Privacy Policy

Throughout this Privacy Policy, the following terms carry the meanings assigned below unless context clearly requires otherwise.

to338 collects the categories of Personal Data listed in the table below. We collect only what is necessary for the purposes identified in Section 4.

Sensitive Data. to338 does not intentionally collect special categories of sensitive personal data such as racial or ethnic origin, religious beliefs, health information, or biometric data. If any such information is incidentally disclosed during a support interaction, it will not be recorded or processed beyond what is strictly necessary to resolve the matter.

to338 collects Personal Data through the following channels:

3.1 Direct Provision. You provide Personal Data directly when you register an account, complete the KYC process, make a deposit or withdrawal, contact customer support, or opt in to marketing communications. All information you submit voluntarily through the Platform is collected at the time of submission.

3.2 Automated Collection. When you visit or interact with the Platform, certain technical and usage data is collected automatically through cookies, server logs, and analytics tools. This includes your IP address, browser fingerprint, session data, and game activity. For full details, see the Cookies & Tracking section below.

3.3 Third-Party Sources. In limited circumstances, to338 may receive Personal Data from third parties for specific, defined purposes, including:

• Payment processors (e.g., virtual account providers for BCA, BRI, BNI, Mandiri; e-wallet gateways for OVO, DANA, GoPay, ShopeePay, LinkAja) who confirm transaction status and payment method ownership.
• Identity verification services who cross-reference submitted documents against authoritative data sources during KYC.
• Fraud prevention partners who flag device fingerprints or IP addresses associated with known fraudulent activity.
• Game content providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft) who may share aggregated session data with us for player protection and game integrity purposes.

Data received from third parties is handled in accordance with this Privacy Policy and is not used for any purpose beyond that for which it was received.

to338 processes Personal Data only where a lawful basis exists. The table below maps each processing purpose to the data category used and the applicable legal basis.

to338 does not sell, rent, or trade your Personal Data. We share data only in the circumstances listed below, and only to the minimum extent necessary for the stated purpose.

5.1 Third-Party Service Providers. We engage external processors to help operate the Platform, including payment gateway providers, identity verification vendors, cloud hosting and infrastructure providers, customer support platform operators, and analytics tool providers. Each processor is bound by a written data-processing agreement that restricts their use of your data exclusively to the services they provide to us.

5.2 Payment Institutions. To complete deposit and withdrawal transactions, we share necessary financial and identity data with the relevant payment institutions. For Indonesian players this includes local bank virtual account operators (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja). Data shared with payment institutions is limited to what is required to authenticate and complete the transaction.

5.3 Game Content Providers. Certain game session data — including Player ID, game type, stake amount, and result — is shared with our licensed game studio partners (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft) for game integrity, audit, and responsible-gaming monitoring purposes. Game studios are prohibited from using this data for any commercial or marketing purpose.

5.4 Legal and Regulatory Disclosure. to338 may disclose Personal Data to law enforcement agencies, courts, regulatory bodies, or other competent authorities where required to do so by law, court order, or where we believe disclosure is necessary to protect the rights, property, or safety of to338, our players, or the public. We will notify affected players of any such disclosure to the extent permitted by law.

5.5 Business Transfers. In the event of a merger, acquisition, restructuring, or sale of all or part of to338's business, Personal Data may be transferred to the acquiring entity as part of that transaction. We will provide notice to affected players prior to any such transfer and will ensure that the acquiring entity is bound by privacy obligations no less protective than those in this policy.

5.6 Aggregated and Anonymised Data. to338 may share aggregated, de-identified, and anonymised data (which cannot reasonably be used to identify any individual) with research partners, industry bodies, and analytics providers for statistical and market-research purposes.

Some of to338's third-party processors operate infrastructure located outside Indonesia. Where Personal Data is transferred to servers or personnel in another country, to338 ensures that appropriate safeguards are in place to provide a level of data protection equivalent to the standards described in this policy. Safeguards employed include:

• Contractual clauses in data-processing agreements that impose obligations on the recipient consistent with internationally recognised data-protection standards.
• Transfers only to jurisdictions that maintain adequate data-protection regimes as recognised by the relevant licensing authority overseeing to338's operations.
• Technical controls including end-to-end encryption during transit and access-restriction policies limiting who may handle transferred data at the destination.

By using the to338 Platform, you acknowledge that your Personal Data may be processed in countries outside Indonesia where data-protection laws may differ from those in your country of residence. to338 takes all reasonable steps to ensure your data remains protected regardless of where it is processed.

to338 retains Personal Data for no longer than is necessary to fulfil the purposes for which it was collected, including satisfying any legal, regulatory, accounting, or reporting requirements. The retention schedule below summarises our standard periods.

Upon expiry of the relevant retention period, Personal Data is securely deleted or anonymised so that it can no longer be linked to any individual. Where deletion is not immediately possible due to backup or archival system constraints, the data will be isolated from active processing and deleted at the next scheduled maintenance cycle.

