Privacy Policy

1. Introduction

This Privacy Policy governs the collection, processing, storage, and protection of personal information provided by users of the hutoto platform accessible at hutoto.cam (the "Platform"). By creating an account, depositing funds, placing bets, or otherwise using hutoto's services, you acknowledge that you have read, understood, and consented to the data practices described in this Privacy Policy.

hutoto recognizes the importance of privacy in the digital age, particularly when handling sensitive financial and gaming data. We have implemented robust technical and organizational measures to ensure that your personal information remains confidential, secure, and is used only for legitimate business purposes consistent with your expectations and applicable laws.

This Privacy Policy should be read in conjunction with our Terms & Conditions and Responsible Gaming Policy, which together form the complete legal framework governing your use of the hutoto platform.

2. Data Controller and Legal Basis

hutoto operates as the data controller responsible for the personal information collected through the Platform. As data controller, we determine the purposes and means of processing your personal data and bear responsibility for compliance with applicable data protection regulations.

We process your personal information on the following legal bases:

• Contractual Necessity: Processing is necessary to perform our obligations under the contract formed when you accept our Terms & Conditions, including account creation, payment processing, bet settlement, and customer support.
• Legal Compliance: Processing is required to comply with legal obligations such as anti-money laundering (AML) regulations, Know Your Customer (KYC) verification, age verification to prevent underage gambling, tax reporting, and cooperation with law enforcement when legally required.
• Legitimate Interests: Processing is necessary for our legitimate business interests, including fraud prevention, platform security, customer relationship management, service improvement, and marketing communications (subject to your consent where required).
• Consent: Where required by law, we obtain your explicit consent for specific processing activities such as marketing communications, cookies, and optional data collection.

3. Information We Collect

hutoto collects various categories of personal information necessary to provide our betting and gaming services, ensure platform security, and comply with regulatory obligations. The types of information we collect include:

3.1 Account Registration Information

When you create a hutoto account, we collect:

• Full legal name as it appears on your government-issued identification
• Date of birth (to verify you are 21 years of age or older)
• Gender (optional, for demographic analysis)
• Residential address (street address, city, province, postal code)
• Email address (for account communications and password recovery)
• Mobile phone number (for two-factor authentication and account security)
• Username and encrypted password (passwords are hashed and never stored in plaintext)
• Preferred currency (Indonesian Rupiah)

3.2 Identity Verification (KYC) Documents

To comply with anti-money laundering regulations and prevent fraud, we collect:

• Government-issued photo identification (Indonesian KTP, passport, or driver's license)
• Proof of address documents (utility bills, bank statements, or government correspondence dated within the last 3 months)
• Selfie photographs holding identification for facial verification
• Payment method verification documents (bank account statements or e-wallet screenshots showing account holder name)

3.3 Financial Information

• Bank account details (bank name, account number, account holder name) for deposits and withdrawals
• E-wallet account information (OVO, DANA, GoPay, ShopeePay account IDs)
• Transaction history (deposits, withdrawals, bonus claims, and payment statuses)
• Betting and gaming activity (stakes, winnings, losses, game selections, bet types, and timestamps)

Note: hutoto does not store full credit card numbers, CVV codes, or online banking passwords. Payment processing is handled by PCI-DSS compliant third-party processors who maintain their own secure systems.

3.4 Technical and Usage Data

We automatically collect technical information when you access the Platform:

• IP address and geolocation data (to verify residency in Indonesia and detect suspicious access patterns)
• Device information (device type, operating system, browser type and version, screen resolution)
• Session data (login timestamps, session duration, pages visited, features used)
• Gameplay data (games played, bet patterns, win/loss ratios, favorite game types)
• Cookies and similar tracking technologies (see Section 9 for details)

3.5 Communications and Support

• Customer support inquiries and chat transcripts
• Email correspondence with hutoto
• Survey responses and feedback submissions
• Marketing communication preferences and opt-out requests

4. How We Use Your Personal Data

hutoto uses your personal information for the following purposes:

4.1 Account Management and Service Delivery

• Creating and maintaining your user account
• Processing deposits and withdrawals via BCA, BRI, BNI, Mandiri, and e-wallets
• Settling bets and crediting winnings to your account balance
• Awarding bonuses, promotions, and loyalty rewards
• Providing customer support in English and Indonesian languages
• Sending transactional notifications (deposit confirmations, withdrawal approvals, bet settlements)

