Privacy Policy

The following terms carry specific meanings throughout this Privacy Policy:

• "taro28" / "we" / "us" / "our" — the company operating the taro28 platform at https://taro28.cam and all associated services.
• "Player" / "you" / "your" — any individual who registers for, accesses, or uses the taro28 platform.
• "Personal Data" — any information relating to an identified or identifiable natural person, including name, date of birth, email address, device identifiers, and financial account details.
• "Processing" — any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.
• "Data Controller" — the entity that determines the purposes and means of processing Personal Data. taro28 acts as Data Controller for all player data collected on this Platform.
• "Data Processor" — a third party that processes Personal Data on behalf of taro28 under a contractual arrangement (e.g., payment service providers, KYC verification partners).
• "KYC" — Know Your Customer; the identity and age verification process required by taro28 before processing withdrawals.
• "Cookie" — a small text file placed on your device by the Platform to facilitate session management, security, and analytics.

This Privacy Policy applies to all Personal Data collected by taro28 in connection with:

• Registration and operation of a taro28 player account.
• Use of the taro28 sportsbook, casino, togel (traditional Indonesian numbers lottery), and any other games or features available on the Platform.
• Deposits and withdrawals processed through BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI, OVO, DANA, GoPay, ShopeePay, LinkAja, and any other payment methods available on the Platform.
• Communications between a Player and the taro28 customer support team.
• Visits to the taro28 website, including browsing behavior and technical interaction data.

This Policy applies to all Players who are residents of Indonesia. taro28's primary target market is Indonesian players, and we process Personal Data in a manner consistent with applicable data protection principles and international best practices.

taro28 collects the following categories of Personal Data, depending on how you interact with our Platform:

taro28 does not intentionally collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, or health data, except where a Player voluntarily discloses such information in the context of a responsible gaming self-exclusion request.

taro28 collects Personal Data through the following channels:

• Direct submission: Information you provide when registering an account, completing KYC verification, making a deposit or withdrawal, participating in a promotion, or contacting our customer support team.
• Automated collection: Technical data collected automatically when you visit or use the Platform, including IP addresses, device identifiers, browser information, and session activity logs. This data is collected via server logs and first-party cookies.
• Payment processors: Confirmation data returned by payment service providers (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja, and others) when a deposit or withdrawal transaction is processed. taro28 does not store full bank account credentials — only the account name, masked account number, and transaction reference.
• KYC verification partners: Results of automated identity checks performed by taro28's accredited KYC service providers, including document authenticity scores and age verification outcomes.
• Fraud prevention systems: Device fingerprinting and behavioral analytics data generated by taro28's fraud detection infrastructure to identify suspicious account activity or multiple-account registrations.

taro28 processes your Personal Data for the following specific purposes:

• Account Management: To create, maintain, and administer your taro28 account, including verifying your identity, processing login requests, and managing account security settings.
• Identity & Age Verification (KYC): To verify that you are at least 21 years of age and a resident of Indonesia, in compliance with taro28's responsible gaming obligations and eligibility requirements.
• Payment Processing: To process deposits and withdrawals via your chosen local bank (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI, Bank Permata) or e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja), and to maintain an accurate transaction record for your account.
• Platform Operation: To provide access to sportsbook markets, casino games, togel draws, and all other features of the Platform; to record and settle your bets; and to credit bonuses and promotions to your account.
• Customer Support: To respond to your inquiries, resolve disputes, and provide technical assistance through our 24/7 support team, including native Indonesian-speaking agents.
• Fraud Prevention & Security: To detect and prevent unauthorized account access, bonus abuse, money laundering, multiple-account registrations, and other prohibited conduct as defined in our Terms & Conditions.
• Responsible Gaming: To monitor gaming patterns for indicators of problem gambling, enforce self-exclusion requests, and apply deposit limits or time-out periods as requested by Players or required by our duty of care obligations. For more information, see our Responsible Gaming page.
• Legal Compliance: To fulfill taro28's obligations under applicable anti-money laundering (AML) regulations, record-keeping requirements, and any lawful requests from competent authorities.
• Platform Improvement: To analyze aggregated, anonymized usage data to improve the Platform's functionality, performance, and user experience for Indonesian players.
• Marketing Communications: To send you promotional offers, bonus alerts, and event notifications relevant to BRI Liga 1, EPL, and other markets you follow — but only where you have opted in to receive such communications and subject to your right to opt out at any time.

taro28 processes your Personal Data on one or more of the following legal bases:

