Privacy Policy

1. Introduction

fftoto operates as Indonesia's premier VIP online gaming destination, serving players across Jakarta, Surabaya, Bandung, Medan, Bali, Yogyakarta, and beyond. In the course of providing our services — which include casino games, live dealer tables, sports betting, togel (Indonesia's traditional numbers lottery) games, and related entertainment — we necessarily collect and process personal data about our Members.

We take our obligations as a data controller seriously. This Policy has been drafted to meet internationally recognized data protection standards, including principles aligned with the General Data Protection Regulation (GDPR) and Indonesia's personal data protection framework. We collect only the data we genuinely need, we store it securely, we do not sell it to marketers, and we honor your rights over that data at all times.

Please read this Policy in full. If you have questions that are not addressed here, our Data Protection team is reachable at any time via [email protected].

2. Definitions

For the purposes of this Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, date of birth, address, email address, phone number, payment details, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, transfer, erasure, or destruction.
• "Data Controller" means fftoto, the entity that determines the purposes and means of Processing your Personal Data.
• "Data Processor" means any third party that processes Personal Data on behalf of fftoto under a written data processing agreement.
• "Member" / "You" means any individual who has registered an account on the fftoto Platform.
• "Platform" means the fftoto website accessible at https://fftoto.cam, including all associated services, features, and mobile-optimized interfaces.
• "Cookie" means a small text file placed on your device by the Platform to facilitate functionality, analytics, and personalization.
• "KYC" means Know Your Customer — the identity and age verification procedure required before withdrawals are processed.

3. Data We Collect

We collect the following categories of Personal Data in connection with your use of the fftoto Platform:

Category	Examples of Data Collected
Identity Data	Full legal name, date of birth, gender, nationality, Indonesian National Identity Card (KTP) number or passport number, photograph submitted for KYC.
Contact Data	Residential address, city (e.g., Jakarta, Surabaya, Bandung), province, postal code, email address, mobile phone number, WhatsApp number.
Financial Data	Bank account details (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata), e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja), transaction history, deposit amounts, withdrawal amounts (all in IDR).
Account Data	Username, encrypted password, account registration date, VIP tier, login history, session durations, responsible gaming settings and limits.
Gaming & Betting Data	Game history, wager amounts, win/loss records, sports markets bet upon, bonus redemption history, gaming preferences.
Technical Data	IP address, device type, operating system, browser type and version, screen resolution, referring URL, time-zone (WIB/WITA/WIT), Cookie identifiers, session tokens.
Communications Data	Records of Live Chat conversations, email correspondence, WhatsApp messages with our support team, and responses to surveys or feedback requests.
Marketing Preferences	Consent records for promotional email, SMS, and WhatsApp communications; preference settings for promotional categories (sports, casino, bonuses).

We do not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data beyond what is strictly necessary for KYC identity verification purposes.

4. How We Collect Your Data

fftoto collects your Personal Data through the following means:

4.1 Direct Submission. You provide Personal Data directly to us when you register an account, complete KYC verification, make a deposit or withdrawal, contact our support team, participate in a promotion, or respond to a survey. The accuracy of directly submitted data is your responsibility; we rely on it for KYC compliance, payment processing, and responsible gaming measures.

4.2 Automated Technical Collection. When you visit and use the Platform, our servers automatically record Technical Data including your IP address, device information, browser type, and session behavior. This data is collected via server logs, Cookies, and similar tracking technologies integral to the operation of any web-based platform.

4.3 Third-Party Sources. In limited circumstances, we may receive Personal Data about you from third-party sources, including: fraud-prevention and identity-verification bureaus used in our KYC process; payment processors processing your transactions; and analytics providers helping us understand aggregate Platform usage patterns.

4.4 Inferred Data. We may derive additional data points from the Personal Data you provide — for example, inferring your preferred gaming categories from your game history, or assessing responsible gaming risk indicators from changes in your betting patterns. These inferences inform the personalization of your fftoto experience and our responsible gaming outreach.

