ato108 Privacy Policy

ato108 is an internationally licensed online sportsbook and casino platform operated at https://ato108.net. As the operator of the Platform, ato108 acts as the data controller in respect of all personal data collected from users who register and interact with the Platform. In this Privacy Policy, "ato108", "we", "us", and "our" refer to the Company and its affiliated entities responsible for operating the Platform.

Our Platform is specifically designed for players across Indonesia and is offered in English for the benefit of internationally oriented Indonesian users. All financial transactions on the Platform are denominated in Indonesian Rupiah (IDR / Rp), and our payment integrations cover major Indonesian banks — including BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, and Bank Permata — as well as e-wallets such as OVO, DANA, GoPay, ShopeePay, and LinkAja. References to Indonesian payment providers in this Policy reflect the nature of the data we process in connection with those services.

This Privacy Policy applies to all data processing activities carried out by ato108 in connection with your use of the Platform, including registration, account management, deposits and withdrawals, sportsbook wagering, live casino and slot gameplay, customer support interactions, and marketing communications where you have opted in.

We collect personal data about you through several channels: information you provide directly during registration and account management; data generated automatically through your use of the Platform; and information received from third-party verification and payment service providers. The categories of personal data we collect are set out in the table below.

2.1 Special Category Data

We do not intentionally collect special category personal data (such as racial or ethnic origin, religious beliefs, health data, or biometric data) unless strictly required by applicable law or regulatory guidance in connection with responsible gaming obligations. Where any such data is incidentally collected — for example, if a user discloses a gambling-related health concern when requesting self-exclusion — it will be treated with the highest level of confidentiality and processed solely for the purpose of fulfilling that request.

2.2 Data You Are Not Required to Provide

Certain fields on our registration and profile forms are optional. You will always be informed at the point of collection which fields are mandatory and which are optional. Declining to provide optional data will not prevent you from using the Platform's core features, though some services (such as promotional opt-in communications) may be unavailable without the relevant information.

We use the personal data we collect for the following clearly defined purposes. We do not process your data for any purpose that is incompatible with those listed here without first obtaining your consent or having a separate legal basis to do so.

• Account creation and management: To register your account, verify your identity, maintain your account settings, and enable you to log in securely.
• Payment processing: To process deposits from and withdrawals to your nominated Indonesian bank account or e-wallet, to reconcile transactions, and to issue refunds where applicable.
• Identity verification (KYC): To comply with anti-money laundering obligations and to confirm that you are at least 21 years of age and are the legitimate account holder before processing withdrawals.
• Service delivery: To make the Platform's sportsbook, live casino, slots, live baccarat, fish shooting, and all other gaming products available and functional for your use.
• Fraud detection and security: To detect, investigate, and prevent fraudulent transactions, multiple account abuse, bonus exploitation, money laundering, and other prohibited conduct as defined in our Terms & Conditions.
• Responsible gaming: To monitor betting patterns that may indicate problem gambling behavior, to enforce deposit limits and self-exclusion requests, and to provide proactive responsible gaming interventions where appropriate.
• Customer support: To respond to your inquiries, resolve disputes, process complaints, and maintain records of support interactions for quality assurance purposes.
• Platform improvement: To analyze aggregated and anonymized usage data for the purpose of improving Platform performance, user experience, and game content selection.
• Marketing communications: Where you have opted in, to send you promotional emails, SMS notifications, and in-Platform messages about bonuses, seasonal promotions, and new features. You may withdraw your consent at any time.
• Legal compliance: To comply with applicable laws and regulations, to respond to lawful requests from regulatory authorities, and to enforce our Terms & Conditions.

For each processing purpose described in Section 3, we rely on one or more of the following legal bases:

• Contractual necessity: Processing that is necessary to perform the contract between you and ato108 — specifically, to operate your account, process your transactions, and deliver the Platform's services. This covers account management, payment processing, and service delivery.
• Legal obligation: Processing that we are required to carry out under applicable laws and regulations, including anti-money laundering requirements, age verification obligations, and responding to lawful regulatory requests. This covers KYC verification and legal compliance processing.
• Legitimate interests: Processing that is necessary for ato108's legitimate business interests, provided those interests are not overridden by your rights and interests. This covers fraud detection, Platform security, responsible gaming monitoring, and aggregated Platform analytics. We have assessed that our legitimate interests in these activities are proportionate and do not unfairly prejudice your privacy.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent. This covers the sending of marketing communications. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

We may share your personal data with the following categories of third parties:

• Payment processors and banking partners: We share transaction data with your nominated Indonesian bank (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, or BSI) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) to the extent necessary to execute your deposit and withdrawal instructions.
• KYC and identity verification providers: We engage licensed third-party identity verification services to assist with KYC document checks. These providers receive only the minimum personal data required to perform identity verification and are contractually prohibited from using that data for any other purpose.
• Game content providers: Our gaming platform integrates titles from studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft. These providers may receive anonymized session data necessary for game operation; they do not receive personally identifiable player information beyond what is required for technical game delivery.
• Technology and hosting providers: We use third-party cloud infrastructure, server hosting, and cybersecurity services. These providers process data on our behalf under strict data processing agreements and are not permitted to use your data independently.
• Regulatory authorities and law enforcement: We may disclose personal data to regulatory bodies, law enforcement agencies, or courts when required to do so by applicable law, court order, or regulatory directive — including in connection with anti-money laundering investigations.
• Professional advisors: Our legal counsel, auditors, and compliance consultants may access personal data on a need-to-know basis in connection with their professional services to ato108, subject to professional confidentiality obligations.

ato108 uses cookies and similar tracking technologies (such as web beacons and local storage objects) to operate the Platform, improve user experience, and support our fraud detection and analytics functions. A cookie is a small text file placed on your device when you visit the Platform; it allows the Platform to recognize your browser and remember certain information about your session.

