Privacy Policy

1. Introduction

Welcome to the duatot Privacy Policy. This document explains how duatot ("we", "us", "our") collects, uses, stores, protects, and discloses personal information from users ("you", "your") of our online gaming platform serving the Indonesian market. We are committed to protecting your privacy and handling your personal data with transparency, integrity, and in compliance with applicable data protection laws and international best practices.

This Privacy Policy applies to all information collected through our website, mobile applications, customer support channels, and any other digital properties operated by duatot. By accessing or using our Services, you acknowledge that you have read, understood, and agree to the collection and use of your information as described in this Privacy Policy.

2. Information We Collect

duatot collects several categories of personal information necessary to provide, maintain, and improve our gaming services, verify your identity, comply with legal obligations, and prevent fraud.

2.1 Information You Provide Directly

When you register for a duatot account, use our Services, or communicate with our support team, you provide the following information:

• Identity Information: Full legal name, date of birth, gender, nationality, Indonesian National Identity Card (KTP) number
• Contact Information: Email address, mobile phone number, residential address, postal code
• Account Credentials: Username, password, security questions and answers
• Financial Information: Bank account details (bank name, account number, account holder name), e-wallet information (OVO, DANA, GoPay, ShopeePay, LinkAja phone numbers)
• Verification Documents: Copies of government-issued identification, proof of address, selfie photos with ID
• Communication Data: Content of messages sent through our customer support channels, including live chat transcripts, emails, and support tickets

2.2 Information Collected Automatically

When you access or use the duatot platform, we automatically collect certain technical and usage information:

• Device Information: Device type (mobile, tablet, desktop), operating system, browser type and version, device identifiers (IMEI, MAC address), screen resolution
• Connection Information: IP address, internet service provider, connection speed, geographic location (city/region level based on IP), time zone setting
• Usage Data: Pages visited, games played, bets placed, time spent on platform, click patterns, navigation paths, feature usage statistics
• Transaction History: Deposit amounts, withdrawal requests, bonus claims, win/loss records, betting patterns
• Performance Data: Error reports, crash logs, page load times, server response times

2.3 Information from Third Parties

We may receive information about you from third-party sources including:

• Payment Processors: Transaction confirmation, payment method verification from Indonesian banks (BCA, BRI, BNI, Mandiri) and e-wallet providers
• Identity Verification Services: Results of identity checks, fraud detection screening, age verification confirmations
• Game Providers: Gameplay data, session information, game outcomes from third-party casino and slot providers (Evolution Gaming, Pragmatic Play, etc.)
• Analytics Services: Aggregated behavioral data, audience insights, demographic information

3. How We Use Your Information

duatot uses your personal information for the following legitimate business purposes:

3.1 Account Management and Service Provision

• Creating and maintaining your duatot account
• Processing deposits, withdrawals, and other financial transactions
• Providing access to sports betting, casino games, lottery draws, and other gaming services
• Managing bonuses, promotions, and VIP rewards programs
• Processing and responding to customer support inquiries
• Sending transactional communications (account confirmations, withdrawal approvals, password resets)

3.2 Legal Compliance and Security

• Verifying your identity and age (21+ requirement enforcement)
• Complying with Know Your Customer (KYC) and Anti-Money Laundering (AML) regulations
• Preventing fraud, cheating, collusion, and other prohibited activities
• Detecting and preventing unauthorized account access
• Investigating suspicious transactions or betting patterns
• Responding to legal requests from law enforcement or regulatory authorities
• Enforcing our Terms & Conditions and other legal agreements

3.3 Platform Improvement and Personalization

• Analyzing user behavior to improve platform functionality and user experience
• Personalizing game recommendations based on your preferences and playing history
• Testing new features and conducting A/B experiments
• Optimizing platform performance, load times, and mobile responsiveness
• Tailoring marketing communications and promotional offers to your interests (with your consent)

3.4 Responsible Gaming

• Monitoring for signs of problem gambling behavior
• Implementing and enforcing deposit limits, loss limits, and self-exclusion requests
• Providing access to responsible gaming tools and resources
• Intervening when concerning gambling patterns are detected

4. Data Sharing and Disclosure

duatot does not sell your personal information to third parties. However, we may share your information with the following categories of recipients under strict confidentiality agreements:

4.1 Service Providers

We engage trusted third-party service providers to perform functions on our behalf, including:

• Payment Processors: Indonesian banks and e-wallet providers to facilitate deposits and withdrawals
• Identity Verification Services: KYC and AML compliance providers for age and identity verification
• Game Suppliers: Casino software providers (Evolution Gaming, Pragmatic Play, Microgaming, etc.) to deliver gaming content
• Cloud Hosting: Secure server infrastructure providers for data storage and platform hosting
• Customer Support Tools: Live chat, email, and ticketing system providers
• Analytics Platforms: Website analytics and user behavior tracking services

These service providers are contractually obligated to use your information only for the specific services they perform for duatot and must maintain equivalent security standards.

4.2 Legal and Regulatory Requirements

We may disclose your information when required by law or in good faith belief that such disclosure is necessary to:

• Comply with legal obligations, court orders, or government requests
• Respond to lawful requests from law enforcement or regulatory authorities
• Investigate potential violations of our Terms & Conditions
• Protect the rights, property, or safety of duatot, our users, or the public
• Prevent fraud, money laundering, or other illegal activities

4.3 Business Transfers

In the event of a merger, acquisition, corporate restructuring, or sale of assets, your personal information may be transferred to the acquiring entity. We will notify you of any such change and ensure the receiving party commits to protecting your data under terms no less protective than this Privacy Policy.

