Privacy Policy

too388 is operated as an international online gaming and sportsbook platform, serving English-preference players across Indonesia — including major cities such as Jakarta, Surabaya, Medan, Bandung, Bali, Yogyakarta, Semarang, and Makassar. We are committed to handling your personal data transparently, responsibly, and in strict accordance with internationally recognized data protection principles.

This Privacy Policy governs the collection, use, disclosure, storage, and protection of personal information provided by or collected about Members and visitors of the too388 platform. It applies in full to all interactions with the Platform, whether accessed via desktop browser, mobile browser, or any future application clients released by too388.

When we refer to "personal data" in this Policy, we mean any information that identifies you or that could reasonably be used, alone or in combination with other data, to identify you as a natural person — including your name, identity document number, email address, phone number, payment account details, IP address, and device identifiers.

References to "we", "us", "our", or "too388" in this Policy refer to the too388 platform and its operating entity. References to "you", "your", or "Member" refer to any registered account holder or visitor to the Platform.

too388 collects personal data through several channels: information you voluntarily provide during registration or verification; information automatically generated through your use of the Platform; and, in limited circumstances, information received from third-party payment processors and identity verification services. The categories of personal data we collect are as follows:

too388 does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or biometric data for identification purposes, except where a government-issued identity document submitted for KYC incidentally contains such information.

too388 uses the personal data we hold about you for specific, documented purposes. We do not use your data for any purpose incompatible with those stated below without first obtaining your explicit consent. Our primary uses are:

1. Account Management: To register your account, verify your identity and age (21+ requirement), manage your Wallet, process deposits and withdrawals in IDR, and maintain accurate account records.
2. Service Delivery: To provide access to the full range of too388 services — including casino games (slots, live dealer tables, roulette, bingo), sportsbook markets (BRI Liga 1, EPL, La Liga, Champions League, MotoGP Mandalika, e-sports), and any future product additions.
3. KYC & Fraud Prevention: To verify your identity documents in compliance with internationally recognized Anti-Money Laundering (AML) standards, detect suspicious transaction patterns, and prevent account fraud, bonus abuse, and money laundering.
4. Customer Support: To respond to your enquiries, resolve disputes, process complaints, and communicate important account notifications — including security alerts and withdrawal confirmations.
5. Responsible Gaming: To monitor your gaming patterns and identify indicators of problem gambling in order to trigger proactive outreach, apply account-level limits where required, and facilitate self-exclusion requests. This use of data is a core component of too388's duty of care to Members.
6. Platform Improvement: To analyze aggregated usage data, identify technical issues, improve game performance, and optimize the user experience across devices, including mobile-optimized views popular with Indonesian users.
7. Promotions & Marketing: To send you personalized promotional offers, bonus notifications, and seasonal campaign updates (e.g., Idul Fitri promotions, Imlek cashback events, 17 August independence celebrations) via email or in-platform notifications — but only where you have not opted out of marketing communications. You may withdraw consent at any time via account settings or by contacting support.
8. Legal Compliance: To comply with applicable legal obligations, respond to lawful requests from competent authorities, and enforce our Terms & Conditions.

too388 processes personal data on the following legal bases, depending on the specific purpose of each processing activity:

• Contractual Necessity: Processing that is necessary to perform the contract with you as a Member — including account creation, deposits, withdrawals, and game access. Without this processing, we cannot provide the Platform's services.
• Legal Obligation: Processing required to comply with AML regulations, KYC mandates, and other applicable legal obligations imposed by our international licensing jurisdiction.
• Legitimate Interests: Processing carried out for too388's legitimate business interests — such as fraud prevention, platform security, responsible gaming monitoring, and aggregate analytics — where those interests do not override your fundamental rights and freedoms.
• Consent: Processing based on your freely given, specific, informed consent — primarily for marketing communications and optional personalization features. You retain the right to withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

too388 does not sell, rent, or trade your personal data to any third party. We share your data only in the limited circumstances described below, and only with parties who are contractually required to protect it to a standard no less rigorous than our own:

• Payment Processors: Local Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the minimum financial data necessary to process your deposit or withdrawal transaction.
• Identity Verification Services: Third-party KYC providers may receive copies of your identity documents and verification data solely for the purpose of confirming your identity and age for AML compliance.
• Game Software Providers: Providers such as Evolution Gaming, Pragmatic Play, Pragmatic Play Live, PG Soft, Microgaming, and Habanero receive anonymized session data necessary to deliver game content. They do not receive your full identity or financial data.
• IT Infrastructure & Security Providers: Cloud hosting, CDN, and cybersecurity vendors may process technical data (IP addresses, session tokens) in the course of maintaining platform availability and security. All such providers operate under strict data processing agreements.
• Legal & Regulatory Authorities: too388 may disclose personal data to law enforcement agencies, regulatory bodies, or courts of competent jurisdiction where required to do so by law, court order, or where disclosure is necessary to protect the rights and safety of too388 or its Members.
• Corporate Transactions: In the event of a merger, acquisition, or sale of assets, Member data may be transferred to the successor entity, which will be bound by this Privacy Policy or a policy providing equivalent protections. Members will be notified of any such transfer in advance.

too388 uses cookies and similar tracking technologies (such as local storage tokens and session identifiers) to operate the Platform effectively. Cookies are small text files placed on your device by your browser when you visit the Platform. We use the following categories of cookies:

