Privacy Policy

1. Introduction

yatoto ("we", "us", "our", "Company") is committed to protecting the privacy and personal data of all users ("you", "your", "Player") of our online gaming platform located at https://yatoto.cam (the "Platform" or "Service"). This Privacy Policy explains what personal information we collect, how we use it, who we share it with, how we protect it, and what rights you have regarding your personal data.

By creating an account, accessing our website, or using any of our services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, disclosure, and storage of your personal information as described herein. If you do not agree with any aspect of this Privacy Policy, you must immediately discontinue use of the yatoto platform and may not register or maintain an account.

This Privacy Policy should be read in conjunction with our Terms and Conditions and Responsible Gaming policy, which together form the complete legal framework governing your relationship with yatoto. We reserve the right to modify this Privacy Policy at any time. Material changes will be communicated via email or prominent notice on our website, though your continued use of the Service following any modifications constitutes acceptance of the updated policy.

2. Information Controller

yatoto acts as the data controller for all personal information collected through our platform. We are responsible for determining the purposes and means of processing your personal data in accordance with applicable data protection laws and regulations. For questions, concerns, or requests regarding your personal data, you may contact our Data Protection Officer at the email address provided in the Contact Information section of this policy.

3. Personal Information We Collect

yatoto collects several categories of personal information necessary to provide our gaming services, verify your identity, process transactions, prevent fraud, and comply with legal obligations. The types of information we collect include:

3.1 Account Registration Information

When you create a yatoto account, we collect:

• Identification Details: Full legal name, date of birth, gender, nationality
• Contact Information: Email address, mobile phone number, residential address (street address, city, province, postal code)
• Account Credentials: Username, password (stored in encrypted form)
• Preferred Currency: Indonesian Rupiah (IDR) for all transactions

3.2 Identity Verification (KYC) Documents

To comply with anti-money laundering regulations and verify you are at least 21 years of age, we collect:

• Copies of government-issued identification documents such as Indonesian KTP (Kartu Tanda Penduduk - National Identity Card) or passport
• Proof of address documents (utility bills, bank statements, government correspondence) dated within the last three months
• Selfie photographs holding your identification document (for enhanced verification)
• Source of funds documentation for large deposits or withdrawals (bank statements, employment letters, business registration documents)

3.3 Financial and Transaction Data

To process deposits, withdrawals, and maintain accurate account records, we collect:

• Bank account details (bank name, account number, account holder name) for Indonesian banks including BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI
• E-wallet information (OVO, DANA, GoPay, ShopeePay, LinkAja account identifiers)
• Transaction history including deposits, withdrawals, bets placed, wins, losses, and bonus usage
• Payment verification codes and transaction reference numbers

Important: yatoto does not store your complete bank card numbers, CVV codes, or online banking passwords. All payment processing is handled through secure, PCI-DSS compliant payment gateways. We only retain the minimum information necessary to process transactions and maintain transaction records.

3.4 Gaming Activity and Behavioral Data

To provide personalized gaming experiences, detect problem gambling patterns, and prevent fraud, we collect:

• Gaming preferences (favorite games, most played categories, betting patterns)
• Bet history including stake amounts, odds, selections, and outcomes for sports betting
• Game session durations and frequency of play
• Responsible gaming tool usage (deposit limits, session time limits, self-exclusion periods)
• Win/loss ratios and account balance fluctuations
• Bonus activation and wagering completion rates

3.5 Technical and Device Information

When you access yatoto, we automatically collect certain technical data:

• IP address and geographic location (to verify you are accessing from Indonesia)
• Device type, operating system, and browser information
• Screen resolution and device identifier
• Cookies and similar tracking technologies (see Section 8 for details)
• Referring website and pages visited on yatoto
• Date and time of access, session duration
• Language preferences and timezone settings

3.6 Communications and Customer Support

When you interact with our customer service team, we collect:

• Chat transcripts from live chat conversations
• Email correspondence
• WhatsApp message history with our support number
• Phone call recordings (where legally permitted and with prior notice)
• Customer satisfaction survey responses
• Complaint details and resolution outcomes

4. How We Use Your Personal Information

yatoto uses the personal information we collect for the following legitimate business purposes:

4.1 Account Management and Service Provision

• Create and maintain your gaming account
• Verify your identity and age (21+ requirement)
• Process deposits, withdrawals, and other financial transactions
• Provide access to sports betting markets, casino games, slots, and other gaming products
• Calculate and credit winnings, process payouts
• Enforce betting limits and account restrictions
• Manage bonus offers and promotional campaigns

4.2 Legal and Regulatory Compliance

• Comply with anti-money laundering (AML) regulations and know-your-customer (KYC) requirements
• Verify source of funds for large transactions
• Prevent underage gambling (enforcing 21+ age restriction)
• Report suspicious transactions to relevant authorities when legally required
• Maintain records for audit and regulatory inspection purposes
• Respond to court orders, subpoenas, and law enforcement requests

