Privacy Policy

1. Introduction and Scope

This Privacy Policy applies to all personal information collected by toya4d through our website located at toya4d.cam, any mobile-optimized versions or applications, customer support communications, email correspondence, and any other channels through which you interact with our platform or services. By creating an account, using our services, or otherwise providing your personal information to toya4d, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and disclosure of your information as described herein.

This Privacy Policy should be read in conjunction with our Terms & Conditions, which govern your overall relationship with toya4d. In the event of any conflict between this Privacy Policy and the Terms & Conditions regarding data protection matters, this Privacy Policy shall prevail.

We reserve the right to modify this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or business operations. Material changes will be communicated via email to your registered address or through prominent notice on our platform. Continued use of our services following any changes constitutes acceptance of the updated Privacy Policy.

2. Data Controller Information

toya4d acts as the data controller for all personal information collected through our platform. This means we determine the purposes for which your personal data is processed and the means by which such processing occurs. We are responsible for ensuring that all data processing activities comply with applicable data protection laws and regulations.

If you have questions about how your personal information is processed, wish to exercise your privacy rights, or need to report a data protection concern, please contact our Data Protection Officer using the contact information provided in Section 14 of this Privacy Policy.

3. Information We Collect

3.1 Information You Provide Directly

When you register for a toya4d account, we collect the following personal information that you provide directly during the registration and account verification process:

• Identity Information: Full legal name (as it appears on your government-issued identification), date of birth, Indonesian National Identity Card (KTP) number, nationality, and gender.
• Contact Information: Email address, mobile phone number, residential address (street address, city, province, postal code), and preferred communication channels.
• Financial Information: Bank account details (account number, account holder name, bank name, branch), e-wallet account identifiers (OVO, DANA, GoPay), payment card details (if applicable), and transaction history including deposits, withdrawals, and betting activity.
• Verification Documents: Copies of government-issued identification documents (Indonesian KTP), proof of address documents (utility bills, bank statements, government correspondence), and selfie photographs for identity confirmation.
• Communication Records: Customer support chat transcripts, email correspondence, phone call recordings (with notice and consent), complaint submissions, and feedback responses.

3.2 Information Collected Automatically

When you access and use our platform, we automatically collect certain technical and usage information through server logs, cookies, and similar tracking technologies:

• Device Information: Device type (desktop, mobile, tablet), operating system and version, browser type and version, screen resolution, device identifiers, and hardware model.
• Usage Data: Pages visited, features used, time spent on pages, click patterns, navigation paths, games played, bets placed, login timestamps, session duration, and feature interaction patterns.
• Technical Data: IP address, geolocation data (country, city, approximate coordinates), internet service provider, referring/exit pages, date and time stamps, and error logs.
• Marketing Data: Responses to promotional campaigns, bonus redemption behavior, email open rates, click-through rates, and marketing preference indicators.

3.3 Information from Third-Party Sources

We may receive information about you from third-party service providers including payment processors (transaction confirmations, fraud detection alerts), identity verification services (KYC verification results, document authentication), fraud prevention agencies (credit checks, identity validation), and marketing partners (referral source attribution, campaign performance data). This information is used to supplement the data you provide directly to enhance security, prevent fraud, and improve service delivery.

4. How We Use Your Information

toya4d processes your personal information for the following specific purposes, each of which is necessary for the provision of our services, compliance with legal obligations, or our legitimate business interests:

4.1 Account Management and Service Delivery

• Creating and maintaining your member account with unique credentials and profile settings
• Processing your registration and completing mandatory KYC (Know Your Customer) identity verification
• Authenticating your identity each time you log in to prevent unauthorized access
• Providing access to gaming products including sports betting, casino games, lottery draws (togel), and other entertainment offerings
• Processing deposit transactions from your verified bank accounts or e-wallets
• Processing withdrawal requests and transferring funds to your verified payment methods
• Maintaining accurate transaction records and account balance information
• Providing customer support assistance via live chat, email, and WhatsApp channels

