At to2288, protecting your personal data is not an afterthought — it is a core operational commitment. This Privacy Policy explains precisely what information we collect when you use our platform, the legal bases on which we process it, how we keep it secure, who we may share it with, how long we retain it, and the rights you hold over your own data. We encourage you to read this document in full before creating an account.
Throughout this Privacy Policy, the following terms carry the meanings set out below. Capitalised terms not defined here carry the same meaning as in to2288's Terms & Conditions.
| Term | Meaning |
|---|---|
| "Platform" | The to2288 website at https://to2288.app, all sub-domains, mobile interfaces, and any associated application programming interfaces (APIs) through which betting and gaming services are delivered. |
| "Personal Data" | Any information relating to an identified or identifiable natural person — for example, a name, national identity number, location data, device identifier, or one or more factors specific to the physical, economic, or online identity of that person. |
| "Processing" | Any operation performed on Personal Data, whether automated or not, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction. |
| "Member" / "you" | Any registered user who holds an active Account on the Platform, or any visitor who accesses the Platform without having registered. |
| "KYC" | Know Your Customer — the identity and document verification process used to confirm a Member's name, age, and residency before processing withdrawals or large deposits. |
| "Cookie" | A small text file placed on your device by the Platform's web server for the purpose of recognising your browser across sessions, maintaining login state, and gathering analytical data. |
| "Third Party" | Any entity other than to2288 and the Member — including payment processors, identity verification providers, analytics vendors, and game content studios. |
| "IDR" / "Rp" | Indonesian Rupiah — the sole currency in which all financial transactions on the Platform are denominated. |
to2288 acts as the data controller in respect of all Personal Data collected from Members and visitors to the Platform. As data controller, to2288 determines the purposes and means of processing your Personal Data and is responsible for ensuring that such processing is carried out in accordance with applicable data protection principles, including the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality.
If you have any questions about how to2288 processes your Personal Data, or if you wish to exercise any of your rights as described in Clause 11, please contact our Data Protection team using the details provided in Clause 15. to2288 has designated a Data Protection Officer (DPO) who is responsible for overseeing compliance with this Privacy Policy and all applicable data protection legislation.
to2288 collects only the Personal Data that is necessary to provide you with a safe, compliant, and enjoyable betting and gaming experience. The categories of data we collect are as follows:
When you register an Account or complete the KYC process, we collect your full legal name (as it appears on your government-issued identity document), date of birth, nationality, and a copy of your Indonesian national identity card (KTP or e-KTP), passport, or driver's licence (SIM). This data is collected to verify that you meet the minimum age requirement of 21 years and to confirm your identity for anti-money-laundering compliance purposes.
We collect your registered email address and Indonesian mobile phone number. These are used to communicate account notifications, security alerts, withdrawal confirmations, and — where you have opted in — promotional messages. Your contact details are also used by our live support agents (available 24/7 in Indonesian) to reach you regarding account queries.
We collect details of the payment methods you register with your Account, including bank account names and partial account numbers for BCA, BRI, BNI, Mandiri, CIMB Niaga, and BSI (Bank Syariah Indonesia), and the registered mobile numbers associated with e-wallet accounts (OVO, DANA, GoPay, ShopeePay, LinkAja). We do not store full bank account numbers or e-wallet PINs. All deposit and withdrawal transactions are recorded, including the amount in IDR, timestamp, payment channel, and settlement status.
We maintain a full record of every wager placed through your Account, including the market selected, stake amount (in Rp), odds at time of placement, settlement result, and the product category (sportsbook, live casino, slots, video poker, in-play betting, or other). This data is necessary for account management, dispute resolution, responsible gaming monitoring, and regulatory compliance. It may include data related to Indonesian football markets such as BRI Liga 1, and game products such as slot gacor (high-return slot) titles from studios including Pragmatic Play and NetEnt.
When you access the Platform, our servers automatically record certain technical information, including your IP address, browser type and version, operating system, device type (desktop, mobile, tablet), screen resolution, referring URL, pages visited, session duration, and click-path data. This information is used for security monitoring, fraud detection, platform performance optimisation, and aggregate analytics. IP address data may be used to perform geo-verification checks consistent with our access control policies.
