At oto12, protecting your personal data is as important to us as providing a great betting experience. This Privacy Policy explains in plain terms what data we collect, why we collect it, how we use it, and the rights you hold as an Indonesian player on our platform. Please read it carefully alongside our Terms & Conditions.
Every data decision at oto12 is governed by these principles. They are not aspirational — they are operational requirements applied to every process that touches player information.
oto12 collects only the personal data necessary for account operation, identity verification, and regulatory compliance. We do not collect data speculatively or for undefined future uses.
Your personal data is never sold, rented, or commercially exchanged with third parties. Sharing occurs only where strictly necessary for service delivery or required by law.
All data transmitted between your device and oto12's servers is protected by 256-bit TLS/SSL encryption. Sensitive financial data is additionally stored with AES-256 encryption at rest.
You have the right to access, correct, and request deletion of your personal data at any time. oto12 responds to valid data requests within 30 days of receipt.
Personal data is retained only as long as necessary to fulfil the purpose for which it was collected, or as required by applicable regulatory obligations. Data is securely deleted thereafter.
In the unlikely event of a data breach affecting your personal information, oto12 will notify affected players promptly and take immediate remediation steps consistent with our incident response policy.
For the purposes of this Privacy Policy, the following terms carry the meanings set out below:
| Term | Meaning |
|---|---|
| "Personal Data" | Any information that identifies or could reasonably identify a natural person, including name, date of birth, address, email address, phone number, and financial account details. |
| "Platform" | The oto12 website at https://oto12.cam, including all associated interfaces, APIs, and services accessible through that domain. |
| "Player" / "You" | Any natural person who has created or is in the process of creating a registered account on the Platform. |
| "oto12" / "We" / "Us" | The operator of the Platform as a licensed and internationally regulated online gaming entity. |
| "Processing" | Any operation performed on Personal Data, including collection, storage, use, transmission, and deletion. |
| "Third Party" | Any entity other than you or oto12, including payment processors, identity verification providers, game studios, and regulatory authorities. |
| "KYC Data" | Identity documents and supporting materials collected as part of the Know Your Customer verification process, including Indonesian national identity card (KTP) images. |
2.1 oto12 is the data controller in respect of Personal Data collected through the Platform. As data controller, oto12 determines the purposes and means of processing Personal Data and bears responsibility for ensuring that processing is carried out lawfully, fairly, and transparently.
2.2 For any questions, requests, or concerns relating to the processing of your Personal Data by oto12, you may contact us at the details provided in Section 16 of this policy. All privacy-related inquiries should include "Privacy Request" in the subject line to ensure prompt routing to our data protection team.
oto12 collects the following categories of Personal Data from players registered on the Platform:
3.1 Registration Data
3.2 Identity Verification (KYC) Data
3.3 Financial Transaction Data
3.4 Betting & Gaming Activity Data
3.5 Technical & Device Data
3.6 Communication Data
oto12 collects Personal Data through the following means:
oto12 processes your Personal Data on the following legal bases:
| Legal Basis | When It Applies |
|---|---|
| Performance of a Contract | Processing necessary to provide the Platform services you have contracted for — account management, transaction processing, game delivery, and support. |
| Legal Obligation | Processing required to comply with applicable laws and regulations, including anti-money laundering (AML) requirements, KYC obligations, and regulatory reporting. |
| Legitimate Interests | Processing for fraud prevention, platform security, responsible gaming monitoring, and service improvement, where these interests are not overridden by your privacy rights. |
| Consent | Where oto12 seeks your consent for specific processing activities (such as direct marketing communications), consent will be obtained explicitly and may be withdrawn at any time. |
oto12 uses collected Personal Data for the following purposes:
6.1 Account Administration
To create, maintain, and manage your Player Account, including processing registration, facilitating login, and administering account settings and preferences.
6.2 Identity Verification
To verify your identity in compliance with our KYC obligations, confirm that you meet the minimum age requirement (21+), and validate that your payment methods belong to you. oto12 does not use KYC documents for any purpose other than identity and eligibility verification.
6.3 Financial Transaction Processing
To process deposits and withdrawals, reconcile accounts, detect and prevent fraudulent transactions, and comply with financial reporting obligations. Transaction records associated with your account are retained for the periods specified in Section 10.
6.4 Responsible Gaming Monitoring
To monitor betting patterns and account activity for signs of problem gambling, enforce player-set deposit, loss, and session limits, and administer self-exclusion requests. This processing is conducted under both our legal obligations and our legitimate interest in protecting player welfare.
