Privacy Policy

1. Definitions

Throughout this Privacy Policy, the following terms carry the meanings defined below:

• "to80" / "Company" / "we" / "us" / "our" — the operator of the online betting platform at https://to80.cam.
• "Player" / "you" / "your" — any individual who accesses or uses the to80 platform, whether as a registered account holder or as a visitor.
• "Personal Data" — any information that identifies or can reasonably be used to identify a living individual, directly or in combination with other data.
• "Processing" — any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, or deletion.
• "Controller" — the entity that determines the purposes and means of processing personal data. to80 is the data controller for all personal data collected through the platform.
• "Processor" — a third party that processes personal data on behalf of to80 under a binding data-processing agreement.
• "Consent" — a freely given, specific, informed, and unambiguous indication of a Player's agreement to the processing of their personal data for a stated purpose.
• "KYC" — Know Your Customer verification, the identity and age-verification process required to operate an account and process withdrawals on to80.

2. Personal Data We Collect

to80 collects the following categories of personal data in the course of providing its services:

2.1 Identity & Contact Data

• Full legal name as it appears on your national identity document (KTP) or passport.
• Date of birth (used to verify that you are at least 21 years of age).
• Indonesian residential address, including province and postal code.
• Email address and mobile phone number.

2.2 Financial Data

• Bank account details for deposit and withdrawal purposes (bank name, account number, account holder name — e.g., BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata).
• E-wallet identifiers for OVO, DANA, GoPay, ShopeePay, and LinkAja accounts used to fund your to80 balance.
• Transaction history, including deposit amounts, withdrawal requests, and bet settlements in Indonesian Rupiah (IDR).

2.3 Identity Verification (KYC) Data

• Scanned copies or photographs of government-issued identity documents.
• Proof-of-address documents (utility bills, bank statements).
• Selfie photographs submitted for liveness verification where required.

2.4 Technical & Usage Data

• IP address, device type, operating system, browser type and version.
• Login timestamps, session durations, and pages visited within the platform.
• Betting activity data, including sports markets accessed, bet history, and game sessions.
• Geolocation data (city-level, derived from IP address) to ensure service eligibility.

2.5 Communications Data

• Content of live chat, email, and support ticket communications with the to80 customer service team.
• Records of any complaint or dispute submitted to to80.

3. How We Collect Your Data

to80 collects personal data through the following channels:

• Direct submission: Data you provide when registering an account, completing KYC verification, making a deposit or withdrawal, or contacting our support team.
• Automated technology: Cookies, web beacons, server logs, and similar tracking technologies that record your interaction with the platform. See Section 10 for full details on our cookie practices.
• Third-party processors: Identity verification providers, payment gateways, and fraud-detection services that share relevant data with us as part of the service delivery process.
• Publicly available sources: In limited circumstances, to80 may cross-reference data against publicly available records (e.g., sanctions lists) to comply with anti-money-laundering obligations.

4. Purposes of Processing

to80 processes your personal data for the following specific purposes:

5. Legal Basis for Processing

5.1 Contract Performance: The majority of data processing by to80 is necessary to fulfill the contractual relationship established when you register an account. Without this processing, we cannot provide account management, execute transactions, or deliver betting services.

5.2 Legal Obligation: Certain processing activities — in particular KYC verification and anti-money-laundering record-keeping — are required by applicable law. to80 cannot waive these requirements, and Players cannot opt out of processing undertaken on this basis.

5.3 Legitimate Interests: to80 processes certain data on the basis of its legitimate business interests, including fraud prevention, platform security, and product analytics. Where we rely on this basis, we have assessed that our interests are not overridden by your fundamental privacy rights.

