Your privacy is a core commitment at to388, not an afterthought. This Privacy Policy explains in plain, professional English exactly what personal data we collect from Indonesian players, why we collect it, how we use and protect it, and what rights you have over your information. We encourage you to read it in full before registering an Account.
These cards highlight the key principles of our privacy approach. The full legal text is in the policy sections below.
We collect only the personal data that is strictly necessary to operate your Account, process payments in IDR, verify your identity under KYC requirements, and deliver a safe, compliant gaming experience on to388. We do not harvest data beyond what is needed.
All data transmitted between your device and the to388 Platform is protected by 256-bit SSL/TLS encryption — the same standard used by major Indonesian banks like BCA and Mandiri. Sensitive data at rest is encrypted and access-controlled within our infrastructure.
to388 does not sell, rent, or trade your personal data to third-party marketers or data brokers. Data shared with our service partners — such as payment processors and KYC verification providers — is limited to what those partners need to fulfil their specific role.
You have the right to access, correct, and request deletion of your personal data. You may also object to certain processing activities or request a portable copy of your data. Submit any data rights request by emailing our support team at [email protected] with your Account username.
We retain your personal data only for as long as your Account is active, or as long as required to fulfil legal and regulatory obligations — typically five (5) years after Account closure in line with internationally recognised financial record-keeping standards. Data no longer required is securely deleted.
to388 uses essential cookies to keep you logged in and maintain session security, and analytics cookies to understand how players use the Platform so we can improve it. We do not use third-party advertising cookies or cross-site tracking technologies on the to388 Platform.
Notice: This Privacy Policy ("Policy") forms part of your agreement with to388 and should be read alongside our Terms & Conditions. By registering an Account or continuing to use the to388 Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.
This Privacy Policy applies to all personal data collected and processed by to388 in connection with the operation of the online casino and sportsbook platform accessible at https://to388.bio (the "Platform"). It applies to all registered players, prospective players who browse the Platform without registering, and any individual who contacts to388 via live chat or email support.
to388 is designed and operated specifically for the Indonesian market. Our player base consists primarily of adults residing in Indonesia aged 21 and over who engage with our sports betting, live casino, and slot gaming services using Indonesian Rupiah (IDR) via local payment methods including BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, and LinkAja.
This Policy is written in English and governs all data processing activities on the to388 Platform. Where Indonesian-specific regulatory requirements are relevant, they are noted in the applicable sections below. This Policy does not cover data practices of third-party websites that may be linked from the Platform; those sites operate under their own privacy policies.
For the purposes of this Privacy Policy, to388 acts as the data controller in respect of all personal data collected through the Platform. As data controller, to388 determines the purposes and means of processing your personal data and is responsible for ensuring that such processing complies with applicable data protection standards.
All data rights requests, privacy concerns, and formal notices should be directed to the to388 privacy team via email at [email protected] with the subject line "Privacy Request — [Your Account Username]". Our support team is available 00:00 – 24:00 WIB daily, including Indonesian public holidays.
to388 collects the following categories of personal data, depending on how you interact with the Platform:
When you register an Account on to388, we collect the information you submit during the registration process, which includes:
To comply with our identity verification (KYC — Know Your Customer) obligations and to process withdrawals, we may collect:
Every deposit and withdrawal transaction on to388 generates a record that includes:
We record all gaming and sportsbook activity conducted through your Account, including:
When you access the to388 Platform, our servers and analytics systems automatically collect certain technical information:
When you contact to388 via live chat or email, we retain a record of that communication, including:
These records allow us to maintain continuity of support, resolve disputes, and improve the quality of our customer service.
