Privacy Policy

1.1   toyo12 is an internationally licensed online betting and casino platform serving players across Indonesia, including in Jakarta, Surabaya, Bandung, Medan, Bali, Yogyakarta, and beyond. We offer sports wagering, live casino games, slot games, togel (Indonesia's traditional numbers lottery), and other gaming products to registered players aged 21 and above.

1.2   In the course of providing these services, toyo12 necessarily processes certain personal data about our players. We take our data protection obligations extremely seriously and are committed to handling all personal information in a transparent, lawful, and secure manner.

1.3   This Policy applies to all data processing activities carried out by toyo12 in connection with the Platform and its services, regardless of the device used to access the Platform (desktop, mobile browser, or mobile application).

2.1   For the purposes of applicable data protection law, toyo12 acts as the data controller in respect of personal data collected through the Platform. This means we determine the purposes for which your personal data is collected and the means by which it is processed.

2.2   Our designated Data Protection point of contact can be reached at the contact details set out in Clause 14 of this Policy. We are committed to responding to all data protection inquiries promptly and in accordance with applicable law.

3.1   toyo12 collects personal data through several channels: directly from you when you register an account or interact with the Platform, automatically when you use the Platform, and from third-party sources such as payment processors and identity verification providers.

3.2   The categories of personal data we collect are summarised in the table below:

3.3   We do not knowingly collect sensitive personal data (such as health information, biometric data beyond facial verification for KYC purposes, or religious beliefs) from any player.

4.1   toyo12 processes your personal data for the following purposes:

• Account Management: To create, maintain, and manage your player account; to authenticate your identity when you log in; to process deposits and withdrawals; to apply account limits and self-exclusion settings.
• Service Provision: To enable you to place bets, participate in casino games, claim bonuses, and use all features of the Platform; to settle wagers and pay out winnings.
• Regulatory Compliance: To verify your age and identity (21+ age restriction enforcement); to conduct Know Your Customer (KYC) checks; to prevent money laundering and financial crime; to comply with licensing obligations and legal reporting requirements.
• Fraud Prevention & Security: To detect and prevent fraudulent activity, account takeovers, collusion, bonus abuse, and other violations of our Terms & Conditions; to monitor betting patterns for signs of match-fixing or insider information use.
• Customer Support: To respond to your inquiries, resolve technical issues, handle complaints, and provide general assistance via live chat and email.
• Marketing Communications: To send promotional offers, bonus notifications, and platform updates via email or SMS, where you have opted in to receive such communications. You may unsubscribe at any time via account settings.
• Platform Improvement: To analyze usage patterns, identify popular games and features, optimize user experience, and develop new products and services.
• Responsible Gaming: To monitor betting behavior for signs of problem gambling; to enforce deposit limits and self-exclusion orders; to provide support resources and intervention when necessary.

5.1   Under applicable data protection law, toyo12 must establish a lawful basis for each processing activity. The legal bases we rely upon are:

• Contractual Necessity: Processing your personal data is necessary to perform the contract between you and toyo12 (our Terms & Conditions). This includes account creation, payment processing, game provision, and customer support.
• Legal Obligation: We are required by law to verify player identity, enforce age restrictions, prevent money laundering, and maintain records for regulatory inspection. This legal obligation applies under our operating license and Indonesian financial crime legislation.
• Legitimate Interests: toyo12 has a legitimate business interest in preventing fraud, ensuring platform security, improving our services, and protecting our commercial interests. Where we rely on legitimate interests, we have conducted a balancing test to ensure that your privacy rights are not overridden.
• Consent: For marketing communications and certain optional data processing activities, we rely on your explicit consent. You may withdraw consent at any time without affecting the lawfulness of processing conducted before withdrawal.

6.1   toyo12 does not sell, rent, or trade your personal data to third parties for marketing purposes. However, we do share limited personal data with carefully selected service providers and partners in the following circumstances:

• Payment Processors: We share financial data with Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) to process deposits and withdrawals. These processors are bound by strict confidentiality obligations and data protection standards.
• Identity Verification Providers: We share identity data with specialist KYC service providers to verify your age, identity, and address. These providers act as data processors on our behalf and are contractually obligated to protect your data.
• Game Providers: We share limited technical and usage data with casino game studios (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming) to enable gameplay and settle wagers. These studios do not receive identity or financial data.
• Cloud Infrastructure Providers: toyo12 uses secure cloud hosting services to store and process data. Our infrastructure partners are certified to internationally recognized security standards (ISO 27001, SOC 2) and operate under strict data processing agreements.
• Legal and Regulatory Authorities: We may disclose personal data to law enforcement, regulatory bodies, or courts where required by applicable law or in response to a valid legal process (such as a court order or regulatory investigation).
• Professional Advisors: We may share personal data with legal advisors, auditors, and consultants for the purposes of obtaining professional advice, conducting internal audits, or managing disputes.

6.2   In the event of a merger, acquisition, or sale of all or part of toyo12's business, your personal data may be transferred to the acquiring entity as part of the business assets. We will notify you of any such transfer and inform you of any changes to this Policy that result from the transaction.

7.1   toyo12 operates an international platform and certain data processing activities may involve the transfer of your personal data to countries outside Indonesia. This may occur where our cloud infrastructure providers, payment processors, or game studios are located in other jurisdictions.

