Privacy Policy

1. Definitions

The following definitions apply throughout this Privacy Policy. Terms defined in our Terms & Conditions and used here carry the same meaning unless otherwise specified.

Term	Meaning
"Personal Data"	Any information that identifies or could reasonably identify a living individual, directly or in combination with other data.
"Processing"	Any operation performed on Personal Data — collection, storage, use, disclosure, erasure, or any other handling.
"Data Controller"	The entity that determines the purposes and means of processing Personal Data — in this case, rogtot.
"Data Processor"	A third party that processes Personal Data on rogtot's behalf (e.g., payment processors, KYC providers).
"Consent"	A freely given, specific, informed, and unambiguous indication of a data subject's agreement to the processing of their Personal Data.
"Cookie"	A small text file stored on a user's device by a website for the purpose of retaining session state, preferences, or analytics data.
"KYC"	Know Your Customer — the identity and age verification process required of all rogtot players.
"Player" / "you" / "your"	Any individual who registers, accesses, or interacts with the rogtot platform.

2. Data Controller

rogtot, operating at https://rogtot.cam, acts as the Data Controller for all Personal Data collected through the platform and its associated services. As the Data Controller, rogtot is responsible for determining the purposes for which your Personal Data is processed and ensuring that all processing is conducted lawfully, fairly, and transparently.

For all privacy-related inquiries, data subject rights requests, and complaints, you may contact our designated Data Protection Officer at the address provided in Section 16 of this Policy.

3. Data We Collect

rogtot collects only the Personal Data that is necessary for the specific purposes described in this Policy. The categories of data we collect are detailed in the table below.

Data Category	Specific Data Points	Purpose
Identity Data	Full legal name, date of birth, nationality, KTP (National Identity Card) number, selfie photograph	Account registration, KYC verification, age compliance (21+)
Contact Data	Email address, mobile phone number, residential address	Account communications, customer support, promotional notifications
Financial Data	Bank account name and number (BCA, BRI, BNI, Mandiri, CIMB Niaga), e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja), transaction history	Deposit/withdrawal processing, fraud detection, AML compliance
Gaming Activity Data	Game sessions, bet amounts, win/loss history, bonus usage, responsible gaming tool activations	Service delivery, bonus management, responsible gaming monitoring
Technical Data	IP address, device type, operating system, browser type, session timestamps, geolocation (city-level)	Security, fraud prevention, platform optimization
Communications Data	Live chat transcripts, email correspondence, support ticket content	Customer service, quality assurance, dispute resolution
Marketing Preferences	Opt-in/opt-out status for promotional communications, preferred contact channel	Targeted promotions (with consent only)

3.1 Sensitive Personal Data

rogtot does not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or health information beyond what is strictly necessary for responsible gaming assessments. Where responsible gaming self-assessments reveal information that could be considered health-related (e.g., problem gambling indicators), such information is handled with the highest degree of confidentiality and used solely to provide appropriate player protection support.

4. How We Collect Data

4.1 Directly From You

The majority of Personal Data rogtot holds is provided directly by you at the time of account registration, during KYC verification, when you contact our support team, when you complete responsible gaming self-assessments, or when you opt into promotional communications. You are under no obligation to provide Personal Data beyond the minimum required for account creation, but failure to provide mandatory data may prevent us from delivering certain services.

4.2 Automatically During Platform Use

Certain Technical Data is collected automatically when you access and interact with the rogtot platform. This includes your IP address, device identifiers, browser fingerprint data, session duration, pages visited, and interaction events (clicks, scrolls, game launches). This data is collected via server logs, cookies, and web analytics tools as described in Section 8.

4.3 From Third Parties

rogtot may receive Personal Data from third-party sources in specific circumstances, including:

• Payment processors: Transaction confirmation data from BCA, BRI, BNI, Mandiri, OVO, DANA, and other payment partners.
• KYC/identity verification providers: Document authenticity confirmation and fraud risk scores from our accredited verification partners.
• Anti-fraud and AML screening services: Politically exposed person (PEP) checks and sanctions list screening results.
• Analytics platforms: Aggregated behavioral data used to improve platform performance and user experience.

