Privacy Policy

This Privacy Policy ("Policy") applies to soto88.pro and all services operated under the soto88 brand. It describes how soto88 ("we", "us", "our") collects, processes, stores, shares, and protects personal data submitted by or collected from individuals ("you", "Player") who register for and use the soto88 platform.

By creating a soto88 account and using our services — including placing wagers on BRI Liga 1 and international football, playing live casino games such as baccarat and live blackjack, or accessing our slot gacor (high-payout slot) library — you acknowledge that you have read, understood, and accepted this Policy in full. This Policy forms part of soto88's overall Terms & Conditions, available at soto88.pro/terms-conditions.

If you do not agree with any part of this Policy, you should discontinue use of the Platform and may request account closure by contacting our support team.

soto88 collects personal data through several channels: directly from you during registration and account use, automatically through your interaction with the Platform, and from trusted third-party partners such as payment processors and KYC verification providers. The categories of data we collect are set out below.

2.1 Data You Provide Directly

2.2 Data Collected Automatically

When you access soto88.pro, our systems automatically collect certain technical data to ensure the Platform functions correctly, detect fraud, and improve your experience:

• Device & Browser Data: IP address, device type (mobile/desktop), operating system, browser type and version, screen resolution, and time zone settings.
• Usage Data: Pages visited, time spent on each page, click paths, game sessions initiated, bets placed, bet amounts in IDR, and game outcomes.
• Session Data: Login timestamps, session duration, logout events, and failed login attempts.
• Location Data: Approximate geographic location derived from your IP address — used for fraud prevention and compliance purposes. soto88 does not use GPS-level device location data.

2.3 Data from Third Parties

We may receive supplementary data from the following trusted third-party sources to complete KYC verification, process payments, and detect fraudulent activity:

• Identity verification providers — to cross-check KTP data against authoritative databases.
• Payment processors — to confirm transaction status for deposits made via BCA, BRI, BNI, Mandiri, and the supported e-wallets.
• Fraud detection services — which may provide risk scores or flags associated with an IP address or device fingerprint.

soto88 processes your personal data only for clearly defined, legitimate purposes. We do not process your data in ways that are incompatible with the purposes described below.

soto88 processes your personal data under one or more of the following legal bases, depending on the specific purpose of the processing activity:

• Contractual Necessity: Processing required to perform the contract between you and soto88 — including account creation, identity verification, deposits, withdrawals, and the delivery of all gaming services.
• Legal Obligation: Processing required to comply with the laws and regulatory requirements of our licensing jurisdiction, including KYC, AML record-keeping, and responding to lawful authority requests.
• Legitimate Interests: Processing for soto88's legitimate business interests — including fraud prevention, platform security, responsible gaming monitoring, and aggregated analytics — where those interests are not overridden by your data protection rights.
• Consent: Processing for optional purposes — specifically, direct marketing communications — where you have given clear, informed, and freely withdrawable consent. Where consent is the legal basis, you may withdraw it at any time without affecting the lawfulness of prior processing.

soto88 does not sell your personal data. We share data only where strictly necessary and only with the categories of recipients listed below, each of whom is bound by contractual data protection obligations or applicable law.

• Payment Processors: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the minimum data necessary to process your deposit or withdrawal transactions in IDR.
• KYC & Identity Verification Providers: Specialist third-party services that verify your identity documents against authoritative data sources. These providers process your identity data solely for verification purposes and are prohibited from using it for any other purpose.
• Game Content Providers: Studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Pocket Games Soft, and Spribe receive session tokens necessary to launch and authenticate game sessions. They do not receive your full personal profile.
• Fraud Detection & Cybersecurity Services: Technical partners who help identify malicious login attempts, bot activity, and suspicious transaction patterns. Data shared is limited to technical identifiers (IP address, device fingerprint, session metadata).
• Regulatory & Law Enforcement Authorities: We will disclose personal data to regulators, courts, or law enforcement agencies where required to do so by a valid legal order, court judgment, or our licensing obligations — without prior notice to you where prohibited by law.
• Professional Advisors: Legal counsel, auditors, and compliance consultants who require access to data in connection with legitimate advisory engagements, subject to professional confidentiality obligations.

soto88.pro uses cookies and similar tracking technologies to deliver core Platform functionality, remember your preferences, maintain your login session, and gather aggregated analytics data. The table below summarizes the categories of cookies we use.

