Data Protection & Privacy
At h2toto, your privacy is a fundamental commitment, not an afterthought. This Privacy Policy explains precisely what personal data we collect, why we collect it, how we use and protect it, and what rights you hold as a player on our platform.
Privacy at a Glance
These six principles define how h2toto approaches your personal data. The full binding policy is in the clauses below — please read the complete document.
h2toto collects only the personal data strictly necessary to provide our Services, verify your identity, and process payments. We do not collect data speculatively or beyond what is required for a stated purpose.
h2toto will never sell, rent, or trade your personal data to third parties for marketing or commercial purposes. Your data belongs to you and is used solely to operate and improve your experience on our platform.
All data transmitted between your device and h2toto's servers is protected by 256-bit SSL/TLS encryption. Stored data is secured in access-controlled environments with regular independent security audits.
You have the right to access, correct, port, or request deletion of your personal data at any time. Submit a data request via email to our Privacy Team and we will respond within 14 business days.
h2toto retains your personal data only for as long as necessary to fulfill the purposes outlined in this Policy, or as required by applicable law. Account data is retained for a minimum of five years following account closure for regulatory compliance.
In the unlikely event of a personal data breach that poses a risk to your rights and freedoms, h2toto will notify affected players promptly and take immediate remedial action in accordance with our incident response procedures.
This Privacy Policy ("Policy") describes how h2toto ("Company", "Platform", "we", "us", "our"), operating the website at https://h2toto.cam, collects, processes, stores, shares, and protects the personal data of registered players and visitors ("you", "your") in connection with our online betting and gaming services. This Policy is incorporated by reference into h2toto's Terms & Conditions and should be read alongside them. By using h2toto's Services, you acknowledge that you have read and understood this Policy.
In this Policy, the following terms carry the meanings assigned below:
This Policy applies to all Personal Data collected by h2toto in connection with the use of its Platform and Services by individuals located in Indonesia or accessing h2toto from Indonesia. It covers data collected through:
This Policy does not apply to third-party websites or services that may be linked to from h2toto's Platform, including game studio portals or payment provider interfaces. h2toto is not responsible for the privacy practices of those third parties.
h2toto collects the following categories of Personal Data, depending on your level of engagement with the Platform:
Special Category Data: h2toto does not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data. If you disclose such information voluntarily in a support communication, it will be handled with the highest level of confidentiality and will not be used for any purpose beyond resolving your query.
h2toto relies on the following legal bases to process your Personal Data:
| Processing Activity | Legal Basis |
|---|---|
| Account registration and management | Performance of a contract (providing the Services you requested) |
| Identity verification (KYC) | Legal obligation (anti-money laundering and fraud prevention compliance) |
| Payment processing | Performance of a contract (executing your deposit and withdrawal instructions) |
| Fraud detection and security monitoring | Legitimate interests (protecting h2toto and its players from fraud and abuse) |
| Responsible gaming monitoring | Legal obligation and legitimate interests (player protection) |
| Marketing communications | Consent (only where you have explicitly opted in to receive promotional messages) |
| Analytics and platform improvement | Legitimate interests (improving service quality and user experience) |
| Record-keeping for regulatory purposes | Legal obligation (retention requirements under applicable law) |
Withdrawing Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time by contacting our Privacy Team. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal, and does not affect processing carried out on other legal bases.
h2toto uses your Personal Data for the following purposes, each of which is grounded in one of the legal bases identified in Clause 4:
To create and maintain your Account, authenticate your identity at login, process deposits and withdrawals through your chosen Indonesian bank or e-wallet, record your betting and gaming activity, and deliver customer support. These activities are essential to providing the Services and cannot be opted out of while your Account remains active.
To conduct KYC checks prior to processing withdrawals, to verify that you meet h2toto's eligibility criteria (including the 21+ age requirement and Indonesian residency), and to detect, investigate, and prevent fraudulent activity, money laundering, bonus abuse, and other prohibited conduct as defined in the Terms & Conditions.
To monitor player activity for indicators of problem gambling — including unusual betting patterns, sudden increases in deposit frequency, or self-exclusion requests — and to provide proactive support, deposit limit nudges, and time-out tools in accordance with our Responsible Gaming commitments.
To monitor for unauthorized access attempts, detect bot activity, prevent account takeover attacks, and maintain the overall security and integrity of the Platform. Technical and usage data, including IP addresses and device identifiers, are used for this purpose.
To send you transactional communications relating to your Account — including deposit confirmations, withdrawal notifications, KYC status updates, and security alerts. These communications are not optional as they are integral to the operation of your Account. Where you have explicitly opted in, we may also send promotional communications about bonuses and offers; you may withdraw this consent at any time through your Account settings.
To comply with applicable legal and regulatory obligations, including record-keeping requirements, responses to lawful information requests from competent authorities, and anti-money laundering reporting obligations. h2toto will disclose Personal Data to law enforcement or regulatory bodies when required to do so by law, court order, or regulatory instruction.
To analyze aggregated and anonymized usage data to improve the functionality, performance, and user experience of the Platform. Insights derived from analytics are used internally and are not shared in identifiable form with third parties.
h2toto does not sell, rent, or trade your Personal Data. We share data with third parties only in the following limited circumstances:
h2toto engages carefully selected third-party service providers who process Personal Data strictly on our behalf and under written data processing agreements that prohibit them from using your data for their own purposes. Categories of processors include:
h2toto may disclose Personal Data to governmental authorities, law enforcement agencies, financial intelligence units, or regulators when required to do so by applicable law, valid legal process, or regulatory instruction. Where permitted, h2toto will notify the affected player of such a disclosure request.
