too28 Privacy Policy

1 Definitions

For the purposes of this Policy, the following definitions apply:

• "Personal Data" means any information that directly or indirectly identifies a natural person, including name, email address, phone number, national identity number, IP address, payment details, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, alteration, retrieval, use, disclosure, transmission, or deletion.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data — in this case, too28.
• "Data Processor" means any third party that processes Personal Data on behalf of too28 under a contractual data-processing agreement.
• "Consent" means a freely given, specific, informed, and unambiguous indication of agreement by the Player to the processing of their Personal Data.
• "KYC" means Know Your Customer — the identity verification process used to confirm a Player's identity, age, and eligibility to use the platform.
• "Cookies" means small text files placed on a Player's device by the too28 platform to store session information, preferences, and usage analytics.

2 Data Controller

too28 acts as the Data Controller for all Personal Data collected through the platform. As Data Controller, too28 is responsible for ensuring that Personal Data is processed lawfully, fairly, and transparently, and that appropriate technical and organisational security measures are maintained at all times.

For all data-related enquiries, requests, or complaints, Players may contact us at:

• Email: [email protected]
• Response time: Within 30 calendar days of receiving a verifiable written request

3 Personal Data We Collect

too28 collects the following categories of Personal Data from Players:

Category	Examples	Purpose
Identity Data	Full legal name, date of birth, national ID (KTP), passport number	Account registration, KYC verification, age compliance
Contact Data	Email address, phone number, residential address in Indonesia	Account communication, support, security alerts
Financial Data	Bank account details (BCA, BRI, BNI, Mandiri, CIMB Niaga), e-wallet IDs (OVO, DANA, GoPay, ShopeePay)	Deposit and withdrawal processing, fraud prevention
Transaction Data	Deposit history, withdrawal records, bonus claims, bet history	Account management, dispute resolution, regulatory compliance
Technical Data	IP address, browser type, device ID, operating system, session timestamps	Security monitoring, fraud detection, platform optimisation
Usage Data	Pages visited, games played, time on platform, click patterns	User experience improvement, personalised promotions
Communication Data	Live chat transcripts, support emails, feedback submissions	Support quality assurance, dispute resolution
KYC Documents	Scanned KTP or passport, selfie with ID, proof of address, bank statements	Identity verification, compliance with anti-money-laundering obligations

4 How We Collect Your Data

too28 collects Personal Data through the following channels:

4.1 Direct Collection

Data you provide directly when you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, or respond to a survey or promotion.

4.2 Automated Collection

Data collected automatically as you interact with the platform, including through cookies, web beacons, pixel tags, log files, and similar tracking technologies. This includes IP addresses, device fingerprints, session durations, and in-platform navigation patterns.

4.3 Third-Party Sources

Data received from third parties in the course of operating the platform, including:

• Identity verification and KYC service providers engaged by too28 to validate the authenticity of documents submitted by Players;
• Payment processors and banking partners (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay) who may share transaction confirmation data;
• Fraud prevention and anti-money-laundering screening services;
• Analytics providers who aggregate anonymised usage statistics to help improve the platform.

5 Purpose & Legal Basis for Processing

too28 processes Personal Data only where a lawful basis exists. The primary legal bases and corresponding purposes are set out below:

5.1 Contractual Necessity

Processing is necessary to perform the contract between too28 and the Player — specifically, to maintain your Account, process deposits and withdrawals, settle bets, administer bonuses, and provide customer support.

5.2 Legal Obligation

Processing is required to comply with applicable legal obligations, including anti-money-laundering (AML) regulations, counter-terrorism financing (CTF) requirements, and obligations under our international operating licence. This includes KYC verification and transaction monitoring.

5.3 Legitimate Interests

Processing is carried out in pursuit of too28's legitimate business interests, including fraud detection and prevention, security monitoring, platform improvement, and responsible gaming compliance — provided that such interests do not override the Player's fundamental rights and freedoms.

5.4 Consent

Where processing is based on consent — such as sending personalised promotional emails or using non-essential cookies — you have the right to withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. Withdrawal of consent does not affect your ability to use the core platform services.