5. Legal Basis for Processing

rogtot processes your Personal Data only where a valid legal basis exists. The primary legal bases we rely upon are as follows:

Legal Basis	When It Applies
Contractual Necessity	Processing required to create and maintain your account, process deposits and withdrawals, deliver game services, and manage bonuses — all of which are core to the contract between you and rogtot.
Legal Obligation	Processing required to comply with anti-money laundering (AML) obligations, age verification requirements, fraud prevention duties, and applicable financial regulations.
Legitimate Interests	Processing for fraud detection, platform security, internal analytics, improving service quality, and responsible gaming monitoring — where our interests do not override your fundamental rights.
Consent	Processing for direct marketing communications and the use of non-essential cookies. You may withdraw consent at any time without affecting prior processing.

6. How We Use Your Data

6.1 Service Delivery

We use your Personal Data to create and manage your rogtot account, process deposits and withdrawals through your chosen Indonesian payment channels, deliver gaming services, calculate and award bonuses, manage your VIP tier status, and provide 24/7 customer support in Indonesian and English. These processing activities are necessary for the performance of your contract with rogtot and cannot be opted out of while you maintain an active account.

6.2 Compliance & Fraud Prevention

rogtot uses identity, financial, and technical data to verify your age (21+ requirement), screen for politically exposed persons and sanctions list matches, detect and prevent fraud and money laundering, investigate suspicious betting patterns, and maintain the integrity of our gaming environment. These activities are conducted under legal obligation and legitimate interest grounds.

6.3 Responsible Gaming

We analyze your gaming activity data to identify behavioral indicators that may suggest developing problem gambling patterns. This analysis enables our responsible gaming team to proactively reach out with support resources, enforce player-set limits, and apply protective measures where necessary. This processing is conducted under our legitimate interest in player welfare and our duty of care toward vulnerable players.

6 .4 Marketing Communications

With your explicit consent, rogtot may use your contact data and gaming preferences to send you personalized promotional offers, bonus notifications, seasonal campaigns (including Idul Fitri, Ramadhan, and Indonesian Independence Day promotions), and platform updates. You may withdraw your consent to marketing communications at any time by contacting our support team. Withdrawal of marketing consent does not affect your ability to use rogtot's core services.

6.5 Platform Improvement

Aggregated and anonymized technical and gaming activity data is used to analyze platform performance, optimize user experience, test new features, and improve our product offering. Where data is fully anonymized and cannot be re-linked to any individual, it falls outside the scope of this Privacy Policy.

7. Data Sharing & Disclosure

7.1 Principle of Minimum Disclosure

rogtot does not sell, rent, or trade your Personal Data to third parties for their own commercial purposes. We share Personal Data only where it is strictly necessary to deliver our services, comply with legal obligations, or protect the legitimate interests of rogtot and its players.

7.2 Authorized Third-Party Processors

rogtot engages the following categories of Data Processors who may handle your Personal Data on our behalf, subject to binding data processing agreements:

• Payment processors: BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, and LinkAja — for the purpose of executing deposit and withdrawal transactions.
• KYC and identity verification providers: Accredited third-party services used to authenticate identity documents and perform age verification.
• Anti-fraud and AML screening services: Platforms that screen transactions and player profiles against sanctions lists and fraud databases.
• Game content providers: Studios including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft receive minimal session data required to deliver their games — they do not receive your financial or identity data beyond what is technically necessary.
• Cloud infrastructure and hosting providers: Servers and data storage services that host the rogtot platform and its databases under strict confidentiality agreements.
• Customer support platforms: Live chat and ticketing systems used to manage player support interactions.

7.3 Legal Disclosure

rogtot may disclose your Personal Data to law enforcement agencies, regulatory authorities, or other competent bodies when required to do so by applicable law, court order, or regulatory mandate. In such cases, we will disclose only the minimum data necessary to satisfy the legal requirement and, where legally permissible, will notify you of the disclosure.