Data Minimisation: to388 applies a data minimisation principle throughout our operations. We do not collect data beyond what is strictly required for the purposes listed in Section 5 of this Policy. If you believe we hold data about you that is unnecessary or inaccurate, you have the right to request correction or deletion — see Section 9.
to388 collects your personal data through the following methods:
The table below sets out the specific purposes for which to388 processes your personal data, together with the legal basis that justifies each processing activity:
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Account creation and management | Registration data, device data | Performance of contract (Account agreement) |
| Identity and age verification (KYC) | KYC documents, registration data | Legal obligation; legitimate interest (fraud prevention) |
| Processing deposits and withdrawals in IDR | Financial transaction data, KYC documents | Performance of contract |
| Delivering gaming and sportsbook services | Gaming activity data, Account data | Performance of contract |
| Fraud detection and prevention | All categories, with emphasis on device and transaction data | Legitimate interest; legal obligation |
| Responsible gaming monitoring and compliance | Gaming activity data, self-exclusion records | Legal obligation; protection of vital interests |
| Customer support and dispute resolution | Communications data, gaming activity data | Performance of contract; legitimate interest |
| Platform analytics and service improvement | Technical and device data, aggregated gaming data | Legitimate interest (improving services) |
| Sending account-related notifications | Email address, mobile number | Performance of contract; legitimate interest |
| Sending promotional communications (optional) | Email address, gaming preferences | Consent (you may opt out at any time) |
| Legal and regulatory compliance | All categories as required | Legal obligation |
to388 does not use your personal data for automated decision-making that produces significant legal effects without human review. Where automated systems flag an Account for review (e.g., fraud detection algorithms), a member of the to388 compliance team conducts a manual assessment before any Account action is taken.
to388 does not sell, rent, or trade your personal data to any third party. We share your data only in the following circumstances and only to the extent necessary for each purpose:
To process IDR deposits and withdrawals, we share the minimum required transaction data with our partner payment processors that handle BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, and LinkAja transactions. These providers are contractually bound to handle your financial data securely and may not use it for any purpose other than processing the specific transaction.
Your identity documents and registration data may be shared with our KYC verification partner solely for the purpose of confirming your identity and age eligibility. KYC data is processed in a secure environment and the results (pass/fail, document validity) are returned to to388. KYC partners are bound by strict confidentiality obligations and data processing agreements.
Certified game providers — including Pragmatic Play, Evolution Gaming, PG Soft, Microgaming, NetEnt, and Spribe — may receive your Account identifier and game-session data to facilitate gameplay and settlement. They do not receive your full identity documents, financial details, or contact information.
to388 may disclose your personal data where required to do so by applicable law, court order, or regulatory directive. We will notify you of any such disclosure where legally permissible and where practicable before disclosure occurs.
In the event of a merger, acquisition, or sale of substantially all of to388's assets, your personal data may be transferred to the successor entity as part of that transaction. You will be notified of any such transfer and the privacy terms governing your data under the new entity at least fourteen (14) days before any transfer takes effect.
No Third-Party Marketing: to388 does not share your contact details, gaming preferences, or behavioural data with external advertisers or marketing platforms. You will only receive promotional communications from to388 itself, and only if you have given consent or if you have an active Account relationship with us (in which case you may opt out at any time).
to388 operates as an internationally hosted platform. Your personal data may be stored and processed on servers located outside Indonesia, including in jurisdictions that may have different data protection standards from those applicable in Indonesia. Where such transfers occur, to388 applies appropriate safeguards, including contractual clauses requiring overseas data processors to maintain protections equivalent to those described in this Policy.
By registering an Account and accepting this Privacy Policy, you acknowledge and consent to the transfer of your personal data to overseas servers as described in this section, where necessary for the delivery of the to388 Platform and Services.
to388 retains your personal data for as long as your Account remains active and for a defined period after Account closure, in accordance with the following schedule:
| Data Category | Retention Period | Reason |
|---|---|---|
| Account registration data | Duration of Account + 5 years after closure | Legal obligation; dispute resolution |
| KYC documents | Duration of Account + 5 years after closure | Regulatory compliance; anti-money-laundering obligations |
| Financial transaction records | Duration of Account + 5 years after closure | Financial record-keeping; dispute resolution |
| Gaming and betting activity logs | Duration of Account + 3 years after closure | Responsible gaming auditing; dispute resolution |
| Customer support communications | 3 years from date of interaction | Quality assurance; dispute resolution |
| Technical and device data | 13 months from collection | Analytics; fraud detection |
| Self-exclusion records | Indefinitely (permanent exclusion) or duration of exclusion + 5 years | Responsible gaming compliance; re-registration prevention |
Upon expiry of the applicable retention period, to388 will securely delete or anonymise the relevant data so that it can no longer be associated with you personally. Anonymised, aggregated data (e.g., aggregate player statistics) may be retained indefinitely for business analytics purposes.
