Privacy Policy

The following definitions apply throughout this Privacy Policy:

• "Personal Data" means any information that identifies or could reasonably be used to identify a living individual, whether directly or in combination with other data held by pktoto.
• "Processing" means any operation performed on Personal Data, including collection, storage, retrieval, alteration, disclosure, erasure, or destruction.
• "Data Controller" means the entity that determines the purposes and means of Processing Personal Data — in this context, pktoto.
• "Data Processor" means any third party that processes Personal Data on behalf of pktoto under a contractual data processing agreement.
• "User" / "You" means any individual who accesses or registers an Account on the pktoto platform.
• "Account" means the unique registered profile created and maintained by a User on pktoto.
• "Platform" means the pktoto website at pktoto.cam and any mobile-optimised version thereof.
• "Cookies" means small text files placed on your device by the Platform that store session, preference, and analytical data.

pktoto acts as the Data Controller in respect of all Personal Data collected from Users of the Platform. As Data Controller, pktoto determines the purposes for which your Personal Data is used and bears responsibility for ensuring those purposes are lawful, transparent, and proportionate.

pktoto operates as an internationally licensed online gaming platform serving Indonesian players. All data handling practices are designed to align with the principles of purpose limitation, data minimisation, storage limitation, accuracy, and integrity — the internationally recognised pillars of responsible data stewardship.

pktoto collects Personal Data only to the extent necessary to deliver its services safely, process financial transactions, comply with anti-fraud obligations, and provide a personalised player experience. The categories of data we collect are as follows:

pktoto collects Personal Data through the following channels:

4.1 Directly From You

• When you complete the Account registration form, providing your name, date of birth, email address, and phone number.
• When you submit identity verification (KYC) documents, including your KTP photograph and selfie.
• When you add or update a payment method, providing bank account or e-wallet details.
• When you contact pktoto support via live chat or email, generating a record of that communication.
• When you respond to surveys, promotions, or feedback requests.

4.2 Automatically From Your Device

• Technical and Usage Data is collected automatically when you browse or interact with the Platform, via server logs, cookies, and similar tracking technologies.
• Your IP address, device fingerprint, and session duration are recorded each time you access the Platform to support fraud detection and platform security.

4.3 From Third Parties

• Payment processors and Indonesian banking partners may share transaction confirmation data with pktoto to reconcile deposits and withdrawals.
• Identity verification service providers may return a verification result (pass or fail) alongside a confidence score used to complete your KYC process.
• Analytics providers process aggregated, anonymised usage data on our behalf to help us understand how the Platform is used and where improvements can be made.

pktoto processes your Personal Data only for clearly defined purposes, each grounded in a lawful basis. The primary purposes and their corresponding legal bases are set out below:

Where processing is based on your consent, you may withdraw that consent at any time by contacting pktoto support. Withdrawal of consent does not affect the lawfulness of processing that occurred prior to withdrawal.

pktoto does not sell, rent, or trade your Personal Data to any third party for commercial gain. We share your data only where necessary for the delivery of our services or where required by law. The categories of recipients are as follows:

6.1 Service Providers and Data Processors

We engage carefully selected third-party processors who handle data strictly on our instructions and are bound by data processing agreements. These include:

• Payment processors: Indonesian banking partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP) and e-wallet operators (OVO, DANA, GoPay) to execute financial transactions.
• KYC and identity verification providers: To validate the authenticity of documents submitted during account verification.
• Game content providers: Including Pragmatic Play, Evolution Gaming, Spribe, and Pocket Games Soft, who may process limited session data to deliver their certified gaming content.
• Cloud infrastructure and hosting providers: Who store encrypted data on servers maintained to enterprise security standards.
• Analytics providers: Who process aggregated, anonymised data to generate platform performance insights.
• Fraud detection and cybersecurity services: Who analyse Technical and Usage Data to identify and block suspicious activity.

6.2 Legal and Regulatory Disclosure

pktoto may disclose Personal Data to law enforcement agencies, regulatory authorities, or courts where required to do so by applicable law, court order, or in connection with legal proceedings. In such cases, pktoto will disclose only the minimum data necessary to satisfy the legal obligation.