7.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of rogtot's business, your Personal Data may be transferred to the acquiring entity as part of the transaction. You will be notified of any such transfer and of any material changes to this Privacy Policy that result from the transaction, with a reasonable notice period before the changes take effect.

8. Cookies & Tracking

8.1 What Are Cookies

Cookies are small text files placed on your device when you visit the rogtot platform. They enable the site to remember your preferences, maintain your login session, and collect analytical data about how you interact with the platform. Some cookies are essential for the site to function; others are optional and require your consent.

8.2 Categories of Cookies We Use

Cookie Type	Purpose	Consent Required
strictly-necessary	Maintain login sessions, apply security settings, process transactions, remember responsible gaming limit preferences.	No — essential for platform operation
functional	Remember display preferences, language settings, game lobby layout, and recently played games.	No — derived from legitimate interest
analytics	Measure page views, session durations, click paths, and feature usage to improve platform performance.	Yes — consent-based
marketing	Track campaign effectiveness, personalize promotional content, and measure conversion from marketing channels.	Yes — consent-based

8.3 Managing Cookies

You may manage your cookie preferences at any time through your browser settings. Most modern browsers allow you to view, block, or delete cookies on a per-site basis. Note that disabling strictly-necessary cookies will impair core platform functionality, including login and transaction processing. Instructions for managing cookies in major browsers (Chrome, Firefox, Safari, Edge) are available through their respective help centers.

8.4 Similar Tracking Technologies

In addition to cookies, rogtot may use web beacons (transparent pixel images embedded in emails), local storage objects, and session storage to collect Technical Data and measure marketing email engagement. These technologies are subject to the same consent framework as cookies.

9. Data Retention

rogtot retains Personal Data only for as long as is necessary for the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention schedule applies:

Data Category	Retention Period	Basis
Account & Identity Data	Duration of account + 5 years post-closure	AML legal obligation, dispute resolution
Financial Transaction Data	Duration of account + 7 years post-closure	Financial regulation compliance
KYC Documents	Duration of account + 5 years post-closure	AML/KYC legal obligation
Gaming Activity Data	Duration of account + 3 years post-closure	Responsible gaming monitoring, dispute resolution
Support Communications	3 years from date of communication	Quality assurance, dispute resolution
Marketing Preferences	Until consent is withdrawn + 1 year	Consent record-keeping
Analytics & Technical Data	Up to 26 months (aggregated/anonymized)	Legitimate interest in platform improvement

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymized. Where deletion is not immediately technically feasible (e.g., data in backup archives), the data is isolated from active processing and deleted at the next scheduled purge cycle.

10. Data Security

10.1 Technical Safeguards

rogtot implements a layered security architecture to protect your Personal Data from unauthorized access, accidental loss, destruction, or disclosure. Our technical security measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and rogtot servers.
• AES-256 encryption for sensitive data stored at rest, including KYC documents and financial records.
• Multi-factor authentication (MFA) available for all player accounts as an additional login security layer.
• Intrusion detection and prevention systems (IDS/IPS) monitoring network traffic for anomalies in real time.
• Regular penetration testing by independent security firms to identify and remediate vulnerabilities.
• Web Application Firewall (WAF) filtering malicious traffic before it reaches application servers.

10.2 Organizational Safeguards

Access to Personal Data within rogtot is governed by the principle of least privilege — staff members can only access the data necessary for their specific role. All personnel with access to Personal Data are bound by confidentiality obligations and receive regular data protection training. Access logs are maintained and reviewed periodically.

10.3 Data Breach Response

In the event of a Personal Data breach that poses a risk to affected players, rogtot will take immediate containment steps and notify affected players without undue delay — and in any case within 72 hours of becoming aware of the breach — providing a clear description of the incident, the data affected, and the remediation steps taken. Players are encouraged to report any suspected unauthorized account access to our support team immediately at [email protected].

11. Your Privacy Rights

As a rogtot player, you hold specific rights over your Personal Data. rogtot is committed to honoring these rights promptly and without undue obstacles. Your rights are summarized below.