4.2 Security and Fraud Prevention

• Verifying your identity through KYC procedures to prevent underage gambling and identity theft
• Monitoring account activity for suspicious patterns indicating fraud, collusion, or bonus abuse
• Detecting and preventing money laundering and terrorist financing
• Enforcing our Terms & Conditions and investigating violations
• Protecting the integrity of our games and betting markets

4.3 Legal and Regulatory Compliance

• Complying with Know Your Customer (KYC) and Anti-Money Laundering (AML) regulations
• Maintaining records for audit and regulatory reporting purposes
• Responding to lawful requests from law enforcement, tax authorities, and regulatory bodies
• Fulfilling tax reporting obligations where applicable

4.4 Platform Improvement and Analytics

• Analyzing user behavior to improve platform functionality and user experience
• Testing new features, games, and betting markets
• Conducting market research to better understand Indonesian player preferences
• Generating aggregated, anonymized statistics for business intelligence purposes

4.5 Marketing Communications (With Your Consent)

• Sending promotional emails about new games, bonuses, and special offers
• Displaying personalized content and recommendations based on your gaming preferences
• Notifying you of tournaments, competitions, and seasonal promotions aligned with Indonesian holidays (Independence Day, Idul Fitri, Chinese New Year)

You may opt out of marketing communications at any time by clicking the unsubscribe link in emails or adjusting your account preferences.

5. Data Sharing and Third-Party Disclosure

hutoto does not sell, rent, or trade your personal information to third parties for their own marketing purposes. However, we may share your data with trusted third parties in the following circumstances:

5.1 Service Providers and Business Partners

• Payment Processors: We share necessary financial information with payment gateways and processors (Indonesian banks, e-wallet providers) to execute deposits and withdrawals. These providers are contractually obligated to use your data solely for transaction processing.
• Game Providers: We share limited gameplay data with licensed game studios (Pragmatic Play, Evolution Gaming, PG Soft, Microgaming) to deliver casino games and maintain game integrity. These providers process data according to their own privacy policies.
• KYC Verification Services: We may use third-party identity verification services to authenticate documents and prevent fraud. These services are GDPR-compliant and process data securely.
• Customer Support Tools: We use live chat and helpdesk software to provide customer support. Support providers may access conversation histories to assist with your inquiries.
• Cloud Hosting Providers: Our platform infrastructure is hosted on secure cloud servers. Hosting providers are contractually bound to maintain data security and confidentiality.

5.2 Legal and Regulatory Authorities

We may disclose your personal information to law enforcement agencies, regulatory bodies, courts, or government authorities when:

• Required by law or legal process (subpoenas, court orders, or statutory obligations)
• Necessary to investigate suspected illegal activity, fraud, or violations of our Terms & Conditions
• Required to comply with anti-money laundering investigations or financial crime prevention
• Necessary to protect the safety, rights, or property of hutoto, our users, or the public

5.3 Business Transfers

In the event of a merger, acquisition, corporate restructuring, or sale of assets, your personal information may be transferred to the acquiring entity. We will notify you via email or prominent notice on the Platform before such transfer occurs, and the acquiring entity will be required to honor this Privacy Policy.

6. Data Security Measures

hutoto employs industry-standard technical and organizational security measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction:

6.1 Technical Security Controls

• 256-bit SSL/TLS Encryption: All data transmitted between your device and our servers is encrypted using bank-grade SSL/TLS protocols, ensuring that intercepted data cannot be read.
• Password Hashing: User passwords are hashed using strong cryptographic algorithms (bcrypt or Argon2). Plaintext passwords are never stored, and even hutoto staff cannot view your password.
• Two-Factor Authentication (2FA): Optional 2FA via SMS or authenticator apps provides an additional layer of account security.
• Firewall Protection: Advanced firewalls and intrusion detection systems monitor and block malicious traffic.
• Regular Security Audits: We conduct periodic security assessments and penetration testing to identify and remediate vulnerabilities.
• Data Segmentation: Financial data, KYC documents, and gameplay records are stored in separate, access-controlled databases to limit exposure in case of a breach.

6.2 Organizational Security Measures

• Access to personal data is restricted to authorized personnel who require it for their job functions, subject to confidentiality agreements.
• Employees receive regular training on data protection best practices and security protocols.
• We maintain an incident response plan to address data breaches or security incidents promptly.
• Third-party service providers are carefully vetted and contractually required to maintain equivalent security standards.

6.3 User Responsibilities

While hutoto implements robust security measures, users also play a critical role in protecting their accounts:

• Choose strong, unique passwords and do not reuse passwords from other websites.
• Enable two-factor authentication for enhanced security.
• Do not share your login credentials with anyone, including customer support (hutoto staff will never ask for your password).
• Log out of your account when using shared or public devices.
• Report suspicious account activity immediately to our support team.