5. Data Security Measures

duatot implements comprehensive technical and organizational security measures to protect your personal information from unauthorized access, disclosure, alteration, or destruction:

5.1 Technical Security

• Encryption: All data transmissions use 256-bit SSL/TLS encryption. Sensitive data at rest is encrypted using industry-standard algorithms.
• Secure Infrastructure: Data is stored on secure servers in professionally managed data centers with 24/7 monitoring, redundant power supplies, and fire suppression systems.
• Firewalls and Intrusion Detection: Multi-layered firewall protection and real-time intrusion detection systems monitor for suspicious activity.
• Access Controls: Role-based access control (RBAC) ensures only authorized personnel can access personal data, limited to what is necessary for their job functions.
• Password Security: User passwords are hashed using bcrypt or similar one-way cryptographic functions and never stored in plain text.
• Regular Security Audits: Independent third-party security audits and penetration testing conducted annually.

5.2 Organizational Security

• Mandatory security training for all employees with access to user data
• Strict confidentiality agreements and background checks for staff members
• Incident response procedures for data breaches or security incidents
• Regular review and update of security policies and procedures

6. Cookies and Tracking Technologies

duatot uses cookies, web beacons, and similar tracking technologies to enhance your experience, analyze usage patterns, and deliver personalized content.

6.1 Types of Cookies We Use

• Essential Cookies: Required for basic platform functionality including session management, login authentication, and security features. These cannot be disabled.
• Performance Cookies: Collect information about how you use our platform (pages visited, time spent, errors encountered) to help us improve performance and user experience.
• Functionality Cookies: Remember your preferences (language, currency, display settings) and provide enhanced features.
• Analytics Cookies: Track user behavior patterns to help us understand how players interact with our games and optimize our offerings.
• Marketing Cookies: Used to deliver relevant promotional offers and measure the effectiveness of marketing campaigns (only with your consent).

6.2 Managing Cookies

Most web browsers allow you to control cookies through their settings. However, disabling essential cookies may affect platform functionality. You can manage cookie preferences through your browser settings or our cookie consent banner displayed on first visit.

7. Your Privacy Rights

duatot respects your privacy rights and provides mechanisms to exercise control over your personal information:

7.1 Access and Portability

You have the right to request a copy of the personal information we hold about you. This will be provided in a structured, commonly used, and machine-readable format (typically CSV or JSON). Access requests are typically fulfilled within 30 days.

7.2 Correction and Update

You can update most personal information directly through your account settings. For information that cannot be self-updated (e.g., verified identity documents), contact our support team to request corrections.

7.3 Deletion (Right to Be Forgotten)

You may request deletion of your personal data, subject to certain exceptions. We must retain certain information to comply with legal obligations (e.g., financial transaction records for tax purposes, identity verification records for AML compliance). Deletion requests are processed within 90 days.

7.4 Object to Processing

You have the right to object to processing of your personal data for direct marketing purposes. You can opt out of marketing communications at any time via the unsubscribe link in emails or through your account settings.

7.5 Restrict Processing

In certain circumstances, you may request that we restrict processing of your personal data (e.g., while disputing data accuracy or challenging the lawfulness of processing).

7.6 Withdraw Consent

Where processing is based on your consent (e.g., marketing communications), you may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, please contact our Privacy Team at [email protected]. We will respond to your request within 30 days and may require identity verification before fulfilling requests.

8. Data Retention

duatot retains personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

8.1 Retention Periods

• Active Accounts: Data retained for the duration of your account's active status plus statutory retention periods
• Closed Accounts: Identity verification data and transaction records retained for 7 years after account closure (AML/KYC legal requirement)
• Marketing Data: Deleted within 2 years of last interaction unless you re-consent to marketing communications
• Support Communications: Retained for 3 years for quality assurance and dispute resolution purposes
• Technical Logs: Typically retained for 90 days unless needed for security investigations

8.2 Secure Deletion

When personal information is no longer needed, it is securely deleted or anonymized such that it can no longer be associated with you. Deletion methods include cryptographic erasure, physical destruction of storage media, and irreversible data anonymization.

9. International Data Transfers

duatot primarily serves Indonesian residents, and your data is stored on servers located within secure data centers. However, some service providers (e.g., cloud hosting, analytics platforms) may process data in jurisdictions outside Indonesia.

When international transfers occur, we ensure adequate safeguards are in place through:

• Standard Contractual Clauses (SCCs) approved for international data transfers
• Service provider certifications demonstrating compliance with international data protection standards
• Binding corporate rules for multinational service providers

We only transfer data to jurisdictions that provide adequate levels of data protection or under legal mechanisms that ensure equivalent protection to what is provided under Indonesian law and international standards.

10. Children's Privacy

duatot's services are strictly intended for adults aged 21 years and older. We do not knowingly collect personal information from individuals under 21 years of age. Our registration process requires date of birth verification, and accounts created with false age information will be immediately terminated.

If we become aware that we have inadvertently collected personal information from someone under 21, we will take immediate steps to delete that information and permanently close the associated account. Parents or guardians who believe their child has provided information to duatot should contact us immediately at [email protected].

11. Changes to This Policy

duatot reserves the right to modify this Privacy Policy at any time to reflect changes in our practices, technology, legal requirements, or business operations. When we make material changes, we will notify you by:

• Posting a prominent notice on our website and mobile app
• Sending an email notification to your registered email address
• Requiring you to acknowledge the updated policy upon next login (for significant changes)

Changes become effective immediately upon posting to this page. The "Last Updated" date at the top of this policy indicates when the most recent revisions were made. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

12. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our dedicated Privacy Team: