4mtoto Privacy Policy

1 Introduction

4mtoto is an internationally operated online gaming and sports betting platform serving players in Indonesia and other eligible markets. As the operator of this platform, we act as the data controller responsible for the personal information you provide to us during registration, verification, and ongoing use of our services.

We understand that privacy is a fundamental concern for our players. The Indonesian online gaming audience — including players who engage with sports betting on BRI Liga 1 matches, togel (Indonesia's traditional numbers lottery) markets, and international football leagues — trusts 4mtoto to handle their personal information with integrity, discretion, and compliance with internationally recognized data protection standards.

This Policy has been drafted in accordance with internationally recognized data protection principles, including those derived from the General Data Protection Regulation (GDPR) framework, as adopted by 4mtoto's licensing authority. It should be read alongside our Terms & Conditions, which govern the overall relationship between you and 4mtoto.

2 Definitions

• "Personal Data" means any information that identifies or could reasonably identify a natural person, directly or indirectly — including name, national ID number, email address, IP address, device identifiers, and financial account details.
• "Processing" means any operation performed on Personal Data — including collection, recording, organization, storage, adaptation, retrieval, consultation, use, disclosure, transmission, restriction, erasure, or destruction.
• "Data Controller" means the entity that determines the purposes and means of Processing Personal Data — in this context, 4mtoto.
• "Data Processor" means any third party that processes Personal Data on behalf of 4mtoto under a written data processing agreement.
• "Consent" means a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your Personal Data for a stated purpose.
• "KYC" means Know Your Customer — the identity and age verification process required before withdrawals are authorized.
• "Cookies" means small text files placed on your device by the Platform for functionality, analytics, and user experience purposes.

3 Data We Collect

4mtoto collects Personal Data across several categories, depending on your level of engagement with the Platform:

4 How Data Is Collected

We collect your Personal Data through the following channels:

• Direct Submission: Information you actively provide when registering an account, completing KYC, making deposits or withdrawals, contacting customer support, or participating in promotions.
• Automated Technical Collection: Data gathered automatically as you use the Platform, including IP addresses, session logs, device fingerprints, and in-platform behavioral tracking via server logs and first-party analytics tools.
• Cookies and Similar Technologies: Session cookies, persistent cookies, pixel tags, and local storage objects placed on your device. See Section 11 for full details.
• Third-Party Sources: In limited circumstances, we may receive data from identity verification providers, payment processors, fraud screening services, or public registers to supplement our KYC and fraud prevention processes. Any such third party operates under a data processing agreement with 4mtoto.

5 Purposes of Processing

4mtoto processes your Personal Data only for clearly defined, legitimate purposes:

1. Account Management: Creating and maintaining your player account, authenticating your identity on login, and managing your account settings and preferences.
2. Payment Processing: Facilitating IDR deposits via Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja), and processing withdrawal requests to verified accounts.
3. Identity Verification (KYC): Confirming that you are who you claim to be, that you are at least 21 years of age, and that your payment methods are legitimately owned by you.
4. Platform Operations: Delivering gaming services, settling bets, managing bonuses, and providing customer support.
5. Fraud Prevention and Security: Detecting, investigating, and preventing account fraud, payment fraud, money laundering, underage gambling, and prohibited conduct described in our Terms & Conditions.
6. Legal and Regulatory Compliance: Meeting obligations under 4mtoto's international gaming license, including anti-money laundering (AML) record-keeping and reporting requirements.
7. Responsible Gaming: Monitoring player behavior to identify signs of problem gambling and offering appropriate intervention tools such as deposit limits, session reminders, and self-exclusion.
8. Marketing Communications: Sending you promotional offers, bonus notifications, and platform updates — but only where you have explicitly opted in to receive such communications. You may opt out at any time.
9. Platform Improvement: Analyzing aggregated, anonymized behavioral data to improve game selection, payment flows, and overall user experience.