5. Legal Basis for Processing

fftoto processes your Personal Data only where a valid legal basis exists. The legal bases we rely on are:

• Contractual Necessity: Processing necessary to perform our contract with you — operating your account, processing deposits and withdrawals in IDR, verifying your identity, calculating winnings, and delivering the gaming services you have requested.
• Legal Obligation: Processing necessary to comply with applicable laws and regulations, including anti-money laundering (AML) requirements, fraud prevention obligations, and KYC mandates imposed by our licensing authority.
• Legitimate Interests: Processing carried out in pursuit of fftoto's legitimate business interests, including fraud detection and prevention, platform security, product improvement, responsible gaming monitoring, and service analytics — provided these interests are not overridden by your fundamental rights and freedoms.
• Consent: Where we rely on your consent — primarily for direct marketing communications via email, SMS, or WhatsApp — you may withdraw that consent at any time by contacting our support team or using the unsubscribe mechanism in any marketing message. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

6. How We Use Your Data

6.1 Account Management. We use your Identity Data, Contact Data, and Account Data to create and maintain your fftoto account, authenticate your logins, manage your VIP tier status, and communicate material account-related information (security alerts, policy updates, transaction confirmations).

6.2 Payment Processing. Your Financial Data is used to process deposits and withdrawals via your nominated Indonesian bank (BCA, BRI, BNI, Mandiri, or other supported banks) or e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja), reconcile transactions, detect payment fraud, and comply with financial reporting requirements.

6.3 KYC & Regulatory Compliance. Identity Data, Contact Data, and Financial Data are processed as part of our mandatory KYC verification procedure and our ongoing AML compliance obligations. We are required by our licensing authority to verify the identity of all Members prior to processing withdrawals and to retain records of this verification.

6.4 Gaming Operations. Gaming & Betting Data is processed to operate the Platform's games and betting markets, calculate wagers and payouts, resolve disputes, maintain fair gaming integrity, and generate transaction histories accessible to you from your account dashboard.

6.5 Responsible Gaming. We actively use Account Data and Gaming & Betting Data to monitor for indicators of problem gambling, enforce self-imposed limits and exclusions, and proactively contact Members whose activity patterns suggest they may benefit from responsible gaming support. This processing is a core component of our du ty of care toward our Members.

6.6 Security & Fraud Prevention. Technical Data and Communications Data are processed to detect and prevent unauthorized access, account takeover attempts, bonus abuse, multi-accounting, collusion, and other fraudulent or harmful behaviors that undermine the integrity of the Platform and the experience of legitimate Members.

6.7 Customer Support. Communications Data is processed to handle your support queries, resolve complaints, and improve the quality and efficiency of our support operations. Live Chat and email transcripts may be reviewed by our quality assurance team for training and service improvement purposes.

6.8 Marketing & Personalization. Where you have provided consent, we use your Contact Data, Account Data, Gaming & Betting Data, and Marketing Preferences to deliver personalized promotional offers, bonus notifications, and event alerts relevant to your gaming interests — such as BRI Liga 1 match promotions, Idul Fitri bonus campaigns, or Ramadhan special reload offers. You may withdraw this consent at any time without affecting your account status.

6.9 Platform Improvement & Analytics. Aggregated and anonymized Technical Data and Gaming & Betting Data are analyzed to understand how Members use the Platform, identify areas for improvement, test new features, and optimize overall Platform performance. This analysis does not involve identifying individual Members.

7. Data Sharing & Disclosure

fftoto does not sell, rent, or trade your Personal Data to any third party for their own marketing or commercial purposes. We share your data only in the following limited circumstances:

7.1 Service Providers (Data Processors). We engage carefully selected third-party service providers who process Personal Data on our behalf under binding data processing agreements. These include: payment gateway and banking API providers facilitating IDR transactions; KYC and identity verification bureaus; fraud detection and AML screening services; cloud hosting and infrastructure providers; customer support platform providers; and email and SMS communication platforms. These providers are contractually prohibited from using your data for any purpose beyond delivering services to fftoto.

7.2 Game Software Providers. Certain game outcomes and session data are processed by third-party game studios — including Pragmatic Play, Evolution Gaming, Microgaming, Pocket Games Soft, Spribe, and NetEnt — whose software powers games on our Platform. These providers act as independent data controllers for their own RNG and fairness auditing purposes. Their data practices are governed by their own published privacy policies.

