m2toto Privacy Policy

1 Definitions

Throughout this Privacy Policy, the following defined terms apply:

• "Platform" — the m2toto website at https://m2toto.cam and all associated services.
• "Personal Data" — any information relating to an identified or identifiable natural person, including name, identification number, location data, email address, financial data, and any online identifiers.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, restriction, erasure, or destruction.
• "Data Controller" — the entity that determines the purposes and means of processing Personal Data. For this Platform, the Data Controller is the m2toto operating entity described in Section 2.
• "Data Processor" — a third party that processes Personal Data on behalf of the Data Controller under a binding written agreement.
• "Player", "You", "Your" — any natural person who accesses, registers on, or uses the Platform.
• "KYC" — Know Your Customer; the identity verification process described in this Policy and in our Terms & Conditions.
• "Cookies" — small text files placed on your device by the Platform to recognise your browser and store preferences or session data.

2 Data Controller

m2toto is operated by an internationally incorporated entity registered under an offshore gaming licence. As the operator of the Platform, m2toto acts as the Data Controller in respect of all Personal Data collected from Players interacting with https://m2toto.cam.

For all privacy-related enquiries, requests, and complaints, you may contact our Data Protection Officer at: [email protected] with the subject line "Privacy — [Your Account Username]".

We are committed to processing your Personal Data lawfully, fairly, and transparently. This Policy describes the full scope of that processing so that you can make an informed decision before using the Platform.

3 Data We Collect

m2toto collects the following categories of Personal Data in the course of operating the Platform:

We do not collect sensitive Personal Data such as racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, biometric data (other than identity photographs for KYC), or health data, except where voluntarily disclosed in a responsible gaming context (e.g., a Player self-identifying a gambling-related health concern).

4 How We Collect Data

m2toto collects Personal Data through the following channels:

• Directly from you: When you register an account, complete KYC verification, make a deposit or withdrawal, contact our support team, or update your account profile.
• Automatically via the Platform: Through server logs, cookies, and similar tracking technologies that record Technical Data and Usage Data each time you access the Platform. See Section 9 for full cookie details.
• From third-party identity verification providers: When we use automated KYC tools to verify the authenticity of your KTP or passport, these providers may return additional data fields (e.g., document validity status, address cross-reference results) that are appended to your KYC record.
• From payment processors: When you complete a deposit or withdrawal, our payment processing partners (e.g., the bank or e-wallet provider) may share transaction confirmation data including your registered account name and transaction reference number.
• From anti-fraud and security screening tools: IP reputation services and device fingerprinting tools may provide risk-score data associated with your session to help us detect fraudulent access attempts.

5 Purposes & Legal Basis for Processing

We process your Personal Data only for specific, documented purposes. The table below sets out each purpose, the data categories used, and the legal basis on which we rely:

Where we rely on legitimate interest as the legal basis, we have conducted a balancing test confirming that our processing does not override your fundamental rights and freedoms. Where we rely on consent, you may withdraw that consent at any time by updating your account settings or contacting our support team.

6 Data Sharing & Disclosure

m2toto does not sell, rent, or trade your Personal Data to any third party for marketing purposes. We do share your Personal Data with the following categories of recipients under strict contractual protections:

• Payment Processors: BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, and the operators of OVO, DANA, GoPay, ShopeePay, and LinkAja receive your registered account name and transaction amount to process deposits and withdrawals. They do not receive your full account balance, wagering history, or any data beyond the specific transaction being processed.
• Identity Verification Providers: Third-party KYC and document verification services receive your KTP or passport image, full name, and date of birth to authenticate your identity. These providers are bound by data processing agreements that prohibit retention of your data beyond the immediate verification purpose.
• Anti-Fraud Service Providers: IP reputation databases and device fingerprinting tools process your Technical Data to generate risk scores. They do not receive your name, financial data, or any directly identifying information.
• Game and Live Casino Providers: Third-party game studios (e.g., Pragmatic Play, Evolution Gaming) receive a pseudonymised Player ID and your wager amounts to operate games in real time. They do not receive your real name, contact details, or financial account information.
• Legal and Regulatory Authorities: We are legally obligated to disclose Personal Data to law enforcement, financial intelligence units, or gaming regulators when presented with a valid legal request. In such cases, we verify the legitimacy of the request and disclose only the minimum data necessary to comply.
• Professional Advisors: Our legal counsel, auditors, and compliance consultants may access Personal Data under strict confidentiality obligations when advising m2toto on legal or regulatory matters.

