kutoto is committed to protecting your personal information. This Privacy Policy explains what data we collect, how we use it, who we share it with, and the rights you hold as a registered user based in Indonesia or elsewhere.
Summary: kutoto collects only the personal data needed to operate your account securely, process payments, comply with KYC and anti-money-laundering obligations, and improve your experience on the Platform. We do not sell your data to third parties. You may exercise your data rights at any time by contacting [email protected].
This Privacy Policy ("Policy") describes how kutoto ("we," "us," or "our") collects, uses, stores, and discloses personal information relating to individuals ("you" or "your") who access or use the kutoto Platform at https://kutoto.cam. It applies to all registered users, visitors, and anyone whose personal data we process in connection with the services we offer.
This Policy forms part of the overall legal framework governing your use of kutoto and should be read alongside our Terms & Conditions. By registering an account or continuing to use the Platform, you acknowledge that you have read and understood this Policy.
kutoto primarily serves players based in Indonesia. We recognize that Indonesian users are accustomed to international privacy standards and expect their personal information to be handled with the same care and transparency applied by globally recognized gaming brands. This Policy reflects those expectations.
The data controller responsible for your personal information is the legal entity operating the kutoto brand under its international gaming licence. For all data-related correspondence, including requests to exercise your rights, please use the contact details in Section 15 of this Policy.
Where kutoto engages third-party service providers to process data on its behalf (for example, payment processors or KYC verification partners), those third parties act as data processors operating under our written instructions and are bound by data processing agreements that comply with applicable data protection standards.
kutoto collects the following categories of personal data:
| Category | Examples | Required? |
|---|---|---|
| Identity Data | Full legal name, date of birth, nationality, gender, government-issued ID number (e.g., KTP number for Indonesian residents) | Mandatory (KYC) |
| Contact Data | Email address, phone number, residential address (including city, province, postal code) | Mandatory |
| Financial Data | Bank account details (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata), e-wallet IDs (OVO, DANA, GoPay, ShopeePay, LinkAja), transaction history, deposit and withdrawal amounts | Mandatory |
| Identity Verification Documents | Scan or photograph of KTP (Kartu Tanda Penduduk), passport, driver's licence; selfie with ID; proof of address documents | Mandatory (KYC) |
| Technical Data | IP address, device type, operating system, browser type and version, time zone, session duration, login timestamps | Automatic |
| Usage Data | Pages visited, games played, bet history, search terms entered on the Platform, click-through paths | Automatic |
| Communications Data | Live chat transcripts, support email content, complaint records, survey responses | When applicable |
| Marketing Preferences | Opt-in/opt-out choices for promotional emails, SMS notifications, and bonus communications | Optional |
Special Category Data: kutoto does not intentionally collect sensitive personal data such as health information, biometric data, political opinions, or religious beliefs. If such data is incidentally disclosed during a support interaction, it will not be processed for any purpose other than addressing the specific support query.
We collect personal data through the following channels:
kutoto processes your personal data for the following purposes:
Where applicable data protection law requires a legal basis for processing, kutoto relies on the following:
kutoto does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share data only in the limited circumstances described below:
kutoto operates internationally, and your personal data may be transferred to, stored in, or processed in countries other than Indonesia. These countries may have data protection laws that differ from those in your home jurisdiction.
When transferring data internationally, kutoto applies appropriate safeguards, which may include standard contractual clauses, data processing agreements with equivalent privacy obligations, or transfers to jurisdictions that maintain an adequate level of data protection recognized by international standards.
By using the kutoto Platform, you acknowledge and consent to the international transfer of your personal data as described in this Policy.
kutoto retains personal data for as long as necessary to fulfil the purposes described in this Policy, or as required by applicable law. The following retention guidelines apply:
When retention periods expire, personal data is securely deleted or anonymised so that it can no longer be associated with you as an individual.
Depending on the data protection laws applicable in your jurisdiction, you may hold some or all of the following rights with respect to your personal data held by kutoto:
Request a copy of the personal data we hold about you and information about how it is being used.
Request correction of inaccurate or incomplete personal data held in your account.
Request deletion of your personal data where it is no longer necessary for the original purpose or where you withdraw consent.
Request that we limit processing of your data while a dispute about its accuracy or lawfulness is resolved.
Receive a structured, machine-readable copy of data you have provided to us, where processing is based on consent or contract.
Object to processing based on legitimate interests, including profiling for direct marketing purposes.
Request human review of any significant decision made about you solely by automated means, including account risk scoring.
Withdraw any previously given consent for marketing or non-essential data processing at any time, without affecting prior processing.
To exercise any of the rights listed above, submit a written request to [email protected] with the subject line "Data Rights Request." We will acknowledge your request within 5 business days and aim to fulfill it within 30 calendar days. In complex cases we may extend this period by a further 30 days, with prior written notice to you.
Identity verification for rights requests: To protect your privacy, we will ask you to verify your identity before processing any data rights request. We may request a copy of your KTP or other government-issued ID to confirm that the request is made by the account holder.
kutoto uses cookies and similar tracking technologies to operate the Platform effectively, remember your preferences, and gather analytics data. The types of cookies we use are as follows:
You can manage cookie preferences through your browser settings at any time. Please note that disabling certain cookies may affect the functionality of the Platform, including the ability to maintain a secure login session. Withdrawing consent for marketing cookies does not affect the use of strictly necessary cookies.
kutoto implements industry-standard technical and organizational measures to protect your personal data against unauthorized access, accidental loss, destruction, or disclosure. Our security practices include:
Despite these measures, no system connected to the internet can be guaranteed to be entirely secure. In the event of a data breach that is likely to result in a high risk to your rights or freedoms, kutoto will notify affected users without undue delay and will take immediate steps to contain and remediate the breach.
Your responsibility: You are responsible for keeping your account credentials confidential. Use a strong, unique password and enable any two-factor authentication options available in your account settings. Report any suspected unauthorized access to [email protected] immediately.
The kutoto Platform is strictly for adults aged 21 and over. We do not knowingly collect personal data from individuals under the age of 21. Our registration process includes date-of-birth verification, and all accounts are subject to KYC age confirmation before withdrawals are processed.
If we become aware that personal data has been collected from a person under 21 — whether through misrepresentation at registration or any other means — we will immediately close the account, delete all associated personal data, reverse any deposits where possible, and report the incident as required by our licensing obligations. Parents or guardians who believe a minor has created a kutoto account should contact us at [email protected] without delay.
kutoto may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or the services we offer. When we make material changes, we will notify registered users via email or a prominent on-site notice at least 7 days before the revised Policy takes effect. The "Last Updated" date at the top of this page reflects the most recent revision.
Your continued use of the Platform after the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not agree with the revised Policy, you must stop using the Platform and request account closure prior to the effective date.
For any questions, concerns, or requests relating to this Privacy Policy or the way kutoto handles your personal data, please contact us using the details below:
If you are not satisfied with how we have handled your personal data or responded to a rights request, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction. We would, however, welcome the opportunity to address your concerns directly before you escalate to a regulatory body — please contact our support team first so we can work toward a resolution.
A snapshot of the key commitments kutoto makes to every registered player regarding the safety and fair use of their personal information.
Every byte of data transmitted between your device and kutoto's servers is protected by TLS encryption. Sensitive stored data — including ID documents and payment details — is encrypted at rest using AES-256.
kutoto never sells, rents, or trades your personal information to third parties for their own commercial use. Data is shared only with service partners who are contractually bound to protect it.
You can access, correct, export, or request deletion of your personal data at any time. Manage your marketing preferences directly from your account settings or by contacting our support team.
Your KTP, passport, and proof-of-address documents are processed by vetted identity verification partners and stored in encrypted form. KYC data is never used for any purpose beyond age and identity verification.
kutoto uses cookies only for session security, performance analytics, and — with your explicit consent — personalised promotions. Non-essential cookies can be disabled via your browser settings at any time.
In the unlikely event of a data breach that poses a risk to your rights or freedoms, kutoto will notify affected users promptly and take immediate action to contain the incident and prevent further exposure.
Our support team is available around the clock. You can also review our Terms & Conditions or visit our FAQ for quick answers.
Visit Our FAQ Terms & Conditions Responsible Gaming