5.4 Consent: Where to80 relies on your consent as the legal basis for processing — for example, sending promotional emails or push notifications — you may withdraw that consent at any time by updating your communication preferences in your Account settings or by contacting [email protected]. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

6. Data Sharing & Disclosure

6.1 to80 does not sell your personal data. We share personal data only in the following limited circumstances:

• Payment processors: Banks and e-wallet providers (including BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja) receive the financial data necessary to execute your deposit and withdrawal instructions.
• KYC and identity verification partners: Third-party verification providers receive identity documents and selfie images solely to perform the verification checks required under our player-protection obligations.
• Fraud prevention and security services: Aggregated or pseudonymized data may be shared with specialist providers to detect and prevent fraudulent activity, money laundering, and match-fixing.
• Game content providers: Providers such as Pragmatic Play, Evolution Gaming, and Spribe receive pseudonymized player identifiers and session data to deliver their game content correctly within the to80 platform. These providers do not receive your full name, bank details, or identity documents.
• Legal and regulatory authorities: to80 will disclose personal data to law enforcement, regulatory bodies, or courts where required by a valid legal order or where disclosure is necessary to protect the rights and safety of to80, its players, or the public.
• Corporate transactions: In the event of a merger, acquisition, or sale of all or part of the to80 business, personal data may be transferred to the acquiring entity, subject to equivalent privacy protections.

6.2 All third-party processors are engaged under binding data-processing agreements that require them to process personal data only on to80's documented instructions and to maintain appropriate security measures.

7. International Data Transfers

7.1 to80 is an international platform. Some of our third-party processors — including cloud infrastructure providers, KYC verification partners, and game content studios — may process data in jurisdictions outside Indonesia.

7.2 Where personal data is transferred internationally, to80 ensures that appropriate safeguards are in place, including:

• Standard contractual clauses approved by relevant data-protection authorities.
• Transfers only to jurisdictions that maintain an adequate level of data protection as recognised by applicable international standards.
• Binding corporate rules where transfers occur within a corporate group subject to group-wide privacy governance.

7.3 By using the to80 platform, you acknowledge that your personal data may be transferred to and processed in countries outside Indonesia. to80 takes all reasonable steps to ensure that such transfers are conducted securely and in accordance with this Privacy Policy.

8. Data Retention

8.1 to80 retains personal data only for as long as necessary to fulfill the purpose for which it was collected, or as required by applicable legal and regulatory obligations.

8.2 The following retention periods apply as a general guide:

• Account and identity data: Retained for the duration of your active account plus five (5) years following account closure, to comply with anti-money-laundering record-keeping requirements.
• Transaction records: Retained for five (5) years from the date of the transaction.
• KYC documents: Retained for five (5) years following account closure or the completion of the last transaction, whichever is later.
• Customer support communications: Retained for three (3) years from the date of the last communication in a support thread.
• Technical and usage logs: Retained for twelve (12) months on a rolling basis, after which they are anonymized or deleted.
• Marketing consent records: Retained for the duration of your consent, plus three (3) years after consent is withdrawn or your account is closed.

8.3 Once the applicable retention period expires, personal data is securely deleted or anonymized so that it can no longer be linked to any individual. Anonymized data may be retained indefinitely for statistical and analytics purposes.

9. Your Data Rights

9.1 Subject to applicable law and any overriding legal obligations, you hold the following rights with respect to your personal data held by to80:

• Right of Access: You may request a copy of all personal data we hold about you in a commonly used electronic format.
• Right to Rectification: You may request correction of any personal data that is inaccurate or incomplete. You can update many data fields directly in your Account settings without contacting support.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where processing was unlawful. Note that this right is subject to our legal obligation to retain certain records.
• Right to Restriction of Processing: You may request that we restrict processing of your data while a dispute about its accuracy or our use of it is pending.
• Right to Data Portability: You may request that we provide your personal data in a structured, commonly used, machine-readable format (e.g., JSON or CSV) so that you can transfer it to another service provider.
• Right to Object: You may object to processing based on our legitimate interests or for direct marketing purposes. Where you object to direct marketing, we will cease that processing immediately.
• Rights Related to Automated Decision-Making: Where to80 makes decisions affecting you solely by automated means (e.g., automated fraud flags), you have the right to request human review of that decision.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

9.2 To exercise any of the above rights, please submit a written request to [email protected] with the subject line "Data Rights Request". Include your registered name, email address, and a description of the right you wish to exercise. to80 will acknowledge your request within 5 business days and respond in full within 30 calendar days. Complex requests may take up to 60 calendar days; we will notify you if an extension is required.

9.3 to80 will not charge a fee for handling data rights requests, except where a request is manifestly unfounded or excessive, in which case a reasonable administrative fee may apply.

