Privacy Policy

For the purposes of this Privacy Policy, the following terms carry the meanings assigned below:

• "Personal Data" means any information that identifies or could reasonably be used to identify a living individual, directly or in combination with other data available to lxtoto.
• "Processing" means any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, and deletion.
• "Data Controller" means lxtoto, which determines the purposes and means of Processing Personal Data collected through the Platform.
• "Data Processor" means any third party that Processes Personal Data on behalf of lxtoto under a written contractual arrangement.
• "Player" / "you" / "your" means any individual who registers an account, accesses, or uses the lxtoto Platform.
• "Platform" means the lxtoto website at https://lxtoto.cam and all associated services, tools, and content.
• "KYC" means Know Your Customer — the identity and age-verification process lxtoto may apply to confirm a player's eligibility.
• "Cookie" means a small text file placed on a user's device by the Platform to store session, preference, or analytics data.

lxtoto collects the following categories of Personal Data from players, depending on how they interact with the Platform:

lxtoto does not collect or store full payment card numbers, CVV codes, or online banking credentials. All payment authentication is handled directly by the player's bank, e-wallet provider, or a PCI-DSS-compliant payment gateway.

lxtoto collects Personal Data through the following means:

• Direct provision: Data you actively submit during account registration, KYC document uploads, deposit and withdrawal requests, bonus claims, support ticket submissions, and live chat conversations.
• Automated technical collection: When you access the Platform, our servers automatically record IP addresses, device identifiers, browser metadata, and session timestamps via standard web server logs, Cookies, and similar tracking technologies.
• Third-party verification services: During KYC, we may share limited identity data with third-party identity verification providers who return a verification result (pass/fail) to us. We do not retain the full raw data beyond what is necessary for compliance purposes.
• Payment processors: When you initiate a deposit or withdrawal, our payment processing partners transmit transaction confirmation data (amount, timestamp, bank or e-wallet reference) to lxtoto's systems. We do not receive or store full account credentials from these providers.
• Game content providers: Third-party game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may transmit game session data (bet amounts, round outcomes, RTP statistics) to lxtoto's systems for settlement, integrity monitoring, and dispute resolution purposes.

lxtoto processes your Personal Data for the following specific, legitimate purposes:

1. Account creation and management: To register your account, verify your identity and age (21+), maintain your profile, and administer your relationship with the Platform.
2. Transaction processing: To process deposits and withdrawals in Indonesian Rupiah (IDR) through your selected bank (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) or e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja) and maintain accurate financial records.
3. Platform security and fraud prevention: To detect, investigate, and prevent fraudulent transactions, unauthorized account access, money laundering, bonus abuse, and other prohibited conduct as defined in our Terms & Conditions.
4. Legal and regulatory compliance: To fulfill KYC obligations, maintain audit trails required by lxtoto's licensing authority, and respond to legally valid requests from law enforcement or regulatory bodies.
5. Customer support: To respond to your support inquiries, resolve disputes, and maintain records of communications for quality assurance purposes.
6. Responsible gaming: To administer deposit limits, session limits, self-exclusion periods, and other player protection tools you activate, and to monitor for patterns indicating potential problem gambling.
7. Platform improvement: To analyze aggregated usage patterns, identify technical issues, optimize game performance, and enhance the overall player experience — using anonymized or pseudonymized data wherever possible.
8. Marketing communications: To send you promotional offers, bonus notifications, and platform updates via email or WhatsApp, subject to your communication preferences. You may opt out of marketing communications at any time by contacting our support team.

lxtoto processes Personal Data on the following legal grounds, consistent with internationally recognized data protection principles:

• Contractual necessity: Processing required to fulfill lxtoto's obligations to you under the Terms & Conditions — including account management, payment processing, bet settlement, and customer support.
• Legal obligation: Processing required to comply with applicable laws, licensing requirements, anti-money laundering (AML) regulations, and KYC obligations to which lxtoto is subject as an online gaming operator.
• Legitimate interests: Processing conducted for lxtoto's legitimate operational interests — including fraud detection, platform security, abuse prevention, and service improvement — where those interests are not overridden by your fundamental data rights.
• Consent: Processing based on your freely given, specific, and informed consent — primarily in the context of optional marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

lxtoto retains Personal Data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention periods apply:

