Privacy Policy

For the purposes of this Privacy Policy, the following terms carry the meanings assigned below:

• "mbtoto", "we", "us", "our" — the mbtoto online betting platform, operated at https://mbtoto.cam by its international licensing entity.
• "Member", "you", "your" — any individual who registers an account on or otherwise accesses the mbtoto platform.
• "Personal Data" — any information that, alone or in combination with other data, can identify a specific natural person. This includes names, ID numbers, email addresses, IP addresses, device identifiers, and financial account details.
• "Processing" — any operation performed on Personal Data, including collection, storage, use, disclosure, alteration, or deletion.
• "Controller" — the entity that determines the purposes and means of Processing. mbtoto acts as the data Controller in respect of Member data.
• "Processor" — a third-party entity that processes Personal Data on behalf of mbtoto, under contractual instruction.
• "Cookies" — small data files placed on your browser or device by the mbtoto platform to store session information, preferences, and analytical data.
• "KYC" — Know Your Customer; the identity verification procedures required under our anti-money laundering obligations.

2.1 This Privacy Policy applies to all Personal Data collected by mbtoto through the platform at https://mbtoto.cam, including data gathered during account registration, account use, customer support interactions, KYC verification, payment transactions, and any marketing communications you opt into.

2.2 This Policy applies to all Members regardless of their location, but is specifically designed to address the data-handling practices relevant to residents of Indonesia accessing the mbtoto platform.

2.3 By registering an account on mbtoto or continuing to use the platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and use of your Personal Data as described herein.

2.4 This Privacy Policy supplements and should be read in conjunction with the mbtoto Terms & Conditions. In the event of any conflict between this Policy and the Terms & Conditions regarding data matters, this Privacy Policy shall take precedence.

3.1 mbtoto collects the following categories of Personal Data from Members:

3.2 mbtoto does not intentionally collect any special categories of sensitive Personal Data (such as racial or ethnic origin, religious beliefs, health data, or biometric data) beyond what may appear incidentally in KYC identity documents.

4.1 Directly from You. The majority of Personal Data we hold is provided directly by you during account registration, KYC document submission, payment transactions, customer support contacts, and when you update your account profile.

4.2 Automatically. When you access the mbtoto platform, our servers automatically record Technical Data including your IP address, browser type, device identifier, operating system, session duration, pages visited, and approximate geographic location derived from IP. This data is used for security, fraud prevention, and platform optimisation.

4.3 Via Cookies and Similar Technologies. mbtoto uses cookies, pixel tags, and local storage objects to recognise your device, maintain session state, remember your preferences, and collect usage analytics. Full details are provided in Section 10 (Cookies & Tracking).

4.4 From Third-Party Processors. Where you make deposits or withdrawals through a third-party payment provider (such as a bank transfer via BCA, BRI, BNI, or Mandiri, or an e-wallet such as OVO, DANA, or GoPay), we may receive confirmation data from that provider necessary to reconcile your transaction. We do not receive your full bank account credentials directly from payment processors.

4.5 From Identity Verification Services. During KYC, mbtoto may use authorised third-party document verification services to authenticate the identity documents you submit. These providers process your document data under strict contractual confidentiality and data minimisation obligations.

5.1 mbtoto processes your Personal Data for the following clearly defined purposes:

• Account Management: To create, verify, maintain, and administer your Member account, including processing deposits and withdrawals in Indonesian Rupiah (IDR).
• Identity & Age Verification (KYC): To confirm that you are at least 21 years of age and that the identity you have registered accurately reflects your legal identity, as required by our responsible gaming and anti-money laundering obligations.
• Service Delivery: To provide access to the full range of mbtoto betting products and services, including football markets, togel (Indonesia's traditional numbers-prediction lottery), live casino games, and slot titles.
• Payment Processing: To execute deposit and withdrawal transactions accurately and securely through your nominated local bank account or e-wallet.
• Security & Fraud Prevention: To detect, investigate, and prevent fraudulent activity, multi-accounting, money laundering, and other prohibited conduct as defined in our Terms & Conditions.
• Regulatory Compliance: To meet our legal obligations under applicable international licensing conditions, anti-money laundering (AML) regulations, and know-your-customer (KYC) requirements.
• Customer Support: To handle and resolve enquiries, complaints, and support requests submitted through live chat, email, or other contact channels.
• Responsible Gaming: To monitor betting patterns, enforce self-exclusion decisions, apply deposit and loss limits, and fulfil our duty of care obligations to Members who may be at risk.
• Marketing Communications: Where you have opted in, to send you promotional offers, seasonal campaigns (such as Idul Fitri, Ramadhan, or BRI Liga 1 promotional events), and personalised recommendations. You may withdraw marketing consent at any time through your account settings.
• Platform Improvement: To analyse aggregated usage data and improve the functionality, performance, and user experience of the mbtoto platform.

6.1 mbtoto processes your Personal Data on one or more of the following legal bases:

• Contractual Necessity: Processing required to perform our obligations under the Member agreement — including account creation, payment processing, and service delivery — is carried out on the basis that it is necessary to fulfil the contract between you and mbtoto.
• Legal Obligation: Certain processing activities — particularly KYC identity verification, AML transaction monitoring, and record-keeping — are carried out because mbtoto is required to do so under applicable international licensing and financial compliance obligations.
• Legitimate Interests: mbtoto processes Technical Data and betting activity data for fraud detection, security monitoring, and platform optimisation on the basis of our legitimate interests in operating a safe, fair, and financially sound platform, provided those interests are not overridden by your privacy rights.
• Consent: Where we send marketing communications or use non-essential cookies, we do so on the basis of your explicit, freely given, and withdrawable consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

7.1 mbtoto does not sell, rent, or otherwise commercialise your Personal Data. We share data only where necessary and only with the categories of recipients described below:

• Payment Processors: Local Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the minimum financial data necessary to execute your deposit and withdrawal instructions.
• Identity Verification Providers: Third-party KYC and document-authentication services receive your identity documents solely for the purpose of verifying your age, name, and address. These providers operate under strict data processor agreements.
• Game Technology Providers: Studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive session identifiers and game-result data necessary to operate the games you play. They do not receive your full identity or financial data.
• IT & Infrastructure Providers: Cloud hosting, content delivery, and cybersecurity service providers who support the technical operation of the platform may process Technical Data under strict confidentiality and data security obligations.
• Legal & Regulatory Authorities: mbtoto will disclose Personal Data to law enforcement bodies, regulatory authorities, or courts where required to do so by applicable law, valid legal process, or to protect the rights and safety of mbtoto, its Members, or third parties.
• Professional Advisors: Lawyers, auditors, and compliance consultants engaged by mbtoto may access Member data on a need-to-know basis, subject to professional confidentiality obligations.

7.2 Any third party receiving Personal Data from mbtoto is required to handle that data in a manner consistent with this Privacy Policy and applicable data protection standards. mbtoto does not permit third-party processors to use Member data for their own independent marketing or commercial purposes.

8.1 As an internationally operated platform, mbtoto may transfer certain Personal Data to servers or service providers located outside of Indonesia. Where such transfers occur, mbtoto takes appropriate steps to ensure that your data receives a level of protection equivalent to that applied domestically.

8.2 Safeguards applied to international transfers include: contractual data processing agreements incorporating standard data protection clauses, technical security measures such as encryption in transit and at rest, and access restriction policies limiting data access to authorised personnel only.

8.3 By registering an account and using the mbtoto platform, you acknowledge and consent to the transfer of your Personal Data to jurisdictions outside Indonesia for the purposes described in this Policy, subject to the safeguards described above.

9.1 mbtoto retains Personal Data for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention periods apply:

9.2 Upon expiry of the applicable retention period, Personal Data will be securely deleted or anonymised so that it can no longer be associated with an identifiable individual. Anonymised or aggregated data may be retained indefinitely for statistical and platform-improvement purposes.

10.1 mbtoto uses cookies and similar tracking technologies to enhance your experience, maintain your session, prevent fraud, and understand how Members interact with the platform. The cookies we use fall into the following categories:

• Strictly Necessary Cookies: Essential to the operation of the platform. Without these cookies, core functions such as logging in, maintaining your session, and processing transactions cannot function. These cookies cannot be disabled without impairing your ability to use the platform.
• Performance & Analytics Cookies: Collect anonymised or pseudonymised data about how Members navigate the platform — including pages visited, time spent, and errors encountered — to help us identify and fix usability issues and improve platform performance.
• Functional Cookies: Remember your preferences such as language settings, preferred payment method, and display options so you do not need to re-enter them on each visit.
• Security Cookies: Used to detect and prevent fraudulent activity, unauthorised access attempts, and multi-accounting. These cookies are classified as strictly necessary and cannot be disabled.

10.2 Most web browsers allow you to control cookie settings through the browser's preferences menu. Disabling non-essential cookies will not prevent you from accessing mbtoto, but certain personalisation features may be affected.

11.1 mbtoto implements a comprehensive set of technical and organisational security measures designed to protect your Personal Data against unauthorised access, accidental loss, alteration, or disclosure. Key measures include:

• 256-Bit SSL/TLS Encryption: All data in transit between your browser and mbtoto servers is encrypted using 256-bit SSL/TLS protocols, preventing interception by unauthorised parties.
• Encryption at Rest: Sensitive data stored on mbtoto servers — including identity documents, financial records, and passwords — is encrypted at rest using industry-standard algorithms.
• Access Control: Internal access to Member Personal Data is restricted on a strict need-to-know basis. All staff with access to Member data are subject to confidentiality obligations and undergo data security training.
• Multi-Factor Authentication: Administrative access to systems holding Member data requires multi-factor authentication to prevent unauthorised access even if login credentials are compromised.
• Penetration Testing & Audits: mbtoto regularly commissions independent security audits and penetration tests to identify and remediate vulnerabilities in the platform's security infrastructure.
• Incident Response: In the unlikely event of a data breach affecting your Personal Data, mbtoto has an incident response plan in place. Affected Members will be notified promptly with details of the nature of the breach and the steps being taken to mitigate harm.

11.2 While mbtoto takes all reasonable steps to protect your data, no method of transmission over the internet is entirely without risk. You are responsible for keeping your own login credentials secure and for logging out of the platform when using shared or public devices.

12.1 As a Member of mbtoto, you hold the following rights in respect of your Personal Data. To exercise any of these rights, contact our support team at [email protected] with the subject line "Data Rights Request". We will respond within thirty (30) calendar days of receiving a valid request.

• Right of Access: You may request a copy of the Personal Data mbtoto holds about you, along with information about how it is used and with whom it is shared.
• Right to Rectification: You may request that inaccurate or incomplete Personal Data be corrected without undue delay. For certain data fields, you can update information directly through your account profile.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected. This right is subject to overriding legal retention obligations — in particular, KYC and transaction records must be retained for the periods specified in Section 9.
• Right to Restriction of Processing: You may request that mbtoto restrict its processing of your data in certain circumstances — for example, where you contest the accuracy of the data or where you have objected to processing pending verification of our legitimate grounds.
• Right to Data Portability: Where processing is based on your consent or on a contract, you may request that we provide your Personal Data in a structured, commonly used, machine-readable format.
• Right to Object: You may object at any time to processing based on mbtoto's legitimate interests, including profiling for responsible gaming monitoring. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (such as marketing communications), you may withdraw that consent at any time through your account settings or by contacting support. Withdrawal does not affect the lawfulness of prior processing.

13.1 mbtoto's platform is strictly intended for adults aged 21 and above. We do not knowingly collect or process Personal Data from individuals under the age of 21. Age verification is a mandatory component of the mbtoto KYC process, and any account found to belong to a person under 21 will be immediately closed, with all associated data deleted or retained only as required by our responsible gaming record-keeping obligations.

13.2 If you are a parent or guardian and believe that a minor has registered an account on mbtoto, please contact us immediately at [email protected]. We will investigate and take appropriate action within 48 hours of receiving your report.

13.3 We strongly encourage parents and guardians to use internet filtering and parental control software to prevent minors from accessing online gambling platforms. For guidance on responsible gaming tools available to Members, please visit our Responsible Gaming page.

14.1 The mbtoto platform may contain informational references to third-party services — including payment processors and game providers — whose own privacy practices are governed by their respective privacy policies, independent of this document. mbtoto is not responsible for the data practices of any third-party service, and your interactions with those services are subject to their own terms and privacy policies.

14.2 We recommend that you review the privacy policy of any third-party service before providing personal information to that service. mbtoto's privacy obligations extend only to data processed directly by or on behalf of mbtoto.

15.1 mbtoto reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable legal requirements, or platform functionality. The date of the most recent revision is displayed at the top of this page.

15.2 Where a material change is made to this Policy — meaning a change that significantly affects how your Personal Data is used or your rights in relation to it — mbtoto will notify registered Members by email or by a prominent notice on the platform at least fourteen (14) days before the change takes effect.

15.3 Continued use of the mbtoto platform following the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. If you do not accept the changes, you must cease use of the platform and contact support to request account closure.

16.1 For any questions, concerns, or requests relating to this Privacy Policy or to the Personal Data mbtoto holds about you, please contact our Data Support team using the following details:

• Email: [email protected] (plain text — not a clickable link)
• Subject Line: Please use "Privacy Enquiry" or "Data Rights Request" so your message is routed promptly to the appropriate team.
• Live Chat: Available on the platform 00:00 – 23:59 WIB, every day of the year. Indonesian-speaking agents are available at all hours.
• Response Time: We aim to acknowledge all privacy-related communications within 24 hours and to provide a substantive response within 30 calendar days.

16.2 If you are dissatisfied with our handling of your Personal Data or our response to a data rights request, you have the right to escalate your complaint to the relevant data protection authority or regulatory body in the jurisdiction applicable to your circumstances.

16.3 For further information about mbtoto's approach to member welfare, please visit our Responsible Gaming page, our FAQ page, or review our Terms & Conditions.