At omtoto, your privacy is a core commitment — not an afterthought. This Privacy Policy explains precisely what personal data we collect, why we collect it, how it is stored and protected, who it may be shared with, and what rights you hold over your own information.
These highlights are a plain-English summary. They do not replace the full policy — please read all sections below for the complete picture.
All data transmitted between your device and omtoto's servers is protected by 256-bit SSL/TLS encryption. Sensitive fields — including passwords and payment details — are never stored in plain text.
omtoto does not sell, rent, or trade your personal information to any third party for their independent marketing purposes. Your data is used solely to operate, improve, and protect the platform.
At any time, you may request a copy of the personal data omtoto holds about you, ask us to correct inaccuracies, or request deletion — subject to our legal and regulatory retention obligations.
You may opt out of promotional communications at any time by contacting our support team or updating your notification settings in your account. Opting out does not affect transactional or security notifications.
We share your data only with trusted partners who are contractually required to protect it — including payment processors, identity verification services, and fraud-prevention tools. No unnecessary exposure.
omtoto retains personal data only for as long as it is needed to fulfill the purposes described in this Policy or as required by applicable law. When data is no longer needed, it is securely deleted or anonymized.
1.1 About This Policy. This Privacy Policy is published by omtoto, an internationally licensed online betting and gaming platform accessible at https://omtoto.cam. It describes how omtoto collects, uses, stores, shares, and protects the personal data of individuals who visit, register on, or interact with the omtoto platform in any capacity.
1.2 Who This Policy Covers. This Policy applies to all registered Members, prospective Members who have initiated but not completed registration, visitors to the omtoto website, and any individual who contacts omtoto through our support channels. It applies regardless of the device or browser used to access the platform.
1.3 Indonesia Market Context. omtoto's Services are primarily directed at individuals residing in Indonesia. While this Policy is written in English — consistent with omtoto's international brand positioning — the data practices described apply fully and without limitation to members based in Jakarta, Surabaya, Bandung, Medan, Bali, Yogyakarta, Semarang, Makassar, and all other regions of Indonesia. omtoto processes all financial transactions in Indonesian Rupiah (IDR) and works with Indonesian payment partners including BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja.
1.4 Relationship to Other Policies. This Privacy Policy should be read in conjunction with omtoto's Terms & Conditions and Responsible Gaming policy. Together, these documents form the complete regulatory framework governing your relationship with omtoto.
For clarity throughout this Policy, the following terms carry the meanings set out below:
3.1 Registration Data. When you create an omtoto account, we collect the information you provide directly, including:
3.2 Identity Verification (KYC) Data. To comply with anti-money laundering (AML) obligations and our responsible gaming age-verification requirements, omtoto collects:
3.3 Financial Transaction Data. For every deposit and withdrawal, omtoto records:
3.4 Betting & Gaming Activity Data. omtoto records all in-platform activity including:
3.5 Technical & Device Data. When you access omtoto, our systems automatically collect certain technical information:
3.6 Communications Data. If you contact omtoto's support team via email or live chat, we retain records of those communications — including the content of messages, timestamps, and any attachments — for service quality, training, and dispute resolution purposes.
omtoto collects personal data through the following channels:
| Collection Method | Description | Data Types Involved |
|---|---|---|
| Direct Input | Information you actively provide during registration, KYC submission, deposits, or support interactions | Registration data, KYC documents, financial details, communications |
| Automated Collection | Technical data gathered automatically when you use the platform, via server logs and session tracking | IP address, device data, browsing behavior, session logs |
| Cookies & Pixels | Small files or tags placed on your device to support functionality, analytics, and security | Session tokens, preference data, analytics identifiers |
| Third-Party Processors | Data received from payment processors, identity verification providers, and fraud-detection services when you transact | Transaction confirmation data, KYC verification results, risk scores |
omtoto processes your personal data for the following purposes:
omtoto processes your personal data on one or more of the following legal grounds, depending on the specific activity involved:
7.1 Principle of Minimal Sharing. omtoto does not sell, rent, or trade your personal data. We share personal data only to the extent necessary to operate the platform safely, process transactions, meet legal obligations, and protect Members and the business from fraud.
7.2 Categories of Recipients. Your personal data may be shared with the following categories of third parties:
7.3 Data Processing Agreements. All third-party processors engaged by omtoto are required to execute a formal data processing agreement that mandates: appropriate technical and organizational security measures; prohibition on using your data for their own independent purposes; and compliance with applicable data protection law.
8.1 What Are Cookies. Cookies are small text files placed on your device when you visit omtoto. They allow the platform to recognize your device across sessions, remember your preferences, and collect analytics data to improve the user experience.
8.2 Types of Cookies Used. omtoto uses the following categories of cookies:
| Cookie Type | Purpose | Can Be Disabled? |
|---|---|---|
| Strictly Necessary | Essential for core platform functionality — login sessions, security tokens, account authentication | No — disabling these prevents the platform from functioning |
| Functional | Remembers your preferences — language settings, notification preferences, last-visited game categories | Yes — disabling may reduce personalization |
| Analytics | Collects aggregated, anonymized data about how Members navigate the platform to guide UX improvements | Yes — opt out via browser settings or support request |
| Security | Supports fraud detection by fingerprinting device and session characteristics to identify anomalous access patterns | No — these are critical to platform integrity |
8.3 Managing Cookies. You may control cookie settings through your browser preferences. Most modern browsers allow you to block, delete, or be notified about cookies. Please note that disabling strictly necessary or security cookies will impair your ability to use the omtoto platform. For analytics cookies, you may request opt-out by contacting our support team.
9.1 Technical Safeguards. omtoto employs a multilayered security architecture to protect your personal data, including:
9.2 Organizational Safeguards. Access to Member personal data is restricted on a strict need-to-know basis. omtoto staff who handle personal data are subject to confidentiality obligations and receive regular data protection training. All access to production systems is logged and audited.