11.1 Exercising Your Rights

To exercise any of the rights listed above, submit a written request to our Data Protection Officer at [email protected] with the subject line "Data Subject Rights Request". We will acknowledge your request within 3 business days and fulfill it within 30 calendar days. In complex cases, we may extend this period by a further 30 days, notifying you of the extension and the reason within the initial 30-day window.

We may need to verify your identity before processing a rights request to protect against fraudulent or unauthorized submissions. Verification will typically involve confirming your registered email address and one additional piece of identifying information.

12. Protection of Minors

rogtot does not knowingly collect Personal Data from individuals under the age of 21. Our platform is strictly for adults aged 21 and over, consistent with our Terms & Conditions eligibility requirements. Age verification is a mandatory step in the account registration and KYC process.

If rogtot discovers or is notified that Personal Data belonging to a person under 21 has been collected, we will take immediate steps to delete that data, close the associated account, return any net deposited funds, and block the device and IP address from future registrations. If you believe a minor has accessed rogtot using your details or by circumventing our age-verification process, please notify us immediately at [email protected].

13. International Data Transfers

rogtot's primary player base is located in Indonesia, and we endeavor to keep Personal Data processing within the region wherever operationally feasible. However, some of our Data Processors — including cloud infrastructure providers, KYC verification services, and game studio partners — may process data in jurisdictions outside Indonesia.

Where Personal Data is transferred internationally, rogtot ensures that appropriate safeguards are in place to maintain a level of data protection equivalent to the standards described in this Policy. These safeguards include binding contractual clauses in data processing agreements, transfer impact assessments, and the selection of processors who maintain internationally recognized security certifications (such as ISO 27001).

By using rogtot's services, you acknowledge that your Personal Data may be transferred to and processed in countries outside Indonesia. If you have concerns about international data transfers, please contact our Data Protection Officer using the details in Section 16.

14. Third-Party Services

The rogtot platform integrates third-party game content from studios such as Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft. These providers operate their own privacy practices for data that passes through their gaming systems. While rogtot ensures that data-sharing agreements with these providers meet our standards, we encourage you to review the privacy policies of major game providers if you have specific concerns about game-session data handling.

rogtot's platform may display informational references that align with Indonesian sporting and cultural events — including BRI Liga 1 football matches featuring clubs such as Persija Jakarta, Persib Bandung, and Bali United, badminton tournaments, and MotoGP Mandalika coverage. Any third-party data involved in delivering live sports data feeds is handled under the same data processing agreement standards described in Section 7.

rogtot is not responsible for the privacy practices of any third-party website, application, or service that is not operated by rogtot, even if referenced informally in our content. This Privacy Policy applies exclusively to data processed by rogtot in connection with your rogtot account and use of our platform.

15. Policy Amendments

rogtot reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable legal requirements, or operational needs. Material changes — those that meaningfully affect how we use your Personal Data or the rights available to you — will be communicated to registered players by email notification and/or a prominent in-platform notice at least 7 days before the changes take effect.

The effective date at the top of this document reflects the date of the most recent revision. We encourage you to review this Policy periodically. Your continued use of rogtot's services after the effective date of any amendment constitutes your acknowledgment of the revised Policy. The current version of this Privacy Policy will always be accessible at https://rogtot.cam/privacy-policy.

16. Contact & Complaints

16.1 Data Protection Officer

For all privacy-related inquiries, data subject rights requests, or concerns about how rogtot handles your Personal Data, please contact our Data Protection Officer through the following channel:

16.2 Complaints

If you are dissatisfied with rogtot's response to a privacy concern or believe we are processing your Personal Data in a manner inconsistent with this Policy, you have the right to escalate your complaint. In the first instance, we encourage you to raise the matter directly with our Data Protection Officer so that we have the opportunity to resolve it internally. If you remain unsatisfied after our formal response, you may seek independent resolution through the appropriate data protection authority or dispute resolution body in your jurisdiction.