Privacy Policy

1. Introduction

exotot ("we," "us," "our," or "the Company") is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, store, share, and protect the personal data you provide when using our online gaming platform located at https://exotot.cam (the "Platform," "Website," or "Services").

This Privacy Policy applies to all users of exotot services, including residents of Indonesia and international visitors. By accessing or using our Platform, you acknowledge that you have read, understood, and agree to the data collection and usage practices described in this Privacy Policy.

We reserve the right to update or modify this Privacy Policy at any time. Changes will be effective immediately upon posting to the Website with an updated "Last Updated" date. Continued use of exotot services after changes constitutes acceptance of the revised Privacy Policy. We encourage you to review this page periodically to stay informed about our data practices.

2. Data Controller Information

exotot acts as the data controller for the personal information collected through our Platform. As the data controller, we determine the purposes and means of processing your personal data in accordance with applicable data protection laws and regulations.

For questions regarding this Privacy Policy or to exercise your data protection rights, please contact our Data Protection Officer:

3. Information We Collect

exotot collects several categories of personal information necessary to provide our gaming services, comply with regulatory requirements, prevent fraud, and improve user experience. The types of information we collect include:

3.1 Information You Provide Directly

When you register for an exotot account, complete KYC (Know Your Customer) verification, or interact with our customer support team, you provide us with personal information including:

• Account Registration Data: Full legal name, date of birth, gender, email address, mobile phone number, username, password, residential address, and preferred currency (Indonesian Rupiah / IDR)
• Identity Verification Documents: Government-issued identification (Indonesian KTP/eKTP, passport, or driver's license), proof of address (utility bills, bank statements), and proof of payment method (bank account statements or e-wallet screenshots)
• Financial Information: Bank account details, e-wallet information, transaction history, deposit and withdrawal records, and payment method preferences
• Communications: Customer support inquiries, email correspondence, live chat transcripts, feedback submissions, and complaint details
• Marketing Preferences: Consent for promotional communications, email subscription status, and communication channel preferences

3.2 Information Collected Automatically

When you access or use the exotot Platform, we automatically collect certain technical and usage information through cookies, web beacons, and similar tracking technologies:

• Device Information: Device type, operating system, browser type and version, screen resolution, device identifiers (UDID, IMEI), and mobile network information
• Log Data: IP address, access times, pages viewed, time spent on pages, referral URLs, clickstream data, and exit pages
• Location Data: Approximate geographic location derived from IP address (country, city, region) to comply with jurisdictional restrictions and detect unauthorized access
• Gaming Activity: Games played, bet amounts, win/loss records, gaming patterns, bonus usage, wagering progress, and session duration
• Cookies and Tracking: Session cookies, persistent cookies, authentication tokens, and analytics identifiers (see Section 4 for detailed cookie information)

3.3 Information from Third Parties

We may receive information about you from third-party sources including:

• Payment Providers: Transaction confirmation, payment status, and fraud prevention data from banks (BCA, BRI, BNI, Mandiri, CIMB Niaga) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja)
• Game Providers: Gaming session data, game results, RTP information, and technical performance metrics from providers like Pragmatic Play, Evolution Gaming, Microgaming, and NetEnt
• Identity Verification Services: Document authentication results and fraud risk assessments from third-party KYC service providers
• Marketing Partners: Referral source information and campaign performance data (when applicable and with your consent)

4. How We Use Your Information

exotot processes your personal data for the following purposes, each grounded in a lawful basis under applicable data protection regulations:

4.1 Service Provision and Account Management

• Creating and maintaining your user account
• Processing deposits, withdrawals, and financial transactions
• Providing access to casino games, sports betting markets, and live dealer tables
• Managing bonuses, promotions, and loyalty rewards
• Tracking wagering requirements and bonus conditions
• Generating transaction history and account statements

Legal Basis: Contract performance - necessary to fulfill our obligations under the Terms and Conditions you accepted when registering.

4.2 Identity Verification and Compliance

• Verifying your identity through KYC procedures
• Confirming age eligibility (21+ requirement)
• Preventing underage gambling
• Complying with anti-money laundering (AML) regulations
• Detecting and preventing fraud, money laundering, and criminal activity
• Maintaining records for regulatory audits
• Responding to legal requests from authorities

Legal Basis: Legal obligation - required to comply with licensing conditions, AML regulations, and applicable gambling laws.

4.3 Security and Fraud Prevention

• Monitoring for suspicious account activity and unauthorized access
• Detecting duplicate accounts and bonus abuse
• Preventing collusion, chip dumping, and other forms of cheating
• Protecting against cyber attacks, DDoS attacks, and hacking attempts
• Investigating disputes, chargebacks, and player complaints

Legal Basis: Legitimate interests - protecting our business operations, preventing fraud, and ensuring fair gaming for all users.

