tok99 Privacy Policy

In this Privacy Policy, the following terms carry the meanings set out below:

tok99 collects the following categories of Personal Data in connection with your use of the Platform:

2.1 Registration Data. When you create a tok99 Account, we collect your full legal name, date of birth, Indonesian national identity number (NIK), residential address, email address, and mobile phone number. This information is required to create and maintain your Account.

2.2 Identity Verification Data. At the withdrawal stage, we collect a copy of a valid Indonesian government-issued identity document — typically your KTP (Kartu Tanda Penduduk) or equivalent — as part of our Know Your Customer (KYC) process. A selfie or liveness check may also be requested through our identity verification partner.

2.3 Financial Data. We collect your bank account details or e-wallet account identifiers (such as BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, OVO, DANA, GoPay, ShopeePay, or LinkAja account numbers) for the purpose of processing deposits and withdrawals in Indonesian Rupiah (IDR). We do not store full debit or credit card numbers on our servers.

2.4 Transaction Data. We record all deposits, withdrawals, bonus transactions, bets placed, game sessions, and settlement outcomes associated with your Account. This data is retained for audit, fraud prevention, and responsible gaming monitoring purposes.

2.5 Technical Data. We automatically collect IP address, browser type, operating system, device type, screen resolution, referring URL, pages visited on the Platform, and session duration. This data is used for security monitoring, fraud detection, and platform performance analysis.

2.6 Communications Data. If you contact our customer support team via live chat or email, we retain records of those communications — including your queries, our responses, and any attachments submitted — for quality assurance and dispute resolution purposes.

2.7 Responsible Gaming Data. If you use any of our responsible gaming tools (deposit limits, session limits, cooling-off periods, or self-exclusion), we record the parameters and dates of those settings to ensure they are properly applied and enforced.

tok99 collects your Personal Data through the following means:

• Directly from you — through the Account registration form, KYC submission portal , deposit and withdrawal request forms, support chat sessions, and any other voluntary data entry on the Platform;
• Automatically — through cookies, web beacons, server logs, and similar tracking technologies as you browse and interact with the Platform;
• From third-party providers — including identity verification vendors, payment processors (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, OVO, DANA, GoPay, ShopeePay, LinkAja), fraud-detection services, and game software providers, who may share data with us in the course of providing their services;
• From publicly available sources — such as sanctions lists and politically-exposed-person (PEP) databases, which we consult as part of our anti-money-laundering compliance obligations.

tok99 processes your Personal Data for the following purposes:

tok99 processes your Personal Data on the following legal bases:

5.1 Contractual Necessity. The majority of the data processing described in this policy is necessary for the performance of the contract between you and tok99 — specifically, the Terms & Conditions you agreed to upon Account registration. Without this processing, we cannot provide the Services, verify your identity, or process your deposits and withdrawals.

5.2 Legal Obligation. Certain processing activities — particularly KYC identity verification, transaction monitoring, and the maintenance of audit records — are required under applicable anti-money-laundering and counter-terrorism-financing obligations that tok99 must meet as an internationally operating gaming platform.

5.3 Legitimate Interests. tok99 processes Technical Data and Communications Data on the basis of its legitimate interest in maintaining platform security, detecting and preventing fraud, improving the player experience, and resolving disputes. In each case, tok99 has assessed that its legitimate interest is not overridden by your right to privacy.

5.4 Consent. Where tok99 sends you promotional communications about new products, bonuses, or seasonal offers, we do so on the basis of your consent, provided at registration or at a later point via your Account communication preferences. You may withdraw this consent at any time by updating your preferences in the Account settings panel or by contacting our support team.

6.1 Third-Party Processors. tok99 shares Personal Data with a limited number of trusted third-party service providers who process data on our behalf under strict confidentiality agreements. These include:

• Payment processors and banking partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, OVO, DANA, GoPay, ShopeePay, LinkAja) — for transaction processing;
• Identity verification and KYC vendors — for document authentication and liveness checks;
• Cloud infrastructure and hosting providers — for secure data storage and Platform operation;
• Fraud detection and cybersecurity service providers — for real-time threat monitoring;
• Game software providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, PG Soft, Spribe, and others) — to the limited extent required for game session integrity and RNG certification.