7.3 Legal and Regulatory Disclosure. We may disclose Personal Data to regulatory authorities, law enforcement agencies, courts, or other public authorities where required to do so by applicable law, court order, or where we reasonably believe disclosure is necessary to prevent fraud, money laundering, or other criminal activity, or to protect the safety of any person.

7.4 Business Transfers. In the event of a merger, acquisition, restructuring, or sale of all or part of fftoto's business assets, your Personal Data may be transferred to the acquiring entity as part of that transaction. We will notify you of any such transfer and the privacy practices that will apply to your data going forward.

7.5 With Your Consent. We may share your Personal Data with other third parties in circumstances not covered above, provided we have obtained your prior explicit consent to do so.

8. Cookies & Tracking Technologies

8.1 What Are Cookies. Cookies are small text files stored on your device when you visit the Platform. They enable core functionality, remember your preferences, and help us understand how the Platform is used. We also use related technologies including web beacons, pixel tags, and local storage objects for similar purposes.

8.2 Types of Cookies We Use.

Cookie Type	Purpose	Can Be Disabled?
Strictly Necessary	Essential for the Platform to function — login sessions, security tokens, account authentication, responsible gaming limit enforcement.	No — disabling these will prevent the Platform from functioning.
Functional	Remember your preferences such as language, currency display, and last-visited game category to improve your experience.	Yes — via browser settings, though some features may be affected.
Analytics	Aggregate, anonymized data on how Members navigate the Platform, which pages are most visited, and where technical errors occur — used to improve performance.	Yes — opt-out available via browser settings.
Marketing	Track your engagement with promotional content so we can deliver offers relevant to your gaming preferences and measure campaign effectiveness.	Yes — withdraw consent via support team or browser settings.

8.3 Managing Cookies. Most browsers allow you to control Cookie settings through their privacy or settings menus. Instructions for managing Cookies in commonly used browsers are available on the respective browser's support pages. Please note that disabling strictly necessary Cookies will impair your ability to log in and use the Platform.

9. International Data Transfers

fftoto operates internationally and your Personal Data may be processed on servers located outside of Indonesia. Where Personal Data is transferred to countries that may not provide the same level of data protection as Indonesia, we ensure appropriate safeguards are in place. These safeguards include contractual obligations on receiving parties that mirror internationally recognized data protection standards, technical security measures, and access restrictions limiting who can interact with your data.

If you would like further information about the specific safeguards applicable to any international transfer of your Personal Data, please contact our Data Protection team at [email protected].

10. Data Retention

10.1 Retention Periods. We retain your Personal Data only for as long as necessary to fulfill the purposes for which it was collected, including compliance with legal, accounting, and reporting obligations. The following general retention periods apply:

• Account and Identity Data: Retained for the duration of your active membership, plus a minimum of 5 years following account closure, in accordance with AML record-keeping requirements.
• Financial Transaction Data: Retained for a minimum of 5 years from the date of each transaction, in line with financial regulatory obligations.
• Gaming & Betting History: Retained for a minimum of 3 years from the date of each gaming session, for dispute resolution and regulatory audit purposes.
• Customer Support Communications: Retained for 2 years from the date of the last communication in a support thread, for quality assurance and dispute resolution purposes.
• Marketing Consent Records: Retained for the duration of your active consent, plus 3 years following withdrawal of consent, as evidence of the consent lifecycle.
• Technical / Log Data: Retained for up to 12 months from collection, unless a longer retention period is required for fraud investigation or legal proceedings.

10.2 Secure Deletion. When Personal Data is no longer required and no legal retention obligation applies, we securely delete or anonymize it so that it can no longer be associated with you as an identified individual.