6.5 Customer Support
To respond to inquiries, resolve complaints, and maintain records of support interactions. Support communications may be reviewed for quality assurance purposes. Indonesian-speaking agents handle support in Bahasa Indonesia during WIB business hours; English support is available 24/7.
6.6 Platform Security & Fraud Prevention
To detect and prevent unauthorized access, multi-accounting, bonus abuse, collusion, money laundering, and other forms of fraudulent activity that could harm the Platform or other players.
6.7 Legal & Regulatory Compliance
To meet oto12's obligations under applicable laws and regulations, including anti-money laundering (AML) legislation, reporting obligations to licensing authorities, and cooperation with law enforcement agencies where legally required.
6.8 Service Improvement
Aggregated and anonymized data may be used to analyze usage patterns, improve platform performance, develop new features, and optimize the player experience. This data does not identify individual players.
Marketing Communications: oto12 will only send promotional communications (emails, SMS, or in-app notifications) if you have expressly opted in. You may withdraw consent for marketing communications at any time by contacting [email protected] or by using the unsubscribe mechanism in any marketing message. Withdrawal of marketing consent does not affect the lawfulness of processing conducted prior to withdrawal.
7.1 General Principle. oto12 does not sell, rent, or commercially exchange your Personal Data with any third party. Sharing of Personal Data occurs only in the limited circumstances described below.
7.2 Service Providers. oto12 engages carefully selected third-party service providers who process Personal Data on our behalf under strict contractual data processing agreements. These include:
7.3 Legal Disclosures. oto12 may disclose Personal Data to government authorities, law enforcement agencies, or regulatory bodies where required to do so by applicable law, court order, or regulatory directive. We will notify affected players of such disclosures where legally permitted to do so.
7.4 Business Transfers. In the event of a merger, acquisition, or sale of all or substantially all of oto12's assets, Personal Data held by oto12 may be transferred to the acquiring entity. Players will be notified of any such transfer and the terms under which their data will be processed by the new controller.
7.5 Aggregated Data. Non-personally identifiable, aggregated data may be shared with analytics partners, game studios (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming), and other business partners for platform analytics and game performance purposes. This data cannot be used to identify individual players.
8.1 What We Use. oto12 uses cookies and similar technologies (including local storage and session identifiers) to operate the Platform, maintain session state, prevent fraud, and analyze usage patterns.
8.2 Cookie Categories
| Category | Purpose | Essential? |
|---|---|---|
| Strictly Necessary | Authentication, session management, fraud prevention, and platform security. These cannot be disabled without rendering the Platform inoperable. | Yes |
| Functional | Remember your preferences (language, timezone display, responsible gaming settings) across sessions. | Optional |
| Analytics | Measure page performance, session durations, and feature usage using aggregated, anonymized data to improve the Platform. | Optional |
8.3 Managing Cookies. You may adjust your browser settings to block or delete non-essential cookies at any time. Note that disabling functional cookies may impair certain Platform features such as saved preferences. Strictly necessary cookies cannot be disabled without preventing access to core Platform functionality.
9.1 Purpose Limitation. All KYC documents submitted to oto12 — including copies of your Indonesian KTP, selfie photographs, and payment method verification materials — are used exclusively for the purpose of identity verification, age confirmation (21+ requirement), and anti-money laundering compliance. These documents are not used for any other purpose and are not shared with any third party except where required by a competent regulatory or law enforcement authority.
9.2 Access Controls. KYC documents are stored in a restricted-access environment. Access is limited to a small number of authorised compliance personnel who are bound by confidentiality obligations. All access to KYC document stores is logged and auditable.
9.3 Storage Security. KYC documents are stored with AES-256 encryption at rest. Transmission of these documents to oto12's servers occurs exclusively over TLS-encrypted connections.
9.4 Retention of KYC Documents. KYC documents are retained for a minimum of five (5) years following account closure, as required by applicable anti-money laundering regulations. Following the expiry of the mandatory retention period, documents are securely deleted from all oto12 systems.
oto12 never requests KYC documents via unsolicited communications. If you receive any communication purporting to be from oto12 requesting KYC documents via an external link, email from a non-oto12.cam domain, or WhatsApp, treat it as a phishing attempt and report it to [email protected] immediately.
oto12 retains Personal Data for the following periods, after which data is securely deleted or permanently anonymized:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account registration data | Duration of account + 5 years post-closure | Regulatory & legal obligation |
| KYC documents | 5 years post-account closure (minimum) | AML compliance |
| Financial transaction records | 7 years from transaction date | Legal / regulatory requirement |
| Betting & gaming activity | 3 years from last activity date | Responsible gaming monitoring |
| Customer support records | 3 years from last interaction | Quality assurance & dispute resolution |
| Technical / device logs | 90 days rolling | Security monitoring |
| Marketing consent records | Duration of consent + 3 years | Proof of lawful basis |
Where a regulatory investigation, legal dispute, or law enforcement request is pending, relevant data may be retained beyond the standard periods above until the matter is fully resolved.
