Privacy Policy — to178

The following terms are used consistently throughout this Privacy Policy. Where a term is also defined in to178's Terms & Conditions, the meaning given in that document applies unless this Policy provides a more specific definition.

to178 collects Personal Data through three primary channels: information you provide directly, data generated automatically by your use of the Platform, and information received from third-party service providers. The categories and specific data elements collected under each channel are set out below.

2.1 Data You Provide Directly

• Registration data: Full legal name, date of birth, residential address, email address, mobile phone number, and chosen username.
• KYC documents: Government-issued photo identification (Indonesian National Identity Card / KTP, passport, or driver's licence), proof of address (utility bill or bank statement), and — where required — proof of payment method ownership.
• Financial data: Bank account numbers (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI, Bank Permata) and e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja) used for deposit and withdrawal transactions. to178 does not store full card numbers or card CVV codes.
• Support communications: The content of any messages, emails, or live-chat conversations you initiate with the to178 support team, including any attachments you choose to provide.
• Responsible gaming declarations: Self-disclosed information about your gaming habits submitted when setting deposit limits, loss limits, session timers, cooling-off periods, or self-exclusion.

2.2 Data Collected Automatically

• Device and technical data: IP address, browser type and version, operating system, device type, screen resolution, and time zone (defaulting to WIB, UTC+7 for Indonesian users).
• Usage data: Pages visited, features accessed, bet history, game session durations, deposit and withdrawal event logs, and timestamps of login and logout events.
• Geolocation data: Approximate geographic location derived from your IP address. to178 does not collect precise GPS coordinates unless you explicitly grant that permission on a mobile device.
• Cookie and tracker data: Session cookies, persistent cookies, and local storage values as described in Section 8.

2.3 Data Received from Third Parties

• KYC verification providers: Verification status, fraud risk scores, and document authentication results returned by our third-party identity verification partners.
• Payment processors: Transaction status, reference numbers, and basic payment-method metadata returned by local Indonesian bank gateways and e-wallet providers.
• Fraud and AML screening: Risk indicators and watchlist screening results returned by our anti-money laundering compliance data providers.
• Game studios: Bet placement records, round outcomes, and return-to-player statistics transmitted by third-party game providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Pocket Games Soft, and Spribe.

to178 uses the Personal Data it collects for the following specific purposes. Each purpose is linked to a legal basis, which is set out in detail in Section 4.

to178 does not use Personal Data for automated profiling that produces legal or similarly significant effects without human review. Responsible gaming monitoring systems may flag accounts for manual review by our compliance team, but no punitive action is taken based solely on automated output.

to178 processes Personal Data only where a recognised legal basis exists. The four bases applicable to our processing activities are described below.

• Contract performance: Processing is necessary to provide the Services you have contracted for — including creating your account, processing transactions, and delivering game content. Without this processing, to178 cannot perform its obligations to you.
• Legal obligation: Processing is necessary to comply with applicable anti-money laundering (AML) regulations, Know Your Customer (KYC) requirements, and any other legal obligations applicable to to178 under the laws of its licensing jurisdiction.
• Legitimate interests: Processing is carried out for to178's legitimate business interests — including fraud detection, platform security, responsible gaming monitoring, and aggregate analytics — provided those interests are not overridden by your privacy rights. You may object to processing on this basis by contacting support@to178.cam.
• Consent: For optional processing activities — specifically, sending you promotional communications about bonuses, new games, and seasonal offers — to178 relies on your freely given, specific, and informed consent. You may withdraw consent at any time by updating your notification preferences in your account settings or by contacting support. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

to178 does not sell, rent, or trade your Personal Data. We share data only in the circumstances described below, and only to the minimum extent necessary for the stated purpose.