• Contractual Necessity: Processing required to perform our obligations under the taro28 Terms & Conditions — including account registration, payment processing, bet settlement, and KYC verification.
• Legitimate Interests: Processing necessary for taro28's legitimate business interests, including fraud detection, platform security, and internal analytics, where such interests are not overridden by your privacy rights.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including AML obligations and responses to lawful authority requests.
• Consent: Processing based on your explicit consent, such as receiving marketing communications or newsletters. You may withdraw consent at any time by contacting [email protected]. Withdrawal of consent does not affect the lawfulness of processing conducted prior to withdrawal.

taro28 does not sell your Personal Data to any third party. We share Personal Data only in the following limited circumstances:

• Payment Service Providers: Your financial data is shared with the relevant Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, and others) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) solely to process your requested transactions.
• KYC & Identity Verification Providers: Your identity documents and verification data are shared with accredited KYC partners to conduct age and identity checks. These partners are contractually bound to process your data solely for verification purposes.
• Game Software Providers: Limited session data (e.g., anonymized player ID, bet amounts, game rounds) may be shared with game studios including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft for the purpose of delivering their games and ensuring fair play auditing.
• Fraud Prevention & Security Partners: Device and behavioral data may be processed by taro28's fraud detection service providers to identify risk patterns and protect the integrity of the Platform.
• Legal Authorities: taro28 will disclose Personal Data to law enforcement agencies, regulatory bodies, or courts when required to do so by a lawful order or where disclosure is necessary to protect taro28's legal rights or to prevent imminent harm.
• Business Transfers: In the event of a merger, acquisition, or sale of taro28's business assets, your Personal Data may be transferred to the acquiring entity, subject to equivalent privacy protections being maintained.

All third parties with whom taro28 shares Personal Data are required to implement appropriate technical and organizational security measures and are prohibited from using your data for any purpose other than those specified in their contractual agreements with taro28.

taro28 operates servers and infrastructure across multiple jurisdictions. As a result, your Personal Data may be transferred to and stored in countries outside of Indonesia, including countries where taro28's hosting infrastructure, KYC partners, or game providers are located.

Where such international transfers occur, taro28 ensures that adequate safeguards are in place to protect your Personal Data, including:

• Standard contractual clauses requiring the recipient to maintain equivalent data protection standards.
• Restricting transfers to jurisdictions that maintain recognized data protection frameworks.
• Implementing end-to-end encryption for all data in transit across international network boundaries.

By using the taro28 Platform, you acknowledge and consent to the transfer of your Personal Data to international jurisdictions as described in this clause.

taro28 implements industry-standard technical and organizational security measures to protect your Personal Data against unauthorized access, accidental loss, alteration, or destruction. These measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the taro28 Platform is encrypted using Transport Layer Security (TLS) with a 256-bit cipher.
• Encrypted Data Storage: Personal Data stored on taro28 servers is encrypted at rest using AES-256 encryption. KYC documents are stored in an isolated, access-controlled environment.
• Access Controls: Internal access to player data is restricted on a strict need-to-know basis. All employee access is logged, audited, and subject to role-based permissions.
• Two-Factor Authentication (2FA): Players are encouraged to enable 2FA on their taro28 accounts to add an additional layer of security beyond their password.
• Regular Security Audits: taro28's infrastructure is subject to periodic penetration testing and vulnerability assessments conducted by independent security specialists.
• Incident Response: In the event of a data breach that is likely to result in risk to Players' rights, taro28 will notify affected Players and relevant authorities in accordance with applicable obligations, without undue delay.

taro28 retains Personal Data only for as long as necessary to fulfill the purposes for which it was collected or to comply with applicable legal obligations. The following retention guidelines apply:

• Active Accounts: Personal Data is retained for the duration of your account's active status and for a period of five (5) years following account closure, to satisfy financial record-keeping and AML compliance obligations.
• KYC Documents: Identity verification documents are retained for a minimum of five (5) years from the date of verification, in line with anti-money laundering record-keeping requirements.
• Transaction Records: Deposit, withdrawal, and betting history records are retained for a minimum of five (5) years to support dispute resolution, audit, and legal compliance purposes.
• Customer Support Records: Communications with the taro28 support team are retained for two (2) years from the date of the last correspondence.
• Technical & Log Data: Server logs, IP address records, and session data are retained for up to twelve (12) months for security monitoring and fraud prevention purposes.
• Closed Accounts: Upon voluntary account closure by a Player, taro28 will anonymize Personal Data within ninety (90) days, subject to the minimum retention periods specified above for regulatory purposes.