4.2 Legal and Regulatory Compliance

• Verifying that you meet the minimum age requirement of 21 years to prevent underage gambling
• Conducting anti-money laundering (AML) checks and suspicious transaction monitoring as required by international gaming regulations
• Maintaining records for regulatory audits and compliance reporting to licensing authorities
• Detecting and preventing fraud, collusion, bonus abuse, and other prohibited activities
• Responding to legal requests from law enforcement agencies or courts when legally obligated
• Enforcing our Terms & Conditions and investigating violations

4.3 Security and Fraud Prevention

• Monitoring account activity for unusual patterns that may indicate unauthorized access or fraudulent behavior
• Implementing multi-factor authentication and other security measures to protect your account
• Detecting duplicate accounts, identity fraud, payment fraud, and coordinated betting attacks
• Blocking access from prohibited jurisdictions or high-risk IP addresses
• Conducting security investigations when suspicious activity is detected

4.4 Marketing and Communication

• Sending promotional emails about new games, bonuses, tournaments, and special offers (only with your consent, which can be withdrawn at any time)
• Personalizing promotional content based on your gaming preferences and activity history
• Conducting customer satisfaction surveys and feedback requests to improve our services
• Sending important account notifications, security alerts, policy updates, and service announcements (these transactional emails cannot be opted out of as they are essential to your account security)

4.5 Platform Improvement and Analytics

• Analyzing usage patterns to understand which games and features are most popular among Indonesian players
• Identifying technical issues, bugs, and performance bottlenecks requiring fixes
• Testing new features and user interface improvements before full deployment
• Generating aggregate statistics and trends reports (anonymized data with no personal identifiers)
• Optimizing platform performance, load times, and mobile responsiveness

5. Legal Basis for Processing

Under international data protection principles, we must have a lawful basis for processing your personal information. We rely on the following legal bases depending on the specific processing activity:

Contractual Necessity

Processing is necessary to fulfill our contractual obligations to you under the Terms & Conditions, including account creation, transaction processing, game access, and customer support. Without this data, we cannot provide our services.

Legal Obligation

Processing is required to comply with legal and regulatory obligations imposed by gaming licenses, anti-money laundering regulations, age verification laws, tax reporting requirements, and court orders.

Legitimate Interest

Processing is necessary for our legitimate business interests including fraud prevention, security monitoring, platform improvement, marketing (except where opt-in consent is required), and business analytics, provided these interests are not overridden by your privacy rights.

Consent

For certain activities such as marketing communications and optional cookies, we rely on your explicit consent, which you may withdraw at any time without affecting the lawfulness of processing based on consent before withdrawal.

6. Information Sharing and Disclosure

toya4d does not sell, rent, or trade your personal information to third parties for their own marketing purposes. However, we do share your information with carefully selected third-party service providers and partners in the following circumstances:

6.1 Service Providers and Business Partners

We share information with third-party companies that perform services on our behalf, subject to strict confidentiality agreements and data processing terms:

Service Provider Type	Data Shared	Purpose
Payment Processors	Name, bank account details, transaction amounts, timestamps	Processing deposits and withdrawals via Indonesian banks and e-wallets
Identity Verification Services	Name, date of birth, KTP number, ID document images	Conducting KYC verification to confirm identity and age
Game Providers	Account ID, game preferences, betting history (pseudonymized when possible)	Delivering casino games, slots, and live dealer experiences
Cloud Hosting Providers	All account data (encrypted)	Hosting platform infrastructure and databases
Customer Support Tools	Contact information, chat transcripts, support tickets	Managing customer service inquiries and issue resolution
Analytics Providers	Usage data, device information (anonymized where possible)	Analyzing platform performance and user behavior
Email Service Providers	Email address, name, communication preferences	Sending transactional emails and marketing communications

6.2 Legal Requirements and Protection

We may disclose your personal information when required by law or when we believe in good faith that disclosure is necessary to comply with legal obligations, protect our legal rights, prevent fraud or illegal activity, respond to court orders or subpoenas, cooperate with law enforcement investigations, or protect the safety and security of toya4d, our users, or the public.