We retain records of all communications between you and to2288's support team, including live chat transcripts, email correspondence, and any documents or images you submit as part of a support request or KYC review. These records are kept for quality assurance, training, and dispute resolution purposes.
In fulfilling our responsible gaming obligations, we monitor and record patterns in your gambling behaviour, including session frequency and duration, changes in staking patterns, frequency of deposits, and self-imposed limit settings. This data is processed solely to identify early indicators of problem gambling and to enable our responsible gaming team to offer appropriate support.
to2288 collects Personal Data through the following channels:
to2288 processes your Personal Data only where a valid legal basis exists. The legal bases we rely upon are as follows:
| Legal Basis | When We Rely on It |
|---|---|
| Contractual necessity | Processing required to perform the contract between you and to2288 — creating and managing your Account, processing deposits and withdrawals in IDR, settling wagers, and providing customer support. |
| Legal obligation | Processing required to comply with applicable legal and regulatory obligations, including KYC/AML identity verification, age verification, and record-keeping requirements. |
| Legitimate interests | Processing necessary for to2288's legitimate business interests — fraud detection and prevention, platform security, responsible gaming monitoring, product analytics, and IT infrastructure management — provided those interests are not overridden by your rights and freedoms. |
| Consent | Processing for which you have given explicit, informed, and freely withdrawable consent — specifically, sending you promotional communications about bonuses, new game releases, and seasonal offers (e.g., Idul Fitri promotions, Ramadhan cashback). You may withdraw marketing consent at any time via your Account settings or by contacting support. |
| Vital interests | In exceptional circumstances, processing may be necessary to protect the vital interests of a Member or a third party — for example, where we have reason to believe a Member may be in a state of gambling-related crisis and we need to act quickly to protect their welfare. |
The Personal Data collected by to2288 is used exclusively for the following purposes, each of which is matched to a legal basis described in Clause 5:
to2288 may share your Personal Data with the following categories of recipients, strictly on a need-to-know basis and subject to contractual data protection obligations:
To process your deposits and withdrawals, to2288 shares the minimum necessary financial data with its payment processing partners. These include the Indonesian banking infrastructure partners facilitating transfers to and from BCA, BRI, BNI, Mandiri, CIMB Niaga, and BSI, as well as the e-wallet aggregation services connecting to OVO, DANA, GoPay, ShopeePay, and LinkAja. Payment processors are permitted to use your data only to execute the relevant transaction; they may not process it for any other purpose.
to2288 uses licensed KYC and AML service providers to verify your identity and screen your name against international sanctions and watchlists. The identity documents you submit are processed by these providers on to2288's behalf. Documents are stored in encrypted form and deleted from the provider's systems within the period stipulated in our data processing agreement, which does not exceed the retention period specified in Clause 10.
Licensed game studios — including Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Pocket Games Soft — receive a pseudonymous session token (not your real name or contact details) to facilitate game-round delivery, RNG certification, and dispute resolution. Game studios do not receive your full identity data.
to2288's Platform is hosted on enterprise-grade cloud infrastructure. Our hosting and infrastructure providers process technical data on our behalf under strict data processing agreements. All servers used to store Member Personal Data are located in jurisdictions with adequate data protection standards.
to2288 may disclose Personal Data to competent legal or regulatory authorities — including law enforcement agencies and financial intelligence units — where required to do so by applicable law, a court order, or a lawful regulatory request. We will notify you of such a disclosure where legally permitted to do so.