11.1 Technical Measures. oto12 implements the following technical security measures to protect Personal Data:
11.2 Organisational Measures. All oto12 staff and contractors with access to Personal Data are subject to binding confidentiality obligations. Security training is conducted regularly. Access to production systems requires multi-factor authentication (MFA).
11.3 Your Responsibilities. You are responsible for maintaining the security of your account credentials. oto12 recommends using a strong, unique password for your account and enabling any available two-factor authentication. Never share your login details with any third party.
11.4 Breach Response. In the event of a security incident affecting your Personal Data, oto12 will: (a) investigate and contain the breach promptly; (b) notify affected players within a reasonable timeframe; (c) take remediation steps to prevent recurrence; and (d) notify relevant regulatory authorities where required by applicable law.
As a registered player on the oto12 Platform, you hold the following rights in respect of your Personal Data. To exercise any of these rights, contact us at [email protected] with "Privacy Request" in the subject line.
Request a copy of all Personal Data oto12 holds about you, along with information about how it is processed and shared.
Request correction of inaccurate or incomplete Personal Data held about you. Updates to name, address, or contact details can be submitted via account settings or support.
Request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
Request that processing of your data be restricted to storage only while a dispute about accuracy or lawfulness is resolved.
Receive a copy of Personal Data you have provided to oto12 in a structured, machine-readable format for transfer to another service provider.
Object to processing based on legitimate interests, including direct marketing. oto12 will cease the relevant processing unless compelling legitimate grounds are demonstrated.
oto12 will respond to all valid privacy rights requests within 30 calendar days of receipt. Where a request is complex or numerous, we may extend this period by a further 60 days and will notify you of the extension within the initial 30-day period. We reserve the right to request reasonable identification before processing a rights request.
13.1 oto12 operates globally and may process or store Personal Data on servers located outside Indonesia. Where Personal Data is transferred internationally, oto12 ensures that adequate safeguards are in place, including contractual arrangements with service providers that incorporate appropriate data protection standards consistent with international best practices.
13.2 oto12 works only with data processors who provide sufficient guarantees of technical and organisational security measures, and who process Personal Data only on documented instructions from oto12. Processor contracts explicitly prohibit sub-processing of Personal Data without oto12's prior written consent.
13.3 By creating an account on the Platform, you acknowledge that your Personal Data may be processed in jurisdictions outside Indonesia as described in this section. If you have concerns about specific international transfers, please contact us at [email protected].
The oto12 Platform is strictly intended for adults aged 21 years and over. We do not knowingly collect or process Personal Data from any person under 21 years of age. If oto12 discovers that Personal Data has been collected from an individual under the age of 21 without appropriate verification, that account will be immediately suspended, the data will be deleted as expeditiously as possible, and any funds held in the account will be returned to the original deposit source.
If you believe that a minor may have created an account on the Platform or that oto12 may have inadvertently collected data from a person under 21, please contact us immediately at [email protected]. We take such reports seriously and will investigate promptly.
15.1 oto12 reserves the right to update or revise this Privacy Policy at any time. Where changes are material — for example, where we propose to process Personal Data for a new purpose or share it with a new category of third party — we will notify registered players by email and via a prominent notice on the Platform at least 14 days before the changes take effect.
15.2 The effective date displayed at the top of this page reflects the date on which the current version came into force. Continued use of the Platform after the effective date of a revised Privacy Policy constitutes acceptance of those changes.
15.3 Prior versions of this Privacy Policy are retained on file and available upon written request to [email protected].
For all privacy-related queries, data rights requests, or concerns about oto12's handling of your Personal Data, please contact us using the following details. Include "Privacy Request" in your subject line for fastest routing.
Acknowledgement of This Policy: By registering an account or continuing to use the oto12 Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your Personal Data as described herein. If you do not agree with any aspect of this policy, please discontinue use of the Platform and contact us to arrange account closure.
Contact our support team at [email protected] with "Privacy Request" in the subject line. Or explore our FAQ for quick answers, and review our Terms & Conditions for full platform rules.