6.3 Business Transfers

In the event of a merger, acquisition, sale of assets, bankruptcy, or other business transaction involving toya4d, your personal information may be transferred to the acquiring entity or successor company, subject to the same privacy protections outlined in this Privacy Policy.

7. Data Security Measures

toya4d employs industry-standard technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction:

• Encryption: All data transmissions between your device and our servers are protected using 256-bit SSL/TLS encryption, the same level used by banks and financial institutions. Sensitive data stored in our databases is encrypted at rest.
• Access Controls: Personal information is accessible only to authorized employees and contractors who require access to perform their job functions. All personnel with data access undergo background checks and sign confidentiality agreements.
• Network Security: Our infrastructure is protected by enterprise-grade firewalls, intrusion detection systems, DDoS mitigation services, and continuous security monitoring.
• Payment Security: All payment processing is conducted through PCI DSS compliant payment gateways. toya4d does not store full credit card numbers or CVV codes on our servers.
• Regular Audits: We conduct periodic security audits, vulnerability assessments, and penetration testing by independent third-party security firms to identify and remediate potential weaknesses.
• Data Segregation: Personal data, financial data, and gameplay data are stored in separate database environments with different access controls to minimize exposure in case of a breach.
• Incident Response: We maintain a comprehensive data breach response plan to quickly detect, contain, investigate, and notify affected users in the event of any security incident.

While we implement robust security measures, no system is completely invulnerable. You also play a critical role in protecting your information by maintaining the confidentiality of your password, enabling two-factor authentication, logging out when finished, and avoiding accessing your account on public or shared devices.

8. Data Retention Periods

toya4d retains your personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods vary based on data type and regulatory requirements:

• Account Data: Active account information is retained for the duration of your membership plus six years after account closure to comply with gaming regulations, tax laws, and legal obligations.
• Transaction Records: Deposit and withdrawal records are retained for seven years from the transaction date as required by financial regulations and anti-money laundering laws.
• Identity Verification Documents: KYC documents (KTP copies, proof of address, selfies) are retained for seven years after account closure to comply with regulatory record-keeping requirements.
• Communication Records: Customer support transcripts and email correspondence are retained for three years to resolve potential disputes and improve service quality.
• Marketing Data: Marketing consent records and communication preferences are retained until you withdraw consent, at which point they are deleted within 30 days.
• Technical Logs: Server logs, IP addresses, and device information are typically retained for 90 days unless needed for fraud investigation or legal proceedings.

After the applicable retention period expires, personal information is securely deleted or anonymized so that it can no longer identify you as an individual. Anonymized data may be retained indefinitely for statistical and analytical purposes.

9. Your Privacy Rights

You have certain rights regarding your personal information under international data protection principles. To exercise any of these rights, please contact our Data Protection Officer using the contact information in Section 14:

Right of Access

You have the right to request a copy of the personal information we hold about you. We will provide this information in a structured, commonly used, and machine-readable format within 30 days of your request.

Right to Rectification

If your personal information is inaccurate or incomplete, you have the right to request correction or completion. You can update most information directly through your account settings, or contact customer support for assistance.

Right to Erasure (Right to be Forgotten)

You may request deletion of your personal information in certain circumstances, such as when it is no longer necessary for the purposes for which it was collected. However, we may retain certain data if required by law or for legitimate business purposes such as fraud prevention.

Right to Restrict Processing

You have the right to request that we limit how we use your personal information in certain situations, such as when you contest the accuracy of the data or object to processing based on legitimate interests.

Right to Data Portability

You have the right to receive your personal information in a portable format and transmit it to another service provider where technically feasible.

Right to Object

You may object to processing of your personal information based on legitimate interests or for direct marketing purposes. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.

Right to Withdraw Consent

Where we process your data based on consent (such as marketing communications), you have the right to withdraw that consent at any time. This will not affect the lawfulness of processing before consent was withdrawn.

Please note that exercising some of these rights may affect our ability to provide certain services. For example, deleting essential account information may require account closure.

10. Cookies and Tracking Technologies

toya4d uses cookies, web beacons, and similar tracking technologies to enhance your browsing experience, analyze platform usage, and deliver personalized content. Cookies are small text files stored on your device that allow us to recognize you on subsequent visits.