4.3 Fraud Prevention and Security

• Detect and prevent fraudulent activity, bonus abuse, and account takeovers
• Identify multiple accounts operated by the same individual (prohibited under our Terms)
• Monitor for irregular betting patterns indicative of match-fixing or insider betting
• Prevent money laundering and terrorist financing
• Protect against unauthorized access, data breaches, and cyber attacks
• Block access from prohibited jurisdictions or sanctioned individuals

4.4 Responsible Gaming and Player Protection

• Monitor gaming behavior for signs of problem gambling
• Enforce deposit limits, loss limits, and session time limits
• Implement self-exclusion and cool-off periods
• Provide reality check reminders during extended gaming sessions
• Contact players exhibiting concerning gambling patterns to offer support resources
• Maintain records of responsible gaming interventions and self-exclusions

4.5 Marketing and Personalization

With your explicit consent, we may use your information to:

• Send promotional emails about new games, bonus offers, and special events
• Provide personalized game recommendations based on your playing history
• Deliver targeted advertising on our platform
• Send SMS notifications about account activity and exclusive promotions
• Conduct market research and customer satisfaction surveys

You may opt out of marketing communications at any time by clicking the unsubscribe link in our emails, adjusting your account preferences, or contacting customer support. Opting out of marketing will not affect essential service communications such as transaction confirmations, security alerts, or legal notices.

4.6 Platform Improvement and Analytics

• Analyze user behavior to improve website navigation and user experience
• Identify popular games and optimize game selection
• Test new features and measure their effectiveness
• Generate aggregate statistics about platform usage (de-identified data)
• Troubleshoot technical issues and improve system performance

5. Legal Basis for Processing Your Data

yatoto processes your personal information based on the following legal grounds:

• Contractual Necessity: Processing is necessary to perform our contract with you (providing gaming services, processing transactions, maintaining your account)
• Legal Obligation: Processing is required to comply with anti-money laundering laws, age verification requirements, tax reporting obligations, and other legal mandates
• Legitimate Interest: Processing is necessary for our legitimate business interests such as fraud prevention, security, responsible gaming monitoring, and platform improvement, provided these interests do not override your fundamental rights
• Consent: You have provided explicit consent for marketing communications, cookies, and other optional data processing activities. Consent can be withdrawn at any time.

6. Who We Share Your Information With

yatoto does not sell your personal information to third parties. We only share your data with the following categories of recipients when necessary for legitimate business purposes:

6.1 Payment Service Providers

We share necessary payment information with Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) to process deposits and withdrawals. These providers operate under strict confidentiality obligations and may only use your data to complete the requested transactions.

6.2 Identity Verification Services

We use third-party KYC verification services to validate your identification documents and check you against sanctions lists, politically exposed persons (PEP) databases, and fraud watchlists. These services receive only the minimum information necessary to perform verification checks.

6.3 Game Providers and Platform Partners

When you play games from providers such as Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Ezugi, Spribe, and Pocket Games Soft, we share your username, bet history, and session data with these partners to deliver the gaming experience and track game rounds. These providers are bound by data protection agreements and may not use your data for purposes beyond game delivery.

6.4 Technology and Infrastructure Partners

We engage cloud hosting providers, content delivery networks (CDN), analytics platforms, and security services to operate our platform. These partners have access to technical data such as IP addresses, device information, and usage patterns but are contractually prohibited from using this data for their own purposes.

6.5 Customer Support Tools

Our live chat software, email platform, and customer relationship management (CRM) system process communications between you and our support team. These service providers are bound by confidentiality agreements.

6.6 Legal and Regulatory Authorities

We may disclose your personal information to law enforcement, regulatory bodies, courts, tax authorities, or other government agencies when:

• Required by law, court order, or subpoena
• Necessary to comply with licensing conditions or regulatory investigations
• Needed to detect, prevent, or prosecute criminal activity (fraud, money laundering, match-fixing)
• Required for tax reporting or financial auditing purposes

6.7 Business Transfers

In the event yatoto undergoes a merger, acquisition, sale of assets, bankruptcy, or other business restructuring, your personal information may be transferred to the successor entity. We will notify you via email or prominent website notice before your data is transferred and becomes subject to a different privacy policy.

7. International Data Transfers

While yatoto primarily operates to serve Indonesian players, some of our service providers and partners are located outside Indonesia. When we transfer your personal data internationally, we ensure appropriate safeguards are in place, including:

• Entering into data processing agreements with third parties that include standard contractual clauses approved by data protection authorities
• Verifying that recipient countries provide adequate data protection equivalent to Indonesian standards
• Implementing technical and organizational measures to protect data during transfer and storage

You have the right to obtain information about the safeguards we use for international transfers by contacting us using the details provided in Section 13.

8. Cookies and Tracking Technologies

yatoto uses cookies, web beacons, pixel tags, and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device that allow us to recognize you, remember your preferences, and analyze how you use our website.