6 Sharing Your Personal Data

too28 does not sell, rent, or trade your Personal Data to third parties for their own marketing purposes. We share Personal Data only in the following limited circumstances:

6.1 Service Providers and Data Processors

We engage trusted third-party service providers to support platform operations, including payment processors (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay), KYC verification providers, IT infrastructure providers, data analytics firms, fraud prevention services, and customer support platforms. All processors are contractually bound to process Personal Data only as instructed by too28 and to maintain appropriate security standards.

6.2 Game Providers

To deliver the g aming experience, certain technical data (such as your Player ID, session token, and game preferences) may be shared with licensed game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft. These providers receive only the minimum data required to deliver the game session and are prohibited from using it for any other purpose.

6.3 Regulatory and Law Enforcement Authorities

too28 may disclose Personal Data to competent authorities, regulators, law enforcement agencies, or courts where required by applicable law, a binding court order, or our international licensing obligations. We will notify affected Players of any such disclosure to the extent permitted by law.

6.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of too28's business, Personal Data held by too28 may be transferred to the acquiring entity as part of that transaction. Players will be notified of any such transfer and the privacy terms that will apply going forward.

7 International Data Transfers

too28 operates as an international platform with infrastructure and service providers located in multiple countries. As a result, your Personal Data may be transferred to, and processed in, countries outside Indonesia. Where such transfers occur, too28 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that required under applicable data protection law. These safeguards may include:

• Standard contractual clauses approved by relevant data protection authorities;
• Data processing agreements that impose binding obligations on recipients;
• Transfers to jurisdictions recognised as providing an adequate level of data protection.

Players may request details of the safeguards in place for any specific international transfer by contacting us at [email protected].

8 Data Retention

too28 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and our licensing obligations. The following general retention periods apply:

Data Category	Retention Period	Reason
Account & Identity Data	Duration of account plus 5 years after closure	AML / regulatory compliance
Financial & Transaction Data	5 years from date of transaction	Financial record-keeping, dispute resolution
KYC Documents	5 years after account closure	Anti-money-laundering obligations
Technical & Usage Data	Up to 24 months from collection	Security monitoring, platform analytics
Support & Communication Data	3 years from last interaction	Quality assurance, dispute resolution
Marketing Preferences	Until consent is withdrawn	Consent-based processing

Once the applicable retention period expires, Personal Data is securely deleted or anonymised so that it can no longer be associated with any individual Player.

9 Data Security

too28 implements a comprehensive set of technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, alteration, or disclosure. Our security framework includes:

• SSL/TLS Encryption: All data transmitted between your device and the too28 platform is encrypted using industry-standard 256-bit SSL/TLS protocols.
• At-Rest Encryption: Sensitive Personal Data stored on our servers — including KYC documents and financial records — is encrypted at rest using AES-256 encryption.
• Access Controls: Personal Data is accessible only to too28 personnel and authorised processors who have a legitimate operational need. Access is governed by role-based permissions and multi-factor authentication.
• Penetration Testing: too28's platform undergoes regular third-party security audits and penetration tests to identify and remediate vulnerabilities.
• Incident Response: too28 maintains a documented data-breach response plan. In the event of a material breach affecting Player data, we will notify affected Players and relevant authorities within the timeframes required by applicable law.
• Staff Training: All too28 employees with access to Personal Data receive mandatory data protection training and are bound by confidentiality obligations.

10 Cookies & Tracking Technologies

too28 uses cookies and similar tracking technologies to operate the platform effectively, improve the user experience, and deliver relevant content to Players. The categories of cookies we use are as follows:

10.1 Strictly Necessary Cookies

These cookies are essential for the platform to function. They enable core features such as secure login sessions, account authentication, and load balancing. These cookies cannot be disabled without rendering the platform inoperable.

10.2 Performance and Analytics Cookies

These cookies collect anonymised information about how Players interact with the platform — such as which pages are visited most frequently, how long sessions last, and where errors occur. This data is used solely to improve platform performance and player experience.