4.4 Customer Support and Communication

• Responding to inquiries submitted via email, live chat, or contact forms
• Resolving technical issues and account problems
• Sending transactional emails (deposit confirmations, withdrawal notifications, password resets)
• Providing important service updates and policy changes

Legal Basis: Contract performance and legitimate interests - providing requested support and maintaining service quality.

4.5 Marketing and Promotions (With Consent)

• Sending promotional emails about bonuses, tournaments, and special offers
• Delivering personalized bonus offers based on gaming preferences
• Notifying you about new game releases and features
• Sharing updates about slot gacor recommendations and high RTP games

Legal Basis: Consent - you may opt out of marketing communications at any time by clicking the unsubscribe link in emails or adjusting your account preferences.

4.6 Analytics and Service Improvement

• Analyzing user behavior to optimize website performance
• Conducting A/B testing on features and interface designs
• Identifying popular games and betting patterns
• Improving mobile optimization and page load times
• Enhancing responsible gaming tools based on usage data

Legal Basis: Legitimate interests - improving our services and user experience.

5. Cookies and Tracking Technologies

exotot uses cookies and similar tracking technologies to enhance your browsing experience, analyze site traffic, and personalize content. Cookies are small text files stored on your device that help us recognize you on repeat visits.

5.1 Types of Cookies We Use

Cookie Type	Purpose	Duration
Essential Cookies	Required for basic site functionality, login authentication, and session management. Cannot be disabled.	Session / 30 days
Performance Cookies	Collect anonymous data about how visitors use our site, including page views, time on site, and error messages.	1-2 years
Functional Cookies	Remember your preferences (language, currency, display settings) for a personalized experience.	1 year
Marketing Cookies	Track your browsing across websites to deliver relevant promotional content. Require consent.	90 days - 1 year

5.2 Managing Cookie Preferences

Most web browsers automatically accept cookies, but you can modify your browser settings to decline cookies or alert you when cookies are being sent. Note that disabling essential cookies may impair site functionality and prevent you from accessing certain features, including account login and game play.

To manage cookies, adjust your browser settings:

• Google Chrome: Settings > Privacy and Security > Cookies and other site data
• Mozilla Firefox: Options > Privacy & Security > Cookies and Site Data
• Safari: Preferences > Privacy > Manage Website Data
• Microsoft Edge: Settings > Cookies and site permissions

6. How We Share Your Information

exotot does not sell your personal information to third parties. However, we may share your data with carefully selected partners and service providers under the following circumstances:

6.1 Service Providers and Business Partners

• Payment Processors: We share necessary financial information with Indonesian banks (BCA, BRI, BNI, Mandiri) and e-wallet providers (OVO, DANA, GoPay) to process deposits and withdrawals
• Game Providers: Gaming session data is shared with providers like Pragmatic Play, Evolution Gaming, Microgaming, and NetEnt to deliver game content and ensure fair play
• KYC Verification Services: Identity documents are shared with third-party verification providers to authenticate your identity and comply with regulatory requirements
• Customer Support Tools: Chat transcripts and support tickets may be processed through customer service software platforms
• Analytics Providers: Anonymized usage data may be shared with analytics services to improve website performance and user experience

6.2 Legal and Regulatory Compliance

We may disclose your personal information if required by law or in response to valid legal processes, including:

• Compliance with court orders, subpoenas, or legal proceedings
• Cooperation with law enforcement investigations
• Response to regulatory audits or licensing authority requests
• Protection of our legal rights in disputes or litigation
• Prevention of fraud, money laundering, or criminal activity

6.3 Business Transfers

In the event of a merger, acquisition, asset sale, or bankruptcy, your personal information may be transferred to the successor entity as part of the business assets. You will be notified via email and/or prominent notice on our Website of any such change in ownership or control of your personal information.

7. Data Security Measures

exotot takes data security seriously and implements industry-standard technical and organizational measures to protect your personal information from unauthorized access, disclosure, alteration, or destruction. Our security measures include:

7.1 Technical Security

• 256-bit SSL Encryption: All data transmitted between your device and our servers is encrypted using SSL/TLS protocols
• Secure Data Storage: Personal information is stored on secure servers with restricted physical and logical access controls
• Firewall Protection: Network firewalls prevent unauthorized access to our systems
• DDoS Protection: Advanced mitigation systems protect against distributed denial-of-service attacks
• Regular Security Audits: Third-party security firms conduct periodic penetration testing and vulnerability assessments
• Secure Password Storage: User passwords are hashed using bcrypt or similar one-way cryptographic functions

7.2 Organizational Security

• Access Controls: Employee access to personal data is restricted based on job function and necessity
• Confidentiality Agreements: All staff members sign confidentiality agreements protecting user data
• Security Training: Regular training programs ensure employees understand data protection obligations
• Incident Response Plan: We maintain procedures for detecting, responding to, and reporting security breaches

8. Data Retention

exotot retains your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, comply with legal obligations, resolve disputes, and enforce our agreements.