In the event of a merger, acquisition, restructuring, or sale of all or part of to2288's business, Member Personal Data may be transferred to the acquiring entity as part of the transaction. to2288 will notify registered Members of any such change before their data is transferred and will ensure that any acquirer is bound by privacy commitments no less protective than those set out in this Privacy Policy.
to2288 uses cookies and similar tracking technologies (including local storage objects and session tokens) to operate the Platform, personalise your experience, maintain login state, and gather aggregate analytics data. The categories of cookies in use are:
| Cookie Type | Duration | Purpose |
|---|---|---|
| Strictly Necessary | Session / up to 24 hours | Maintain your authenticated login session, prevent cross-site request forgery (CSRF), and enable core Platform functionality including the bet slip, balance display, and deposit flow. |
| Functional | Up to 30 days | Remember your language, preferred odds format, default payment method, and last-visited sport or game category to personalise your experience on return visits. |
| Analytical | Up to 12 months | Collect anonymised data about how Members navigate the Platform — which pages are visited most, where users exit, and which features drive engagement — to inform product improvements. |
| Security & Fraud | Up to 90 days | Fingerprint device attributes to detect multi-account abuse, bot activity, and anomalous login patterns. This data feeds directly into our fraud prevention systems. |
Strictly necessary cookies are placed automatically when you access the Platform and cannot be disabled without breaking core functionality. All other cookie categories are placed only where a valid legal basis applies (legitimate interests for analytical and security cookies; consent for any future marketing cookies). You may manage cookie preferences at any time through your browser settings — most modern browsers allow you to block or delete cookies on a per-domain basis.
to2288 takes the security of your Personal Data seriously and implements a comprehensive set of technical and organisational measures to protect it from unauthorised access, disclosure, alteration, or destruction:
to2288 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, to comply with legal and regulatory obligations, and to resolve any disputes that may arise. The specific retention periods applicable to each category of data are as follows:
| Data Category | Retention Period |
|---|---|
| Identity & KYC documents | For the duration of your Account plus 5 years after Account closure, to comply with AML record-keeping obligations. |
| Financial transaction records | 7 years from the date of the transaction, consistent with standard financial record-keeping requirements. |
| Betting history | 5 years from the date of the wager, for dispute resolution and responsible gaming monitoring purposes. |
| Contact data (email, phone) | For the duration of your Account plus 2 years after Account closure, unless earlier deletion is requested and approved. |
| Support communications | 3 years from the date of the communication, for quality assurance and dispute resolution. |
| Technical / device / IP logs | 90 days for routine access logs; up to 2 years for security-relevant logs where an incident investigation is ongoing. |
| Marketing consent records | Until consent is withdrawn, plus 1 year thereafter as evidence of the consent record. |
When the applicable retention period expires, Personal Data is securely deleted or anonymised so that it can no longer be associated with you as an individual. Anonymised, aggregate data (for example, statistical analytics) may be retained indefinitely as it no longer constitutes Personal Data.
As a Member of to2288 and a data subject, you hold a number of rights in relation to the Personal Data to2288 holds about you. These rights are described below. To exercise any of them, please contact our Data Protection team at [email protected] with a clear description of your request and proof of your identity (to prevent unauthorised access to your data). We will respond within 30 calendar days.
to2288 is strictly an adults-only platform. You must be at least 21 years of age to register an Account, place a wager, or access any real-money gaming service on the Platform. This age requirement applies to all Members regardless of the product category — sportsbook, live casino, slots, video poker, in-play betting, or any other service offered by to2288.
to2288 does not knowingly collect Personal Data from any individual under the age of 21. The KYC identity verification process — which requires submission of a government-issued identity document — is specifically designed to confirm that each Member meets this age threshold before their Account is fully activated for real-money play.
If to2288 discovers, at any point, that an Account has been registered by or on behalf of a person under the age of 21, the following actions will be taken immediately:
to2288 is a platform serving Indonesian players, and the primary processing of Member Personal Data takes place on servers located in jurisdictions assessed to offer an adequate level of data protection. Where it is necessary to transfer Personal Data outside of these jurisdictions — for example, to a game studio's dispute resolution team or to an international identity verification provider — to2288 ensures that appropriate safeguards are in place before any such transfer occurs.