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymized so that it can no longer be attributed to any identifiable individual. Anonymized, aggregated data may be retained indefinitely for analytical purposes.

lxtoto does not sell, rent, or trade your Personal Data to third parties for their own commercial purposes. We share Personal Data only in the following limited circumstances:

• Payment processors and banking partners: We share the minimum necessary financial data with our payment processing partners and local banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) to facilitate deposits and withdrawals in IDR.
• Identity verification providers: We engage third-party KYC service providers to verify identity documents and age on our behalf. These providers process data strictly as Data Processors under binding contractual terms and are prohibited from using your data for any other purpose.
• Game content providers: Game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft receive session identifiers and bet data necessary to operate their games and return results to the Platform. They do not receive your full identity profile.
• IT infrastructure and cloud service providers: lxtoto uses cloud hosting and cybersecurity service providers who may have access to encrypted data stored on our servers in the course of providing infrastructure services. All such providers operate under strict data processing agreements.
• Legal and regulatory authorities: We may disclose Personal Data to law enforcement agencies, regulatory bodies, or courts when required to do so by a legally valid order, subpoena, warrant, or equivalent legal instrument. We will notify you of such a disclosure where we are legally permitted to do so.
• Fraud and AML networks: In cases of confirmed or strongly suspected fraud or money laundering activity, we may share relevant data with industry fraud-prevention networks and financial intelligence partners to protect the integrity of the Platform and the broader gaming ecosystem.

lxtoto's primary player base is located in Indonesia (Jakarta, Surabaya, Bandung, Medan, Bali, Yogyakarta, Semarang, Makassar, and other cities). Some of our service providers — including cloud infrastructure hosts and game content providers — operate data centers located outside Indonesia. Where Personal Data is transferred internationally, lxtoto ensures that appropriate safeguards are in place, including:

• Contractual data protection clauses (equivalent to Standard Contractual Clauses) incorporated into all agreements with international Data Processors.
• Requiring receiving parties to implement security standards at least equivalent to those applied by lxtoto domestically.
• Conducting transfer impact assessments for high-risk data categories, such as KYC documents and financial records, before any cross-border transfer is authorized.

By using the Platform, you acknowledge that your Personal Data may be transferred to and processed in countries outside Indonesia. lxtoto takes all reasonable steps to ensure that such transfers are conducted securely and in accordance with applicable data protection principles.

lxtoto implements a layered security architecture to protect your Personal Data against unauthorized access, alteration, disclosure, and destruction. Our technical and organizational security measures include:

• TLS/SSL encryption: All data transmitted between your browser or device and lxtoto's servers is encrypted using industry-standard TLS 1.2 or higher protocols. The padlock indicator in your browser confirms an active secure connection.
• Data encryption at rest: Sensitive Personal Data — including KYC documents, financial records, and identity information — is encrypted at rest using AES-256 or equivalent encryption standards.
• Access controls: Access to Personal Data within lxtoto's systems is restricted on a strict need-to-know basis. Staff access is governed by role-based permissions, and all access events are logged for audit purposes.
• Multi-factor authentication: Internal systems containing Personal Data require multi-factor authentication for all staff access, mitigating the risk of credential-based breaches.
• Regular security assessments: lxtoto's infrastructure undergoes regular vulnerability scans and periodic penetration testing by qualified independent security professionals.
• Incident response: lxtoto maintains a documented data breach response procedure. In the event of a breach that materially affects your Personal Data, you will be notified without undue delay, with details of the breach and the steps we are taking to mitigate harm.

