bociltoto Platform Privacy Notice

This page describes what we collect when you use bociltoto and how we keep that data protected. Indonesia's digital payment ecosystem processed over 13 billion transactions in 2024, reflecting broad adoption of DANA, e-wallet, mobile banking, and local payment across urban and regional centres. When you register with bociltoto and fund your account through any of our nine supported payment methods, we collect only the information necessary for account verification, payment processing, and regulatory compliance.

We at bociltoto operate as a licensed gaming platform in supported jurisdictions. Your privacy is central to how we handle account data, transaction records, and gaming activity. This notice explains what we collect, why we collect it, how we protect it, and what rights you have over your information. We keep data encrypted and access-controlled; we never sell personal information to third parties unrelated to account servicing or legal requirements.

What We Collect When You Use bociltoto

We collect account registration details—email address, full name, date of birth, and government-issued identity number (KTP or passport)—to verify your identity and comply with gaming regulations in your jurisdiction. During account opening, we also collect your residential address, which we verify using address-matching services. This information is mandatory for account activation; without it, bociltoto cannot process your registration or deposits.

We collect payment details when you fund your account through DANA, e-wallet, mobile banking, local payment, online payment, e-wallet, mobile banking, local payment, online payment, or e-wallet. We do not store full payment instrument numbers (e.g., complete card numbers or wallet IDs) on our servers; instead, we tokenize payment data and route it through encrypted payment gateways managed by our processors. We retain transaction records—amounts, dates, payment method type, and settlement status—for 7 years to fulfil regulatory and audit requirements.

We collect gaming activity data—games played, stakes, outcomes, bonuses claimed—to calculate cashback and tier progression. We log your IP address, device type (mobile or desktop), and browser type to detect fraud and unauthorized account access. We also collect support interactions (chat history, email correspondence) if you contact bociltoto with questions or disputes.

How We Use Your Data

We use your identity and address data to comply with KYC (Know Your Customer) and AML (Anti-Money Laundering) regulations. Jurisdictions including Jakarta, Surabaya, Bandung, Medan, and Semarang require gaming platforms to verify player identity before processing withdrawals. We share this data only with our payment processors, regulatory auditors, and law enforcement if legally compelled. We do not use your information for marketing emails or third-party offers unless you explicitly consent during account setup.

We use your payment and transaction records to process deposits and withdrawals, calculate promotional cashback, and monitor for suspicious activity (e.g., rapid account changes, geographic anomalies, or funding from banned sources). If our fraud-detection systems flag your account, we may temporarily restrict withdrawals pending verification. We use your gaming activity data to track loyalty tier progression and tournament eligibility; we also aggregate anonymized gaming data to improve bociltoto's game selection and feature performance.

We use your support communications to resolve disputes and improve customer service. If you report an issue with deposits, withdrawals, or account access, we retain your correspondence to investigate the matter and prevent future problems. We may contact you via email or in-app chat to confirm resolution or request additional information.

Third-Party Processors and Data Transfers

We at bociltoto work with third-party providers to operate our platform. Our payment processors (handling mobile banking, local payment, online payment, e-wallet, mobile banking, local payment, online payment, e-wallet, mobile banking, local payment transactions) receive only the minimum data needed to settle your deposit or withdrawal—your account ID, payment amount, and banking details. These processors are contractually bound to protect your data and use it solely for payment processing.

Our hosting provider stores bociltoto's servers; your data may be physically located in data centres outside Indonesia, though encrypted at rest. We use SSL/TLS encryption for all data in transit, ensuring that payment information and account details are protected from interception. Our identity-verification partner receives your government ID image and address data; this partner is contractually obligated to delete verification data within 90 days of successful verification.

Cookies and Tracking

We use session cookies to maintain your bociltoto login and remember your language preference (English or regional). These cookies expire when you close your browser or log out. We do not use persistent cookies for tracking your behaviour across other websites. We do not use Google Analytics, Meta Pixels, or other third-party tracking scripts on bociltoto; our analytics are internal and anonymized.

Your Data Rights on bociltoto

We at bociltoto recognise your rights under data protection laws in supported jurisdictions. You have the right to access your personal data—we can export your account details, deposit history, and gaming activity upon request via in-app chat or email. You have the right to correct inaccurate information; if your address or identity details change, you can update them in your account settings or contact support for verification of major changes.

You have the right to request data deletion, though we must retain records required by gaming regulations and financial laws. After your account closure, we maintain anonymized transaction data for 7 years for audit purposes; personal identifiers (name, ID number, address) are deleted within 90 days unless a dispute or investigation requires retention. You have the right to lodge a complaint with your jurisdiction's data protection authority if you believe we have mishandled your data.

• •

  Access request: Email privacy@bociltoto with your account ID; we respond within 14 days with your exported data.

• •

  Correction request: Update non-sensitive data (address, email) directly in account settings; government ID changes require support verification.

• •

  Deletion request: Contact support to request account closure; we delete personal data within 90 days except where legal holds apply.

Security and Data Protection Measures

We at bociltoto encrypt all account data at rest using AES-256 encryption. Password hashes are salted and cannot be reversed by bociltoto staff; we never ask for your password via email or support chat. Access to customer data is restricted to bociltoto employees with legitimate business need; we maintain access logs and conduct quarterly audits. Our infrastructure undergoes annual security assessments by independent auditors; we are PCI DSS compliant for all payment card data handling.

We monitor for suspicious access patterns—login attempts from unusual locations, rapid password changes, or unusual withdrawal requests—and may restrict account access temporarily pending verification. We also scan for malware and patch security vulnerabilities in our systems within 48 hours of discovery. Despite these measures, we cannot guarantee absolute security; data breaches are rare but possible. If we detect a breach affecting your account, we notify you via email and provide guidance on securing your account.

bociltoto's Contact and Policy Updates

If you have questions about this privacy notice or wish to exercise your data rights, contact us via in-app chat or email privacy@bociltoto. We respond to privacy inquiries within 14 days. You may also contact our data protection officer if you believe bociltoto has violated data protection laws in your jurisdiction; this escalation does not affect your ability to file a complaint with your local data protection authority.

We at bociltoto update this privacy notice from time to time to reflect regulatory changes or operational improvements. Major changes are announced in-app and via email; continued use of bociltoto after the notification date constitutes acceptance of the revised notice. We maintain an archive of previous versions available on request. This notice does not constitute legal advice; consult a privacy attorney if you have specific concerns about your jurisdiction's data protection laws.

bociltoto services are available only in jurisdictions where local law permits online gaming. By using bociltoto, you acknowledge that your data processing complies with laws in your jurisdiction. We are not responsible for users accessing bociltoto from prohibited territories; such access occurs at your own legal risk and we do not collect or store data from such users intentionally.