Privacy Policy

1 Introduction

mototo ("we", "us", "our") operates the online betting and casino platform accessible at mototo.cam. In the course of providing our services — which include sports betting, live casino games, slot games, crash games, and togel (Indonesia's traditional numbers lottery) — we necessarily collect and process certain personal information about registered players, visitors, and prospective users.

This Privacy Policy ("Policy") describes the categories of personal data we collect, the purposes for which we process it, the parties with whom we may share it, the security measures we apply to protect it, the retention periods we observe, and the rights you hold in relation to it. We have written this Policy in plain, professional English because we believe you deserve to understand clearly how your data is used — not merely to have a policy exist.

mototo's primary market is Indonesia. We specifically serve English-preference Indonesian players — individuals who prefer to engage with international gaming brands in English while benefiting from Indonesian payment methods such as BCA, BRI, BNI, Mandiri, OVO, DANA, and GoPay. This market context shapes certain data processing decisions described in this Policy, particularly around payment processing, KYC compliance, and customer support.

For the purposes of applicable data protection law, mototo is the data controller in respect of the personal data covered by this Policy.

2 Categories of Personal Data We Collect

We collect personal data across the following categories:

We do not intentionally collect special categories of personal data (such as health information, religious beliefs, or political opinions). If you voluntarily disclose such data — for example, when requesting special accommodations through customer support — we will treat it with heightened care and process it only to the extent necessary to respond to your request.

3 How We Collect Your Data

mototo collects personal data through the following channels:

• Direct provision by you: When you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, or participate in a promotion.
• Automated collection: When you access and use the Platform, our servers automatically log technical data including IP address, device identifiers, page views, and session activity. This occurs whether or not you are logged into an account.
• Payment processors: When you initiate a deposit or withdrawal, our payment processing partners share transaction confirmation data with us, including the payment method identifier, amount, and status.
• Identity verification providers: If we use a third-party KYC service to verify your identity documents, that provider shares verification results (pass/fail and relevant data points) with us.
• Cookies and similar technologies: As described in Section 7, we use first-party cookies and analytics tools to understand how users navigate the Platform.
• Referral partners: If you arrive at mototo via an affiliate or referral link, we may receive a referral identifier from the referring party. We do not receive personal data about you from affiliates beyond this ident ifier.

4 How We Use Your Personal Data

mototo uses the personal data we collect for the following purposes:

We do not use your personal data for automated profiling that produces legal or similarly significant effects without human review. Our responsible gaming monitoring system may flag accounts for review, but all consequential decisions — such as enforcing deposit limits or initiating account closures — involve human oversight.

5 Legal Basis for Processing

mototo processes your personal data on the following legal grounds:

• Contractual necessity: Processing required to fulfill our obligations under the Terms & Conditions — including account creation, bet settlement, and payment processing — is carried out on the basis that it is necessary to perform the contract between you and mototo.
• Legal obligation: Certain processing activities, particularly KYC identity verification, anti-money laundering (AML) checks, and transaction record-keeping, are carried out because we are legally required to do so under applicable international gaming regulations.
• Legitimate interests: We process Technical Data, Account Activity Data, and Cookie & Tracking Data on the basis of our legitimate interest in operating a secure, fraud-free platform, improving user experience, and detecting misuse. We apply a balancing test to ensure our interests do not override your fundamental privacy rights.
• Consent: Where we send you promotional or marketing communications — including bonus offers, seasonal promotions around events such as Idul Fitri, Ramadhan, and Indonesian Independence Day — we do so on the basis of your freely given consent. You may withdraw this consent at any time without affecting the lawfulness of processing that occurred before withdrawal.

6 How We Share Your Data

6.1 We do not sell your data. mototo does not sell, rent, or trade your personal data to any third party for their own commercial purposes. The following describes the limited circumstances in which we share data:

6.2 Payment processors. When you make a deposit or request a withdrawal, we share the minimum necessary financial and identity data with our payment processing partners — including local bank transfer facilitators and e-wallet providers such as OVO, DANA, GoPay, ShopeePay, and LinkAja — to execute the transaction. These partners are contractually bound to use your data solely for payment processing.

6.3 Identity verification providers. We engage third-party KYC and AML screening providers to verify player identities and screen against international sanctions lists. These providers process your identity documents under strict data processing agreements and are not permitted to use your data for any purpose other than verification.

6.4 Game content providers. Third-party game studios — including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft — may receive a pseudonymous player identifier and session token to facilitate game launching and result recording. These studios do not receive your full name, contact details, or financial information.

6.5 Analytics providers. We use privacy-respecting analytics tools to understand Platform usage patterns. Data shared with analytics providers is aggregated or pseudonymized and does not identify you individually.

6.6 Legal authorities. We may disclose personal data to law enforcement agencies, regulatory authorities, or courts when required to do so by applicable law, a valid court order, or where we have a good-faith belief that disclosure is necessary to prevent or investigate fraud, money laundering, or other criminal activity involving our Platform.

