At bmtoto, protecting your personal information is a top priority. This Privacy Policy explains how we collect, use, store, and safeguard your data across every interaction with our platform.
This Privacy Policy ("Policy") describes how bmtoto ("we", "us", "the Platform") collects, processes, stores, and protects personal data from individuals ("Members", "you") who access or use the bmtoto platform at bmtoto.cam. By registering an account or using our services, you consent to the data practices described in this Policy.
1.1 Our Commitment to Privacy. bmtoto is committed to protecting the privacy, confidentiality, and security of all personal information entrusted to us by our Members. We recognize that online gaming platforms handle sensitive personal and financial data, and we take our responsibility to safeguard this information seriously.
1.2 Scope. This Policy applies to all personal data collected through bmtoto.cam, including but not limited to data submitted during account registration, data generated through gameplay and betting activity, payment and withdrawal information, customer support interactions, and technical data collected automatically through cookies and server logs.
1.3 Legal Framework. bmtoto operates in compliance with internationally recognized data protection principles, including principles derived from the General Data Protection Regulation (GDPR) framework and other applicable privacy laws. Where local Indonesian privacy regulations apply, we take those requirements into account as well.
2.1 Controller Identity. bmtoto acts as the data controller for all personal data processed through the Platform. As the controller, we determine the purposes and means of processing your personal information.
2.2 Contact Information. For all privacy-related inquiries, data access requests, or concerns about how your data is handled, please contact our Data Protection Officer at [email protected] with the subject line "Privacy Inquiry".
bmtoto collects several categories of personal data to provide, secure, and improve our services:
When you register an account, we collect:
To comply with Know Your Customer (KYC) and anti-money-laundering regulations, we collect:
Automatically collected when you access bmtoto:
| Data Category | Examples | Collection Method |
|---|---|---|
| Registration Data | Name, email, phone, date of birth | Provided directly by you during signup |
| KYC Documents | KTP scan, bank statement, selfie photo | Uploaded by you via secure file portal |
| Financial Data | BCA account number, OVO phone number | Entered in deposit/withdrawal forms |
| Gameplay Data | Bet history, game sessions, RTP outcomes | Automatically logged by platform systems |
| Technical Data | IP address, browser type, device OS | Collected via server logs and cookies |
| Communication Records | Live chat logs, support emails | Recorded during support interactions |
bmtoto processes your personal data for the following legitimate purposes:
4.1 Account Management & Service Delivery. We use your registration data to create and maintain your account, authenticate your identity when you log in, process deposits and withdrawals, display your balance and transaction history, and enable you to place wagers and play games.
4.2 Legal & Regulatory Compliance. KYC and identity verification data is used to confirm that you meet the 21+ age requirement, verify that payment methods are registered in your own name, comply with anti-money-laundering (AML) obligations, prevent fraud and identity theft, and respond to lawful requests from Indonesian or international regulatory authorities.
4.3 Payment Processing. Financial data is used to route deposits to your bmtoto balance, process withdrawal requests to your registered bank account or e-wallet, reconcile transaction records with payment providers (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, BSI, OVO, DANA, GoPay, ShopeePay, LinkAja), and detect suspicious patterns such as structuring or rapid deposit-withdrawal cycles.
4.4 Responsible Gaming & Risk Management. Gameplay data is monitored to identify Members who may be experiencing gambling-related harm, enforce deposit limits and self-exclusion requests, detect patterns consistent with problem gambling behavior, and provide targeted responsible gaming messages and resources.
4.5 Fraud Prevention & Security. Technical data (IP address, device fingerprint) is analyzed to detect multiple accounts held by the same individual, identify automated betting scripts ("bots") or other prohibited tools, flag geographic access from restricted jurisdictions, and prevent unauthorized account access.
4.6 Customer Support. Communication records allow us to respond to your inquiries efficiently, investigate and resolve account disputes, provide technical assistance with deposits, withdrawals, or gameplay issues, and maintain a history of previous interactions for continuity.
4.7 Marketing & Promotions (With Consent). If you have opted in to marketing communications, we use your email address and phone number to send promotional offers, bonus announcements, exclusive VIP rewards, seasonal campaigns (e.g., Indonesian Independence Day, Chinese New Year, Idul Fitri promotions), and personalized recommendations based on your gameplay preferences.
4.8 Platform Improvement & Analytics. Aggregated and anonymized data is used to analyze which games and sports markets are most popular among Indonesian players, optimize the user interface and mobile experience, identify technical performance issues (slow loading, bet placement errors), and develop new features requested by the Member community.
