toro12 Privacy Policy

toro12 ("we", "us", "the Platform", or "the Company") operates the online gaming and sports betting platform accessible at toro12.pro. We are committed to handling all personal data in accordance with recognised international data protection standards, including principles drawn from the General Data Protection Regulation (GDPR) and applicable data protection frameworks relevant to our international player base, including players based in Indonesia.

This Privacy Policy applies to all personal data collected through toro12.pro, its mobile web interface, and any communications between you and toro12 via live chat, email, or other support channels. By registering an account or otherwise providing your personal information to toro12, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein.

This Policy should be read in conjunction with the toro12 Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" — any information that identifies or could reasonably be used to identify a natural person, either directly (e.g., full name, email address, national ID number) or indirectly (e.g., device identifier, IP address, account username combined with behavioural data).
• "Processing" — any operation performed on personal data, including collection, storage, organisation, structuring, adaptation, retrieval, use, disclosure, transmission, restriction, erasure, or destruction.
• "Data Controller" — toro12, which determines the purposes and means of processing personal data collected through the Platform.
• "Data Processor" — any third-party service provider engaged by toro12 to process personal data on its behalf (e.g., payment processors, KYC verification partners, cloud hosting providers).
• "Consent" — a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your personal data for a stated purpose.
• "Player" / "you" — any registered account holder or visitor who accesses or uses the toro12 Platform.
• "Sensitive Data" — a subset of personal data that warrants heightened protection, including financial account details, government-issued identity document numbers, and, where applicable, health or welfare data provided in the context of responsible gaming self-assessments.

toro12 collects personal data across several categories, depending on how you interact with the Platform. The table below provides a structured overview of the categories of data we collect and the specific data points within each category.

toro12 collects personal data through the following channels and mechanisms:

• Account Registration: When you create a toro12 account, you voluntarily provide your name, date of birth, email address, and preferred payment method details. This is the primary source of identity and contact data.
• KYC Submissions: When you submit identity verification documents via the KYC portal within your account dashboard, you provide government-issued identity documents and proof-of-address materials. These are transmitted over encrypted HTTPS connections and stored in a secure, access-controlled document vault.
• Deposits and Withdrawals: Each financial transaction on the Platform generates a transaction record that includes the payment method used, the amount in IDR or USDT, the timestamp, and a transaction reference number. toro12 does not store full bank account numbers or e-wallet PINs.
• Platform Usage (Automatic Collection): When you browse toro12.pro, our servers and analytics tools automatically log technical data including your IP address, browser fingerprint, session duration, pages viewed, and game interactions. This data is collected via server logs, cookies, and local storage.
• Live Chat and Support: When you initiate a live chat session or send an email to our support team, the content of those communications is collected and stored for quality assurance, training, and dispute resolution purposes.
• Responsible Gaming Interactions: If you use any of our responsible gaming tools — such as setting a deposit limit, requesting a cooling-off period, or initiating self-exclusion — those actions and their timestamps are recorded as part of your account profile and compliance history.
• Marketing Opt-Ins: If you opt in to receive promotional communications, your marketing preferences are recorded at the point of opt-in, including the date, time, and the specific channel through which you subscribed.

toro12 processes your personal data only where a valid legal basis exists. The primary legal bases we rely upon are as follows:

• Contractual Necessity: Processing your account information, payment data, and KYC documents is necessary to perform the contract between you and toro12 (i.e., to operate your account, process deposits and withdrawals, and deliver gaming services). Without this processing, toro12 cannot provide the Services described in the Terms & Conditions.
• Legal Obligation: Certain processing activities — particularly KYC identity verification and transaction monitoring — are necessary for toro12 to comply with its obligations under applicable anti-money laundering (AML) regulations and international responsible gaming standards.
• Legitimate Interests: toro12 processes technical and behavioural data based on its legitimate interests in operating a secure, fair, and commercially sustainable gaming platform. This includes fraud detection, abuse prevention, platform performance analytics, and responsible gaming monitoring. We conduct balancing tests to ensure our legitimate interests do not override your fundamental rights and freedoms.
• Consent: Where processing is not required for contract performance or legal compliance — for example, sending you promotional emails about seasonal bonuses or new game releases — toro12 relies on your explicit consent, which you can withdraw at any time via your account settings or by contacting our support team.

toro12 processes your personal data for the following specific, defined purposes:

1. Account Management: Creating, maintaining, and securing your toro12 player account, including password reset and session authentication.
2. Identity Verification (KYC): Verifying your identity and age (21+) to comply with responsible gaming standards and to prevent underage gambling and fraudulent account creation.
3. Payment Processing: Facilitating deposits and withdrawals via your chosen payment method — whether BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja, or USDT — and maintaining accurate financial records of all transactions.
4. Fraud and Security Monitoring: Detecting and preventing unauthorised account access, bonus abuse, money laundering, collusion, and other forms of fraudulent or prohibited activity on the Platform.
5. Responsible Gaming Compliance: Monitoring gaming behaviour to identify potential problem gambling patterns, enforcing player-requested deposit limits and self-exclusion orders, and ensuring the Platform is not used by vulnerable individuals in breach of their own protective restrictions.
6. Customer Support: Responding to your support queries, resolving disputes, and maintaining records of communications for quality assurance and regulatory compliance.
7. Platform Improvement: Analysing aggregated, anonymised usage data to improve game offerings, payment flows, page performance, and user experience across devices including mobile browsers commonly used by Indonesian players.
8. Marketing Communications: Sending you promotional offers, bonus notifications, and seasonal campaign communications where you have consented to receive them. You may withdraw consent at any time.
9. Legal and Regulatory Compliance: Retaining records as required by applicable law, responding to lawful requests from regulatory or law enforcement authorities, and defending or pursuing legal claims.

toro12 does not sell, rent, or trade your personal data to any third party for their own commercial or marketing purposes. Your data may be shared with the following categories of authorised third parties, strictly on a need-to-know basis and subject to written data processing agreements:

• Payment Processors and Banking Partners: To facilitate your deposits and withdrawals, toro12 shares necessary transaction data with the relevant payment infrastructure providers. For Indonesian bank transfer players, this includes reference data shared with BCA, BRI, BNI, Mandiri, CIMB Niaga, and other banking partners solely for transaction routing purposes.
• KYC Verification Partners: toro12 uses internationally certified third-party KYC verification services to validate identity documents and perform liveness checks. These partners process your documents under strict confidentiality obligations and are prohibited from using your data for any purpose other than identity verification for toro12.
• Game Studio Providers: When you launch a game developed by a third-party studio (e.g., Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft), limited session and stake data may be transmitted to that studio's game server infrastructure to operate the game. Game providers are contractually bound by data protection obligations consistent with this Policy.
• Cloud Hosting and Infrastructure Providers: toro12's platform is hosted on secure cloud infrastructure. Our hosting providers process data on our behalf under data processing agreements that include appropriate technical and organisational security measures.
• Fraud Prevention and Analytics Services: toro12 uses specialist fraud-detection and analytics tools that may process IP addresses, device fingerprints, and behavioural signals to identify suspicious activity. These tools do not receive full identity data.
• Legal and Regulatory Authorities: toro12 may disclose personal data to competent authorities, regulatory bodies, or law enforcement agencies where required by applicable law, a valid court order, or where toro12 has a good-faith belief that disclosure is necessary to prevent imminent harm, investigate fraud, or comply with a legal obligation.

toro12 uses cookies and similar tracking technologies to ensure the Platform functions correctly, to maintain your session securely, and to improve your browsing experience. The categories of cookies used on toro12.pro are described below:

• Strictly Necessary Cookies: These cookies are essential for the Platform to operate. They manage your login session, maintain your account authentication state, remember your language and currency preferences (IDR), and protect against cross-site request forgery (CSRF) attacks. These cookies cannot be disabled without breaking core Platform functionality.
• Performance and Analytics Cookies: These cookies collect anonymised, aggregated data about how players navigate toro12.pro — including which pages are visited most frequently, which games are launched, and where players encounter errors. This data helps us identify and resolve technical issues and improve the overall experience.
• Functional Cookies: These cookies remember your preferences (e.g., whether you prefer to view odds in decimal or Indonesian format, your preferred deposit method) to provide a more personalised experience without requiring you to re-enter settings on each visit.
• Marketing and Retargeting Cookies: toro12 may use marketing cookies to serve relevant promotional content to players who have opted in to marketing communications. These cookies help ensure that bonus offers and seasonal promotions (such as Idul Fitri reload bonuses or Ramadhan cashback campaigns) are shown to players who are most likely to find them relevant.

You may manage your cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair or prevent access to core Platform features. Most modern browsers on Android and iOS (commonly used by Indonesian players to access toro12) support per-site cookie management.

toro12 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or compliance obligations. The general retention periods applied by toro12 are as follows:

Upon expiry of the applicable retention period, toro12 will securely delete or irreversibly anonymise your personal data, such that it can no longer be linked to your identity.

toro12 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, disclosure, alteration, or destruction. Our key security controls include:

• Transport Encryption: All data transmitted between your browser and toro12.pro is encrypted using TLS 1.2 or TLS 1.3 (HTTPS). toro12 enforces HTTP Strict Transport Security (HSTS) to prevent protocol downgrade attacks.
• At-Rest Encryption: Personal data stored in toro12's databases — including KYC documents, financial records, and account credentials — is encrypted at rest using 256-bit AES encryption.
• Password Hashing: Account passwords are never stored in plain text. toro12 uses a modern, salted hashing algorithm (bcrypt or Argon2) to store password credentials, ensuring that even in the event of a database breach, passwords cannot be recovered in their original form.
• Access Controls: Access to personal data within toro12's internal systems is governed by strict role-based access controls. Only authorised personnel with a documented business need can access player data, and all access events are logged and subject to audit.
• Two-Factor Authentication (2FA): toro12 strongly recommends that all players enable two-factor authentication on their accounts. 2FA adds a second layer of verification, significantly reducing the risk of unauthorised account access even if login credentials are compromised.
• Penetration Testing and Vulnerability Management: toro12 conducts regular security assessments, including third-party penetration testing and automated vulnerability scanning, to identify and remediate security weaknesses before they can be exploited.
• Incident Response: In the event of a personal data breach that poses a risk to your rights and freedoms, toro12 will notify affected players without undue delay and will take immediate remedial action to contain the breach and prevent further exposure.

toro12 operates as an international platform and, as such, your personal data may be processed in jurisdictions outside of Indonesia. This may occur when data is stored on cloud servers located in other countries, when KYC verification is performed by an international identity verification partner, or when game data is processed on game studio servers operated outside Indonesia.