5.1 Service Providers (Data Processors)

to178 engages third-party companies to perform specific functions on our behalf. These companies act as Data Processors and are contractually prohibited from using your data for any purpose other than providing the contracted service to to178. Current categories of Data Processors include:

• Cloud infrastructure providers: Host Platform servers and databases under strict data-security agreements.
• KYC and identity verification providers: Authenticate documents and perform watchlist screening on behalf of to178.
• Payment gateway and banking partners: Process deposits and withdrawals through Indonesian bank networks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI, Bank Permata) and e-wallet integrations (OVO, DANA, GoPay, ShopeePay, LinkAja).
• Third-party game studios: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Pocket Games Soft, Spribe, and others whose games are integrated into the Platform. These studios receive the minimum data necessary to authenticate game sessions and record outcomes.
• Customer support software providers: Provide the ticketing and live-chat infrastructure used by our support team.
• Fraud and AML analytics providers: Supply risk-scoring and watchlist screening services to meet our compliance obligations.

5.2 Legal Disclosures

to178 may disclose Personal Data to law enforcement agencies, regulators, or other public authorities where required or permitted by applicable law — for example, in response to a court order, subpoena, or formal regulatory request. Where legally permitted, to178 will endeavour to notify affected Players before making such disclosures.

5.3 Business Transfers

In the event that to178 undergoes a merger, acquisition, restructuring, or sale of all or part of its assets, Player Personal Data may be transferred to the acquiring entity as part of that transaction. to178 will notify registered Players via email at least 30 days before any such transfer takes effect, and will ensure the receiving entity is bound by privacy obligations no less protective than those in this Policy.

to178 retains Personal Data only for as long as necessary to fulfil the purposes described in this Policy, or as required by applicable law. The following retention schedule applies:

Following the expiry of the applicable retention period, Personal Data is securely deleted or anonymised so that it can no longer be associated with you as an individual. Anonymised, aggregated data may be retained indefinitely for statistical analysis and product development purposes.

Depending on your jurisdiction, you may have some or all of the following rights in respect of your Personal Data held by to178. to178 applies these rights to all Players regardless of jurisdiction as a matter of policy.

• Right of access: You may request a copy of all Personal Data to178 holds about you. We will provide this in a structured, readable format within 30 days of a verified request.
• Right to rectification: If any Personal Data we hold about you is inaccurate or incomplete, you may request that we correct it. You can update basic account details directly from your account settings; for KYC-related corrections, contact support@to178.cam.
• Right to erasure ("right to be forgotten"): You may request that we delete your Personal Data. This right is subject to overriding legal obligations — for example, we are required to retain KYC and financial records for the periods specified in Section 6 and cannot delete them on request. We will always inform you of the extent to which a deletion request can be fulfilled.
• Right to restriction: You may request that we temporarily restrict the processing of your data while a dispute over its accuracy or the lawfulness of processing is resolved.
• Right to data portability: You may request a machine-readable export of the Personal Data you have provided to us directly (e.g., account information and self-reported preferences). This right applies to data processed on the basis of contract or consent.
• Right to object: You may object at any time to processing of your Personal Data carried out on the basis of legitimate interests, including the use of your data for analytical or profiling purposes. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on consent (e.g., marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

to178 uses cookies and similar technologies (local storage, session storage, pixel tags) to operate the Platform, maintain session security, and understand how Players interact with the site. We do not use third-party advertising cookies or cross-site tracking pixels.

8.1 Cookie Categories

8.2 Cookie Lifespan

Session cookies expire when you close your browser. Persistent cookies used for functional and analytics purposes are set with a maximum lifespan of 13 months, after which they expire automatically and are renewed only if you continue to use the Platform. Security-related persistent cookies follow a shorter refresh cycle based on session activity.

8.3 Browser-Level Controls

You may configure your browser to block or delete cookies at any time. Please note that blocking strictly necessary or security cookies will prevent you from logging in to your to178 account. Detailed instructions for managing cookies in the most common browsers are available via your browser's built-in help documentation.

to178 implements a layered set of technical and organisational security controls to protect Personal Data against unauthorised access, disclosure, alteration, and destruction. Our current security architecture includes the following measures.

