At gto108, your privacy is a core commitment, not a compliance afterthought. This Privacy Policy explains precisely what data we collect, why we collect it, how we use it, and the rights you hold as a platform member.
Effective Date: 1 January 2026 | Last Updated: 1 January 2026The following terms carry the meanings defined below throughout this Privacy Policy. Capitalized terms not defined here carry the meanings assigned in the gto108 Terms and Conditions.
gto108 collects the minimum Personal Data necessary to deliver a safe, compliant, and high-quality gaming experience. The categories of data we collect are as follows:
What We Do Not Collect: gto108 does not collect biometric data beyond the selfie KYC requirement, does not access your device contacts or camera beyond the KYC upload process, and does not purchase or import Personal Data from commercial data brokers.
gto108 collects your Personal Data through the following channels:
gto108 processes your Personal Data for the following clearly defined purposes:
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Account creation and management | Identity, contact, and credential data | Contractual necessity |
| Identity verification (KYC) | Identity documents, selfie, address data | Legal obligation |
| Processing deposits and withdrawals | Financial data, transaction history | Contractual necessity |
| Fraud prevention and AML compliance | Identity, financial, technical, and behavioral data | Legal obligation / Legitimate interest |
| Customer support | Contact data, account data, communication records | Contractual necessity |
| Responsible gaming monitoring | Behavioral and gaming data | Legal obligation / Legitimate interest |
| Platform improvement and analytics | Technical and usage data | Legitimate interest |
| Promotional communications | Contact data, behavioral data | Consent |
| Legal compliance and regulatory reporting | All categories as required | Legal obligation |
gto108 processes your Personal Data on the following legal grounds, in accordance with applicable data protection principles:
Processing is necessary to perform the contract between you and gto108 — that is, to operate your Account, process your transactions, and deliver the gaming services you have requested. Without this processing, we cannot provide the Platform's core functionality.
Certain processing activities are required to comply with applicable laws and regulations, including anti-money laundering (AML) requirements, know-your-customer (KYC) obligations, responsible gaming mandates, and tax reporting duties. gto108 cannot waive these obligations regardless of your consent preferences.
gto108 processes some data on the basis of its legitimate business interests, including fraud detection, platform security, product improvement, and analytics — provided those interests do not override your fundamental rights and freedoms. We carry out a balancing test before relying on this basis and document the outcome internally.
Where processing is not covered by the three bases above — most notably for direct marketing communications and the use of non-essential cookies — gto108 will request your explicit consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal. To withdraw marketing consent, contact [email protected] or update your notification preferences within your Account settings.
gto108 does not sell, rent, or trade your Personal Data to third parties for commercial purposes. We share data only in the limited circumstances described below, and only to the extent necessary for the stated purpose.
We engage trusted third-party service providers to support Platform operations. These providers act as Data Processors under binding agreements that restrict their use of your data to the specific services they deliver on our behalf. Categories of service providers include:
gto108 may disclose your Personal Data to regulatory bodies, financial intelligence units, or law enforcement agencies where required by applicable law, court order, or regulatory directive. We will notify you of such disclosures where legally permitted to do so.
In the event of a merger, acquisition, restructuring, or sale of all or part of gto108's business, your Personal Data may be transferred to the successor entity. We will notify affected users in advance and ensure that the successor entity is bound by privacy commitments no less protective than those in this Policy.
No Sale of Personal Data: gto108 does not sell, license, or otherwise commercialize your Personal Data to advertisers, data brokers, or any third party for their independent marketing use. Any sharing described above is strictly operational and contractually constrained.
gto108 operates globally and some of our service providers — including cloud infrastructure partners and game studios — are headquartered outside Indonesia. As a result, your Personal Data may be transferred to, stored in, or processed in countries other than Indonesia, including jurisdictions that may not provide the same level of data protection as Indonesian law.
Where such transfers occur, gto108 takes all reasonably practicable steps to ensure your data is protected to a standard equivalent to that required under applicable data protection principles, including by:
By using the Platform, you acknowledge and consent to the transfer of your Personal Data as described in this section, subject always to the protections described above.
gto108 retains your Personal Data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable law. The following retention periods apply as a general guide:
| Data Category | Retention Period | Reason |
|---|---|---|
| Account and identity data | Duration of Account + 5 years post-closure | AML / regulatory compliance |
| KYC documents | Duration of Account + 5 years post-closure | Legal obligation |
| Financial transaction records | Duration of Account + 7 years post-closure | Tax and AML obligations |
| Support communications | 3 years from date of interaction | Dispute resolution / quality review |
| Technical and usage logs | 13 months rolling | Security monitoring / analytics |
| Marketing consent records | Until consent withdrawn + 3 years | Proof of consent basis |
Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymized so that it can no longer be attributed to an identifiable individual.
gto108 applies industry-leading technical and organizational measures to protect your Personal Data against unauthorized access, accidental loss, alteration, disclosure, or destruction.
In the event of a Personal Data breach that poses a risk to your rights and freedoms, gto108 will notify affected members without undue delay — and in any event within 72 hours of becoming aware of the breach — with details of the nature of the incident, the data affected, and the steps taken to mitigate harm.
While gto108 implements robust security measures, no online platform can guarantee absolute security. You remain responsible for maintaining the confidentiality of your login credentials. Report any suspected unauthorized access to your Account immediately by contacting [email protected].
gto108 uses cookies and similar tracking technologies to operate the Platform efficiently, remember your preferences, and understand how members interact with our services.