Whenever personal data is transferred internationally, toro12 ensures that appropriate safeguards are in place to maintain a level of data protection consistent with the standards described in this Policy. These safeguards may include:

• Contractual clauses (equivalent to Standard Contractual Clauses under GDPR) binding the receiving party to data protection obligations no less stringent than those in this Policy.
• Transferring data only to jurisdictions that maintain adequate data protection legal frameworks.
• Applying end-to-end encryption for all cross-border data transmissions involving personal data.

By using the toro12 Platform, you acknowledge and consent to the international transfer of your personal data under the safeguards described above.

As a toro12 player, you have the following rights with respect to your personal data. To exercise any of these rights, contact our Data Protection team as described in Section 16.

• Right of Access: You may request a copy of all personal data that toro12 holds about you. We will provide this within thirty (30) calendar days of receiving a verified request, free of charge.
• Right to Rectification: If any of your personal data held by toro12 is inaccurate or incomplete, you have the right to request that we correct or complete it promptly.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (and no other legal basis applies), or where you object to processing based on legitimate interests. Note that some data must be retained to comply with legal obligations (see Section 9) even after an erasure request is received.
• Right to Restriction of Processing: You may request that toro12 restricts (but does not delete) your personal data in certain circumstances — for example, while a rectification request is being assessed, or while an objection to processing is being considered.
• Right to Data Portability: You may request that toro12 provide your account data and transaction history in a structured, commonly used, machine-readable format (e.g., CSV or JSON), enabling you to transfer it to another service provider.
• Right to Object: You may object at any time to the processing of your personal data where toro12 relies on legitimate interests as the legal basis. You also have an unconditional right to object to direct marketing processing, including profiling for marketing purposes.
• Right to Withdraw Consent: Where toro12 processes your data on the basis of consent (e.g., for marketing communications), you may withdraw that consent at any time via your account settings or by contacting support. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

toro12 strictly prohibits the use of the Platform by any person under the age of 21. We do not knowingly collect personal data from individuals under 21 years of age. The minimum age requirement of 21 years applies to all players, regardless of their jurisdiction of residence.

toro12 employs a multi-layered age verification process:

• At registration, players are required to confirm their date of birth. Any stated age below 21 results in immediate rejection of the registration application.
• Upon triggering the KYC verification process, players must submit a government-issued photo ID (KTP, passport, or driver's licence) confirming their date of birth. Any document indicating the player is under 21 results in immediate account suspension and return of any deposited funds.
• Where toro12 receives a report or otherwise has reason to believe that an account is held by a person under 21, the account will be frozen immediately pending investigation.

The toro12 Platform may contain references to third-party game studios, payment processors, and affiliated service providers. While toro12 selects its third-party partners carefully, this Privacy Policy applies solely to data processed by toro12 in its capacity as Data Controller. toro12 is not responsible for the privacy practices of third-party game studios, banking institutions, or e-wallet providers when you interact with their platforms directly (e.g., when completing a bank transfer via BCA's or BRI's own interfaces, or when authenticating an OVO or DANA payment through those providers' own apps).

We encourage you to review the privacy policies of any third-party service you interact with in connection with your use of toro12, including your chosen bank and e-wallet provider, and any game studio whose standalone products you access outside the toro12 Platform.

toro12 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or operational requirements. When material changes are made, we will provide at least seven (7) calendar days' advance notice to registered players via email or a prominent in-Platform notification before the amended Policy takes effect.

The "Last Updated" date displayed at the top of this page will be revised with each published update. We recommend that you review this Policy periodically to stay informed of how toro12 protects your personal data. Your continued use of the toro12 Platform following the effective date of any amendment constitutes your acceptance of the revised Privacy Policy.

If you have any questions, concerns, or requests relating to this Privacy Policy, your personal data, or the exercise of your data rights, please contact the toro12 Data Protection team through the following channels:

• Live Chat: Available 24/7 on toro12.pro. Indonesian-speaking agents are on hand at all hours to assist with data rights requests. This is the fastest way to reach us for urgent privacy concerns.
• Email: support at toro12 dot pro — please include "Privacy Request" in your subject line. We endeavour to acknowledge all privacy-related emails within one (1) business day and to resolve requests within the thirty (30) day statutory window.
• FAQ: For general questions about account data, payment security, and KYC verification, visit our FAQ page.