6 Legal Basis for Processing

Each processing activity at 4mtoto is grounded in one or more of the following legal bases under internationally recognized data protection frameworks:

• Contractual Necessity: Processing required to fulfill our obligations under the Terms & Conditions — including account creation, payment processing, bet settlement, and service delivery. Without this processing, we cannot provide the Platform to you.
• Legal Obligation: Processing mandated by laws applicable to 4mtoto's licensing jurisdiction — including KYC verification, AML record-keeping, fraud reporting, and regulatory audits.
• Legitimate Interests: Processing necessary for our legitimate business interests — such as fraud prevention, platform security, business analytics, and network integrity — provided these interests do not override your fundamental rights.
• Consent: Processing authorized by your explicit, freely given consent — such as marketing communications and optional cookies. You may withdraw consent at any time.

7 Data Sharing and Disclosure

4mtoto does not sell, rent, or trade your Personal Data to third parties for marketing purposes. We share your data only in the limited circumstances described below:

7.1 Service Providers

We engage trusted third-party processors to perform essential functions on our behalf, including payment gateway operators, identity verification providers, hosting and cloud infrastructure providers, customer support platforms, and email delivery services. Each processor operates under a written data processing agreement requiring compliance with our data protection standards.

7.2 Game Providers

To deliver gaming content from studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Pocket Games Soft, and Spribe, we transmit limited session and authentication data to these providers. They process this data solely to deliver gameplay and maintain game integrity.

7.3 Regulatory Authorities

4mtoto is obligated to disclose certain records to our licensing authority and other competent regulatory bodies upon lawful request. This includes KYC documentation, transaction logs, and suspicious activity reports required under AML regulations.

7.4 Law Enforcement

We will cooperate with law enforcement agencies where disclosure is required by court order, subpoena, or applicable law, or where we have a good-faith belief that disclosure is necessary to prevent fraud, protect our legal rights, or ensure public safety.

7.5 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your Personal Data may be transferred to the successor entity. You will be notified via email and Platform notice before any such transfer takes effect.

8 International Data Transfers

4mtoto operates internationally and uses hosting infrastructure and service providers located in multiple jurisdictions. This means your Personal Data may be transferred to, stored in, or processed in countries outside Indonesia — including jurisdictions in Europe, North America, and Asia-Pacific regions.

Where we transfer data to countries that do not provide an equivalent level of data protection to that required under our licensing standards, we implement appropriate safeguards such as Standard Contractual Clauses (SCCs), binding corporate rules, or reliance on adequacy decisions issued by competent authorities.

By using the Platform, you acknowledge and consent to these international transfers, subject to the protections described in this Policy.

9 Data Retention

4mtoto retains your Personal Data for as long as necessary to fulfill the purposes outlined in this Policy, subject to the following retention periods:

• Active Accounts: Personal Data is retained for the duration your Account remains open and active.
• Closed Accounts: Following voluntary account closure, we retain Identity Data, Financial Data, and Transaction Records for a minimum of five (5) years to comply with international AML regulations and licensing obligations.
• Marketing Data: If you opt out of marketing communications, your contact details are retained on a suppression list to ensure we do not re-contact you, but are not used for any other purpose.
• Legal Claims: Where Personal Data is relevant to a pending or threatened legal claim, it will be retained until the claim is resolved, regardless of the standard retention period.

After the applicable retention period expires, Personal Data is securely deleted or anonymized such that it can no longer identify you.

10 Data Security Measures

4mtoto employs industry-standard technical and organizational measures to protect your Personal Data against unauthorized access, alteration, disclosure, or destruction:

• 256-bit SSL Encryption: All data transmitted between your device and 4mtoto servers is encrypted using Transport Layer Security (TLS) protocols.
• Secure Data Centers: Personal Data is stored on servers located in ISO 27001-certified data centers with physical access controls, redundant power, and 24/7 monitoring.
• Access Controls: Internal access to Personal Data is restricted to authorized personnel only, granted on a need-to-know basis and logged for audit purposes.
• Password Hashing: Account passwords are hashed using bcrypt or equivalent algorithms. 4mtoto staff cannot view your plaintext password.
• Regular Penetration Testing: Our Platform undergoes regular third-party security audits and penetration testing to identify and remediate vulnerabilities.
• Incident Response: In the event of a data breach affecting your Personal Data, we will notify you and relevant authorities within 72 hours where required by law, and will take immediate steps to contain and remediate the breach.