Types of Cookies We Use

• Essential Cookies: Required for basic platform functionality including login sessions, security features, and shopping cart functions. These cannot be disabled without significantly impairing site functionality.
• Performance Cookies: Collect anonymous usage data to understand how visitors interact with our platform, which pages are most popular, and where technical issues occur.
• Functional Cookies: Remember your preferences such as language settings, currency selection, and layout choices to provide a more personalized experience.
• Marketing Cookies: Track your browsing activity across sessions to deliver relevant advertisements and measure campaign effectiveness. These require your consent and can be disabled through browser settings.

You can control cookie preferences through your browser settings by blocking all cookies, accepting only first-party cookies, or receiving notifications before cookies are set. However, disabling cookies may limit certain platform features. For detailed cookie management instructions, consult your browser's help documentation.

11. Children's Privacy

toya4d services are strictly intended for individuals aged 21 years and older in accordance with Indonesian age-of-majority laws and international responsible gaming standards. We do not knowingly collect, use, or solicit personal information from individuals under 21 years of age. Our registration process includes mandatory age verification through government-issued identification (Indonesian KTP) to prevent underage access.

If we discover that we have inadvertently collected personal information from a person under 21 years of age, we will immediately delete that information from our systems and permanently close any associated account. If you believe we have collected information from an underage individual, please contact us immediately at [email protected] so we can take appropriate action.

Parents and guardians are encouraged to monitor their children's internet usage and prevent access to gambling websites through parental control software and browser restrictions.

12. International Data Transfers

toya4d operates internationally and may transfer your personal information to countries outside of Indonesia for processing and storage. These transfers are necessary to provide our services, as our infrastructure, service providers, and business partners are located in various jurisdictions around the world.

When we transfer personal information internationally, we ensure appropriate safeguards are in place to protect your data in accordance with this Privacy Policy and applicable data protection laws. These safeguards may include standard contractual clauses approved by regulatory authorities, adequacy decisions recognizing equivalent data protection standards, or other legally recognized transfer mechanisms.

By using our services, you acknowledge and consent to the international transfer and processing of your personal information as described in this Privacy Policy.

13. Policy Changes and Updates

toya4d reserves the right to modify this Privacy Policy at any time to reflect changes in our data practices, legal requirements, technological developments, or business operations. When we make material changes that significantly affect how we collect, use, or share your personal information, we will provide notice through one or more of the following methods:

• Email notification sent to your registered email address at least 30 days before changes take effect
• Prominent banner notification displayed on our platform homepage and account dashboard
• Pop-up notification requiring acknowledgment upon your next login

Minor changes such as updates to contact information, clarifications of existing policies, or formatting improvements may be made without prior notice. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information. The "Last Updated" date at the top of this document indicates when the policy was most recently revised.

Continued use of toya4d services following any Privacy Policy changes constitutes your acceptance of the updated terms. If you disagree with any modifications, you may close your account by contacting customer support, though you will remain bound by the policy version in effect at the time of your prior use.

14. Contact Information

If you have questions, concerns, or complaints about this Privacy Policy, wish to exercise your privacy rights, or need to report a data protection issue, please contact our Data Protection Officer through any of the following channels:

Email: [email protected] (include "Privacy Inquiry" in subject line for priority handling)

Live Chat: Available 24/7 through the chat widget on our platform. Select "Privacy & Data Protection" as your inquiry category for routing to specialized agents.

WhatsApp: Contact our Indonesian-speaking support team via WhatsApp messaging service. Privacy inquiries are handled during business hours (09:00-21:00 WIB) with response times typically within 1-2 hours.

When contacting us about privacy matters, please provide sufficient detail to allow us to understand and address your inquiry, including your account username (if applicable), the nature of your concern, and any relevant dates or transaction references. We will acknowledge receipt of your inquiry within 48 hours and provide a substantive response within 30 days.

For urgent security concerns such as suspected account compromise or data breach, please use the live chat channel and select "Security Emergency" for immediate escalation to our security team.