Types of Cookies We Use:

Cookie Type	Purpose	Duration
Essential Cookies	Enable core functionality such as login authentication, account security, and session management. These cannot be disabled.	Session or up to 30 days
Functional Cookies	Remember your preferences (language, timezone, display settings) to personalize your experience.	Up to 1 year
Analytics Cookies	Collect anonymized data about how visitors use yatoto to help us improve the platform.	Up to 2 years
Marketing Cookies	Track your activity across websites to deliver relevant advertising and measure campaign effectiveness. Requires your consent.	Up to 1 year

You can control cookies through your browser settings. Most browsers allow you to block or delete cookies, though disabling essential cookies may impair your ability to use certain features of the yatoto platform. For detailed instructions on managing cookies, please consult your browser's help documentation.

9. Data Security Measures

yatoto implements robust technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, destruction, or loss. Our security framework includes:

• Encryption: All data transmitted between your device and our servers is encrypted using 256-bit SSL/TLS technology. Sensitive data stored in our databases is encrypted at rest.
• Access Controls: We employ strict role-based access controls ensuring only authorized personnel can access personal data, and only to the extent necessary to perform their job functions.
• Authentication: Multi-factor authentication (MFA) is required for all staff accounts with access to sensitive systems and customer data.
• Network Security: Firewalls, intrusion detection systems, and DDoS protection guard our infrastructure against cyber attacks.
• Regular Audits: Independent security firms conduct annual penetration testing and vulnerability assessments of our systems.
• Employee Training: All staff undergo mandatory data protection and security awareness training upon hiring and annually thereafter.
• Incident Response: We maintain a documented data breach response plan and will notify affected individuals within 72 hours of discovering any breach that poses a risk to their rights and freedoms.

While we implement industry-standard security measures, no method of electronic transmission or storage is 100% secure. You also have a responsibility to protect your account by using a strong, unique password, not sharing your login credentials, and logging out of your account when using shared devices.

10. Data Retention

yatoto retains your personal information only for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. Our retention periods are as follows:

• Account Data: Retained for the duration of your active account plus 7 years after account closure (to comply with financial record-keeping regulations)
• Transaction Records: Retained for 7 years from the date of transaction (tax and financial audit requirements)
• Identity Documents: Retained for 7 years after account closure (AML/KYC compliance)
• Gaming History: Retained for 7 years (dispute resolution and regulatory compliance)
• Marketing Communications: Retained until you unsubscribe or request deletion
• Customer Support Records: Retained for 3 years (quality assurance and training purposes)
• Technical Logs: Retained for 90 days to 1 year (security monitoring and troubleshooting)

After the applicable retention period expires, we securely delete or anonymize your personal data such that it can no longer be associated with you.

11. Your Privacy Rights

Under applicable data protection laws, you have the following rights regarding your personal information:

11.1 Right of Access

You have the right to request a copy of the personal data we hold about you. We will provide this information in a structured, commonly used, machine-readable format (such as PDF or CSV) within 30 days of your request.

11.2 Right to Rectification

You may request correction of inaccurate or incomplete personal data. You can update most information directly through your account settings, or contact customer support for assistance.

11.3 Right to Erasure

You may request deletion of your personal data in certain circumstances, such as when it is no longer necessary for the purposes for which it was collected, or you withdraw consent for processing based on consent. Note that we may be unable to delete data we are legally required to retain (e.g., transaction records for tax purposes).

11.4 Right to Restrict Processing

You may request that we limit how we use your personal data in specific situations, such as when you contest the accuracy of the data or object to our processing.

11.5 Right to Data Portability

You have the right to receive your personal data in a portable format and transmit it to another service provider where technically feasible.

11.6 Right to Object

You may object to processing of your personal data based on legitimate interests or for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

11.7 Right to Withdraw Consent

Where we process your data based on consent, you may withdraw that consent at any time. This will not affect the lawfulness of processing based on consent before its withdrawal.

Exercising Your Rights

To exercise any of these rights, please contact our Data Protection Officer using the contact information provided in Section 13. We may request additional information to verify your identity before processing your request. We aim to respond to all requests within 30 days, though complex requests may take up to 60 days with notification of the extension.

12. Children's Privacy

yatoto's services are strictly intended for individuals aged 21 years and older. We do not knowingly collect personal information from anyone under 21. Our age verification processes are designed to prevent underage access. If we discover we have inadvertently collected information from someone under 21, we will immediately delete that information and close the account. If you believe an underage individual has registered an account with yatoto, please contact us immediately at the email address provided in Section 13.

13. Contact Information and Complaints

If you have questions, concerns, or complaints regarding this Privacy Policy or how yatoto handles your personal information, please contact our Data Protection Officer:

• Email: [email protected] (plain text, not a clickable link)
• Subject Line: "Privacy Inquiry" or "Data Protection Request"
• Response Time: We aim to respond within 72 hours

If you are not satisfied with our response to your privacy complaint, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction.

14. Changes to This Privacy Policy

yatoto reserves the right to modify this Privacy Policy at any time to reflect changes in our practices, technology, legal requirements, or business operations. When we make material changes, we will notify you by:

• Sending an email to the address associated with your account
• Displaying a prominent notice on our website homepage
• Requiring you to acknowledge the updated policy upon your next login

The "Last Updated" date at the top of this policy indicates when it was most recently revised. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal information. Your continued use of yatoto following notification of changes constitutes acceptance of the updated Privacy Policy.