citratotoPrivacy Policy

What we collect

We collect information in several categories. During registration, we request your full name, email address, date of birth, phone number, and residential address. These details are mandatory for account creation and compliance with anti-money-laundering regulations. We use your email to send account notifications, payment confirmations, and service updates.

For account verification (KYC), we request a government-issued ID and an address proof (utility bill or bank statement). We store these documents securely and use them solely to confirm your identity and prevent fraud. We do not share these documents with third parties except where required by law or financial regulation.

When you deposit funds, we collect transaction details: the method you used (DANA, e-wallet, mobile banking, local payment, or bank VA), the amount, the timestamp, and transaction ID. Our payment processors see these details to facilitate the transfer; citratoto also retains them for your account history and regulatory reporting.

How we use your data on citratoto

We use your account data to operate citratoto: to verify your identity, process deposits and withdrawals, settle bets on Liga 1, Piala Indonesia, Piala AFF, Champions League, and other markets, and manage your live-dealer and slot-game sessions. We analyse aggregate (non-personal) usage patterns to understand which features are popular, detect bugs, and prioritise development.

We retain transaction records to provide you with account history, audit trails for disputes, and proof of deposits or withdrawals. We keep identity verification documents for the duration of your account plus a reasonable retention period after closure (typically six months) to comply with financial regulations. If your account is inactive for more than two years, we may delete non-essential data while retaining transaction records required by law.

We use your contact details (email and phone) to send account alerts, payment confirmations, and critical service announcements. We do not send marketing emails unless you opt in through a separate preference control in your account settings. If you receive unsolicited marketing, contact us immediately—we will stop it and investigate.

Third parties and data processors

We engage third parties to operate citratoto. Our payment processors (who handle online payment, e-wallet, mobile banking, local payment, and bank transfers) see your transaction details but do not control how we use them—our data processing agreements specify their obligations. Our cloud hosting provider (which may be located outside Indonesia) stores our servers and backups but does not access user data directly.

We use a KYC service provider to verify your identity documents; they see your ID and address proof but only for verification purposes. We comply with anti-money-laundering and counter-terrorism-financing rules, which may require us to share transaction data with government agencies if ordered by court or regulatory authority. We do not voluntarily report user data to government unless legally compelled.

Cookies and tracking

We use cookies to keep you logged in, remember your preferences, and detect fraud. These are functional cookies essential to citratoto's operation—you cannot disable them and still access your account. We do not use third-party cookies for advertising or profiling. Your browser's cookie settings apply: if you clear cookies, you will need to log in again.

We keep your data only as long as necessary to operate citratoto, verify your account, and comply with law. We do not build marketing profiles or sell your information.

Your rights under citratoto privacy terms

You have the right to access the personal data we hold about you. Contact our support team and request a data export; we will provide a readable summary within 15 business days. You can request that we correct inaccurate data (e.g., if your name is misspelled in our system). You can request deletion of non-essential data—though we must retain transaction records and identity documents for regulatory compliance.

You can withdraw consent for non-essential uses (such as marketing emails) at any time through your account settings or by contacting support. You may request that we restrict how we process your data—for example, if you believe we have collected information under false pretences, you can ask us to pause processing while we investigate.

Jurisdiction and data location

Our primary servers are located in Indonesia. We may maintain backups on cloud infrastructure outside Indonesia for redundancy. Indonesian data protection principles apply to all data we hold, regardless of storage location. If we transfer any data internationally, we ensure equivalent protection through contractual safeguards or reliance on mutual legal agreements.

citratoto's services are available only in jurisdictions where local law permits online gaming and sportsbook operations. If you access citratoto from outside a permitted jurisdiction, you do so at your own risk and citratoto is not responsible. We do not knowingly collect data from minors; if you are under the age of majority in your jurisdiction, do not register.

Policy updates and contact

We may update this privacy policy to reflect changes in our operations, technology, or applicable law. We will notify you of material changes by email or through a banner on citratoto. Continued use of the platform after policy updates constitutes acceptance of the new terms. If you disagree with a change, you may request account closure and a refund of your balance.

To exercise any privacy right, report a data breach, or ask questions about this policy, contact our support team during business hours. Provide your account email and a clear description of your request. Our data protection officer will review your request and respond within 15 business days. Your privacy is our responsibility; we take all requests seriously.