In the event of a merger, acquisition, or sale of all or substantially all of h2toto's assets, Personal Data held by the Company may be transferred to the acquiring entity. Players will be notified of any such transfer and of any material changes to this Policy that result from it, with reasonable advance notice.
No Cross-Selling: h2toto strictly prohibits its service providers from using your Personal Data for their own marketing, profiling, or commercial purposes. All data processing agreements include explicit restrictions to this effect.
h2toto uses cookies and similar tracking technologies to operate the Platform, remember your preferences, and analyze usage patterns. The following categories of cookies are used:
| Cookie Type | Purpose | Retention |
|---|---|---|
| Strictly Necessary | Essential for login session management, security tokens, and basic Platform functionality. Cannot be disabled. | Session / up to 24 hours |
| Functional | Remembers your language preference, display settings, and last visited pages to improve your experience. | Up to 30 days |
| Analytics | Collects anonymized data about how visitors navigate the Platform to help us identify performance improvements. | Up to 13 months |
| Security | Detects fraudulent login attempts, bot activity, and suspicious behavioral patterns. | Up to 90 days |
You may manage your cookie preferences through your browser settings. Please note that disabling functional or analytics cookies may affect the performance of certain Platform features. Strictly necessary and security cookies cannot be disabled without impairing the Platform's core functionality.
h2toto implements a layered approach to data security, combining technical, organizational, and procedural controls to protect your Personal Data against unauthorized access, alteration, disclosure, or destruction.
Your Role in Security: While h2toto maintains robust technical safeguards, account security is a shared responsibility. Please use a strong, unique password for your h2toto Account, enable two-factor authentication, and never share your login credentials with anyone. h2toto support staff will never ask for your password.
h2toto retains Personal Data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law and regulatory obligations. The following general retention periods apply:
| Data Category | Retention Period |
|---|---|
| Account and registration data | Duration of Account plus 5 years following closure |
| KYC and identity verification documents | Duration of Account plus 5 years following closure |
| Transaction and financial records | Minimum 5 years following the transaction date |
| Betting and gaming activity records | Duration of Account plus 3 years following closure |
| Customer support communications | 3 years from the date of the communication |
| Technical and usage logs | Up to 13 months on a rolling basis |
| Marketing consent records | Until consent is withdrawn, plus 2 years thereafter |
Following the expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymized in accordance with h2toto's data lifecycle management procedures. Anonymized data that can no longer identify any individual may be retained indefinitely for statistical and analytical purposes.
As a player on h2toto, you hold the following rights with respect to your Personal Data. To exercise any of these rights, please contact our Privacy Team at the address provided in Clause 14. We will respond to all verified requests within 14 business days.
Request a copy of the Personal Data h2toto holds about you.
Request correction of inaccurate or incomplete Personal Data.
Request deletion of your Personal Data where no legal basis for retention exists.
Request that processing of your data be restricted in certain circumstances.
Receive your Personal Data in a structured, machine-readable format.
Object to processing based on legitimate interests, including profiling.
Please note that certain rights are subject to limitations where h2toto has a legal obligation to retain data (for example, KYC and transaction records required by anti-money laundering regulations). In such cases, we will clearly explain the applicable limitation in our response to your request.
h2toto's Services are strictly available to individuals aged 21 years and above. The Platform does not knowingly collect Personal Data from individuals under the age of 21. Age verification is conducted as part of the account registration process and reinforced through the KYC verification procedure.
If h2toto becomes aware that a player is under 21 years of age, the Account will be immediately suspended, all bets voided, deposited funds returned, and all Personal Data associated with that Account deleted as soon as the mandatory regulatory retention period permits. Parents and guardians are encouraged to use parental control software to restrict access to gambling-related websites by minors.
h2toto primarily stores and processes player data on servers located in data centers serving the Asia-Pacific region. In certain circumstances — for example, where a third-party service provider operates from a different jurisdiction — your Personal Data may be transferred to and processed in countries outside Indonesia.
When such transfers occur, h2toto ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that applied within Indonesia. Safeguards include contractual data protection clauses in agreements with all third-party processors, and the selection of processors who maintain internationally recognized security certifications (such as ISO/IEC 27001).
By using h2toto's Services, you acknowledge and consent to the transfer of your Personal Data as described in this clause, for the purposes set out in this Policy.
h2toto reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the Services we offer. When material changes are made, we will publish the revised Policy on this page with an updated "Last Updated" date and, where appropriate, notify registered players via email or in-platform notification.
Your continued use of h2toto's Platform following the publication of a revised Policy constitutes your acceptance of those changes. We encourage you to review this Policy periodically. If you disagree with any material change, you may request Account closure as described in our Terms & Conditions.
If you have any questions, concerns, or requests relating to this Privacy Policy or to the processing of your Personal Data by h2toto, please contact our Privacy Team through the following channels:
h2toto has designated a Data Protection Officer (DPO) who is responsible for overseeing compliance with this Policy and applicable data protection obligations. The DPO can be reached via the email address above, marked for the attention of the Data Protection Officer.
Complaint Rights: If you are not satisfied with h2toto's response to a privacy concern or believe that your data has been processed in a manner inconsistent with this Policy, you have the right to escalate your complaint to the relevant data protection supervisory authority in your jurisdiction. h2toto welcomes direct engagement before any formal complaint is lodged and will make every effort to resolve concerns promptly and fairly.
Our Privacy Team is available around the clock to address data requests, consent withdrawals, or any concern about how h2toto handles your personal information.
Adults only (21+) · Play responsibly · h2toto is an internationally licensed platform