems: Automated monitoring tools run continuously to detect and alert on anomalous access patterns, unauthorized login attempts, and data exfiltration indicators;
• Data Minimization: toro99 collects only the minimum Personal Data required for each processing purpose and restricts internal data sharing to the teams that require it.

10 Your Privacy Rights

toro99 respects your rights over your Personal Data. Depending on applicable law, you may be entitled to exercise some or all of the following rights:

Exercising Your Rights

To exercise any of the rights listed above, please contact our Data Protection team by email at [email protected] (plain text — not a clickable link). toro99 will respond to all verifiable requests within thirty (30) calendar days. Where a request is complex or numerous, we may extend this period by a further sixty (60) days and will notify you accordingly. toro99 may need to verify your identity before processing a data request to protect against unauthorized access to another Member's information.

11 Minors & Age Restriction

toro99 uses KYC verification procedures — including government-issued ID checks against the Indonesian KTP database — to confirm that all registering individuals meet the minimum age requirement of 21 years. If toro99 becomes aware that Personal Data has been collected from an individual under the age of 21, that data will be permanently deleted and the associated account will be closed immediately, with any deposited funds returned via the original payment method following identity confirmation of the legal guardian where appropriate.

If you are a parent or guardian and believe that your child has submitted Personal Data to toro99, please contact us immediately at [email protected] so that we can investigate and take the necessary remedial steps without delay.

12 Third-Party Links & Services

The toro99 Platform may reference or integrate third-party services — such as payment providers (BCA, BRI, OVO, GoPay), game studios (Pragmatic Play, Evolution Gaming, Spribe), and identity verification platforms — that operate independently from toro99 and maintain their own privacy policies. toro99 is not responsible for the privacy practices, data handling procedures, or content of any third-party service, and we strongly encourage Members to review the privacy policies of any third-party service they interact with.

The presence of a third-party service integration on the Platform does not constitute an endorsement by toro99 of that service's privacy standards beyond the contractual obligations established in our data-processing agreements with verified processors.

13 International Data Transfers

toro99 operates globally and may transfer Personal Data to service providers or infrastructure partners located outside of Indonesia. Where such transfers occur, toro99 ensures that appropriate safeguards are in place to maintain a level of data protection consistent with the standards described in this Policy. Safeguards include:

• Standard contractual clauses (SCCs) incorporated into agreements with all international processors;
• Transfers only to jurisdictions that provide an adequate level of data protection as assessed by internationally recognized frameworks;
• Binding corporate rules (BCRs) where applicable within affiliated group entities;
• Explicit Member consent obtained in advance for specific transfer scenarios where no other safeguard is available.

Members may request details of the safeguards in place for any specific international transfer by contacting our Data Protection team at the address given in Section 15.

14 Amendments to This Policy

toro99 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, new regulatory requirements, or developments in technology. When material changes are made, toro99 will provide advance notice by email to the registered address on file and by posting a prominent notice on the Platform at least seven (7) days before the revised Policy takes effect.

The "Last Updated" date at the top of this Policy will always reflect the date on which the most recent version came into effect. Continued use of the Platform after the effective date of any revision constitutes your acceptance of the updated Policy. We encourage Members to review this page periodically to stay informed about how toro99 protects their data.

15 Contact & Data Requests

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data by toro99, please reach out to our Data Protection team through the following channels:

• Email: [email protected] (plain text — not a clickable link)
• Subject Line for Data Requests: "Privacy Request — [Your Registered Name]"
• Live Chat: Available 24/7 via the chat widget on the Platform
• Response Time: Within 30 calendar days for formal data subject requests; within 24 hours for general privacy inquiries
• Support Languages: Bahasa Indonesia and English
• Operating Hours: 24 hours per day, 7 days per week, across WIB (UTC+7), WITA (UTC+8), and WIT (UTC+9) time zones

When submitting a data subject request, please provide your registered email address, registered phone number, and a brief description of your request to allow our team to locate your records and verify your identity promptly. toro99 does not charge a fee for processing data subject requests except in cases of manifestly unfounded or excessive repetition, in which case a reasonable administrative fee may apply.