Privacy Policy

Throughout this Privacy Policy, the following terms carry the meanings assigned below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, date of birth, national identity number, contact details, financial information, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, or deletion.
• "Data Controller" means to200, the entity that determines the purposes and means of Processing Personal Data.
• "Data Processor" means any third-party service provider that Processes Personal Data on behalf of to200 under a binding data processing agreement.
• "Member" or "You" means any individual who has registered an account on the to200 Platform.
• "Platform" means the to200 website at https://to200.cam and all associated services, applications, and digital interfaces.
• "KYC" means Know Your Customer — the identity and age verification process applied to all Members of to200.
• "Cookies" means small data files placed on your device by the Platform to support session management, analytics, and personalization functions.

to200 acts as the Data Controller with respect to all Personal Data collected from Members and visitors of the Platform. As Data Controller, to200 is responsible for ensuring that Personal Data is Processed lawfully, fairly, and transparently in accordance with applicable data protection legislation.

Our designated data protection contact can be reached via the support channels listed in Section 14 of this Policy. We welcome all data-related inquiries and are committed to responding promptly and substantively.

to200 collects the following categories of Personal Data, limited to what is necessary for the purposes described in Section 5:

We do not collect sensitive special-category data such as racial or ethnic origin, political opinions, religious beliefs, health records, or biometric data beyond what is inherent in standard government-issued identification documents submitted during KYC.

to200 collects Personal Data through the following channels:

• Direct Submission: Data you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting support, or responding to a survey or promotion.
• Automated Technologies: Data collected automatically when you access the Platform, including server logs, session cookies, analytics pixels, and device fingerprinting tools used for fraud prevention.
• Third-Party Sources: Data received from identity verification service providers, payment processors (including local Indonesian banks and e-wallet operators), and fraud-screening partners, to supplement information you have provided directly.
• Gaming Activity Records: Data generated automatically by game engines and sports-betting systems as you interact with products on the Platform, including bet placement records, game round results, and session durations.

to200 processes your Personal Data only where a valid legal basis exists. The primary purposes and their corresponding legal bases are set out below:

• Contract Performance: Processing your Identity, Contact, Financial, and Gaming Activity Data is necessary to operate your account, execute deposits and withdrawals, settle wagers, and deliver the services you have contracted with us to receive.
• Legal Obligation: to200 is required by applicable anti-money-laundering (AML) regulations, tax reporting obligations, and financial record-keeping requirements to collect and retain certain categories of Personal Data, particularly KYC documentation and transaction records.
• Legitimate Interests: We process Technical Data and limited Gaming Activity Data to detect and prevent fraud, protect the integrity of the Platform, improve user experience, conduct platform analytics, and operate our responsible gaming monitoring systems. We have assessed that these legitimate interests are not overridden by your privacy rights.
• Consent: Where we send you marketing communications about promotions, seasonal offers (including those tied to Indonesian cultural events such as Idul Fitri, Chinese New Year / Imlek, or Independence Day), or new product launches, we do so only where you have given explicit consent. You may withdraw this consent at any time without penalty by contacting support.

to200 does not sell, rent, or trade your Personal Data. We share data only in the following limited circumstances, and only to the extent necessary for the stated purpose:

• Payment Processors: Your financial data is shared with Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI, Bank Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) solely to execute deposit and withdrawal instructions you have authorized.
• Identity Verification Partners: KYC documents may be shared with licensed identity verification service providers for the purpose of confirming the authenticity of submitted documents and cross-referencing against sanctions watchlists.
• Game Technology Providers: Session and wagering data is shared with game providers (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft) to the extent necessary for game operation, dispute resolution, and regulatory audit purposes. These providers are bound by contractual data protection obligations.
• Fraud Prevention & Security: Technical Data and aggregated risk signals may be shared with specialist fraud prevention platforms to protect the Platform and its members from criminal activity, including money laundering and identity theft.
• Legal & Regulatory Authorities: We will disclose Personal Data to competent government authorities, law enforcement agencies, or courts where we are legally compelled to do so by a valid order, subpoena, or statutory obligation. Where legally permissible, we will notify you of such a disclosure.
• Business Transfers: In the event of a merger, acquisition, or sale of substantially all assets of to200, Personal Data held at that time may be transferred to the acquiring entity, subject to equivalent privacy protections being maintained.

All third-party Data Processors engaged by to200 are subject to a binding Data Processing Agreement that mandates compliance with applicable data protection standards, restricts use of your data to the specified purpose, and requires prompt notification of any security incidents affecting your data.

to200 retains Personal Data for the minimum period necessary to fulfill the purpose for which it was collected, or as required by law. The following retention schedule applies:

Once a retention period expires, data is securely deleted or anonymized so that it can no longer be associated with an identifiable individual. Anonymized aggregate data may be retained indefinitely for statistical and analytical purposes.

to200 implements a layered security architecture to protect your Personal Data against unauthorized access, loss, alteration, or destruction. Our technical and organizational safeguards include:

