Privacy Policy

1.1 This Privacy Policy applies to all personal data processed by tok99 in connection with the operation of the tok99 platform at tok99.cam, including data collected through the website interface, mobile-optimised browser sessions, customer support interactions, and payment processing channels.

1.2 This Policy applies to the following categories of individuals whose data tok99 may process:

• Registered members with active or suspended accounts.
• Prospective members who have initiated but not completed the registration process.
• Former members whose accounts have been closed, for the duration of the applicable data retention period.
• Visitors to tok99.cam who have not registered an account, to the limited extent that technical data is collected automatically during browsing.

1.3 This Policy does not apply to third-party websites, payment platforms, or game studios that may be accessible via links or integrations within the tok99 platform. Those entities operate under their own privacy policies, and tok99 accepts no responsibility for their data practices.

1.4 tok99 primarily serves players based in Indonesia and processes the majority of personal data relating to Indonesian residents. References to legal obligations in this Policy should be understood in that context, though tok99 also applies internationally recognised data protection standards as a baseline across all operations.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information that identifies or could reasonably be used to identify a natural person, either directly (e.g., full name, national ID number) or indirectly (e.g., device identifiers combined with behavioural data).
• "Processing" means any operation performed on personal data, including collection, storage, retrieval, use, disclosure, transfer, and deletion.
• "Data Controller" means tok99, which determines the purposes and means of processing your personal data.
• "Data Processor" means a third party that processes personal data on behalf of tok99 under a contractual data processing agreement.
• "Member" means a natural person who holds a registered account on the tok99 platform.
• "KYC" means Know Your Customer — the identity and age verification process required by tok99's compliance framework before full account functionality is enabled.
• "Sensitive Data" means a subset of personal data that warrants a higher level of protection, including government-issued identification numbers, financial account details, and data revealing a person's identity or financial position.
• "Anonymisation" means the irreversible process of altering personal data such that the individual can no longer be identified, directly or indirectly, by any reasonable means.

tok99 collects personal data across several categories depending on your interaction with the platform. The table below summarises the categories of data we collect and their primary purpose:

tok99 does not collect racial or ethnic origin data, political opinions, religious beliefs, biometric data for identification purposes, or health data as part of standard account operations.

tok99 collects personal data through the following methods:

• Direct submission: Information you provide voluntarily when registering an account, completing the KYC process, making a deposit or withdrawal request, or contacting our support team.
• Automated technical collection: Data collected automatically when you access the tok99 website, including IP address, browser fingerprint, device identifiers, and session behaviour logs via server-side logging and first-party analytics tools.
• Cookies and similar technologies: Session cookies, functional cookies, and analytics trackers that operate within your browser session. See Section 7 for full details of our cookie practices.
• Third-party verification services: During KYC processing, tok99 may receive confirmatory data from licensed identity verification providers. tok99 does not purchase personal data from data brokers.
• Payment processors: When you deposit or withdraw funds using local Indonesian banking channels or e-wallets, the relevant processor may share transaction confirmation data with tok99 for reconciliation purposes.

tok99 processes your personal data only where a clear lawful basis exists. The following table sets out our primary processing purposes and the corresponding legal basis for each:

Where processing is based on your consent — such as receiving promotional emails or SMS notifications — you may withdraw that consent at any time by contacting [email protected] or updating your account communication preferences. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

6.1 Core principle. tok99 does not sell, rent, or trade your personal data to any third party for commercial purposes. Data is shared externally only where necessary to deliver our services, comply with legal obligations, or protect the legitimate interests of the platform and its members.

6.2 Categories of recipients. Personal data may be shared with the following categories of third parties, each acting strictly under data processing agreements:

• Payment processors and banking partners: Local Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, Bank Permata, BSI) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) for the purpose of executing deposit and withdrawal transactions.
• KYC and identity verification providers: Licensed third-party KYC services that verify the authenticity of identity documents and screen members against financial crime watchlists.
• Game content providers: Studios such as Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft may receive a session token and minimum technical data required to authenticate a member's game session. These studios do not receive your full identity profile.
• Cloud infrastructure and hosting providers: tok99's platform infrastructure relies on enterprise-grade cloud providers operating secure data centres. These providers process data solely as data processors under tok99's instructions.
• Fraud prevention and security services: Specialist providers that analyse transactional and behavioural data to identify suspicious activity, unauthorised access attempts, and patterns indicative of bonus abuse.

6.3 Regulatory and legal disclosures. tok99 may disclose personal data to competent regulatory or law enforcement authorities where required to do so by a valid legal process, court order, or applicable law. Where permissible, tok99 will notify the affected member of such a disclosure request before complying.

6.4 Corporate transactions. In the event of a merger, acquisition, restructuring, or sale of assets involving tok99, personal data may be transferred to the acquiring entity as part of the transaction, subject to equivalent privacy protections being maintained by the successor entity.

7.1 What are cookies? Cookies are small text files placed on your device by a web server when you visit a website. They allow the site to recognise your device across page requests within the same session or across multiple visits.

