Privacy Policy

to303 is an online gaming platform operating at https://to303.ws, offering sports betting, live casino, slot gacor (high-RTP online slots), togel (Indonesia's traditional numbers lottery), and other gaming products to players in the Indonesia market and other eligible jurisdictions. to303 acts as the data controller in respect of all personal data collected through the Platform.

When we refer to "personal data" in this Policy, we mean any information that identifies or could reasonably be used to identify you as an individual — including your name, date of birth, contact details, financial account information, device identifiers, and usage behaviour on the Platform.

If you have any questions about how to303 handles your personal data, or wish to exercise any of your privacy rights, please contact our Data Support team at [email protected].

to303 collects the following categories of personal data from Members and platform visitors:

to303 collects personal data through the following channels:

• Directly from you: When you register an Account, complete your profile, submit KYC documents, make a deposit or withdrawal, contact our support team, or interact with any form or input field on the Platform.
• Automatically: When you browse or use the Platform, our servers and analytics tools automatically record Technical Data and Usage Data such as your IP address, device fingerprint, session duration, and game activity.
• From payment processors: When you execute a transaction via BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, or LinkAja, the relevant payment processor shares transaction confirmation data with us to credit or debit your Account balance.
• From KYC and identity verification partners: Where to303 engages a third-party KYC verification service, that service may return identity verification scores, document authenticity signals, and watchlist screening results to us.
• From cookies and similar technologies: As described in Section 8 below, to303 uses first-party cookies and session storage to maintain your login state, personalise your experience, and measure platform performance.

to303 processes your personal data on one or more of the following lawful grounds:

• Contractual necessity: Processing is required to perform our contract with you — namely, to operate your Account, process deposits and withdrawals in IDR (Rp), settle bets and game rounds, and deliver customer support.
• Legal obligation: Processing is required to comply with applicable anti-money-laundering (AML) regulations, fraud prevention obligations, KYC requirements, and any court order or regulatory direction that applies to to303.
• Legitimate interests: Processing is necessary for to303's legitimate business interests, including fraud detection, security monitoring, platform analytics, product improvement, and responsible gaming enforcement, provided those interests are not overridden by your privacy rights.
• Consent: Where to303 relies on your consent as the legal basis for processing — for example, when sending you promotional emails or push notifications about bonuses, seasonal promotions (Idul Fitri, Ramadhan, Indonesian Independence Day), or new game releases — you may withdraw that consent at any time by contacting support or updating your notification preferences in your account dashboard.

to303 uses your personal data for the following specific purposes:

• Account management: Creating, maintaining, and securing your Account; authenticating your login sessions; and managing account settings and preferences.
• Identity verification: Conducting KYC checks to confirm your identity, age (21+ requirement), and eligibility to use the Platform, and to screen against fraud, sanction, and politically exposed person (PEP) watchlists.
• Payment processing: Facilitating deposits and withdrawals via supported Indonesian banks and e-wallets; verifying that payment accounts are registered in your own name; reconciling transaction records.
• Gaming operations: Recording wager placements, settling game rounds and sports markets, applying bonus credits, calculating cashback, and maintaining an auditable transaction history for every Member.
• Responsible gaming: Monitoring gaming behaviour for indicators of problem gambling; applying self-imposed deposit limits, session reminders, cooling-off periods, and self-exclusion instructions; intervening proactively where our systems identify at-risk behaviour patterns.
• Customer support: Responding to enquiries, resolving disputes, and investigating complaints submitted via email or live chat.
• Fraud prevention and security: Detecting and preventing unauthorised access, multi-accounting, collusion, bonus abuse, money laundering, and other prohibited conduct as defined in our Terms & Conditions.
• Platform improvement: Analysing aggregated and anonymised usage data to improve the Platform's performance, user experience, game catalogue, and promotional offerings.
• Marketing communications: Sending you promotional emails, notifications, or in-platform messages about bonuses, new games, sportsbook markets (BRI Liga 1, EPL, Timnas Indonesia), and seasonal campaigns — only where you have opted in and subject to your right to withdraw consent at any time.
• Legal compliance: Meeting our obligations under applicable law and cooperating with competent authorities where required.

to303 does not sell your personal data. We share your data only in the following limited circumstances:

• Game Providers: When you launch a game from a third-party studio such as Pragmatic Play, Evolution Gaming, PG Soft, Habanero, NetEnt, Microgaming, or Spribe, that provider receives the minimum data necessary to initialise the game session — typically a session token, your Account currency (IDR), and your preferred language setting. Game Providers do not receive your full identity data.
• Payment processors: To facilitate deposits and withdrawals, to303 shares your payment account details (bank name, account number) with the relevant Indonesian bank or e-wallet service operator (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, LinkAja). These parties act as independent data controllers for the transaction data they process.
• KYC and identity verification partners: To verify your identity documents and screen against watchlists, to303 may share copies of your KTP, passport, or SIM with a contracted KYC service provider. Such providers process data solely on our behalf under strict confidentiality obligations.
• Fraud and security vendors: to303 may share Technical Data and Transaction Data with specialist fraud-detection platforms to identify suspicious patterns. These vendors process data on our behalf and are contractually prohibited from using it for any other purpose.
• Legal and regulatory authorities: to303 will disclose personal data to law enforcement agencies, regulatory bodies, or courts where required to do so by applicable law, court order, or official regulatory request. We will notify you of any such disclosure to the extent permitted by law.
• Business transfers: In the event that to303 undergoes a merger, acquisition, or asset sale, your personal data may be transferred to the acquiring entity, who will be required to honour this Privacy Policy or provide you with adequate prior notice of any material changes.

All financial transactions on to303 are denominated in Indonesian Rupiah (IDR / Rp). to303 stores only the minimum financial data necessary to facilitate transactions, reconcile balances, and comply with AML obligations. Specifically:

• to303 records your bank account number, bank name, and account holder name as provided during your first withdrawal request and verified during KYC. This data is used exclusively to process future withdrawal requests to the same verified account.
• to303 does not store full credit card numbers, CVV codes, or PIN numbers. If card-based payments are introduced in future, they will be processed exclusively through PCI-DSS-compliant third-party payment gateways, and to303 will never have direct access to raw card data.
• Your e-wallet account identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja) are stored in encrypted form and are accessible only to authorised to303 finance staff for the purpose of executing your withdrawal instructions.
• Transaction histories — including deposit amounts, withdrawal amounts, bet totals, and bonus credits — are retained for a minimum of 5 years from the date of each transaction for AML compliance purposes.

The minimum deposit on to303 is Rp 10.000 and the minimum withdrawal is Rp 50.000. All amounts are processed in IDR.

to303 uses cookies and similar browser-based storage technologies to operate the Platform securely and efficiently. The following types of cookies are in use:

Strictly necessary cookies are essential to the Platform's operation and cannot be disabled without impairing your ability to log in and use your Account. Functional and analytics cookies may be disabled via your browser settings. Please note that disabling functional cookies may degrade certain personalisation features.

to303 does not use third-party advertising cookies or permit external ad networks to track your behaviour across other websites via the to303 Platform.

to303 retains personal data for as long as your Account remains active and for a defined period thereafter, based on the category of data and the legal obligation it serves:

• Account and identity data: Retained for the duration of your Account plus a minimum of 5 years following Account closure, to satisfy AML record-keeping obligations.
• Transaction and betting records: Retained for a minimum of 5 years from the date of each transaction, consistent with financial record-keeping best practices.
• KYC documents: Retained for a minimum of 5 years following the completion of the KYC process, or for a longer period where required by a specific legal obligation or ongoing investigation.
• Support correspondence: Retained for 2 years from the date of the last interaction, after which records are archived or deleted.
• Technical and usage data: Retained in aggregated, anonymised form for up to 24 months for analytics and platform improvement purposes. Raw log data is deleted within 90 days.
• Marketing consent records: Retained for 3 years from the date consent was given or last renewed, to evidence your opt-in status in case of a dispute.

