All data transmitted between your device and oxtoto is encrypted using industry-standard TLS/SSL protocols. Account credentials, payment details, and personal information are never transmitted in plain text.
oxtoto does not sell, rent, or trade your personal data to any third party for commercial marketing purposes. Data is shared only with processors essential to platform operation, under strict contractual confidentiality obligations.
Registered players may access, correct, export, or request deletion of their personal data at any time by contacting our support team. Marketing communication preferences can be updated directly within your account settings.
oxtoto collects only the data that is strictly necessary for account administration, KYC compliance, payment processing, fraud prevention, and responsible gaming monitoring. We do not collect data beyond these defined purposes.
Personal data is retained only for as long as required by our operational and legal obligations. Account data is held for a minimum of five years following account closure to satisfy anti-money-laundering record-keeping requirements.
Promotional communications — including bonus offers, seasonal promotions, and product updates — are sent only to players who have opted in. You may withdraw consent at any time via your account notification preferences.
This Privacy Policy applies to all users of the oxtoto platform accessible at https://oxtoto.cam, including visitors who have not yet registered an account. By accessing the platform or submitting personal data via the registration form, you acknowledge that you have read and understood this policy. If you are under 21 years of age, you are not permitted to use this platform and must exit immediately.
oxtoto operates an internationally licensed online gaming and sports-betting platform primarily serving English-preference players resident in Indonesia. In the course of providing our Services, we collect and process personal data relating to our players, prospective players, and website visitors.
We take data privacy seriously. This Privacy Policy sets out, in plain and transparent terms, the categories of personal data we collect, the purposes for which we process that data, the parties with whom we may share it, the security controls we apply, the retention periods we observe, and the rights available to you as a data subject.
This policy should be read alongside our Terms & Conditions, which govern the overall contractual relationship between oxtoto and registered players. Capitalised terms used but not defined in this policy have the meanings given to them in the Terms & Conditions.
For the purposes of this Privacy Policy, the following definitions apply:
The Data Controller responsible for the Personal Data collected through the oxtoto platform is the internationally incorporated entity operating the oxtoto brand under its gaming licence. All data protection enquiries, subject-access requests, and consent-withdrawal requests should be directed to:
Email: [email protected] (plain text — not a clickable link)
For the avoidance of doubt, oxtoto does not maintain a physical office in Indonesia. The platform is operated remotely and serves Indonesian residents in a digital capacity only.
oxtoto collects Personal Data from players through multiple touchpoints during the account lifecycle. The categories of data we collect are set out in the table below:
| Data Category | Specific Data Points | Collection Trigger |
|---|---|---|
| Identity Data | Full legal name, date of birth, gender, nationality | Account registration & KYC verification |
| Contact Data | Email address, mobile phone number, residential address (city, province, postal code) | Account registration |
| Verification Documents | National ID (KTP), passport, driving licence image; proof of address document | KYC verification (prior to first withdrawal) |
| Financial Data | Bank account name and number (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon); e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja); deposit and withdrawal transaction history | Payment processing |
| Gaming Activity Data | Wager history, game sessions, win/loss records, bonus redemptions, betting markets accessed | Ongoing platform use |
| Technical Data | IP address, device type and OS, browser type and version, session timestamps, geolocation (country/city level) | Automatic collection on site access |
| Communications Data | Live chat transcripts, email correspondence, support ticket records | Customer support interactions |
| Marketing Preferences | Opted-in communication channels, promotional offer interactions, unsubscribe records | Opt-in at registration or via account settings |
oxtoto does not collect full credit or debit card numbers. Payment card transactions, where applicable, are handled entirely by PCI-DSS-compliant third-party payment processors. oxtoto receives only a tokenised reference, never the full card details.
oxtoto processes Personal Data only where a valid legal basis exists. The primary legal bases on which we rely are as follows:
oxtoto uses collected Personal Data for the following defined purposes only:
oxtoto does not use Personal Data for fully automated decision-making that produces legal effects without human review. Where automated processes flag an account for investigation (e.g., suspected fraud or AML triggers), a member of our compliance team conducts a manual review before any account action is taken.
oxtoto does not sell Personal Data to third parties. We share data only in the following limited circumstances, and only to the extent necessary for the stated purpose:
oxtoto will never share your personal data with third-party advertisers, data brokers, or social media platforms for commercial profiling or targeted advertising purposes.