While lxtoto takes all reasonable precautions to protect your data, no internet-based system can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for notifying us promptly if you suspect any unauthorized access to your account.

lxtoto uses Cookies and similar tracking technologies to operate the Platform effectively and to improve your experience. The following categories of Cookies are used:

Strictly necessary Cookies are required for the Platform to function and cannot be disabled without preventing you from logging in or using core features. All other Cookie categories may be managed through your browser settings. Note that disabling functional or analytics Cookies may affect your Platform experience but will not prevent you from accessing the service entirely.

lxtoto does not use third-party advertising or retargeting Cookies to track your activity across other websites for commercial advertising purposes.

As a player on lxtoto, you hold the following rights with respect to your Personal Data. To exercise any of these rights, please contact us at the details provided in Section 15:

• Right of Access: You have the right to request a copy of the Personal Data lxtoto holds about you, along with information about how it is being used. We will respond to verified access requests within 30 days.
• Right to Rectification: If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request that we correct it without undue delay.
• Right to Erasure: You may request deletion of your Personal Data where it is no longer necessary for the purpose it was collected, where you withdraw consent (and no other legal basis applies), or where processing is unlawful. Note that we may be legally required to retain certain data — particularly KYC and financial records — for up to five years after account closure, which will limit our ability to fulfill erasure requests in full.
• Right to Restriction of Processing: You may request that we restrict the processing of your Personal Data in certain circumstances — for example, while a dispute regarding accuracy is being resolved.
• Right to Data Portability: Where processing is based on your consent or on a contract, and is carried out by automated means, you have the right to receive your Personal Data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing based on legitimate interests at any time. You also have an unconditional right to object to processing for direct marketing purposes, including profiling related to marketing.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

lxtoto is strictly an adults-only platform. You must be at least 21 years of age to register an account, make a deposit, or place any bet on the Platform. lxtoto does not knowingly collect Personal Data from any individual under the age of 21.

If we discover or are notified that Personal Data has been submitted by a person under the age of 21, we will immediately suspend the associated Account, delete the data collected from that individual to the extent legally permissible, and return any deposited funds to the originating payment method.

If you are a parent or guardian and believe that a minor under your care has registered on lxtoto, please contact us immediately at [email protected] so that we can take prompt corrective action.

The lxtoto Platform integrates third-party services to deliver its full range of products — including live casino streams, slot games, sports data feeds, and payment processing. Each of these providers operates under its own privacy policy and data practices, which are independent of this Policy.

Third-party game providers whose software is available on lxtoto — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft — may process limited technical session data as part of delivering their game content. lxtoto contractually limits the data these providers may collect and prohibits them from using player data for purposes beyond game delivery and integrity monitoring.

lxtoto is not responsible for the data practices of third-party providers operating independently of our contractual arrangements. We encourage you to review the privacy policies of any third-party service you interact with outside the lxtoto Platform environment.

lxtoto reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform functionality. When material changes are made, we will notify active players via email and display a prominent notice on the Platform at least seven (7) days before the revised Policy takes effect.

The effective date at the top of this page reflects when the current version came into force. Your continued use of the Platform after the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not agree to the revised Policy, you must cease using the Platform and contact our support team to arrange Account closure.

We recommend that you review this Privacy Policy periodically to remain informed about how lxtoto handles your Personal Data. The most current version is always available at https://lxtoto.cam/privacy-policy.

For any questions, concerns, or formal requests relating to this Privacy Policy or lxtoto's handling of your Personal Data, please reach out to our dedicated privacy team through the following channels:

• Email: [email protected] — please include "Privacy Request" in the subject line for faster routing.
• Live Chat: Available 24/7 via the Platform interface. Ask to be connected to our privacy compliance team for data rights requests.
• WhatsApp: +62 811 0000 9988 — monitored during WIB business hours (08:00–22:00 WIB).

All formal data rights requests should be submitted in writing (email or live chat transcript) so that a proper record can be maintained. lxtoto commits to acknowledging all written privacy inquiries within 48 hours and providing a substantive response within 30 calendar days of receipt.