Data Protection Statement
This Privacy Policy explains how estoto collects, processes, stores, uses, and protects your personal information. We are committed to safeguarding your privacy and ensuring transparency in all data handling practices.
Our Data Protection Commitments
Six core privacy commitments that guide every decision we make about your personal data.
All data transmitted between your device and estoto's servers is encrypted using industry-standard 256-bit SSL technology. Your login credentials, payment details, and personal information are never sent in plain text.
Your personal information is stored in encrypted databases hosted in secure data centers. Access to player data is restricted to authorized personnel only and is logged for audit purposes.
estoto will never sell, rent, or trade your personal information to third parties for marketing purposes. Your data is used solely to provide and improve our services.
You have the right to know what data we collect, why we collect it, and how it is used. This Privacy Policy documents every category of personal information estoto processes.
You can request a copy of your personal data at any time. If any information is inaccurate or outdated, you have the right to request corrections via our support team.
Subject to legal retention requirements, you may request deletion of your account and associated personal data. We will process deletion requests within 30 days of account closure.
estoto, accessible at https://estoto.cam, is the data controller responsible for the processing of your personal information. As data controller, estoto determines the purposes and means of processing personal data and is accountable for compliance with applicable data protection laws and regulations.
estoto operates as an internationally licensed online betting and casino platform serving the Indonesian market. All data processing activities are conducted in accordance with international data protection standards and the specific requirements of the gaming industry, including anti-money-laundering (AML) and Know Your Customer (KYC) obligations.
estoto collects the following categories of personal information to provide, maintain, and improve our services:
Most personal data is collected directly from you when you:
Certain data is collected automatically through your use of the platform:
In limited circumstances, estoto may receive personal data from third-party providers:
estoto processes your personal information for the following purposes:
Note: You may opt out of marketing communications at any time by adjusting your account preferences or clicking "Unsubscribe" in any promotional email. Service-related emails (account security alerts, transaction confirmations) cannot be disabled as they are essential to platform operation.
estoto processes your personal data under the following legal grounds:
Processing is necessary to perform the contract between you and estoto (the Terms & Conditions). This includes account registration, deposit and withdrawal processing, bet settlement, and customer support.
Processing is required to comply with legal obligations imposed on estoto, including KYC verification, AML monitoring, record-keeping requirements under our international gaming license, and cooperation with regulatory or law enforcement authorities.
Processing is necessary for estoto's legitimate business interests, provided these interests do not override your fundamental rights. Legitimate interests include fraud prevention, security monitoring, service improvement, internal analytics, and operational efficiency.
Where processing is based on consent (e.g., marketing communications, advanced personalization features), you have the right to withdraw consent at any time without affecting the lawfulness of processing conducted prior to withdrawal.
estoto does not sell your personal information to third parties. We share data only in the following limited circumstances:
estoto engages trusted third-party service providers to operate specific aspects of the platform. These providers process personal data on estoto's behalf under strict contractual obligations:
All service providers are contractually required to protect your data, use it only for the specified purpose, and delete it when no longer needed.
estoto may disclose personal data where required or permitted by law:
In the event estoto undergoes a merger, acquisition, asset sale, or insolvency proceeding, your personal data may be transferred to the acquiring entity. You will be notified of any such transfer, and the new entity will be bound by the commitments made in this Privacy Policy.
estoto retains personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy, or as required by law:
While your account remains active, estoto retains all associated data to provide continuous service, maintain transaction history, and comply with ongoing regulatory obligations.
After you close your account, estoto retains your data for a minimum of 5 years to comply with financial record-keeping requirements, AML regulations, and gaming license conditions. During this period, data is archived in encrypted storage and is accessible only for compliance and legal purposes.
Identity verification documents and transaction records are retained for a minimum of 5 years from the date of the last transaction, as required by international AML and counter-terrorism financing (CTF) regulations.
If you opt out of marketing emails, your email address is retained on estoto's suppression list indefinitely to ensure you do not receive future marketing communications.
Where data is subject to a legal hold (e.g., pending litigation, regulatory investigation, or dispute resolution), retention periods are extended until the matter is fully resolved.
estoto employs industry-standard technical and organizational measures to protect your personal data from unauthorized access, disclosure, alteration, or destruction:
Player passwords are hashed using bcrypt with a high work factor. estoto staff cannot view your password — only you know it. If you forget your password, you must reset it via the secure password recovery process.
In the unlikely event of a data breach, estoto will notify affected users and relevant regulatory authorities within 72 hours, in accordance with applicable data breach notification requirements.
You have the following rights regarding your personal data:
You have the right to request a copy of the personal data estoto holds about you. To exercise this right, submit a request via email to [email protected] with the subject line "Data Access Request." estoto will respond within 30 days.
If any personal information we hold is inaccurate or incomplete, you have the right to request correction. You can update most information directly through your account settings, or contact support for assistance.
You may request deletion of your personal data by closing your account. Subject to legal retention requirements, estoto will delete your data within 30 days of account closure. Note that certain data must be retained for 5 years to comply with AML regulations.
You may request that estoto temporarily restrict the processing of your personal data in specific situations, such as while a dispute regarding data accuracy is being resolved.
You have the right to receive your personal data in a structured, commonly used, machine-readable format (e.g., CSV or JSON). Contact support to request a data export.
You may object to the processing of your personal data for marketing purposes at any time. You may also object to processing based on legitimate interests, though estoto may continue processing if we demonstrate compelling legitimate grounds that override your interests.
Where processing is based on consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted before withdrawal.
If you believe estoto has violated your privacy rights, you have the right to lodge a complaint with a data protection supervisory authority in your jurisdiction.
Cookies are small text files placed on your device by websites you visit. They enable the website to remember your actions and preferences (such as login state, language preference, and session data) over a period of time.
estoto uses the following types of cookies:
You can control cookie settings through your browser preferences. Most browsers allow you to block or delete cookies. Note that disabling strictly necessary cookies may prevent you from using essential platform features such as login and payment processing.
estoto's services are strictly for adults aged 21 and above. We do not knowingly collect personal data from individuals under the age of 21. If you are under 21, you must not register an account or use any part of this platform.
If estoto becomes aware that a person under 21 has provided personal information or created an account, the account will be immediately closed, all data will be deleted, and any funds will be returned to the source payment method (minus any bonuses or promotional credits).
If you are a parent or guardian and believe your child has provided personal information to estoto, contact us immediately at [email protected].
estoto reserves the right to update this Privacy Policy at any time to reflect changes in legal requirements, business practices, or platform features. When material changes are made, estoto will:
Your continued use of estoto following the effective date of a revised Privacy Policy constitutes acceptance of the changes. If you do not agree to the revised policy, you must stop using the platform and may request account closure.
If you have questions, concerns, or requests regarding this Privacy Policy or estoto's data handling practices, please contact us:
For a complete overview of estoto's legal framework, please also review our Terms & Conditions and Responsible Gaming pages.
Questions About Your Data?
Our privacy team is available 24/7 to answer questions about data collection, processing, retention, and your rights. Contact us any time.
Your privacy is protected by 256-bit SSL encryption. We never sell your data to third parties.