6.2 Legal Disclosures. tok99 may disclose your Personal Data to law enforcement agencies, regulatory authorities, or courts of competent jurisdiction where required by law, by court order, or where tok99 has reasonable grounds to believe that disclosure is necessary to prevent fraud, money laundering, or other criminal activity.

6.3 Business Transfers. In the event of a merger, acquisition, or sale of all or part of tok99's business assets, your Personal Data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and the identity of the new data controller via the Platform or by email.

6.4 No Commercial Data Sales. Under no circumstances does tok99 sell, rent, or otherwise commercially transfer your Personal Data to third parties for their own marketing or profiling purposes.

7.1 Active Accounts. While your tok99 Account is active, we retain all Personal Data associated with that Account for as long as necessary to provide the Services and meet our compliance obligations.

7.2 Closed Accounts. Following closure of your Account — whether at your request or by tok99 — we retain your Personal Data for a minimum period of five (5) years. This retention period reflects standard anti-money-laundering record-keeping requirements and the need to maintain records sufficient to resolve any post-closure disputes or regulatory inquiries.

7.3 KYC Documents. Identity documents submitted as part of the KYC verification process are retained for the duration of the retention period specified in Clause 7.2. Copies of identity documents are stored in an encrypted, access-controlled environment separate from general Account data.

7.4 Technical Logs. Server logs, IP address records, and session data are retained for up to 12 months from the date of the relevant session, after which they are automatically purged or anonymised.

7.5 Communications. Support chat transcripts and email correspondence are retained for up to 3 years from the date of the last communication in a given thread, to support dispute resolution and quality assurance.

7.6 Deletion Requests. Where you exercise your right to erasure (Clause 10.3), tok99 will delete or anonymise your Personal Data within 30 days of receiving a verified deletion request, except where retention is required by law or where the data is needed to resolve an open dispute or pending transaction.

8.1 Technical Safeguards. tok99 applies industry-standard technical measures to protect your Personal Data, including:

• 256-bit SSL/TLS encryption for all data in transit between your device and the Platform;
• AES-256 encryption for sensitive data at rest, including KYC documents and payment account identifiers;
• Multi-factor authentication for internal staff access to systems holding Personal Data;
• Firewalls, intrusion detection systems, and real-time security monitoring on all Platform infrastructure;
• Regular penetration testing conducted by independent cybersecurity specialists.

8.2 Organisational Safeguards. Access to Personal Data within tok99 is governed by a strict need-to-know policy. Only staff members with a legitimate operational requirement are granted access to player data, and all such access is logged and audited. Staff members with access to Personal Data are subject to confidentiality obligations as a condition of their engagement.

8.3 Payment Security. Financial data submitted in connection with deposits and withdrawals is handled in compliance with the Payment Card Industry Data Security Standard (PCI-DSS). Full bank account numbers are masked in our internal systems following initial processing.

8.4 Incident Response. In the event of a data breach that creates a material risk to your rights and freedoms, tok99 will notify affected players via email and update the Platform's security notice within 72 hours of becoming aware of the breach. We will provide details of the nature of the breach, the data affected, and the steps we have taken to mitigate the impact.

9.1 What Are Cookies. Cookies are small text files stored on your device by your browser when you visit the Platform. tok99 uses cookies and similar technologies (such as local storage objects and web beacons) to operate the Platform and improve your experience.

9.2 Types of Cookies We Use.

9.3 Cookie Control. You may manage or disable non-essential cookies through your browser settings. Note that disabling strictly necessary cookies will impair your ability to log in and use the Platform. Browser-level cookie controls vary by browser — consult your browser's help documentation for instructions specific to your setup.

9.4 Third-Party Tracking. tok99 does not embed third-party advertising pixels or social media tracking scripts on the Platform. Performance analytics are processed using tools subject to data processing agreements that restrict their use of your data to analytics purposes only.

As a player whose Personal Data is processed by tok99, you hold the following rights with respect to that data. To exercise any of these rights, contact our support team at [email protected] with the subject line "Data Rights Request" and include your full name and registered Account email address so that we can verify your identity before responding.

10.1 Right of Access. You may request a copy of the Personal Data tok99 holds about you. We will provide this within 30 days of receiving a verified request, in a commonly used electronic format.