You can manage cookie preferences through your browser settings. Most browsers allow you to refuse non-essential cookies or delete existing cookies. Note that disabling strictly necessary cookies will impair core Platform functionality, including login and session management. The Platform does not currently use third-party advertising or retargeting cookies.

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. Our standard retention periods are as follows:

• Active account data (identity, contact, financial, gaming history): Retained for the duration of your active account relationship with ato108, plus a minimum of 5 years following account closure — in compliance with anti-money laundering record-keeping requirements.
• KYC documents (copies of ID, proof of address, selfies): Retained for a minimum of 5 years from the date of verification or from the date of account closure, whichever is later.
• Transaction records (deposit and withdrawal logs): Retained for a minimum of 5 years from the date of the transaction.
• Customer support records (chat logs, email correspondence): Retained for 3 years from the date of the support interaction, or until any related dispute is fully resolved.
• Marketing preference records: Retained for the duration of your account relationship, or for 3 years following opt-out, to evidence your consent status.
• Technical and server log data: Retained for up to 12 months in raw form; retained in aggregated, anonymized form for up to 36 months for analytics purposes.

Following the expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized. Where data must be retained for a shorter period than the maximum stated above due to your exercise of a data right (see Section 9), we will comply within the timeframes set out in that section.

ato108 implements a comprehensive set of technical and organizational security measures designed to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. Our security framework includes:

• 256-bit SSL/TLS encryption on all data transmitted between your device and ato108 servers, ensuring that your login credentials, personal details, and financial information cannot be intercepted in transit.
• Encrypted password storage: Passwords are never stored in plain text. We apply industry-standard one-way hashing algorithms with salting so that even in the event of a data breach, raw passwords cannot be recovered.
• Two-factor authentication (2FA): Available to all account holders and strongly recommended for all accounts. 2FA adds a second verification step to your login process, protecting your account even if your password is compromised.
• Access controls: Personal data is accessible only to ato108 staff who require it to perform their specific job functions. All staff with data access are subject to confidentiality obligations and receive regular data protection training.
• Penetration testing and vulnerability assessments: ato108 engages independent security professionals to conduct regular penetration tests and vulnerability scans of the Platform to identify and remediate security weaknesses proactively.
• Data breach response: We maintain an incident response plan that specifies the steps to be taken in the event of a personal data breach, including notification of affected users and relevant regulatory authorities within the timeframes required by applicable law.

As a registered user of ato108, you have the following rights in respect of your personal data. To exercise any of these rights, please contact us using the details in Section 13. We will respond to all verifiable data requests within 30 calendar days. In complex cases, this period may be extended by a further 30 days, in which case we will notify you of the extension before the initial deadline expires.

ato108 takes its age restriction obligations seriously and employs the following measures to prevent underage access:

• Mandatory date-of-birth declaration at registration, which is cross-referenced against submitted KYC documents.
• KYC identity verification using government-issued documents (Indonesian KTP or passport) before any withdrawal is processed, which includes confirmation of the account holder's date of birth.
• The right to request proof of age from any user at any time. Accounts where age cannot be confirmed will be suspended pending verification.

If we become aware that personal data has been collected from a user who is under 21 years of age, we will promptly close the associated account, return any deposited funds to the payment method used (net of any wagers already placed), and securely delete all personal data associated with that account. If you believe that an individual under 21 has registered an account on the Platform, please notify us immediately using the contact details in Section 13.

As an internationally operating platform, ato108 may store and process your personal data on servers located outside Indonesia. When personal data is transferred to a jurisdiction that does not provide a level of data protection equivalent to that applicable in Indonesia or in the jurisdiction of our licensing authority, we take appropriate safeguards to ensure that the transfer is lawful and that your data remains protected.

These safeguards may include: standard contractual clauses approved by relevant data protection authorities; binding corporate rules where applicable; adequacy decisions covering the destination country; or other legally recognized transfer mechanisms. By using the Platform, you acknowledge that your personal data may be transferred to, stored in, and processed in jurisdictions outside Indonesia as described in this section.

ato108 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. When we make material changes to this Policy, we will provide notice via a prominent banner on the Platform and, where we hold your email address, by sending a notification to your registered email. The updated effective date will be shown at the top of the Policy.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data. Your continued use of the Platform following the publication of any revised Policy constitutes your acceptance of the updated terms. If you disagree with any material change, you are entitled to close your account by contacting support and to request deletion of your personal data in accordance with Section 9, subject to applicable legal retention obligations.

If you have any questions, concerns, or requests relating to this Privacy Policy or our data processing practices, please contact the ato108 Data Protection team using any of the following channels. We are committed to responding to all privacy-related inquiries promptly and thoroughly.

• Email (plain text — not a link): support@ato108.net
• Live Chat: Available 24/7 via the Platform. Indonesian-speaking agents are on shift from 08:00 to 24:00 WIB (Western Indonesia Time, UTC+7).
• Written correspondence: Address your request to the Data Protection Officer, ato108, as listed in your account's "Contact Us" section.

When submitting a data rights request, please include your registered username and email address so that we can verify your identity before processing the request. We will never ask for your account password in connection with a data rights inquiry.