Session cookies expire when you close your browser. Persistent cookies have defined expiry periods ranging from 30 days (functional preferences) to 13 months (analytics). You can view and manage cookies stored by the Platform through your browser's built-in cookie management settings.
You may configure your browser to refuse all cookies or to alert you when cookies are being set. Note that disabling strictly necessary cookies will prevent you from logging in and using the Platform's core features. Instructions for managing cookies are available in the help documentation of all major browsers.
As a member of gto108, you hold the following rights with respect to your Personal Data. To exercise any of these rights, submit a written request to [email protected] with the subject line "Data Subject Rights Request". We will acknowledge your request within 5 business days and fulfill it within 30 calendar days.
Request a copy of the Personal Data gto108 holds about you, along with information on how it is used and with whom it is shared.
Request correction of inaccurate or incomplete Personal Data held in your Account. Some corrections require re-submission of KYC documentation.
Request deletion of your Personal Data where it is no longer necessary for the purpose collected, subject to our legal retention obligations.
Request that we limit the processing of your data while a rectification or objection request is being resolved.
Request your Personal Data in a structured, machine-readable format for transfer to another service provider, where technically feasible.
Object to processing based on legitimate interest or for direct marketing purposes. Marketing objections are actioned immediately upon receipt.
Withdraw consent for any consent-based processing at any time without penalty. Withdrawal does not affect the lawfulness of prior processing.
Request human review of any decision made about you solely by automated means that produces a significant legal or similarly serious effect.
gto108 will not charge a fee for reasonable data subject rights requests. Where requests are manifestly unfounded or excessive, we reserve the right to charge a reasonable administrative fee or decline the request, with written explanation provided.
gto108 is strictly an adults-only (21+) platform. We do not knowingly collect Personal Data from individuals under the age of 21. All account registrations include an age declaration, and KYC verification confirms the member's date of birth against their identity document.
If gto108 becomes aware that Personal Data has been collected from a person under 21, that Account will be immediately closed, all data associated with it will be deleted (or retained only as required by law), and any deposited funds will be returned to the originating payment method after verification.
If you are a parent or guardian and believe your minor child has created an Account on gto108, please contact us immediately at [email protected] so that we can take prompt remedial action.
The gto108 Platform may display content or functionality delivered by third-party game providers and payment partners. While gto108 vets all partners for security and compliance standards, each third party operates its own privacy practices that are independent of this Policy.
gto108 does not control, and is not responsible for, the privacy practices of third-party game studios or payment processors beyond the contractual data processing obligations we impose on them. We encourage you to review the privacy policies of any third-party service provider whose interface you interact with directly.
The Platform does not include links to unrelated external websites. If such a link were ever added in a future update, this Policy would be amended accordingly to reflect the associated data practices.
gto108 reserves the right to update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or the services we offer. When we make material changes — particularly those that affect your rights or the ways in which we use your Personal Data — we will notify you by email to your registered address and/or by a prominent notice on the Platform at least 7 calendar days before the revised Policy takes effect.
For minor clarifications or non-material changes (such as updating contact details or correcting typographical errors), the revised Policy will be published on this page with an updated "Last Updated" date, without a prior notice period.
Your continued use of the Platform after the effective date of any revision constitutes acceptance of the updated Privacy Policy. If you do not agree with the revised Policy, you should cease using the Platform and may request Account closure in accordance with the Terms and Conditions.
We recommend bookmarking this page and reviewing it periodically. The current version is always available at https://gto108.cam/privacy-policy.
If you have any questions about this Privacy Policy, wish to exercise a data subject right, or have a concern about how gto108 has handled your Personal Data, please contact our Data Protection team using the details below:
Email: [email protected] — Please mark your message "Privacy Enquiry" or "Data Subject Rights Request" in the subject line.
Our support team is available 24/7 via live chat on the Platform and via email. For formal written privacy complaints, we aim to acknowledge receipt within 24 hours (WIB, UTC+7) and provide a substantive written response within 30 calendar days.
If you are not satisfied with our response to a privacy complaint, you have the right to escalate the matter to the relevant data protection supervisory authority in your jurisdiction. gto108 is committed to cooperating fully with any regulatory inquiry relating to our data processing practices.
Six principles that guide how gto108 handles every piece of your personal information — every day, without exception
All data in transit is protected with 256-bit SSL/TLS encryption. Sensitive records stored on our servers — including KYC documents and payment details — are encrypted at rest and never exposed in plain text.
gto108 does not sell, rent, or trade your personal data to advertisers or data brokers. Any data sharing is strictly operational, governed by binding processor agreements, and limited to what is necessary for the service to function.
We collect only the data that is genuinely necessary to operate your account, process your transactions, and comply with legal obligations. We do not harvest data beyond these defined purposes or retain it beyond its useful life.
You can access, correct, delete, or port your personal data at any time by contacting our support team. All data subject rights requests are acknowledged within 5 business days and fulfilled within 30 calendar days.
Where your data is processed outside Indonesia — for instance by cloud infrastructure or game studio partners — gto108 enforces contractual data protection obligations equivalent to those in this Policy on every receiving party.
In the event of a data breach that affects your rights, gto108 will notify you within 72 hours of discovery, with full details of the incident and the steps taken to contain and remediate it.
Our support team is available around the clock to address any privacy concern. You can also review our Terms & Conditions, Responsible Gaming commitments, or visit the FAQ for quick answers.