8.1 Technical Safeguards. to338 implements a comprehensive set of technical controls to protect Personal Data against unauthorised access, loss, alteration, or disclosure. These include:

• TLS 1.2 / 1.3 encryption for all data in transit between the player's device and our servers.
• AES-256 encryption for sensitive data fields stored at rest in our databases.
• One-way bcrypt hashing for account passwords — we are unable to retrieve plain-text passwords under any circumstances.
• Tokenisation of payment method details so that full bank account numbers and card numbers are never stored on to338 servers.
• Web application firewall (WAF) and DDoS mitigation systems protecting the Platform from external attacks.
• Intrusion detection systems (IDS) monitoring server traffic for anomalous patterns.

8.2 Organisational Safeguards. Access to Personal Data within to338 is granted on a strict need-to-know basis. Staff who handle player data receive privacy and data-security training upon onboarding and annually thereafter. All personnel with data access are bound by confidentiality obligations.

8.3 Incident Response. In the event of a confirmed data breach that is likely to result in a risk to the rights and freedoms of affected players, to338 will notify affected individuals within 72 hours of becoming aware of the breach, to the extent this is practicable. The notification will describe the nature of the breach, the data affected, the likely consequences, and the measures taken or proposed to address it.

8.4 Player Responsibility. While to338 maintains robust security infrastructure, the security of your account also depends on you. You are responsible for keeping your login credentials confidential, not sharing your account details with others, and logging out of the Platform when using shared or public devices. If you suspect your account has been compromised, contact support immediately at [email protected].

to338 uses cookies and similar tracking technologies to operate the Platform effectively, remember your preferences, and understand how players engage with our content. The table below describes each category of cookie we use.

Managing Cookies. Most modern browsers allow you to view, block, and delete cookies through the browser's privacy or security settings. Blocking strictly necessary cookies will prevent you from logging in or placing bets. For full browser-specific instructions, refer to the help documentation of your browser (e.g., Chrome, Firefox, Safari, Samsung Internet).

Do Not Track. Some browsers transmit a "Do Not Track" (DNT) signal. to338 currently does not alter its data collection practices in response to DNT signals, as no uniform standard for interpreting them has been established. We will revisit this position as industry standards evolve.

As a player on the to338 Platform, you hold the following rights in relation to your Personal Data. To exercise any of these rights, contact our support team at [email protected] with the subject line "Data Subject Request" and specify which right you wish to exercise. We will respond within thirty (30) calendar days of receiving a valid and verifiable request.

The to338 Platform is strictly restricted to adults aged 21 years and above. to338 does not knowingly collect, store, or process Personal Data belonging to any person under the age of 21. The Platform's registration process requires applicants to confirm their date of birth, and KYC verification is used to enforce this restriction.

If to338 becomes aware that Personal Data has been collected from an individual under the age of 21, we will immediately suspend the associated account, void all bets placed, and delete the minor's data from our systems as promptly as possible.

Parents and guardians who believe that a minor in their household may have accessed or registered on the Platform are urged to contact to338 support immediately at [email protected]. We take the protection of minors extremely seriously and will prioritise and expedite all such reports. For guidance on preventing underage access to gambling platforms, please visit our Responsible Gaming page.

to338 may send you promotional communications — including bonus offers, seasonal promotions tied to events such as Idul Fitri, Ramadhan, and Indonesian Independence Day (17 August), new game announcements, and platform updates — where you have given us explicit consent to do so at the time of registration or subsequently through your account settings.

12.1 Channels. Marketing communications may be delivered via email, WhatsApp, or in-platform notifications. We will never send unsolicited SMS messages to numbers you have not registered with your account.

12.2 Opting Out. You may withdraw your marketing consent and opt out of all promotional communications at any time by:

• Clicking the unsubscribe link included in any marketing email;
• Sending an opt-out message to our customer support team via WhatsApp or email at [email protected] with the subject line "Marketing Opt-Out"; or
• Updating your communication preferences in your to338 account settings once the feature is available.

Opting out of marketing communications will not affect the delivery of transactional messages related to your account — such as deposit confirmations, withdrawal notifications, KYC status updates, and security alerts. These service-critical messages cannot be disabled while your account remains active.

12.3 Profiling for Marketing. to338 may use your transactional and usage data to segment players and tailor promotional offers to your betting activity and preferences. This profiling is carried out on the basis of your consent. You have the right to object to this profiling at any time, as described in Section 10.

to338 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, regulatory requirements, or Platform functionality. The revised policy will be published on this page with an updated effective date at the top of the document.

Material Changes. Where an amendment constitutes a material change — for example, a new category of data being collected, a new sharing arrangement with a third party, or a change to your rights — to338 will notify all registered players by email to the address on file at least fourteen (14) days before the change takes effect. Continued use of the Platform after the effective date of a revised policy constitutes acceptance of the updated terms.

Minor Changes. Non-material updates such as clarifications of existing language, typographical corrections, or changes to contact details may be published without prior notice, though the effective date will always be updated to reflect the revision date.

We encourage all players to review this Privacy Policy periodically to stay informed about how to338 protects your information. The current version of this policy is always accessible at https://to338.app/privacy-policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or the way to338 handles your Personal Data, please reach out to our support team using the details below. Our customer support team is available 07:00–24:00 WIB, seven days a week, and includes Indonesian-speaking agents who can assist you in your preferred language.