11 Cookies and Tracking Technologies

4mtoto uses cookies and similar technologies to enhance your experience on the Platform, analyze usage patterns, and maintain session integrity. A cookie is a small text file stored on your device by your web browser.

11.1 Types of Cookies We Use

• Essential Cookies: Required for basic Platform functionality, including session management, authentication, and security. These cannot be disabled without impairing Platform usability.
• Functional Cookies: Remember your preferences such as language settings, timezone, and display options.
• Analytics Cookies: Collect aggregated, anonymized data on how users interact with the Platform — including page views, session duration, and navigation patterns. We use this data to improve Platform design and performance.
• Marketing Cookies: Track visits across websites to deliver targeted promotional content. These cookies require your explicit consent and may be disabled at any time.

11.2 Managing Cookies

Most web browsers allow you to control cookies through their settings. You can configure your browser to block all cookies, accept only first-party cookies, or receive a notification before a cookie is set. Note that blocking essential cookies will prevent you from logging in or using certain Platform features. Instructions for managing cookies are available in your browser's help documentation.

12 Your Data Protection Rights

Under internationally recognized data protection standards, you hold the following rights with respect to your Personal Data:

• Right of Access: You may request confirmation of whether we process your Personal Data and obtain a copy of that data in a structured, commonly used format.
• Right to Rectification: If your Personal Data is inaccurate or incomplete, you may request correction. You can update most information directly via your Account settings.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data where: (a) it is no longer necessary for the purposes collected; (b) you withdraw consent and no other legal basis applies; or (c) you object to processing and no overriding legitimate grounds exist. This right is subject to our legal retention obligations under AML regulations.
• Right to Restriction: You may request that we limit processing of your Personal Data in certain circumstances, such as while a dispute over accuracy is being resolved.
• Right to Data Portability: You may request that we provide your Personal Data in a machine-readable format and transmit it directly to another controller where technically feasible.
• Right to Object: You may object to processing based on legitimate interests or direct marketing at any time. We will cease such processing unless we demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted prior to withdrawal.

To exercise any of these rights, contact our Data Protection Officer using the details in Section 16. We will respond to verified requests within 30 calendar days.

13 Minors and Age Verification

4mtoto's services are strictly limited to individuals aged 21 years or older. We do not knowingly collect Personal Data from anyone under 21. Our KYC process includes mandatory age verification before any withdrawal is authorized.

If we become aware that we have inadvertently collected Personal Data from an individual under 21, we will immediately suspend the Account, delete the data, and refund any deposits at our discretion. Parents or guardians who believe their child has provided Personal Data to 4mtoto should contact us immediately.

14 Third-Party Links

The Platform may contain links to third-party websites operated by game providers, payment processors, or regulatory bodies. This Privacy Policy applies only to 4mtoto's own services. We are not responsible for the privacy practices of third-party sites. We encourage you to review the privacy policies of any third-party site you visit.

15 Policy Amendments

4mtoto reserves the right to amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or Platform features. Material changes will be communicated via email to your registered address and prominently displayed on the Platform at least 14 days before taking effect.

Your continued use of the Platform after the effective date constitutes acceptance of the updated Policy. The "Last Updated" date at the top of this page reflects the most recent revision. Previous versions are available on request.

16 Contact and Data Protection Officer

If you have questions, concerns, or complaints about this Privacy Policy or 4mtoto's data practices, or if you wish to exercise any of your data protection rights, please contact our Data Protection Officer:

If you believe 4mtoto has not adequately addressed your data protection concerns, you have the right to lodge a complaint with the data protection supervisory authority in the jurisdiction where 4mtoto's license is held, or in your country of residence where applicable law permits.