The pktoto Platform uses cookies and similar technologies to maintain session continuity, personalise your experience, and collect anonymised analytics data. We use the following categories of cookies:

You may configure your browser to refuse or delete cookies at any time. Note that disabling strictly necessary cookies will prevent you from logging into your Account or completing financial transactions on the Platform. Disabling analytics cookies does not affect your ability to use pktoto's core features.

pktoto applies industry-standard technical and organisational security measures to protect your Personal Data from unauthorised access, disclosure, alteration, or destruction. Our security framework includes the following controls:

• Transport Encryption: All data transmitted between your browser and the pktoto Platform is protected by TLS 1.2 or TLS 1.3 (256-bit encryption), denoted by the HTTPS protocol in your browser address bar.
• Data-at-Rest Encryption: Personal Data and financial records stored in our databases are encrypted at rest using AES-256 encryption.
• Access Controls: Internal access to Personal Data is granted strictly on a need-to-know basis, with role-based permissions enforced across all internal systems. All access events are logged and auditable.
• Password Security: User passwords are never stored in plain text. They are hashed using a modern one-way cryptographic algorithm with per-record salting.
• Vulnerability Management: The Platform undergoes regular penetration testing and security audits. Critical vulnerabilities are remediated on a priority basis.
• Incident Response: pktoto maintains a documented data breach response procedure. In the event of a breach affecting your Personal Data, pktoto will notify affected Users within a reasonable timeframe consistent with applicable obligations.

pktoto retains Personal Data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. Our standard retention periods are as follows:

• Active Account data: Retained for the full duration of your Account's active status.
• Closed Account data: Retained for a minimum of five (5) years following Account closure to satisfy anti-money laundering and fraud record-keeping obligations.
• Financial transaction records: Retained for a minimum of five (5) years in compliance with applicable financial record-keeping requirements.
• KYC documents: Retained for a minimum of five (5) years after Account closure, or longer if required by an ongoing regulatory investigation.
• Support communications: Retained for three (3) years from the date of the last interaction.
• Analytics data: Anonymised or aggregated after 24 months; identifiable usage data is deleted at that point.
• Marketing consent records: Retained for the duration of your consent and for three (3) years after withdrawal, as evidence of the consent previously given.

Once a retention period expires, Personal Data is securely deleted or irreversibly anonymised. Anonymised data — from which it is no longer possible to identify any individual — may be retained indefinitely for statistical and research purposes.

As a User of the pktoto Platform, you hold the following rights in respect of your Personal Data. To exercise any of these rights, contact our support team via live chat or at [email protected]. pktoto will respond to all valid requests within 30 days.

If you believe that a minor has registered an Account on pktoto or has submitted Personal Data to our Platform without parental consent, please notify us immediately via live chat or at [email protected] so that we may take prompt remedial action. All data relating to an underage Account will be permanently deleted upon confirmation.

pktoto employs age-verification checks at registration, reinforced by KYC document submission, to minimise the risk of underage access. Responsible Gaming tools — including parental controls guidance — are available on our Responsible Gaming page.

The pktoto Platform integrates game content and services from third-party providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft. These providers operate their own platforms and may independently process certain technical or session data to deliver their certified gaming content.

pktoto is not responsible for the privacy practices of these third-party providers. However, all providers engaged by pktoto are contractually required to meet minimum data security standards and to process User data solely for the purpose of delivering their contracted services. They are prohibited from using User data for any independent commercial purpose.

pktoto does not embed third-party advertising networks, affiliate tracking pixels, or social media tracking scripts that would share your Personal Data with unaffiliated commercial entities without your knowledge.

pktoto's primary services are directed at players based in Indonesia. However, some of our Data Processors — including cloud hosting providers and certain game content providers — may operate infrastructure in jurisdictions outside Indonesia. Where such cross-border data transfers occur, pktoto ensures that appropriate safeguards are in place, including contractual data processing agreements that impose equivalent data protection obligations on the receiving party.

By using the pktoto Platform, you acknowledge that your Personal Data may be transferred to, stored in, and processed in countries outside Indonesia as part of the delivery of our services. pktoto takes reasonable steps to ensure that such transfers are conducted securely and that your privacy rights are respected regardless of the location of processing.

pktoto reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, applicable law, or operational requirements. When material changes are made, we will notify registered Users via an Account notification or by email to the address on file, and we will update the "Last Updated" date at the top of this page.

Your continued use of the pktoto Platform following the effective date of a revised Privacy Policy constitutes your acceptance of those changes. If you do not agree with any revision, you should stop using the Platform and may request Account closure as outlined in our Terms & Conditions.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way pktoto handles your Personal Data, please reach our Data Protection team through either of the following channels:

• Live Chat: Available 24 hours a day, 7 days a week, directly on the pktoto Platform. Indonesian-speaking agents are available at all times.
• Email: [email protected] — displayed here as plain text only and is not a clickable link. Please include "Privacy Request" in the subject line to ensure prompt routing to our Data Protection team.

We are committed to addressing all privacy-related enquiries within 30 days. Complex requests involving large volumes of data or legally sensitive circumstances may take up to 60 days; in such cases, we will keep you informed of the expected timeline.