8.1 Active Account Data

Personal information for active user accounts is retained for the duration of your relationship with exotot plus any period required by applicable regulations. This includes account details, transaction history, and gaming records.

8.2 Closed Account Data

After account closure (whether voluntary or involuntary), we retain certain information for legal and regulatory compliance purposes:

• Financial Records: Transaction history retained for 7 years to comply with anti-money laundering regulations and tax law requirements
• KYC Documents: Identity verification records retained for 5 years post-closure for regulatory audit purposes
• Dispute Records: Information related to unresolved disputes retained until final resolution
• Marketing Data: If you consented to marketing, your opt-out preferences are retained indefinitely to honor your choice

8.3 Anonymized Data

We may retain anonymized, aggregated data indefinitely for statistical analysis and business intelligence purposes. This data cannot be linked back to individual users and does not constitute personal information under data protection laws.

9. Your Data Protection Rights

Under applicable data protection laws, including Indonesian privacy regulations and international standards, you have the following rights regarding your personal information:

9.1 Right of Access

You have the right to request confirmation of whether we process your personal data and obtain a copy of that data. You can access most information through your account dashboard or by contacting our Data Protection Officer.

9.2 Right to Rectification

If your personal information is inaccurate or incomplete, you have the right to request correction. You can update most account information directly through your profile settings.

9.3 Right to Erasure (Right to be Forgotten)

You may request deletion of your personal data when it is no longer necessary for the purposes for which it was collected, subject to legal retention requirements and legitimate business needs (e.g., maintaining financial records for regulatory compliance).

9.4 Right to Restriction of Processing

In certain circumstances, you may request that we limit how we use your personal information, such as when you contest the accuracy of data or object to processing.

9.5 Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format and transmit it to another service provider where technically feasible.

9.6 Right to Object

You may object to processing of your personal data for direct marketing purposes (including profiling) or processing based on legitimate interests. Marketing opt-out links are provided in all promotional emails.

9.7 Right to Withdraw Consent

Where we process your data based on consent (e.g., marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.

9.8 Exercising Your Rights

To exercise any of these rights, please contact our Data Protection Officer at [email protected] with the subject line "Data Protection Request" and specify which right you wish to exercise. We will respond within 30 days of receiving your request. Identity verification may be required to prevent unauthorized data access.

10. International Data Transfers

exotot operates as an internationally licensed platform with servers and service providers located in various jurisdictions outside Indonesia. When you use our services, your personal information may be transferred to, stored in, and processed in countries that may have different data protection laws than Indonesia.

We ensure that any international data transfers comply with applicable data protection requirements through:

• Utilizing service providers that adhere to internationally recognized data protection standards
• Implementing appropriate technical and organizational safeguards
• Ensuring contractual protections are in place with third-party processors
• Transferring data only to jurisdictions with adequate data protection frameworks where possible

By using exotot services, you acknowledge and consent to the transfer of your personal information outside Indonesia for the purposes described in this Privacy Policy.

11. Children's Privacy

exotot services are strictly intended for individuals aged 21 years and older. We do not knowingly collect, use, or disclose personal information from individuals under the age of 21. If we become aware that we have inadvertently collected personal data from someone under 21, we will take immediate steps to delete that information and terminate the associated account.

12. Changes to This Privacy Policy

exotot reserves the right to update, modify, or replace this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or business operations. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Notify active users via email to their registered address
• Display a prominent notice on the Website for 30 days following the change
• For significant changes affecting user rights, request renewed consent where required by law

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information. Your continued use of exotot services after changes become effective constitutes acceptance of the revised Privacy Policy.

13. Contact Us

If you have questions, concerns, or complaints about this Privacy Policy or our data handling practices, please contact our Data Protection Officer:

For urgent data protection matters (such as suspected data breaches or unauthorized account access), please mark your email as "URGENT" and we will prioritize your request.

exotot is committed to resolving privacy concerns in a timely and transparent manner. If you are not satisfied with our response, you may have the right to lodge a complaint with your local data protection authority.