• Encryption in Transit: All data exchanged between your browser or app and the Platform is encrypted using TLS 1.2 or higher (256-bit SSL certificates). This applies equally to the Platform's API connections with payment processors and game providers.
• Encryption at Rest: Sensitive database fields, including national identity numbers, bank account details, and hashed passwords, are encrypted at rest using AES-256 encryption.
• Access Controls: Access to member Personal Data within to200's systems is governed by role-based access controls (RBAC). Only staff whose job function requires access to specific data categories are granted that access, and all access events are logged.
• Two-Factor Authentication: Internal administrative systems that contain member data require two-factor authentication (2FA) for all staff logins.
• Regular Security Audits: to200 commissions periodic penetration testing and vulnerability assessments from independent cybersecurity specialists to identify and remediate weaknesses before they can be exploited.
• Staff Training: All to200 staff who handle Personal Data receive data protection training at onboarding and at least annually thereafter.

to200 uses cookies and similar tracking technologies on the Platform for the following purposes:

• Essential Cookies: Required for the Platform to function correctly. These include session authentication tokens, load-balancing identifiers, and security tokens. Essential cookies cannot be disabled without impairing your ability to use the Platform.
• Analytics Cookies: Used to understand how members navigate the Platform, which pages are visited most frequently, and where technical errors occur. This data is aggregated and used to improve Platform performance and user experience.
• Fraud Prevention Cookies: Device fingerprinting and behavioral analytics cookies help to200 identify and block suspicious login attempts, detect multi-account abuse, and protect member funds.
• Preference Cookies: Store your display preferences (such as language or odds format selection) so that they persist across sessions without requiring you to re-configure them on each visit.

to200 does not use third-party behavioral advertising cookies to serve targeted advertisements on external websites. Most modern browsers allow you to manage cookie preferences through their settings menu. Blocking essential cookies will impair the functionality of the Platform and may prevent you from logging in or completing financial transactions.

As a member of to200 and a resident of Indonesia, you have the following rights with respect to your Personal Data:

• Right of Access: You may request a copy of the Personal Data that to200 holds about you, together with information about how it is being used.
• Right to Rectification: If any Personal Data held by to200 is inaccurate or incomplete, you have the right to request that it be corrected. For account details, many fields can be updated directly through your account settings panel.
• Right to Erasure: You may request that to200 delete your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations (see Section 7). Erasure requests cannot be fulfilled for data that must be retained to comply with AML or tax law.
• Right to Restrict Processing: You may request that to200 temporarily suspend processing of your Personal Data in specific circumstances, for example while a rectification request is under review.
• Right to Data Portability: Where processing is based on your consent or on contract performance, and the processing is carried out by automated means, you may request a copy of your Personal Data in a structured, commonly used, machine-readable format.
• Right to Withdraw Consent: Where to200 relies on your consent as the legal basis for processing (primarily for marketing communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing.
• Right to Object: You may object to processing carried out on the basis of to200's legitimate interests where you believe your privacy rights override those interests in your specific circumstances.

To exercise any of the above rights, please contact our support team via live chat or email (see Section 14). We will respond within 14 calendar days of receiving a verifiable request. We may ask you to confirm your identity before processing a data rights request to prevent unauthorized disclosure.

The to200 Platform is strictly intended for adults aged 21 years or older. to200 does not knowingly collect Personal Data from individuals under the age of 21. Age verification is a mandatory component of the KYC process applied to all Members.

If to200 becomes aware that Personal Data has been collected from a person under the age of 21, we will take immediate steps to delete that data, close the associated account, and return any deposited funds to the payment method of origin following appropriate due diligence.

If you have reason to believe that a minor has registered an account on to200, please notify us immediately via our support channels so that we can investigate and act promptly.

to200's primary data processing infrastructure is located in jurisdictions that maintain robust data protection frameworks. Where Personal Data is transferred outside of Indonesia — for example, to the servers of international game providers such as Pragmatic Play or Evolution Gaming — such transfers are conducted under binding contractual protections that require the receiving party to apply data protection standards equivalent to those described in this Policy.

to200 does not transfer your Personal Data to any country or entity that does not provide an adequate level of data protection without first putting in place appropriate contractual safeguards. A list of countries to which we currently transfer data may be requested from our support team.

to200 reviews this Privacy Policy periodically and reserves the right to update it to reflect changes in our data processing practices, applicable legal requirements, or operational changes to the Platform. The date of the most recent revision is displayed at the top of this page.

Where changes are material — meaning they significantly affect your rights or how your Personal Data is used — we will notify you via the email address registered to your account or through a prominent notice on the Platform at least 14 days before the revised Policy takes effect. Your continued use of the Platform after the effective date of any revision constitutes acceptance of the updated Privacy Policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the processing of your Personal Data by to200, please contact us through any of the following channels:

• Live Chat: Available 24 hours a day, 7 days a week directly through the Platform. Average response time: under 60 seconds.
• Email: [email protected] (plain text — not a clickable link). We aim to respond to all data-related inquiries within 14 calendar days.
• Support Hours (Senior / Escalated Cases): 08.00–23.00 WIB, seven days a week.

This Privacy Policy was last reviewed and updated on 1 January 2026. The most current version is always available at https://to200.cam/privacy-policy.