7.2 Types of cookies tok99 uses:

• Strictly necessary cookies: Required for core platform functionality, including maintaining your authenticated session, storing your account preferences, and enabling secure transaction processing. These cookies cannot be disabled without disrupting platform functionality.
• Functional cookies: Used to remember your preferences — such as language settings and display options — to provide a more personalised experience on return visits.
• Analytics cookies: First-party analytics cookies that help tok99 understand how members navigate the platform, which features are used most frequently, and where technical issues may arise. Data collected is aggregated and pseudonymised.
• Security cookies: Used to detect and prevent fraudulent activity, including CSRF protection tokens and bot-detection signals.

7.3 Third-party tracking. tok99 does not permit third-party advertising networks or cross-site tracking services to deploy cookies on the tok99 platform for the purpose of building commercial advertising profiles of our members.

7.4 Managing cookies. You can control and delete cookies through your browser settings. Please note that disabling strictly necessary cookies will impair or prevent your ability to log in to and use the tok99 platform. Instructions for managing cookies in common browsers are available in your browser's help documentation.

8.1 tok99 retains personal data for no longer than is necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by applicable law. The following indicative retention periods apply:

8.2 On expiry of the applicable retention period, personal data is either securely and permanently deleted from tok99's systems or irreversibly anonymised so that it can no longer be attributed to any identifiable individual. Anonymised data may be retained indefinitely for aggregate statistical analysis.

9.1 tok99 implements a layered security framework to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. Key measures include:

• Transport encryption: All data in transit between your browser and tok99 servers is protected by TLS 1.2 or higher with 256-bit AES encryption.
• Data at rest encryption: Personal data stored in tok99's databases is encrypted at the storage layer using industry-standard encryption algorithms.
• Access control: Access to personal data within tok99's internal systems is restricted on a strict need-to-know basis. Staff with data access privileges undergo background screening and regular security training.
• Multi-factor authentication (MFA): Administrative access to systems that store personal data requires MFA. Members are strongly encouraged to enable additional verification on their own accounts.
• Penetration testing and vulnerability assessments: tok99's infrastructure undergoes periodic security testing by qualified independent specialists to identify and remediate potential vulnerabilities before they can be exploited.
• Incident response: tok99 maintains a documented data breach response procedure. In the event of a breach that poses a risk to member data, affected members will be notified without undue delay, along with guidance on protective steps they should take.

9.2 While tok99 takes all reasonable precautions, no system connected to the internet can guarantee absolute security. Members also share responsibility for their own account security — particularly the confidentiality of their login credentials. If you suspect your account has been compromised, contact [email protected] immediately.

As a member of tok99, you have the following rights in relation to your personal data. To exercise any of these rights, submit a written request to [email protected] from the email address associated with your account. tok99 will respond within 30 days of receiving a valid request.

11.1 As part of the KYC process, tok99 requires all members to provide documentary proof of age before full account functionality is enabled. Any account found to belong to an individual under 21 years of age will be immediately suspended and all associated balances will be frozen pending review.

11.2 If tok99 discovers that it has inadvertently collected personal data from an individual under the age of 21, that data will be securely deleted without delay. If you believe that a minor has registered an account on tok99, please notify us immediately at [email protected].

11.3 Parents and guardians are encouraged to use available parental control tools to restrict access to online gambling platforms on devices shared with or accessible to minors.

12.1 tok99 is an internationally operated platform, and your personal data may be transferred to and processed in countries other than Indonesia. This may occur when our cloud infrastructure, KYC verification partners, or game content providers operate data processing facilities in other jurisdictions.

12.2 Where personal data is transferred internationally, tok99 ensures that appropriate safeguards are in place to maintain a level of data protection consistent with the standards described in this Policy. Safeguards may include standard contractual clauses, binding corporate rules, or transfers to jurisdictions recognised as providing an adequate level of data protection.

12.3 By using the tok99 platform, you acknowledge and consent to the international transfer of your personal data as described in this section, subject always to the protections set out in this Policy.

13.1 tok99 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or platform functionality. The date of the most recent revision is displayed at the top of this page.

13.2 Where changes are material — meaning they significantly affect how we process your personal data or reduce your rights — tok99 will provide at least seven (7) days' advance notice by email to the address registered on your account and by displaying a prominent notice on the platform.

13.3 Minor amendments — such as typographical corrections, clarifications that do not alter the substance of the Policy, or updates to reflect new payment method integrations — may be made without advance notice and take effect on publication.

13.4 Continued use of the tok99 platform following the effective date of any revision constitutes your acceptance of the updated Policy. If you do not accept the revised terms, you should close your account and cease using the platform.

If you have any questions, concerns, or formal requests regarding this Privacy Policy or the way tok99 processes your personal data, please contact our data support team through the following channels:

• Email: [email protected] (plain text — not a clickable link). Include "Privacy Request" in the subject line for faster routing.
• Live Chat: Available 24 hours a day, 7 days a week, via the chat widget on the tok99 platform. Our Indonesian-speaking agents can assist with data subject requests in English or Bahasa Indonesia.
• Response time: tok99 acknowledges all written privacy enquiries within 24 hours (WIB) and resolves substantive data subject requests within 30 calendar days of identity verification.