Consent Reminder: Where Indonesian law or international best practices require explicit consent for certain types of processing (such as marketing), we will obtain your opt-in consent during registration or via your Account Settings page. You may withdraw consent at any time without affecting your ability to use core Platform services.
bmtoto does not sell, rent, or trade your personal data to third parties. We share data only in the following limited circumstances:
5.1 Payment Processors. Your bank account number or e-wallet identifier is shared with our payment gateway partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, BSI, OVO, DANA, GoPay, ShopeePay, LinkAja) solely to process deposit and withdrawal transactions. These processors operate under strict confidentiality agreements.
5.2 Game Studio Partners. When you play games from Pragmatic Play, Evolution Gaming, NetErt, Microgaming, Spribe, or other integrated studios, session data (username, bet amounts, game outcomes) is shared with those studios to deliver the game experience. Studios do not receive your full name, identity documents, or payment details.
5.3 KYC Verification Providers. Identity documents submitted for KYC verification may be processed by specialized third-party verification services that use optical character recognition (OCR) and biometric matching technology. These providers are bound by data processing agreements and are prohibited from retaining your documents after verification is complete.
5.4 Legal Obligations & Law Enforcement. We may disclose personal data if required to do so by Indonesian law, court order, subpoena, or other legal process; to cooperate with law enforcement investigations into fraud, money laundering, or illegal gambling activity; to protect the rights, property, or safety of bmtoto, our Members, or the public; or to enforce our Terms & Conditions.
5.5 Business Transfers. In the event of a merger, acquisition, or sale of all or part of bmtoto's assets, your personal data may be transferred to the acquiring entity, subject to the same privacy protections outlined in this Policy.
5.6 Aggregated Data. We may share aggregated, anonymized, non-personally-identifiable statistics with business partners, advertisers, or industry analysts (e.g., "70% of our Indonesian Members prefer live casino over slots"). This data cannot be used to identify individual Members.
6.1 Encryption. All data transmitted between your device and bmtoto's servers is protected by 256-bit SSL/TLS encryption, the same standard used by global financial institutions. This ensures that your login credentials, payment details, and personal information cannot be intercepted by unauthorized third parties.
6.2 Secure Storage. Personal data is stored on secure servers located in jurisdictions with strong data protection frameworks. Access to production databases is restricted to authorized technical personnel who require access to perform their duties. All access is logged and audited.
6.3 Password Protection. Member passwords are hashed using industry-standard one-way cryptographic algorithms (bcrypt). bmtoto staff cannot view or retrieve your plain-text password. You are responsible for choosing a strong password and keeping it confidential.
6.4 Access Controls. Internal access to personal data is governed by role-based permissions. Customer support agents can view account balances and transaction history but cannot access raw identity documents or payment credentials. Only senior compliance officers have access to KYC document archives.
6.5 Regular Security Audits. bmtoto conducts quarterly security assessments, including penetration testing, vulnerability scanning, and code review, to identify and remediate potential security weaknesses before they can be exploited.
6.6 Data Breach Protocol. In the unlikely event of a data breach that compromises Member personal information, we will notify affected Members by email within 72 hours of discovering the breach, as required by international best practices. The notification will describe what data was affected, what steps we are taking to mitigate the breach, and what actions you should take (e.g., changing your password).
Your Security Responsibilities: Use a unique, strong password for your bmtoto account. Enable two-factor authentication (2FA) if available. Never share your login credentials with anyone. Log out when using a shared or public computer. Report suspicious activity to [email protected] immediately.
7.1 Active Account Data. Personal data associated with an active account is retained for as long as your account remains open and in good standing. This includes all registration data, KYC documents, financial records, and gameplay history.
7.2 Closed Accounts. When you close your account voluntarily, we retain your personal data for an additional 7 years after closure to comply with Indonesian financial record-keeping requirements, fulfill any outstanding legal obligations (e.g., tax reporting, dispute resolution), and prevent you from re-registering to abuse welcome bonuses.
7.3 Transaction Records. Deposit, withdrawal, and wager history is retained for 7 years from the date of the transaction, as required by anti-money-laundering and tax regulations in Indonesia and internationally.
7.4 Communication Records. Live chat transcripts and email correspondence are retained for 3 years to support ongoing customer service quality assurance and to provide evidence in the event of a dispute.
7.5 Marketing Data. If you opt out of marketing communications, your email address and phone number are retained in a suppression list to ensure we do not inadvertently send you promotional messages in the future. This suppression list is retained indefinitely.