9.3 Data Breach Response. In the event of a confirmed personal data breach that poses a risk to Members, omtoto will: (a) take immediate steps to contain and assess the breach; (b) notify affected Members as promptly as practicable via their registered email address; and (c) report to relevant authorities as required by our international gaming license obligations. omtoto will provide clear guidance on any steps Members should take to protect themselves.
9.4 No Absolute Guarantee. While omtoto takes all reasonable and industry-standard measures to protect your data, no information system is completely impenetrable. omtoto cannot guarantee absolute security, and Members are encouraged to use strong, unique passwords and enable any available two-factor authentication features on their accounts.
10.1 Retention Principle. omtoto retains personal data only for as long as is necessary to fulfill the purposes for which it was collected, as described in this Policy, or as required by applicable law and regulatory obligations. When data is no longer required, it is securely deleted or irreversibly anonymized.
10.2 Retention Schedule. The following general retention periods apply:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account & Registration Data | Duration of account plus 5 years after closure | AML compliance and dispute resolution |
| KYC Documents | 5 years from the date of verification or account closure (whichever is later) | International AML regulatory requirements |
| Transaction Records | 5 years from the date of each transaction | Financial record-keeping and AML obligations |
| Betting & Gaming Logs | 3 years from the date of each session | Dispute resolution and responsible gaming audit |
| Support Communications | 3 years from the date of last interaction | Quality assurance and dispute history |
| Marketing Consent Records | Until withdrawal of consent plus 1 year | Consent audit trail |
| Technical / Server Logs | 12 months | Security monitoring and fraud investigation |
10.3 Early Deletion Requests. You may request early deletion of your personal data where omtoto does not have a legal obligation to retain it. Such requests will be reviewed within 30 calendar days. Please note that deletion of certain data may prevent omtoto from continuing to operate your account.
As a Member of omtoto, you hold the following rights with respect to your personal data. To exercise any of these rights, contact our support team at [email protected]. We will respond within 30 calendar days of receiving a verifiable request.
Request a copy of all personal data omtoto holds about you, along with information about how it is processed.
Ask us to correct any inaccurate or incomplete personal data held in your account or KYC records.
Request deletion of your personal data where there is no compelling legal reason for continued retention.
Ask omtoto to limit processing of your data while a dispute about accuracy or lawfulness is being resolved.
Receive your personal data in a structured, machine-readable format for transfer to another service provider.
Object to processing based on legitimate interests or for direct marketing purposes, with immediate effect for marketing.
Withdraw previously given consent for marketing communications or non-essential cookies at any time.
Request human review of any decision made solely by automated processes that significantly affects you.
12.1 Strict 21+ Requirement. omtoto does not knowingly collect personal data from any individual under 21 years of age. Our platform is intended exclusively for adults aged 21 and over. Age verification is a mandatory step in our KYC process for all Members.
12.2 Discovery of Underage Use. If omtoto discovers or has reason to believe that a registered Member is under 21 years of age, we will immediately suspend the account, preserve relevant data for legal purposes, and return any real-money balance to the payment method on record. Any winnings or bonus funds accumulated will be forfeited. The matter may be referred to relevant child protection or regulatory authorities where required by law.
12.3 Parental & Guardian Responsibility. Parents and legal guardians are responsible for ensuring that minors under their care do not access online gambling platforms. If you believe a minor in your household has accessed omtoto, please contact [email protected] immediately so we can take appropriate action.
13.1 Cross-Border Processing. As an internationally licensed platform, omtoto may transfer and process your personal data in countries outside Indonesia. These transfers occur when data is processed by third-party service providers — including cloud hosting infrastructure, KYC verification services, and game studio analytics — that operate in jurisdictions outside Indonesia.
13.2 Transfer Safeguards. Where personal data is transferred internationally, omtoto ensures that appropriate safeguards are in place, including: data processing agreements that incorporate standard contractual clauses aligned with internationally recognized data protection frameworks; transfer impact assessments where required; and selection of processors located in jurisdictions with adequate data protection standards.
13.3 Indonesian Payment Data. Financial transaction data processed through Indonesian payment channels — BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, and LinkAja — is handled in accordance with Bank Indonesia regulations and the data protection requirements of each respective financial institution.
14.1 Right to Update. omtoto reserves the right to update, modify, or replace any part of this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or platform features. The updated Policy will be published on this page with a revised effective date.
14.2 Material Changes. For any changes that materially affect how we collect, use, or share your personal data, omtoto will provide advance notice via email to your registered address or through a prominent in-platform notification, at least 14 days before the changes take effect where practicable.
14.3 Continued Use. Your continued use of the omtoto platform following the effective date of any amendment constitutes your acceptance of the updated Privacy Policy. If you do not agree with the updated Policy, you must cease using the platform and request account closure.
For any privacy-related inquiries, data rights requests, or concerns about how omtoto handles your personal data, please contact our team using the details below. All data rights requests will be acknowledged within 5 business days and resolved within 30 calendar days.
When submitting a data rights request, please provide sufficient information to allow us to verify your identity before processing the request. This protects your data from unauthorized disclosure. For sensitive requests such as full data access or erasure, omtoto may require you to verify ownership of your registered email address or provide a copy of your KTP or passport.
For questions about our terms of service, please visit the Terms & Conditions page. For guidance on managing your gaming habits, visit our Responsible Gaming page. For answers to common questions, our FAQ page covers the most frequently raised topics.
Our support team is available around the clock to help with any data-related concern. You can also review our full Terms & Conditions or explore our FAQ for quick answers.
21+ only. omtoto operates as an internationally licensed offshore gaming platform. Please play responsibly.