As an internationally operated platform, oxtoto may transfer Personal Data to countries outside of Indonesia for processing by authorised third-party service providers. Such transfers occur only where appropriate safeguards are in place, including:
By registering an account with oxtoto, you acknowledge and consent to the transfer of your Personal Data to our service providers as described in this section, subject to the safeguards outlined above.
oxtoto retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention schedule applies as a baseline:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account & Identity Data | 5 years from account closure | AML regulatory obligation |
| KYC Documents | 5 years from account closure | AML / licensing requirement |
| Financial Transaction Records | 5 years from transaction date | AML / accounting obligation |
| Gaming Activity Data | 3 years from last session | Responsible gaming monitoring |
| Support Communications | 2 years from interaction date | Dispute resolution / QA |
| Marketing Preference Records | Until consent withdrawn + 1 year | Consent audit trail |
| Technical / Log Data | 12 months from collection | Security monitoring |
Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised such that it can no longer be linked to an identifiable individual. Anonymised, aggregated data may be retained indefinitely for statistical and analytical purposes.
oxtoto implements a layered set of technical and organisational security measures to protect Personal Data against unauthorised access, disclosure, alteration, or destruction. These measures include, but are not limited to:
While oxtoto applies robust security controls, no online system can guarantee absolute security. We encourage all players to use strong, unique passwords for their oxtoto accounts and to enable any available two-factor authentication features. If you suspect unauthorised access to your account, contact our support team immediately.
oxtoto uses cookies and similar tracking technologies on its platform to ensure core functionality, improve performance, and (where consent is given) deliver personalised content. The categories of cookies we deploy are as follows:
| Cookie Type | Purpose | Consent Required? |
|---|---|---|
| Strictly Necessary | Session management, authentication, CSRF protection, load balancing. Without these, the platform cannot function. | No — essential |
| Performance / Analytics | Aggregated, anonymised data on page load times, error rates, and user navigation paths — used to improve platform performance. | Yes |
| Functional | Remembering user preferences such as language display settings and preferred payment method for faster checkout. | Yes |
| Marketing / Targeting | Tracking interactions with promotional offers and measuring campaign effectiveness. oxtoto does not serve third-party advertising cookies. | Yes |
You may manage cookie preferences through your browser settings at any time. Please note that disabling strictly necessary cookies will impair or prevent access to the oxtoto platform. Disabling other cookie categories will not affect your ability to play, but may reduce the personalisation of your experience.
As a data subject, you hold the following rights with respect to the Personal Data oxtoto holds about you. These rights may be exercised by contacting our support team at the email address listed in Section 15:
Request a copy of the Personal Data oxtoto holds about you, along with information about how it is processed.
Request correction of inaccurate or incomplete Personal Data held in your account record.
Request deletion of your Personal Data where it is no longer necessary for the purpose collected, subject to our legal retention obligations.
Request that we restrict processing of your data while a dispute over its accuracy or the legality of its processing is resolved.
Receive a structured, machine-readable copy of Personal Data you have provided to oxtoto on the basis of consent or contract.
Object to processing based on legitimate interests or for direct marketing purposes. Marketing objections are processed immediately.
oxtoto will respond to all valid data subject requests within 30 calendar days of receipt. Where a request is complex or numerous, we may extend this period by a further 60 days, in which case we will notify you of the extension and the reasons for it within the initial 30-day window. We do not charge a fee for processing data rights requests unless they are manifestly unfounded or excessive.
Please note that the right to erasure is subject to overriding legal retention obligations — particularly our AML and licensing requirements to retain account and transaction records for a minimum of five years following account closure. In such cases, we will inform you of the specific obligation that prevents full erasure and the earliest date at which deletion can be completed.
The oxtoto platform is strictly intended for individuals aged 21 years or older. oxtoto does not knowingly collect Personal Data from individuals under this age threshold. Age verification is conducted as part of the KYC process required before any withdrawal is processed.
If oxtoto becomes aware — through KYC, parental notification, or any other means — that a registered account belongs to an individual under 21 years of age, the account will be immediately suspended, all balances will be frozen pending investigation, and any deposits made will be returned to the originating payment method after verification of the account holder's true identity. No winnings will be paid out in respect of an underage account.
If you are a parent or guardian and have reason to believe that your child has registered an account on oxtoto, please contact us immediately at [email protected] (plain text only — not a clickable link).
oxtoto reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or our Services. Where amendments are material — for example, where we introduce a new category of data processing or a new class of third-party recipient — we will provide advance notice of at least 14 days via email to your registered address or via an in-platform notification before the revised policy takes effect.
For minor or clarificatory updates, the revised policy will be published on this page with an updated "Last Updated" date. We encourage you to review this page periodically to remain informed of how oxtoto handles your Personal Data.
Your continued use of the oxtoto platform following the effective date of any amendment constitutes acceptance of the revised Privacy Policy. If you do not accept the revised terms, you must cease using the platform and may request account closure in accordance with our Terms & Conditions.
For any questions, concerns, or requests relating to this Privacy Policy or oxtoto's data practices, please contact us through the following channels:
When submitting a data subject access request or exercising any other data right, please include your full registered name and the email address associated with your oxtoto account so that we can verify your identity and process your request efficiently.
Please do not include sensitive financial information — such as full bank account numbers or copies of identity documents — in your initial email contact. Our support team will guide you through the appropriate secure channel for submitting any required documentation.