• Strictly Necessary Cookies: Essential to the operation of the Platform — including maintaining your login session, enabling wallet transactions, and preserving your security token. These cookies cannot be disabled without rendering the Platform non-functional.
• Performance & Analytics Cookies: Used to collect anonymized, aggregate data about how Members navigate the Platform — which pages are visited most frequently, where errors occur, and how load times vary across device types. This data is used solely to improve the Platform experience and is never used to identify individual Members.
• Preference Cookies: Store your Platform preferences such as display language, notification settings, and odds format selection so that you do not need to reconfigure them on each visit.

too388 does not deploy third-party advertising cookies, social media tracking pixels, or cross-site behavioral profiling technologies. You may manage or delete cookies at any time via your browser settings. Please note that disabling strictly necessary cookies will prevent you from logging in or accessing Platform services.

too388 implements a comprehensive set of technical and organizational security measures designed to protect your personal data against unauthorized access, accidental loss, alteration, disclosure, or destruction. Our security framework includes:

• 256-bit SSL/TLS Encryption: All data transmitted between your browser and the too388 server is encrypted in transit using industry-standard TLS protocols. Our SSL certificate is maintained and renewed without lapse.
• Password Hashing: Member passwords are stored using a strong cryptographic hashing algorithm with per-account salting. Raw passwords are never stored or accessible to too388 staff.
• Two-Factor Authentication (2FA): Members are strongly encouraged to enable 2FA on their accounts. too388 offers authenticator-app-based 2FA as an additional access control layer, significantly reducing the risk of unauthorized login even in the event of credential compromise.
• Access Controls: Access to Member personal data within too388's internal systems is restricted on a strict need-to-know basis. Staff with data access are subject to confidentiality obligations and periodic security training.
• Intrusion Detection: Automated systems monitor platform infrastructure for anomalous access patterns, brute-force login attempts, and other indicators of compromise on a continuous basis.
• Regular Security Audits: too388 commissions periodic independent security assessments and penetration tests to identify and remediate vulnerabilities before they can be exploited.

too388 retains personal data only for as long as necessary to fulfill the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention schedule applies:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized so that it can no longer be associated with any individual Member. Anonymized aggregate data (e.g., platform-wide betting statistics with no individual identifiers) may be retained indefinitely for research and analytics purposes.

As a Member of too388, you hold the following data subject rights with respect to your personal data. You may exercise any of these rights at any time by contacting our support team at [email protected]. We will respond to all verifiable requests within 30 days of receipt.

Please note that certain rights are subject to limitations. For example, too388 may be unable to fulfill an erasure request where retention of the relevant data is required by law (e.g., KYC documents held for AML compliance). In such cases, we will inform you of the specific legal basis preventing full compliance with your request.

too388 will never charge a fee for responding to a legitimate data subject request. However, where requests are manifestly unfounded or excessive — particularly if repetitive — we reserve the right to charge a reasonable administrative fee or to decline to act on the request, with written reasons provided.

The too388 platform is strictly for individuals aged 21 years or older. We do not knowingly collect, process, or retain personal data from any person under the age of 21. Age verification is a mandatory step in the KYC process, and too388 employs automated and manual checks to identify and prevent underage registration.

If too388 becomes aware that personal data has been collected from an individual under the age of 21 — whether through the registration process, KYC review, or any other means — we will immediately suspend the account, delete all associated personal data to the extent permitted by law, and, where appropriate, report the incident to relevant authorities. Any funds held in such accounts will be returned to the payment method used for the original deposit.

If you are a parent or guardian and believe that your child has registered an account or submitted personal data to too388, please contact us immediately at [email protected] so that we can investigate and take appropriate action.

too388 operates as an international platform. As a result, your personal data may be transferred to, stored in, or processed by systems located in countries other than Indonesia. Where such international transfers occur, too388 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to this Privacy Policy, including:

• Contractual data protection clauses that impose obligations on the recipient equivalent to those applicable under this Policy.
• Transfers to vendors and service providers who have demonstrated compliance with internationally recognized data security standards (such as ISO 27001).
• Transfers necessary for the performance of your account contract — for example, where game content is delivered via servers operated by licensed software providers such as Evolution Gaming or Pragmatic Play in their respective jurisdictions.

By registering an account with too388, you acknowledge and consent to the international transfer of your personal data for the purposes described in this Policy.

too388 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or business operations. When material changes are made, we will provide advance notice to Members via the email address registered on your account and/or via a prominent notice on the Platform, no less than 14 days before the changes take effect.

The version number and "Last Updated" date displayed at the top of this document always indicate the most current version of the Policy. Your continued use of the Platform after the effective date of any amendment constitutes your acceptance of the revised Policy. If you do not agree to the updated terms, you must cease using the Platform and contact support to arrange account closure.

We encourage you to review this Privacy Policy periodically to stay informed about how too388 protects your personal data.

If you have any questions about this Privacy Policy, wish to exercise any of your data subject rights, or wish to raise a concern about how too388 handles your personal data, please contact our support team through the following channel:

When submitting a data subject request, please include your registered username or email address and a clear description of the right you wish to exercise. too388 may need to verify your identity before processing the request in order to prevent unauthorized access to another Member's data.