to388 respects your rights over your personal data. You may exercise the following rights at any time by contacting our support team at [email protected]:
Identity Verification for Data Requests: To protect your privacy, to388 will verify your identity before processing any data rights request. You will be asked to confirm your Account username, registered email address, and one additional verification factor. We aim to respond to all verified requests within thirty (30) days. Complex requests may take up to sixty (60) days, in which case we will notify you of the extended timeline.
The to388 Platform uses cookies and similar tracking technologies to operate correctly and to improve the player experience. A cookie is a small text file placed on your device by your browser when you visit a website. to388 uses the following categories of cookies:
| Cookie Type | Purpose | Duration | Essential? |
|---|---|---|---|
| Session Cookies | Maintain your login state and secure session while you are active on the Platform | Deleted when browser closes | Yes |
| Authentication Cookies | Remember your login if "Stay logged in" is selected, reducing repeated login prompts | Up to 30 days | Yes |
| Security Cookies | Detect unusual login patterns, bot activity, and cross-site request forgery (CSRF) attempts | Session or up to 1 year | Yes |
| Analytics Cookies | Aggregate data on pages visited, session duration, and Platform features used — used to improve to388's design and content | Up to 13 months | No (but enabled by default) |
| Preference Cookies | Remember your Platform settings, such as display preferences | Up to 12 months | No |
to388 does not use advertising cookies, retargeting pixels, or cross-site tracking scripts. We do not share cookie data with advertising networks. You may configure your browser to block or delete cookies; however, disabling essential cookies will prevent you from logging in and using the to388 Platform correctly.
to388 takes the security of your personal data seriously and implements a layered set of technical and organisational measures to protect it against unauthorised access, loss, alteration, or disclosure:
While to388 applies all reasonable security measures, no online platform can guarantee absolute security. You are responsible for keeping your login credentials confidential and for notifying to388 immediately at [email protected] if you suspect your Account has been accessed without your authorisation.
The to388 Platform is strictly intended for adults aged 21 and over. to388 does not knowingly collect personal data from individuals under the age of 21. If you are under 21 years of age, you must not register an Account or use the Platform in any capacity.
If to388 discovers, through KYC verification or other means, that an Account has been registered by a person under the age of 21, the Account will be immediately suspended, all personal data associated with the Account will be securely deleted, and any funds held in the Account will be returned in accordance with our Terms & Conditions. If you believe a minor has registered on to388, please notify us immediately at [email protected].
The to388 Platform does not contain links to external third-party websites. All navigation links on the Platform direct you exclusively to pages within the to388 domain (to388.bio). In the event that any third-party content or services are integrated with the Platform in the future, this section will be updated to reflect how data may be shared with those third parties and to direct you to their respective privacy policies.
to388 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law, or improvements to the Platform. When we make material changes — particularly changes that affect how we use your personal data or expand the categories of data we collect — we will:
Your continued use of the Platform following the effective date of any revised Privacy Policy constitutes your acknowledgement and acceptance of the updated terms. If you do not agree to the revised Policy, you must cease using the Platform and may request Account closure and deletion of your data as described in Section 9.
We encourage you to review this Privacy Policy periodically. Archived versions of previous Privacy Policy documents are available upon request by contacting [email protected].
For any questions, concerns, or formal requests relating to this Privacy Policy or to388's data processing practices, please reach out to our team through the following channels:
to388 aims to acknowledge all privacy-related enquiries within one (1) business day and to resolve data rights requests within thirty (30) days of receiving all necessary verification information.
Now that you've reviewed our Privacy Policy, you can enjoy to388 with full confidence — live casino tables, BRI Liga 1 sportsbook markets, and hundreds of certified slot titles, all secured with 256-bit SSL encryption and fast IDR banking.
21+ only. Play responsibly. Gambling is for entertainment purposes only.