6.7 Corporate transactions. If mototo undergoes a merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity as part of that transaction. We will notify you via email prior to your data becoming subject to a materially different privacy policy.

7 Cookies & Tracking Technologies

mototo uses cookies and similar tracking technologies on the Platform for the purposes described below. A cookie is a small text file placed on your device by our web server when you visit the Platform.

mototo does not use third-party advertising cookies or cross-site tracking technologies. We do not participate in real-time bidding (RTB) advertising networks. You may disable cookies through your browser settings; however, disabling strictly necessary cookies will prevent you from logging into your account or using core Platform features.

8 Data Security

mototo implements a layered security architecture to protect your personal data against unauthorized access, disclosure, alteration, and destruction. Our security measures include:

• Transport encryption: All data transmitted between your browser and our servers is protected by TLS 1.2 or higher (256-bit encryption). Our SSL certificate is maintained continuously and renewed before expiry.
• Encryption at rest: Sensitive personal data fields — including passwords, financial account numbers, and identity document scans — are encrypted at rest using AES-256 encryption.
• Access controls: Access to personal data within mototo's systems is restricted on a need-to-know basis using role-based access controls (RBAC). All internal access to player data is logged and subject to periodic audit.
• Password security: Player passwords are stored as salted cryptographic hashes. mototo staff cannot view your plaintext password under any circumstances.
• Intrusion detection: Our infrastructure includes automated intrusion detection and anomaly monitoring systems that alert our security team to suspicious access patterns in real time.
• Penetration testing: We commission independent security assessments on a regular basis to identify and remediate vulnerabilities before they can be exploited.
• Incident response: In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify affected players without undue delay and take immediate remedial action.

9 Data Retention

mototo retains personal data only for as long as is necessary to fulfill the purpose for which it was collected, subject to applicable legal and regulatory minimum retention periods. The following schedule sets out our standard retention periods:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized. Anonymized data that can no longer identify you may be retained indefinitely for aggregate statistical and research purposes.

10 Your Data Rights

You have the following rights in relation to the personal data that mototo holds about you. We take these rights seriously and will respond to all valid requests within 30 days of receipt:

To exercise any of the above rights, please contact our Data Protection team using the details in Section 15. We may need to verify your identity before processing your request. We will not charge a fee for handling rights requests unless a request is manifestly unfounded or excessive, in which case we will notify you before any fee is applied.

11 Children's Privacy

The mototo Platform is strictly intended for adults aged 21 and older. We do not knowingly collect personal data from persons under the age of 21. If we discover or are notified that we have inadvertently collected personal data from a person under 21, we will immediately close the associated account, return any deposited funds, and permanently delete the personal data in question.

If you are a parent or guardian and believe that a person under 21 in your care has registered an account with mototo, please contact us immediately at the address provided in Section 15. We take underage gambling extremely seriously and will act on all reports without delay.

12 International Data Transfers

mototo operates as an internationally licensed platform. Your personal data may be processed in countries outside Indonesia where our service providers, data centers, or game content partners are located. These countries may have data protection frameworks that differ from those applicable in Indonesia.

Where personal data is transferred internationally, mototo ensures that appropriate safeguards are in place, including:

• Data processing agreements that incorporate internationally recognized standard contractual clauses (SCCs) or equivalent mechanisms.
• Transfer impact assessments where required, to evaluate whether the destination jurisdiction provides an adequate level of protection for the data being transferred.
• Technical measures such as end-to-end encryption that protect data in transit regardless of the legal environment in the destination country.

By using the Platform, you acknowledge that your personal data may be transferred internationally in accordance with the safeguards described above.

13 Third-Party Links and Services

The Platform may display references to or information about third-party services, including payment providers and game studios. mototo does not operate those third-party websites or services, and this Privacy Policy does not apply to them. We encourage you to review the privacy policies of any third-party service you interact with independently of the mototo Platform.

mototo is not responsible for the data practices, security standards, or privacy policies of any third-party website or service, even where access to that service is facilitated through the Platform.

14 Changes to This Privacy Policy

mototo may update this Privacy Policy periodically to reflect changes in our data processing practices, legal obligations, or business operations. When we make material changes — meaning changes that meaningfully affect your rights or how we use your personal data — we will:

• Post the updated Policy on this page with a revised effective date prominently displayed at the top.
• Send a notification to your registered email address at least 14 days before the updated Policy takes effect.
• Display an in-Platform notice for a period of at least 14 days following publication of the update.

For non-material changes — such as corrections to typographical errors, clarifications of existing language, or updates to contact details — the revised Policy will take effect immediately upon publication. Your continued use of the Platform after an updated Policy takes effect constitutes your acceptance of the revised terms. If you do not accept the revised Policy, you should close your account and cease using the Platform before the effective date.

15 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way mototo handles your personal data, please reach out to our Data Protection team:

When submitting a data rights request, please provide your registered account username, the specific right you wish to exercise, and sufficient information for us to verify your identity. We will not be able to process requests where we cannot reasonably confirm the identity of the requesting individual.