All third-party Data Processors engaged by m2toto are required to sign data processing agreements that mandate compliance with applicable data protection laws, implement appropriate security measures, and prohibit use of your data for any purpose other than the specific service they provide to m2toto.

7 International Data Transfers

m2toto's primary data hosting infrastructure is located in secure data centres outside Indonesia. Some of the third-party service providers described in Section 6 are also located in jurisdictions outside Indonesia. By using the Platform, you consent to the transfer of your Personal Data to these international locations.

We ensure that all international data transfers are subject to appropriate safeguards, including:

• Use of data centres and cloud hosting providers that maintain ISO 27001 certification and SOC 2 Type II compliance.
• Execution of Standard Contractual Clauses (SCCs) or equivalent data transfer mechanisms with all Data Processors located in jurisdictions without adequacy decisions.
• Implementation of encryption in transit (TLS 1.3) and at rest (AES-256) for all transferred data.

You have the right to request copies of the specific safeguards we have implemented for any international data transfer. Submit such requests to [email protected] with the subject line "International Transfer Safeguards Request".

8 Data Retention

m2toto retains Personal Data only for as long as necessary to fulfil the purposes described in Section 5, or as required by applicable law. The following retention periods apply:

• Active Accounts: Personal Data is retained for the duration of your account's active status and for 5 years following account closure to comply with anti-money-laundering regulations and to resolve any disputes that arise post-closure.
• KYC Documents: Identity documents, proof-of-address records, and selfie verification images are retained for 5 years from the date of account closure or the date of the last transaction, whichever is later.
• Financial Records: Deposit and withdrawal transaction logs are retained for 7 years from the transaction date to comply with tax reporting obligations and financial audit requirements.
• Wagering Data: Bet history and game session logs are retained for 5 years from the date of the wager to support dispute resolution and regulatory reporting.
• Marketing Communications: Opt-in and opt-out records are retained indefinitely to ensure we honour your preferences. Actual marketing message content is deleted 2 years after sending.
• Support Correspondence: Live chat transcripts and email exchanges are retained for 3 years from the date of the last message to support quality assurance and training purposes.

Once the applicable retention period expires, Personal Data is securely deleted or anonymised such that it can no longer be associated with an identifiable individual. Anonymised data may be retained indefinitely for statistical analysis and service improvement purposes.

9 Cookies & Tracking Technologies

m2toto uses cookies and similar tracking technologies to recognise your browser, maintain your login session, and improve platform performance. The following types of cookies are deployed:

• Essential Cookies: Strictly necessary for the Platform to function. These include session tokens that keep you logged in, language preference cookies, and security cookies that help detect fraudulent login attempts. Essential cookies cannot be disabled without rendering the Platform unusable.
• Performance Cookies: Collect anonymous data about how visitors use the Platform, including page load times, error messages, and navigation paths. This data helps us identify and fix technical issues. Examples: Google Analytics (anonymised IP), server-side performance monitoring.
• Functionality Cookies: Remember your preferences such as preferred odds format, time zone display (WIB / WITA / WIT), and interface layout choices. These cookies enhance convenience but are not essential.
• Marketing Cookies: Track whether you arrived at the Platform via a promotional link or advertisement, enabling us to measure campaign effectiveness. These cookies are only set if you have opted in to marketing communications.

You can control non-essential cookies through your browser settings. Disabling Performance, Functionality, or Marketing cookies will not prevent you from using the Platform, though some features may be less convenient. Detailed instructions for managing cookies in Chrome, Firefox, Safari, and Edge are available in our FAQ.

Most cookies used by m2toto expire when you close your browser (session cookies). Persistent cookies that remain after browser closure have a maximum lifespan of 12 months, after which they expire automatically.

10 Your Rights

Under applicable data protection laws, you hold the following rights in relation to your Personal Data. To exercise any of these rights, contact our Data Protection Officer at [email protected]:

All data subject rights requests are handled by our Data Protection Officer. We respond to valid requests within 30 days. If your request is complex or we receive multiple requests from you simultaneously, we may extend this period by an additional 60 days, notifying you of the extension and the reasons for it within the initial 30-day period.