10.2 Right to Rectification. If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request that we correct it. For basic Account details such as your phone number or email address, you may update these directly via the Account settings panel without contacting support.

10.3 Right to Erasure. You may request that tok99 delete your Personal Data. We will comply within 30 days of a verified request except where retention is required by law (see Clause 7.2), where an open dispute or pending transaction requires the data, or where the data relates to a self-exclusion record that must be retained for player protection purposes.

10.4 Right to Restriction. You may request that tok99 restrict the processing of your Personal Data — for example, while a dispute about data accuracy is being resolved. During a restriction period, tok99 will store but not actively process the relevant data.

10.5 Right to Data Portability. You may request a structured, machine-readable copy of the Personal Data you provided to tok99 directly (such as registration data and transaction history), so that you may transfer it to another service provider.

10.6 Right to Object. You may object to processing carried out on the basis of tok99's legitimate interests (Clause 5.3) at any time. Where you object, tok99 will cease the relevant processing unless we can demonstrate compelling legitimate grounds that override your rights, or unless the processing is necessary for the establishment, exercise, or defence of legal claims.

10.7 Right to Withdraw Consent. Where processing is based on your consent (Clause 5.4), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

11.1 Age Requirement. The tok99 Platform is strictly for adults aged 21 and over. We do not knowingly collect Personal Data from any person under the age of 21. By registering an Account, you confirm that you are at least 21 years of age.

11.2 Discovery of Underage Accounts. If tok99 discovers or has reasonable grounds to believe that an Account is held by a person under 21, that Account will be immediately suspended, all balance forfeited, and all associated Personal Data deleted as promptly as is compatible with our legal record-keeping obligations.

11.3 Parental Controls. If you share a device with household members under the age of 21, tok99 strongly recommends enabling device-level parental control software to prevent minors from accessing the Platform. If you believe a minor has registered or attempted to register an Account on tok99, please notify us immediately at [email protected] so that we can take appropriate action.

12.1 Cross-Border Processing. As an internationally operating gaming platform, tok99 may transfer and process your Personal Data in jurisdictions outside Indonesia. This may occur when, for example, our cloud hosting infrastructure, KYC verification vendor, or game software provider operates servers in a country other than Indonesia.

12.2 Safeguards. Where Personal Data is transferred to a jurisdiction that does not provide an equivalent level of data protection to that applicable in Indonesia, tok99 applies appropriate contractual and technical safeguards to protect that data. These include standard contractual clauses binding the recipient to obligations equivalent to those described in this policy, and technical measures such as encryption of data in transit and at rest.

12.3 Processor Obligations. All third-party processors to whom data is transferred internationally are required, under their data processing agreements with tok99, to process Personal Data solely for the agreed purpose, to maintain security standards consistent with those described in Clause 8, and to notify tok99 promptly in the event of a data incident affecting transferred data.

13.1 Right to Update. tok99 reserves the right to update or replace this Privacy Policy at any time. The revised policy will be published on this page with an updated "Last updated" date. Your continued use of the Platform following publication of a revised policy constitutes your acceptance of the updated terms.

13.2 Material Changes. For changes that materially affect how we process your Personal Data — particularly changes to the categories of data collected, the purposes for which it is used, or the third parties with whom it is shared — tok99 will provide notice to registered Members via email or in-Platform notification at least 14 days before the changes take effect, where operationally practicable.

13.3 Version History. The current version of this Privacy Policy, dated January 2026, supersedes all previous versions. If you require a copy of a prior version for dispute or legal purposes, contact our support team with your request.

If you have questions about this Privacy Policy, wish to exercise any of your data rights under Clause 10, or wish to raise a concern about how tok99 has handled your Personal Data, please contact our support team using the details below.

Customer Support: Available 24 hours a day, 7 days a week (WIB, UTC+7) via live chat on the Platform.

Data Rights Requests: Email [email protected] with the subject line "Data Rights Request". Include your full name and registered Account email address so that we can verify your identity before processing your request.

For responsible gaming concerns, please refer to our dedicated Responsible Gaming page. For general platform questions, our FAQ page covers the most common topics in detail. A full description of the contractual framework governing your use of the Platform is set out in our Terms & Conditions.