11. Security Measures

fftoto employs a comprehensive set of technical and organizational security measures to protect your Personal Data against unauthorized access, accidental loss, destruction, alteration, or disclosure. Our security infrastructure includes:

• 256-bit SSL/TLS Encryption: All data transmitted between your browser and the fftoto Platform is encrypted using industry-standard SSL/TLS protocols, the same technology used by major Indonesian banks including BCA and Mandiri.
• Encrypted Data Storage: Sensitive Personal Data including financial details and KYC documents is stored in encrypted form at rest, with access restricted to authorized personnel on a strict need-to-know basis.
• Access Controls: Role-based access control systems ensure that fftoto staff can only access the Personal Data necessary for their specific job functions. All access is logged and audited.
• Two-Factor Authentication: Optional two-factor authentication (2FA) is available for all Member accounts, and mandatory for administrative accounts used by fftoto staff.
• Penetration Testing: The Platform undergoes regular independent security assessments, including penetration testing and vulnerability scanning, to identify and remediate potential weaknesses before they can be exploited.
• Incident Response: We maintain a documented data breach response procedure. In the event of a confirmed data breach affecting your Personal Data, we will notify you and relevant authorities within the timeframes required by applicable data protection law.

While we maintain robust security measures, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your own account credentials. If you suspect unauthorized access to your account, please contact our support team immediately.

12. Your Rights Over Your Personal Data

Subject to applicable law and certain limited exceptions, you have the following rights over the Personal Data that fftoto holds about you:

• Right of Access: You may request a copy of the Personal Data we hold about you, together with information about how it is used and with whom it has been shared.
• Right to Rectification: You may request correction of any inaccurate or incomplete Personal Data we hold about you. Basic account details (email address, phone number) can be updated directly from your account settings; changes to registered name or identity information require KYC documentation.
• Right to Erasure: You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where processing is unlawful. This right is subject to overriding legal retention obligations — for example, AML-mandated record-keeping requirements mean we cannot delete all data immediately upon account closure.
• Right to Restriction: You may request that we restrict processing of your Personal Data in certain circumstances, for example while the accuracy of data you have contested is being verified.
• Right to Data Portability: Where processing is based on your consent or on a contract with you, you may request that we provide your Personal Data in a structured, commonly used, machine-readable format.
• Right to Object: You may object at any time to processing of your Personal Data for direct marketing purposes. You may also object to processing based on our legitimate interests, though we may override your objection where we have compelling legitimate grounds.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please submit a written request to [email protected] with the subject line "Data Rights Request" and include your registered username and a description of the right you wish to exercise. We will respond within 30 calendar days of receiving a valid request.

13. Protection of Minors

The fftoto Platform is strictly for adults aged 21 years and over. We do not knowingly collect Personal Data from individuals under the age of 21. All accounts are subject to age verification as part of our KYC process, and we reserve the right to request documentary proof of age at any time.

If we become aware that Personal Data has been collected from a person under 21 years of age, we will take immediate steps to delete that data and permanently close the associated account. If you believe a minor may have registered an account on our Platform, please notify us immediately at [email protected].

14. Third-Party Links & Services

The fftoto Platform may contain references to third-party services — such as game studios, payment partners, or sports data providers — whose privacy practices are governed by their own separate policies. fftoto is not responsible for the data practices of these third parties. We encourage you to review the privacy policies of any third-party services you access in connection with your use of the Platform.

15. Policy Amendments

fftoto reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or operational requirements. We will notify registered Members of material changes via email to the address held on file and by displaying a prominent notice on the Platform prior to the changes taking effect.

Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. The most current version of this Policy will always be available at https://fftoto.cam/privacy-policy. We recommend checking this page periodically.

16. Contact & Complaints

If you have any questions, concerns, or complaints regarding this Privacy Policy or our handling of your Personal Data, please contact our Data Protection team through any of the following channels:

• Email: [email protected] — please use the subject line "Privacy Inquiry" and include your registered username.
• Live Chat: Available 24/7 directly on the Platform — our Indonesian-speaking support agents can log and escalate privacy-related queries to the Data Protection team.
• WhatsApp: +62 812-3456-7890 — available around the clock for Members across all time zones, including WIB, WITA, and WIT.

We aim to resolve all privacy-related queries within 5 business days. If you are not satisfied with our response, you have the right to escalate your complaint to the relevant data protection supervisory authority in your jurisdiction.