10. Cookies & Tracking Technologies

10.1 to80 uses cookies and similar tracking technologies to operate the platform, remember your preferences, prevent fraud, and analyze usage patterns. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential to the operation of the platform (e.g., session authentication, fraud prevention). These cannot be disabled without impairing core functionality.
• Functional Cookies: Remember your preferences such as language settings, preferred deposit method, and odds format.
• Analytics Cookies: Collect anonymized data about how Players navigate the platform to help us improve usability and performance. Data from these cookies is aggregated and not linked to individual identities.
• Marketing Cookies: Used only where you have given explicit consent to receive personalized promotional content. These cookies track interactions with promotional materials to measure campaign effectiveness.

10.2 You can manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent core platform functions from operating correctly. Disabling analytics or marketing cookies will not affect your ability to place bets or withdraw funds.

10.3 to80 does not use third-party advertising networks that place tracking cookies on your device for the benefit of other websites.

11. Security Measures

11.1 to80 implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, loss, alteration, or destruction. These measures include:

• TLS 1.3 encryption for all data transmitted between your browser or device and our servers.
• AES-256 encryption for sensitive data stored in our databases, including identity documents and financial records.
• Multi-factor authentication options for player accounts and mandatory two-factor authentication for all administrative access to our systems.
• Regular penetration testing and vulnerability assessments conducted by qualified independent security professionals.
• Role-based access controls ensuring that only authorized personnel can access personal data on a need-to-know basis.
• Comprehensive audit logging of all access to systems containing personal data.
• A formal data breach response plan with defined timelines for internal escalation and, where required, regulatory notification.

11.2 While to80 takes all reasonable precautions to protect your data, no internet-based system can guarantee absolute security. You are responsible for keeping your account credentials confidential and for using a secure internet connection when accessing the platform.

11.3 If you suspect that your account has been compromised, please contact our support team immediately via live chat or by emailing [email protected] so that we can take prompt protective action.

12. Minors & Underage Users

12.1 The to80 platform is strictly intended for adults aged 21 years and above. to80 does not knowingly collect, process, or retain personal data from individuals under the age of 21.

12.2 If to80 becomes aware that personal data has been collected from a person under 21 — whether through age-verification checks, a report from a third party, or any other means — we will take the following immediate steps:

• Suspend the associated account pending investigation.
• Permanently close the account upon confirmation of underage status.
• Return all deposits made to the account to the original payment method, net of any amounts required by law to be retained.
• Delete or anonymize all personal data associated with the account, except where retention is required by applicable law.

12.3 Parents and guardians who believe that a minor under their care has registered an account on to80 are encouraged to contact us immediately at [email protected]. We will investigate and act on all such reports as a matter of priority.

13. Amendments to This Privacy Policy

13.1 to80 reserves the right to update or revise this Privacy Policy at any time. Where changes are material — for example, a change in the categories of data we collect, the purposes for which we use it, or the third parties with whom we share it — we will notify registered Players via email or an in-platform notification at least 14 days before the change takes effect.

13.2 The most current version of this Privacy Policy will always be accessible at https://to80.cam/privacy-policy and will display the date of the most recent revision at the top of the page.

13.3 Your continued use of the to80 platform after any revised Privacy Policy has taken effect constitutes your acknowledgment and acceptance of the updated terms. If you do not agree with the revised policy, you must discontinue use of the platform and submit an account closure request to [email protected].

14. Contact & Complaints

14.1 If you have any questions about this Privacy Policy, wish to exercise a data right, or want to report a privacy concern, please contact the to80 Data Privacy team using the details below:

• Email: [email protected] — please use the subject line "Privacy Policy Enquiry" or "Data Rights Request" as appropriate.
• Live Chat: Available 24 hours a day, 7 days a week, through your Account dashboard.
• Response Time: We aim to acknowledge all privacy-related enquiries within 5 business days (WIB) and to provide a full response within 30 calendar days.

14.2 If you are not satisfied with how to80 has handled your personal data or responded to a data rights request, you have the right to escalate your complaint to a relevant data-protection authority or to seek independent dispute resolution. to80 will cooperate fully with any legitimate regulatory investigation.

14.3 For all other account-related enquiries — including responsible gaming support, bonus queries, and technical issues — please visit our FAQ page or reach out via live chat.