When the applicable retention period expires, personal data is securely deleted from our active systems and any third-party processors are instructed to do the same. Data held in backup systems is purged on the next scheduled backup rotation cycle.

to303 implements a layered security programme designed to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Our key security measures include:

• SSL/TLS encryption: All data in transit between your browser and to303's servers is encrypted using TLS 1.2 or higher. Our SSL certificate is maintained and renewed continuously.
• AES-256 encryption at rest: Sensitive data stored in our databases — including KYC documents, identity data, and payment account details — is encrypted at the storage layer using AES-256.
• Access controls: Access to Member personal data is restricted to authorised to303 personnel on a need-to-know basis. All staff with data access undergo background screening and receive regular data protection training.
• Two-factor authentication (2FA): to303 offers optional 2FA for Member login sessions. We strongly encourage all Members to enable 2FA to protect their Account from unauthorised access.
• Intrusion detection and monitoring: Our infrastructure is monitored 24/7 for anomalous activity. Automated threat detection systems alert our security team to potential intrusions or data breaches in real time.
• Penetration testing: to303 commissions periodic third-party penetration testing of its platform and infrastructure to identify and remediate security vulnerabilities before they can be exploited.

As a Member of to303, you hold the following rights in respect of your personal data. To exercise any of these rights, contact our Data Support team at [email protected] with your Account username and a description of your request. to303 will acknowledge your request within 5 business days and provide a substantive response within 30 days.

Please note that some rights are subject to limitations under applicable law. For example, the right of erasure does not override to303's obligation to retain AML records for a minimum of 5 years. Where a right cannot be fully exercised, to303 will explain the reason in its response.

to303 is strictly an adults-only platform (21+). We do not knowingly collect or process personal data from individuals under the age of 21. Age verification is a mandatory step in our KYC process, and Accounts where the Member's age cannot be confirmed are suspended pending verification.

If you believe that a minor has registered an Account on to303 or has accessed the Platform using your device or Account credentials, please contact us immediately at [email protected]. Upon confirmation, to303 will close the Account and securely delete all personal data associated with it as promptly as reasonably possible.

to303's primary infrastructure is operated with Indonesia-based Members as the target audience. In the course of delivering our services — particularly in connection with third-party Game Providers and KYC verification partners — some personal data may be processed on servers located outside of Indonesia.

Where such international transfers occur, to303 takes appropriate safeguards to ensure that your data receives a level of protection equivalent to the standards described in this Policy. These safeguards include:

• Entering into data processing agreements with all international recipients of personal data, incorporating standard contractual clauses or equivalent binding protections.
• Conducting transfer impact assessments where data is transferred to jurisdictions that may not provide equivalent data protection standards to Indonesia.
• Ensuring that all international Game Providers (including Pragmatic Play, Evolution Gaming, PG Soft, and others) maintain their own independent ISO 27001 or equivalent information security certifications.

The to303 Platform may contain references to third-party game studios, payment processors, and sports data providers. While to303 takes reasonable care in selecting its partners, we do not control and are not responsible for the privacy practices of any third-party websites or services that may be accessible from or referenced on the Platform.

This Privacy Policy applies solely to personal data collected and processed by to303 through the https://to303.ws Platform. If you navigate to a third-party website — for example, a Game Provider's promotional page or a payment processor's help centre — that site's own privacy policy will govern the handling of any data you provide there. to303 encourages you to review the privacy policies of any third-party services you choose to access.

to303 does not embed third-party advertising networks, social media tracking pixels, or external analytics tools that report your behaviour to parties outside of to303's direct control.

to303 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform functionality. When we make material changes, we will:

• Update the "Last Updated" date at the top of this Policy.
• Display a prominent notice on the Platform's homepage or within your Account dashboard for a minimum of 14 days following the change.
• Where the change is significant — for example, a new category of data sharing or a new international transfer arrangement — send a direct notification to the email address registered to your Account.

Your continued use of the Platform after the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not agree with a material change, you may close your Account and request deletion of your personal data in accordance with Section 11 above. Outstanding balances will be settled before closure in line with our Terms & Conditions.

We encourage you to review this Privacy Policy periodically so that you remain informed about how to303 protects your data. Archived versions of this Policy are available on request by contacting our Data Support team.

If you have any questions, concerns, or requests relating to this Privacy Policy or to303's handling of your personal data, please contact our Data Support team through the following channel:

For general platform guidance, deposit and withdrawal instructions, and answers to common questions, please visit our FAQ page. For information on how to set deposit limits, cooling-off periods, or self-exclusion, please visit our Responsible Gaming page.