Privacy Policy

The following definitions apply throughout this Privacy Policy:

• "Personal Data" means any information relating to an identified or identifiable natural person ("data subject"), including but not limited to name, email address, date of birth, national identity number, bank account details, IP address, and device identifiers.
• "Processing" means any operation performed on personal data, including collection, recording, storage, use, disclosure, erasure, or destruction.
• "Data Controller" means the entity that determines the purposes and means of processing personal data — in this context, to3888.
• "Data Processor" means any third party that processes personal data on behalf of to3888 under a written data-processing agreement.
• "Member" or "You" refers to any individual who has registered an account on the to3888 platform.
• "KYC" (Know Your Customer) refers to the identity and document verification process to3888 conducts to confirm a Member's identity and source of funds.
• "Cookie" means a small text file stored on your device by the to3888 website for session management, analytics, and personalisation purposes.
• "Sensitive Data" means a subset of personal data warranting heightened protection, including financial account details, government-issued identity numbers, and health-related information.

2.1 The Data Controller responsible for personal data collected through the to3888 platform is the operator of https://to3888.cam, an internationally licensed online gaming entity operating under a valid gaming licence issued by a recognised offshore regulatory authority.

2.2 to3888 primarily serves Members who are residents of Indonesia. Where applicable, to3888 complies with the data protection obligations imposed by the laws of the jurisdiction in which it is licensed, as well as the provisions of Indonesian Government Regulation No. 71 of 2019 on the Implementation of Electronic Systems and Transactions insofar as they apply to data handling for Indonesian residents.

2.3 For all privacy-related enquiries, Members may contact the designated data protection point of contact at: [email protected] (Plain text — not a clickable link. Available 24/7 · WIB, UTC+7)

3.1 Registration Data. When you create a to3888 account, we collect your full legal name, date of birth, residential address, email address, and preferred bank account or e-wallet details (for example, BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, OVO, DANA, GoPay, ShopeePay, or LinkAja).

3.2 Identity Verification (KYC) Data. To comply with our anti-money-laundering (AML) obligations and verify that you meet the 21+ age requirement, we collect copies of government-issued identity documents such as your Indonesian National Identity Card (KTP), passport, or driver's licence, as well as proof of bank account or e-wallet ownership.

3.3 Transaction Data. We record all financial transactions conducted through your account, including deposit amounts, withdrawal requests, bonus claims, betting history, game session logs, and balance movements.

3.4 Technical and Device Data. When you access the platform, we automatically collect technical data including your IP address, device type, operating system, browser type and version, session timestamps, pages visited, and clickstream data.

3.5 Communications Data. If you contact our support team via live chat, email, or any other channel, we retain records of those communications for quality assurance, training, and compliance purposes.

3.6 Responsible Gaming Data. If you use any of our responsible gaming tools — including deposit limits, session reminders, or self-exclusion requests — we record the specific settings and any changes you make to them as part of your account record.

to3888 processes personal data only when a valid legal basis exists. The primary legal bases we rely upon are:

to3888 uses your personal data for the following purposes:

• Account management: Creating, maintaining, and closing your Member account; processing login authentication; and communicating important account notices.
• Financial processing: Processing deposits and withdrawals via local Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Danamon, and others) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja); reconciling transactions; and issuing receipts.
• Identity verification: Conducting KYC checks to confirm identity, age (21+), and lawful source of funds in compliance with our AML programme.
• Fraud prevention and security: Detecting and investigating suspicious activity, multiple-account creation, bonus abuse, money laundering, and any other form of prohibited conduct as defined in our Terms & Conditions.
• Responsible gaming: Monitoring gameplay patterns to identify potential problem-gambling indicators and applying responsible gaming tool settings configured by the Member.
• Customer support: Responding to enquiries, resolving complaints, and providing technical assistance.
• Marketing communications (consent-based only): Sending personalised promotions, bonus offers, and seasonal event notifications — for example, special offers during Idul Fitri, Ramadhan, and major sporting events such as BRI Liga 1 and FIFA World Cup qualifiers.
• Platform improvement: Analysing aggrega ted usage data to improve platform performance, user experience, and game selection.
• Legal compliance: Retaining records as required by applicable law and responding to lawful requests from regulatory, tax, or law-enforcement authorities.

to3888 will not use your personal data for any purpose that is materially different from those listed above without first notifying you and, where required, obtaining your consent.

6.1 General Principle. to3888 does not sell, rent, or trade your personal data to third parties for their own commercial or marketing purposes. Data is shared only in the circumstances described below, and only to the minimum extent necessary.

6.2 Payment Processors. To facilitate deposits and withdrawals in Indonesian Rupiah (IDR), to3888 shares relevant transaction data with licensed payment service providers and local Indonesian banking partners including BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, and e-wallet operators such as OVO, DANA, GoPay, ShopeePay, and LinkAja. These providers are contractually bound to process your data solely for payment-related purposes.

6.3 KYC and AML Providers. Identity verification and anti-money-laundering screening is conducted with the assistance of regulated third-party KYC service providers. These providers process your identity documents and check your details against global sanctions and politically exposed persons (PEP) databases. All such providers are bound by strict data-processing agreements.

6.4 Game Content Providers. Game studios such as Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft may receive limited technical session data (such as session tokens and game-round identifiers) to enable game functionality and dispute resolution. These providers do not receive your full identity data.

6.5 Fraud Prevention and Security. In cases of suspected fraud, money laundering, or other criminal activity, to3888 may share relevant personal data with fraud-prevention agencies, financial intelligence units, or law-enforcement authorities, as permitted or required by applicable law.

6.6 Regulatory and Legal Disclosures. to3888 may disclose personal data to regulators, courts, arbitral tribunals, or government authorities when legally compelled to do so, or when such disclosure is necessary to protect the rights, property, or safety of to3888, its Members, or the public.

6.7 Corporate Transactions. In the event of a merger, acquisition, or sale of all or substantially all of to3888's assets, personal data held by to3888 may be transferred to the acquiring entity, subject to that entity assuming equivalent data protection obligations. Members will be notified prior to any such transfer.

7.1 As an internationally operated platform serving Members primarily based in Indonesia, to3888 may transfer personal data to servers and service providers located in jurisdictions outside of Indonesia. Such transfers are necessary to provide the platform's core services.

7.2 Whenever personal data is transferred internationally, to3888 takes appropriate safeguards to ensure that your data remains protected to a standard equivalent to that described in this Privacy Policy. These safeguards include:

• Entering into standard contractual clauses or data-processing agreements with recipient entities that impose obligations equivalent to those described in this policy.
• Transferring data only to jurisdictions or service providers that maintain demonstrably adequate data protection standards.
• Applying technical controls — including end-to-end encryption — to all cross-border data transfers.

7.3 Members who wish to obtain further information about the specific safeguards applied to international transfers of their personal data may submit a written request to [email protected].

8.1 to3888 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations.

8.2 The following indicative retention periods apply:

8.3 Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be linked to an identifiable individual. Anonymised, aggregated data may be retained indefinitely for statistical and analytical purposes.

8.4 Where a legal obligation, ongoing dispute, or regulatory investigation requires extended retention beyond the standard periods above, to3888 will retain the relevant data until that obligation or proceeding is resolved.

9.1 to3888 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• Encryption in Transit: All data transmitted between your device and to3888's servers is protected using TLS 1.2 or higher (256-bit encryption). The platform is accessible exclusively via HTTPS.
• Encryption at Rest: Sensitive data stored on to3888's servers — including identity documents and financial records — is encrypted using AES-256 encryption.
• Access Controls: Access to personal data within to3888 is restricted to authorised personnel only, on a strict need-to-know basis. All internal access is logged and audited regularly.
• Multi-Factor Authentication (MFA): Administrative access to to3888's internal systems requires multi-factor authentication. Members are also encouraged to enable two-factor authentication (2FA) on their accounts where available.
• Penetration Testing: to3888 engages independent cybersecurity professionals to conduct regular penetration tests and vulnerability assessments of its platform infrastructure.
• Incident Response: to3888 maintains a documented data breach incident response plan. In the event of a breach affecting your personal data, you will be notified within 72 hours of to3888 becoming aware of the breach, where required by applicable law.

9.2 While to3888 takes all reasonable steps to protect your personal data, no electronic transmission or storage system is completely immune to security risks. You are responsible for maintaining the security of your own account credentials and for notifying to3888 immediately if you suspect any unauthorised access to your account.

10.1 to3888 uses cookies and similar tracking technologies to operate the platform, remember your preferences, and analyse how Members interact with our services. The following categories of cookies are used:

10.2 You may manage or withdraw your consent to non-essential cookies at any time by adjusting your browser settings. Please note that disabling certain cookies may impair the functionality of some platform features.

10.3 to3888 does not use cookies or tracking technologies to build profiles for sale to third-party advertisers, nor to track your browsing activity across unaffiliated websites.

As a Member of to3888, you have the following rights with respect to your personal data. to3888 will respond to all valid requests within 30 days of receipt:

11.1 Identity Verification for Requests. To protect your data, to3888 may need to verify your identity before processing a data-subject request. We will not action requests from unverified individuals.

11.2 Limitations. Certain rights may be limited where to3888 is legally required to retain data — for example, transaction records required for AML compliance — or where exercising a right would adversely affect the rights and freedoms of other individuals.

12.1 The to3888 platform is strictly intended for adults aged 21 and over. to3888 does not knowingly collect or process personal data from individuals under the age of 21.

12.2 If to3888 becomes aware that it has inadvertently collected personal data from a person under 21 years of age, the relevant account will be immediately suspended, all data associated with the account will be securely deleted, and any deposits made will be returned to the verified source account after investigation.

12.3 If you have reason to believe that a minor has registered an account on to3888, please notify us immediately at [email protected]. We will investigate and take appropriate action without delay.

13.1 The to3888 platform may contain references to or integrations with third-party services — including game studio platforms, payment gateways, and identity verification tools. While to3888 selects these partners carefully, we do not control their privacy practices and are not responsible for how they handle personal data.

13.2 Each third-party service provider operates under its own privacy policy. We encourage you to review the privacy notices of any third-party service you interact with in connection with your to3888 account. to3888's Privacy Policy applies only to data processed directly by to3888 and its contracted Data Processors acting under our instruction.

14.1 to3888 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or platform services. When material changes are made, we will notify Members via the registered email address at least 7 days before the changes take effect, and will display a prominent notice on the platform.

14.2 The "Last Updated" date at the top of this page indicates the most recent revision. Your continued use of the platform after any amendment takes effect constitutes your acceptance of the revised Privacy Policy.

14.3 The current version of this Privacy Policy is always available at https://to3888.cam/privacy-policy. We recommend reviewing this page periodically to remain informed of how to3888 protects your personal data.

15.1 For any questions, concerns, or requests relating to this Privacy Policy or to3888's handling of your personal data, please contact our support team using the details below:

15.2 Formal Data-Subject Requests. Requests to exercise any of the rights described in Section 11 must be submitted in writing to the above email address with the subject line "Data Rights Request — [your registered username]". to3888 will acknowledge receipt within 48 hours and issue a substantive response within 30 days.

15.3 Complaints. If you believe that to3888 has processed your personal data in a manner that violates applicable data protection law, you have the right to lodge a complaint with the relevant data protection supervisory authority in the jurisdiction in which you reside. to3888 would, however, welcome the opportunity to address your concerns directly before any formal regulatory complaint is made.