We do not charge a fee for exercising your rights unless your request is manifestly unfounded, excessive, or repetitive, in which case we may charge a reasonable administrative fee or refuse to act on the request.

11 Children & Minors

The Platform is intended exclusively for adults aged 21 and over. m2toto does not knowingly collect Personal Data from individuals under 21 years of age. Our KYC verification process is designed to identify and reject underage applicants.

If we become aware that we have inadvertently collected Personal Data from a person under 21, we will delete that data immediately, close the associated account, and return any deposited funds to the funding source. If you believe we have collected data from a minor, please notify us immediately at [email protected] with the subject line "Underage Account Report".

Parents and guardians are encouraged to monitor their children's internet activity and to use parental control software to prevent access to gambling platforms.

12 Security Measures

m2toto employs industry-standard technical and organisational measures to protect Personal Data against unauthorised access, accidental loss, destruction, or damage. These measures include:

• Encryption: All data transmitted between your device and our servers is encrypted using TLS 1.3 with forward secrecy. Stored Personal Data is encrypted at rest using AES-256.
• Access Controls: Personal Data is accessible only to m2toto employees and contractors who require access to perform their job functions. All personnel are bound by confidentiality agreements.
• Multi-Factor Authentication: Administrative access to our systems requires two-factor authentication and IP whitelisting.
• Intrusion Detection: Automated monitoring tools scan for suspicious activity, unauthorised access attempts, and data exfiltration patterns 24/7.
• Regular Security Audits: Independent security firms conduct penetration testing and vulnerability assessments on the Platform semi-annually. Critical vulnerabilities are patched within 24 hours of discovery.
• Secure Data Disposal: Personal Data scheduled for deletion is securely wiped using DoD 5220.22-M compliant methods. Physical media is destroyed according to NIST SP 800-88 guidelines.

Despite these measures, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your Personal Data, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account password and for any activity that occurs under your account.

13 Third-Party Links

The Platform may contain links to third-party websites, including payment provider portals (e.g., BCA KlikPay, OVO app, DANA merchant interface) and game studio sites. This Privacy Policy applies only to m2toto's processing of your Personal Data. Once you leave the Platform via a third-party link, your interaction with that third party is governed by their own privacy policy.

m2toto is not responsible for the privacy practices or content of third-party websites. We recommend reviewing the privacy policy of any external site before providing Personal Data to it.

14 Policy Amendments

m2toto reserves the right to amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or operational requirements. Material changes will be communicated to registered Players via email at least 14 days before the revised Policy takes effect. The revised Policy will also be published on this page with an updated Effective Date.

Non-material amendments (e.g., clarifications that do not alter the substance of our processing, typographical corrections, updated contact details) take effect immediately upon publication. Your continued use of the Platform following publication of an amended Privacy Policy constitutes acceptance of the revised terms.

If you do not agree to a material amendment, you must cease using the Platform and may request account closure in accordance with our Terms & Conditions.

15 Governing Law

This Privacy Policy is governed by the data protection and privacy laws of the jurisdiction in which m2toto's operating entity is incorporated. Where Indonesian law provides you with stronger data protection rights than the law of our incorporation jurisdiction, those Indonesian rights apply to the extent that they cannot be waived by contract.

Any dispute arising from this Privacy Policy that cannot be resolved through our internal complaints process may be referred to the data protection supervisory authority in your country of residence, or to binding arbitration as described in our Terms & Conditions.

16 Contact & Complaints

For all privacy-related questions, to exercise your data subject rights, or to lodge a formal complaint about how m2toto has handled your Personal Data, please contact our Data Protection Officer:

Email: [email protected]
Subject Line: "Privacy — [Your Request Type]"
Live Chat: Available 24/7 via the Platform (select "Privacy & Data Protection" from the topic menu)

We will acknowledge receipt of your privacy enquiry within 24 hours and provide a substantive response within 30 days. If your complaint is not resolved to your satisfaction, you have the right to escalate the matter to the data protection authority in your country of residence.

For Players resident in Indonesia, the relevant authority is the Ministry of Communication and Informatics (Kominfo). Contact details and complaint procedures are available at the Kominfo website. Please note that Indonesian data protection regulations are still developing, and some international privacy frameworks may provide stronger protections.