These safeguards include, as applicable: contractual clauses that impose data protection obligations equivalent to those described in this Privacy Policy; assessments of the recipient country's data protection legal framework; and, where required, supplementary technical measures such as encryption of data in transit and at rest.
to2288 does not transfer your Personal Data to any jurisdiction solely on the basis of cost or operational convenience. Every cross-border data transfer is subject to a documented transfer impact assessment. If you would like more information about the safeguards in place for a specific transfer, please contact our Data Protection team using the details in Clause 15.
to2288 reviews this Privacy Policy regularly and reserves the right to amend it at any time to reflect changes in applicable law, regulatory requirements, our business operations, or the services we offer. The "Last Revised" date at the top of this document will be updated whenever a material change is made.
Where a change is material — meaning it affects the way we use your Personal Data in a manner that is less favourable to you, or grants us broader rights over your data — to2288 will provide advance notice of not less than 14 days before the change takes effect. This notice will be delivered via email to your registered address and via a prominent notice displayed when you next log in to the Platform.
For non-material changes — such as corrections of typographical errors, clarification of existing practices, or updates to contact information — no advance notice period applies, and the revised Policy becomes effective from the date it is published on the Platform.
Your continued use of the Platform after the effective date of any revision constitutes your acknowledgement of the updated Privacy Policy. If you do not agree with any changes, you should cease using the Platform and may request Account closure by contacting support.
If you have any questions, concerns, or requests relating to this Privacy Policy or to2288's handling of your Personal Data, please contact us using the details below. Our Data Protection team is committed to responding to all enquiries promptly and thoroughly.
If you are not satisfied with our response to a data protection complaint, you have the right to escalate the matter to the relevant supervisory authority or to seek judicial remedy through the courts. to2288 takes all data protection complaints seriously and will cooperate fully with any regulatory investigation.
Six pillars that define our approach to data protection and member trust on the Platform.
Every connection between your browser and to2288's servers is protected by TLS 1.2+ encryption. Your login credentials, financial data, and personal information are never transmitted in plain text.
to2288 does not sell, rent, or trade your Personal Data to third parties for commercial gain. Data shared with partners is strictly limited to what is necessary to deliver the services you use.
Our identity verification process protects all Members — including you — by ensuring that every Account belongs to a real, age-verified (21+) Indonesian resident before real-money play is permitted.
Your identity data, financial records, and betting history are held in logically separate, independently access-controlled databases. A breach in one environment cannot cascade to others.
to2288 publishes a clear, detailed Privacy Policy written in plain English — not impenetrable legalese. You always know what data we hold, why we hold it, and how long we keep it.
Native Indonesian-speaking support agents are available around the clock to help you exercise your data rights — from Subject Access Requests to marketing opt-outs and account data deletion requests.
A quick-reference summary of the eight rights you hold as a to2288 Member and data subject.
Request a copy of all Personal Data to2288 holds about you, including how it is used.
Ask us to correct inaccurate or incomplete Personal Data held in your Account profile.
Request deletion of your data where it is no longer necessary and no legal obligation requires its retention.
Pause processing of your data while a dispute about accuracy or legal basis is being resolved.
Receive your Personal Data in a machine-readable format (CSV/JSON) for transfer to another service.
Object to processing based on legitimate interests or to all direct marketing at any time.
Revoke marketing or other consent-based processing at any time through your Account settings.
Request human oversight of any automated decision that significantly affects your Account status.
To exercise any of these rights, email [email protected] with the subject "Data Rights Request". We respond within 30 calendar days.
Now that you understand how to2288 handles your data, explore everything the platform has to offer — from live sportsbook markets to premium casino games and high-RTP slots.
Bet on BRI Liga 1, EPL, Champions League, and more with competitive odds and live in-play markets.
Explore SportsbookBrowse hundreds of titles from Pragmatic Play, NetEnt, and Microgaming — including the top slot gacor picks.
Browse SlotsLive dealer baccarat, roulette, and blackjack from Evolution Gaming — streamed in HD, 24/7.
Enter CasinoHave questions about deposits via BCA or BRI, bonus terms, or account verification? Our FAQ has the answers.
View FAQAdults only (21+). Please gamble responsibly. Financial risk applies.