7.6 Technical Logs. Server logs containing IP addresses, timestamps, and user-agent strings are retained for 90 days for security monitoring and troubleshooting, then automatically purged.
bmtoto respects your rights to control your personal data. Under international data protection principles, you have the following rights:
8.1 Right of Access. You may request a copy of all personal data we hold about you. We will provide this in a structured, commonly used, machine-readable format (CSV or PDF) within 30 days of your request.
8.2 Right to Rectification. If any personal data we hold is inaccurate or incomplete, you may request that we correct it. You can update most account information (email, phone number, bank details) directly via the Account Settings page. For changes to your registered name or date of birth, contact support with supporting documentation.
8.3 Right to Erasure ("Right to Be Forgotten"). You may request deletion of your personal data. However, this right is subject to legal exceptions — we must retain data necessary to comply with legal obligations (7-year financial record retention), defend against legal claims, or fulfill contractual obligations. If we cannot delete all data, we will explain which categories must be retained and why.
8.4 Right to Restrict Processing. You may request that we temporarily stop processing your personal data (other than storage) while we investigate a dispute about accuracy or lawfulness of processing.
8.5 Right to Data Portability. You may request a machine-readable export of personal data you provided to bmtoto (registration info, transaction history) to transfer to another service provider.
8.6 Right to Object. You may object to processing of your data for direct marketing purposes at any time by clicking "Unsubscribe" in any promotional email or adjusting your marketing preferences in Account Settings. You may also object to processing based on legitimate interests by contacting us with reasons specific to your situation.
8.7 Right to Withdraw Consent. Where processing is based on your consent (e.g., marketing emails), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted before withdrawal.
8.8 How to Exercise Your Rights. To exercise any of the above rights, send an email to [email protected] with the subject line "Privacy Rights Request". Include your full name, username, registered email address, and a description of the specific right you wish to exercise. We will respond within 30 days.
9.1 What Are Cookies? Cookies are small text files stored on your device by your web browser when you visit bmtoto.cam. They help us remember your preferences, keep you logged in, and understand how you use the Platform.
9.2 Types of Cookies We Use:
9.3 Managing Cookies. You can configure your browser to reject cookies, but this may prevent you from logging in or using certain features. Most browsers allow you to delete cookies manually via Settings > Privacy.
9.4 Third-Party Tracking. bmtoto does not allow third-party advertising networks to place cookies on our Platform. Game studio partners (Pragmatic Play, Evolution Gaming) may use session cookies to deliver game content, but these do not track you across other websites.
10.1 Age Restriction. bmtoto is strictly for adults aged 21 years or older. We do not knowingly collect or solicit personal data from anyone under the age of 21.
10.2 Parental Notice. If you are a parent or guardian and believe your child has provided personal information to bmtoto, contact us immediately at [email protected] with the subject line "Minor Account — Urgent". We will investigate and, if confirmed, permanently close the account and delete all associated data.
10.3 Age Verification. All new accounts undergo KYC verification before the first withdrawal. This includes date-of-birth checks against government-issued identity documents. Accounts failing to meet the 21+ requirement are closed immediately, and all funds are returned after deducting any fraudulently obtained bonuses.
11.1 Right to Amend. bmtoto reserves the right to update this Privacy Policy from time to time to reflect changes in our data practices, new legal requirements, or Platform feature enhancements.
11.2 Notification. Material changes will be communicated to you by email and by a prominent notice on the Platform homepage at least 14 days before the revised Policy takes effect. The "Last Updated" date at the top of this Policy will always reflect the most recent revision.
11.3 Continued Use. Your continued use of bmtoto after the effective date of a revised Policy constitutes acceptance of the changes. If you do not agree to the revised terms, you must close your account before the effective date.
For privacy-related questions, data access requests, or concerns about how your personal information is handled, please contact bmtoto's Data Protection Officer:
Email: [email protected]
Subject Line: "Privacy Inquiry" or "Data Rights Request"
Expected Response Time: Within 30 days (WIB)
Last Updated: January 1, 2026 | Document Version 2.1 | Effective for all Members from January 1, 2026
The foundational principles that guide every data decision we make at bmtoto.
All data transmitted between your device and our servers is protected by bank-grade encryption technology.
We never sell, rent, or trade your personal information to third parties. Your data stays with bmtoto.
Every data collection point is explained. You always know what we collect, why we need it, and how it's used.
Personal data stored on hardened servers in jurisdictions with strong data protection frameworks. Access is strictly controlled.
Access, rectify, port, or delete your data. We respond to all rights requests within 30 days.
In the unlikely event of a data breach, affected Members are notified within 72 hours with full details.
Our Data Protection Officer is available to answer any questions about how we handle your personal information. You can also explore our FAQ or review our full Terms & Conditions.