• Encryption in transit: All data transmitted between your device and to178's servers is encrypted using TLS 1.2 or higher (256-bit SSL). Unencrypted HTTP connections are automatically redirected to HTTPS.
• Encryption at rest: Sensitive Personal Data — including KYC documents, financial account references, and hashed credentials — is encrypted at rest using AES-256.
• Access controls: Access to Personal Data is restricted to to178 personnel and authorised Data Processors who require it to perform their job functions. Access is governed by role-based permissions and reviewed quarterly.
• Password security: Account passwords are stored as salted hashes using a strong one-way hashing algorithm. to178 staff cannot retrieve your plain-text password under any circumstances.
• Penetration testing: to178 commissions independent security assessments of the Platform on a regular basis to identify and remediate vulnerabilities before they can be exploited.
• Incident response: In the event of a Personal Data breach that poses a risk to Players, to178 will notify affected Players and relevant authorities within the timeframe required by applicable law, and no later than 72 hours after becoming aware of the breach.

to178 operates internationally, and some of the Data Processors described in Section 5 are located outside Indonesia. When Personal Data is transferred to a country that does not provide an equivalent level of data protection, to178 implements appropriate safeguards to ensure your data remains protected to the same standard as described in this Policy.

Applicable safeguards include:

• Contractual clauses: to178 enters into binding data processing agreements with all third-party processors that include standard contractual clauses obligating those processors to handle data in accordance with this Policy.
• Adequacy assessments: Before engaging a new Data Processor located outside Indonesia, to178 conducts a data transfer impact assessment to evaluate whether the recipient's domestic legal framework provides adequate protection for Personal Data.
• Minimisation: Only the minimum Personal Data necessary for the contracted service is transferred internationally. Where a service can be provided using anonymised or pseudonymised data, to178 will prefer that approach.

If you would like further information about the specific safeguards applied to any particular international transfer, or to obtain a copy of the relevant contractual clauses, please contact support@to178.cam.

The to178 Platform is strictly intended for adults aged 21 and over. to178 does not knowingly collect or process Personal Data from any individual under the age of 21. As part of the account registration process, all applicants are required to confirm that they are at least 21 years of age, and identity verification (KYC) is performed to validate this declaration.

If to178 becomes aware that Personal Data has been collected from a person under the age of 21 — whether through a fraudulent registration, a failed KYC check, or any other means — the following steps will be taken immediately:

• The account will be suspended and access to the Platform will be blocked.
• All funds held in the account will be handled in accordance with to178's Terms & Conditions and applicable legal requirements regarding underage gambling.
• All Personal Data associated with the underage account will be securely deleted as soon as the legal and compliance review is complete, subject to any mandatory retention obligations.

to178 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable legal requirements, or Platform features. The current version of this Policy is always accessible at https://to178.cam/privacy-policy. The "Last updated" date at the top of this page reflects the date on which the most recent revision came into effect.

Where an amendment materially changes the way we process your Personal Data — for example, introducing a new processing purpose, engaging new categories of third-party processors, or altering retention periods — to178 will notify registered Players by email at least 14 days before the change takes effect. Your continued use of the Platform after the effective date of a material amendment constitutes your acceptance of the revised Policy.

Where an amendment is minor in nature — such as a typographical correction, a clarification that does not alter substantive meaning, or an update to contact details — it may take effect immediately upon publication without advance notice.

If you do not accept a material amendment to this Policy, you should discontinue use of the Platform and contact support@to178.cam to request account closure. We will process your closure request and handle your remaining data in accordance with the version of the Policy in effect at the time of closure.

If you have any questions, concerns, or complaints about this Privacy Policy or the way to178 handles your Personal Data, please contact our support team. Note that the email address below is provided as plain text only and is not a clickable link — please copy it manually into your email client.

Our support team operates 24 hours a day, 7 days a week, including Indonesian public holidays such as Idul Fitri, Independence Day (17 August), and Nyepi. When submitting a data rights request, please include your registered account username, the specific right you wish to exercise (as listed in Section 7), and a copy of your identity document so we can verify your identity before acting on the request.

For responsible gaming support — including requests to activate self-exclusion, deposit limits, cooling-off periods, or session timers — please visit our Responsible Gaming page or contact the support team directly. Responsible gaming requests are treated as the highest priority and actioned immediately upon receipt, irrespective of any other pending queries.