10.3 Functional Cookies

These cookies remember your preferences — such as your preferred language setting, game view layout, and notification preferences — to personalise your experience on return visits.

10.4 Targeting and Promotional Cookies

Where you have provided consent, these cookies enable too28 to present you with personalised promotional content based on your gaming activity and preferences. You may withdraw consent for this category of cookies at any time through your Account settings.

You can manage your cookie preferences at any time through your browser settings. Please note that disabling certain cookies may affect the functionality of the too28 platform.

11 Your Data Rights

As a Player registered on too28, you hold the following rights with respect to your Personal Data. To exercise any of these rights, please submit a written request to [email protected]. too28 will respond within 30 calendar days of receiving a verifiable request.

11.1 Right of Access

You have the right to request a copy of the Personal Data too28 holds about you, along with information about how it is being used and with whom it has been shared.

11.2 Right to Rectification

If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. Minor corrections (such as updating your email address or phone number) can be made directly through your Account settings.

11.3 Right to Erasure

You may request that too28 delete your Personal Data where it is no longer necessary for the purposes for which it was collected, where consent has been withdrawn, or where processing is unlawful. This right is subject to limitations where retention is required by law — for example, AML record-keeping obligations that require us to retain transaction and identity data for a minimum of five years.

11.4 Right to Restriction of Processing

You may request that too28 restrict the processing of your Personal Data in certain circumstances — for example, while the accuracy of the data is being contested, or while an objection to processing is being assessed.

11.5 Right to Data Portability

Where processing is based on consent or contractual necessity and is carried out by automated means, you have the right to receive a copy of your Personal Data in a structured, commonly used, machine-readable format.

11.6 Right to Object

You may object to processing carried out on the basis of too28's legitimate interests, including profiling for personalised promotions. too28 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.

11.7 Right to Withdraw Consent

Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. To opt out of marketing communications, use the unsubscribe link in any promotional email or contact [email protected].

12 Minors & Age Protection

The too28 platform is strictly for adults aged 21 and above. too28 does not knowingly collect or process Personal Data from individuals under the age of 21. If we become aware that Personal Data has been submitted by a minor, we will take immediate steps to delete that data and close the associated Account.

If you are a parent or guardian and believe your child has registered an account on too28, please contact us immediately at [email protected] so that we can investigate and take appropriate action without delay. We take underage access extremely seriously and operate a zero-tolerance policy in this regard.

13 Third-Party Services and Links

The too28 platform may include references to third-party services — such as payment providers (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay) and game studios (Pragmatic Play, Evolution Gaming, Spribe, Pocket Games Soft). When you interact with these third-party services — for example, by initiating a bank transfer — you will be subject to the privacy policy of that third party.

too28 is not responsible for the privacy practices of any third-party provider. We encourage Players to review the privacy policies of all third-party services they interact with in connection with the too28 platform. Our selection of payment and game partners is based in part on their demonstrated commitment to data security and player privacy.

14 Policy Amendments

too28 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, operational requirements, or applicable law. Where changes are material — for example, a new category of data being collected or a new purpose for processing — we will notify Players by email to the address registered on their Account and/or by a prominent notice on the platform, with a minimum of 14 days' notice before the amended Policy takes effect.

Your continued use of the too28 platform after the effective date of any amendments constitutes acceptance of the updated Policy. The date of the most recent revision is displayed at the top of this page. We encourage Players to review this Policy periodically to remain informed about how we protect their data.

15 Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise your data rights, or wish to raise a complaint about how too28 has handled your Personal Data, please contact our data protection team using the details below:

• Email: [email protected]
• Response time: Within 30 calendar days for data rights requests; within 5 business days for general privacy enquiries
• Support hours: 24 hours a day, 7 days a week, including Indonesian public holidays

If you are not satisfied with too28's response to a privacy complaint, you may have the right to escalate the matter to the relevant data protection authority in your jurisdiction. too28 is committed to resolving all privacy concerns promptly and transparently, and we will cooperate fully with any supervisory authority investigation.