7. Data Retention Policy

hutoto retains your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods vary by data type:

• Account Information: Retained for the duration of your account's active status plus 5 years after account closure, as required by anti-money laundering regulations.
• KYC Documents: Retained for 5 years after the last transaction or account closure, in compliance with financial record-keeping requirements.
• Transaction and Betting History: Retained for 7 years to comply with audit and tax reporting obligations.
• Support Communications: Retained for 3 years for quality assurance and dispute resolution purposes.
• Technical Logs: Retained for 12 months for security monitoring and troubleshooting.

After the applicable retention period expires, personal data is securely deleted or anonymized such that it can no longer be attributed to an individual user.

8. Your Privacy Rights

Under applicable data protection laws, you have the following rights regarding your personal information:

8.1 Right of Access

You have the right to request a copy of the personal information we hold about you. This includes account details, transaction history, KYC documents, and communications. To request access, contact our support team. We will provide the information within 30 days in a commonly used electronic format.

8.2 Right to Rectification

If your personal information is inaccurate or incomplete, you have the right to request correction. You can update most information directly through your account settings. For KYC document corrections, contact customer support with updated documentation.

8.3 Right to Erasure (Right to Be Forgotten)

You may request deletion of your personal data in certain circumstances, such as when data is no longer necessary for its original purpose or you withdraw consent. However, this right is not absolute—we may be required to retain certain data to comply with legal obligations (e.g., AML record-keeping) or establish legal claims.

8.4 Right to Restrict Processing

You may request that we limit how we use your data in specific situations, such as when you contest the accuracy of data or object to processing based on legitimate interests. During the restriction period, we will store your data but not actively process it except for legal compliance.

8.5 Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format and transmit it to another service provider, where technically feasible.

8.6 Right to Object

You may object to processing of your data for direct marketing purposes at any time. You may also object to processing based on legitimate interests by demonstrating compelling grounds relating to your particular situation.

8.7 Right to Withdraw Consent

Where processing is based on consent (e.g., marketing communications), you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing conducted before withdrawal.

To exercise any of these rights, contact hutoto support at [email protected]. We may require identity verification before processing your request to prevent unauthorized disclosure of personal information.

9. Cookies and Tracking Technologies

hutoto uses cookies and similar technologies to enhance user experience, analyze platform performance, and deliver personalized content. Cookies are small text files stored on your device that help us recognize you on repeat visits.

9.1 Types of Cookies We Use

• Essential Cookies: Required for platform functionality, including session management, login authentication, and security features. These cannot be disabled without impairing platform operation.
• Performance Cookies: Collect anonymous usage statistics (pages visited, time spent, bounce rates) to help us improve platform performance. Managed through Google Analytics or similar tools.
• Functionality Cookies: Remember your preferences (language, currency, display settings) to provide a personalized experience.
• Advertising Cookies: Track your activity to deliver relevant promotional content and measure campaign effectiveness. These are used only with your consent.

9.2 Managing Cookies

You can control cookie preferences through your browser settings. Most browsers allow you to block or delete cookies. However, disabling essential cookies may impair platform functionality. Consult your browser's help documentation for instructions on managing cookies.

10. International Data Transfers

hutoto primarily serves users in Indonesia, and your data is stored on servers located in secure data centers. However, some third-party service providers (payment processors, game studios, cloud hosting providers) may be located outside Indonesia. When we transfer data internationally, we ensure adequate protection through:

• Contractual clauses requiring equivalent data protection standards
• Verification that recipients comply with recognized international frameworks (e.g., GDPR adequacy decisions)
• Technical safeguards such as encryption during transit and at rest

11. Changes to This Privacy Policy

hutoto reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or business operations. When material changes are made, we will notify you via email to your registered address or through a prominent notice on the Platform. The "Last Updated" date at the top of this policy indicates the most recent revision. Continued use of the Platform after changes are posted constitutes acceptance of the updated Privacy Policy. We encourage you to review this policy periodically to stay informed of how we protect your information.

12. Contact Information and Data Protection Officer

If you have questions, concerns, or requests regarding this Privacy Policy or how hutoto processes your personal data, please contact us:

• Email: [email protected]
• Live Chat: Available 24/7 through the Platform
• WhatsApp Support: Available for Indonesian-speaking users

For formal data protection inquiries or complaints, you may request to contact our Data Protection Officer, who oversees compliance with privacy regulations and investigates privacy-related concerns. We are committed to resolving any issues promptly and transparently.