7.2   Where personal data is transferred internationally, we ensure that appropriate safeguards are in place to protect your data in accordance with this Policy and applicable law. These safeguards may include:

• Transfers to countries that have been determined by competent authorities to provide an adequate level of data protection.
• Use of Standard Contractual Clauses approved by relevant data protection authorities.
• Reliance on service providers certified under recognized international data protection frameworks.

7.3   You may request further details about the safeguards in place for international data transfers by contacting our Data Protection contact at the email address set out in Clause 14.

8.1   toyo12 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. Our standard retention periods are:

• Active Account Data: Retained for the duration of your account's active status.
• Closed Account Data: Retained for 90 days following verified account closure to allow for any final transaction settlement, after which identity data, contact data, and financial data are securely deleted. Transaction history may be retained for up to 7 years to comply with financial record-keeping requirements.
• KYC Documents: Retained for 7 years following account closure to comply with anti-money laundering regulations.
• Marketing Data: Deleted immediately upon opt-out or account closure.
• Technical Logs & Usage Data: Retained for 12 months for security monitoring and fraud prevention, then securely deleted or anonymized.

8.2   Where personal data is no longer required, it is securely deleted or anonymized such that it can no longer be associated with you. Anonymized data may be retained indefinitely for statistical and research purposes.

9.1   toyo12 implements comprehensive technical and organizational measures to protect your personal data against unauthorized access, accidental loss, destruction, or damage. These measures include:

• Encryption: All data transmitted between your device and toyo12's servers is encrypted using 256-bit SSL/TLS protocols. Sensitive data at rest (including passwords and payment method tokens) is encrypted using industry-standard encryption algorithms.
• Access Controls: Access to personal data is restricted to authorized personnel only, on a need-to-know basis. All personnel with access to personal data are subject to strict confidentiality obligations.
• Network Security: Our infrastructure is protected by enterprise-grade firewalls, intrusion detection systems, and distributed denial-of-service (DDoS) mitigation.
• Secure Data Centers: Personal data is stored in ISO 27001-certified data centers with physical access controls, environmental monitoring, and redundant backup systems.
• Regular Audits: toyo12 conducts regular security audits, penetration testing, and vulnerability assessments to identify and remediate potential weaknesses.
• Incident Response: We maintain a formal data breach response plan. In the event of a personal data breach that poses a risk to your rights, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach.

10.1   toyo12 uses cookies and similar tracking technologies to enhance your experience on the Platform, monitor usage patterns, and deliver personalized content. A cookie is a small text file placed on your device when you visit a website.

10.2   The types of cookies we use include:

• Essential Cookies: Necessary for the Platform to function correctly. These include authentication cookies (to keep you logged in), session cookies (to maintain game state), and security cookies (to detect fraud). Essential cookies cannot be disabled without impairing core functionality.
• Performance Cookies: Collect anonymous data about how the Platform is used, including which pages are visited most frequently and whether users encounter errors. This data helps us optimize the Platform's performance.
• Functional Cookies: Remember your preferences (such as language settings, display options, and favorite game filters) to provide a more personalized experience on repeat visits.
• Analytics Cookies: Measure traffic and usage patterns using tools such as Google Analytics. Data collected is aggregated and anonymized.

10.3   You can manage cookie preferences through your browser settings. Most browsers allow you to block or delete cookies. However, blocking essential cookies will prevent you from accessing certain features of the Platform, including account login.

10.4   toyo12 does not use third-party advertising cookies or share browsing data with advertising networks. We do not track your activity on other websites.

11.1   Under applicable data protection law, you have the following rights in relation to your personal data:

11.2   To exercise any of these rights, please contact our Data Protection team at [email protected] with the subject line "Data Subject Rights Request". We will respond to all valid requests within 30 days of receipt. In complex cases, this period may be extended by a further 60 days, in which case we will inform you of the delay and the reasons for it.

11.3   We may require proof of identity before acting on a rights request to prevent unauthorized disclosure of personal data.

11.4   You have the right to lodge a complaint with a data protection supervisory authority if you believe that toyo12 has processed your personal data in violation of applicable law.

12.1   toyo12's services are strictly for players aged 21 years and above. We do not knowingly collect or process personal data from individuals under the age of 21.

12.2   All players are required to verify their age during the KYC process by providing a government-issued identity document showing date of birth. Any account found to belong to a person under the age of 21 will be immediately suspended and all associated funds will be subject to investigation.

12.3   If we become aware that we have inadvertently collected personal data from a minor, we will delete that data as soon as reasonably practicable.

13.1   toyo12 reserves the right to amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or business operations. Material changes will be communicated to you via email and/or a prominent notice on the Platform at least 14 days prior to the changes taking effect.

13.2   Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the updated Policy. If you do not agree with the changes, you must cease using the Platform and may request account closure and data deletion in accordance with Clause 11.

13.3   The current version of this Policy is always available on the toyo12 website at https://toyo12.cam/privacy-policy. We recommend that you review this Policy periodically to stay informed of any updates.

14.1   If you have any questions, concerns, or complaints about this Privacy Policy or toyo12's data processing practices, please contact our Data Protection team:

• Email: [email protected] (plain text — not a clickable link)
• Subject Line: "Privacy Inquiry" or "Data Subject Rights Request"
• Response Time: We will acknowledge receipt of your inquiry within 2 business days and provide a full response within 30 days.

14.2   You also have the right to lodge a complaint directly with your local data protection supervisory authority if you believe that toyo12 has not adequately addressed your concerns or has violated your data protection rights.