When Personal Data is no longer required for any legitimate purpose, it is securely deleted or irreversibly anonymized.

taro28 uses cookies and similar technologies on the Platform to ensure a secure, functional, and personalized experience. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the Platform to function correctly. These include session authentication cookies, security tokens, and login state cookies. These cookies cannot be disabled without impairing your ability to use the Platform.
• Functional Cookies: Used to remember your preferences, such as your preferred language display, default payment method, or last-visited game category. These improve convenience but are not essential to Platform operation.
• Analytics Cookies: First-party analytics cookies that collect aggregated, anonymized data about how players interact with the Platform (e.g., pages visited, session duration, feature usage). This data is used exclusively to improve Platform performance and user experience.

taro28 does not use third-party advertising cookies, cross-site tracking technologies, or behavioral profiling cookies that share your data with external advertising networks.

You may manage or disable cookies through your browser settings at any time. Note that disabling strictly necessary cookies will impair your ability to log in and use the Platform. Disabling functional cookies will result in loss of your saved preferences.

As a taro28 Player and resident of Indonesia, you have the following rights in relation to your Personal Data:

• Right of Access: You may request a copy of the Personal Data we hold about you, free of charge. taro28 will respond to access requests within 30 calendar days.
• Right to Rectification: You may request the correction of any inaccurate or incomplete Personal Data held on your account. Basic profile information (email address, phone number) can be updated directly within your account settings.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to taro28's legal obligation to retain certain records for the minimum retention periods described in Clause 10.
• Right to Restrict Processing: You may request that taro28 restrict the processing of your Personal Data in specific circumstances, such as where you contest the accuracy of the data or where processing is unlawful but you prefer restriction over erasure.
• Right to Data Portability: You may request a copy of your Personal Data in a structured, commonly used, machine-readable format for the data you have provided to us directly.
• Right to Object: You may object to the processing of your Personal Data where taro28 relies on legitimate interests as the legal basis, including profiling for responsible gaming monitoring purposes.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, please submit a written request to [email protected] (plain text — not a clickable link). taro28 may require verification of your identity before actioning any request to protect against fraudulent access to account data.

taro28 strictly prohibits the use of its Platform by any person under 21 years of age. The Platform is intended exclusively for adults (21+). We do not knowingly collect or process Personal Data from individuals under the age of 21.

If taro28 discovers or has reasonable grounds to believe that an account is held by a person under 21, the account will be immediately suspended. Any deposits made will be returned to the deposit source after verification of the account holder's identity, and any winnings accumulated will be forfeited.

If you are a parent or guardian and you believe that your child under 21 has registered an account on taro28, please contact us immediately at [email protected] (plain text — not a clickable link). We will investigate the matter and take appropriate action, including account closure and data deletion where applicable.

The taro28 Platform does not contain links to third-party websites as a matter of policy. However, game content delivered by third-party studios (Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, Pocket Games Soft) may operate within iframes or dedicated game clients that are governed by their own privacy policies.

taro28 is not responsible for the privacy practices or content of any third-party game studio platforms. We encourage you to review the privacy policies of game providers if you have specific concerns about how they handle session-level data within their game environments.

taro28 reserves the right to update or amend this Privacy Policy at any time. The date of the most recent revision is displayed at the top of this page. Material changes — those that significantly affect how we collect, use, or share your Personal Data — will be communicated to Players via a prominent notice on the Platform and, where practicable, by email to your registered address.

Your continued use of the taro28 Platform following the effective date of any amendment constitutes your acceptance of the updated Privacy Policy. If you do not agree with any changes, you may request account closure in accordance with Clause 12 of the Terms & Conditions.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way taro28 processes your Personal Data, please contact our Data Protection team using the details below:

• Email: [email protected] (plain text — not a clickable link)
• Subject Line: Please use "Privacy Request – [Your Account Username]" for privacy-related inquiries to ensure prompt routing to the correct team.
• Support Hours: 24 hours a day, 7 days a week, including Indonesian public holidays. Native Indonesian-speaking agents are available at all times.
• Response Time: Privacy and data protection inquiries are acknowledged within 48 hours (WIB) and resolved within 30 calendar days.

If you are not satisfied with our response to a privacy complaint, you may escalate the matter to taro28's senior compliance team by replying to the original support ticket and requesting escalation. All escalations are reviewed within a further 10 business days.

For responsible gaming concerns — including requests to self-exclude, set deposit limits, or access support resources — please visit the Responsible Gaming page or include "Responsible Gaming Request" in your support email subject line. All such requests are handled with complete confidentiality.