You can manage functional and analytics cookies through your browser settings at any time. Note that disabling strictly necessary or fraud-prevention cookies may prevent you from logging in or using certain Platform features. soto88 does not use third-party advertising cookies or cross-site behavioral tracking technologies.

soto88 implements a layered security architecture designed to protect your personal data against unauthorized access, accidental loss, alteration, and disclosure. Our key technical and organizational security measures include:

• 256-bit SSL/TLS Encryption: All data in transit between your browser or mobile device and soto88.pro is encrypted using industry-standard TLS 1.2 or higher. The padlock icon in your browser confirms an active encrypted connection.
• Password Hashing: Account passwords are never stored in plaintext. soto88 uses a modern adaptive hashing algorithm (bcrypt with a high work factor) so that even if our database were ever compromised, individual passwords could not be recovered.
• Two-Factor Authentication (2FA): Players are strongly encouraged to enable SMS OTP two-factor authentication, which is available from the account security dashboard. This adds a critical layer of protection even if your password is compromised.
• Access Controls: Internal access to Player personal data is restricted on a strict need-to-know basis. All staff members with access to sensitive data undergo background screening and regular security awareness training.
• Infrastructure Security: soto88's servers are hosted in certified data centers with physical access controls, 24/7 monitoring, redundant power and connectivity, and regular penetration testing by independent third-party security firms.
• Incident Response: In the event of a data security incident that poses a material risk to your rights and freedoms, soto88 will notify affected Players and the relevant regulatory authority within the timeframes prescribed by our licensing obligations.

soto88 retains personal data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by our international gaming license and applicable financial regulations. The general retention periods are as follows:

Following the end of the applicable retention period, personal data is securely deleted or irreversibly anonymized. Where deletion is not immediately technically feasible (for example, in encrypted backup archives), data is isolated from active processing until it can be securely purged.

As a Player on soto88, you hold the following data rights, exercisable at any time by contacting our support team at [email protected] or via live chat on soto88.pro:

soto88 is strictly an adults-only platform. We do not knowingly collect personal data from any individual under the age of 21. The Platform is not directed at, and is not intended for use by, anyone under 21 years of age.

During the registration and KYC process, soto88 takes active steps to verify that every Player meets the 21+ age requirement. Any account where we have reasonable grounds to suspect underage registration will be suspended immediately, all Balances held pending investigation, and the account permanently closed if the suspicion is confirmed. We may report confirmed cases of underage gambling to the relevant authorities.

If you are a parent or guardian and you believe that a minor in your care has registered a soto88 account or submitted personal data to our Platform, please contact us immediately at [email protected]. We will investigate and delete the data without delay, subject to any legal hold requirements.

soto88 operates as an internationally licensed platform. This means that some of your personal data may be transferred to, and processed in, countries other than Indonesia — specifically the jurisdiction in which soto88 holds its gaming license, and the locations of our contracted KYC and payment processing partners.

Where such transfers occur, soto88 ensures that appropriate safeguards are in place to protect your data to a standard at least equivalent to the protections described in this Policy. These safeguards typically include:

• Standard contractual data protection clauses incorporated into our agreements with all international data processors.
• Transfer only to countries or processors that operate under privacy frameworks recognized as providing adequate protection for personal data.
• Binding corporate rules and data processing agreements with all third-party service providers that receive Indonesian Player data.

soto88 does not transfer your personal data to any country or organization for the purpose of evading the privacy protections set out in this Policy. If you have questions about the specific safeguards applicable to any particular international transfer, please contact our Privacy team at [email protected].

soto88 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, Platform features, or applicable legal requirements. When we make material changes to this Policy, we will notify you by one or more of the following methods:

• A prominent notice displayed on soto88.pro at login, clearly indicating that the Privacy Policy has been updated.
• An email notification sent to the address registered on your soto88 account, if you have not opted out of transactional communications.
• An in-platform notification visible in your account dashboard on your next login session.

The "Last Updated" date at the top of this page reflects the most recent revision. Continued use of the soto88 Platform after any update constitutes your acceptance of the revised Policy. If you do not agree with the changes, you should discontinue use and may request account closure by contacting [email protected] before the effective date of the changes.

We encourage you to review this Policy periodically to stay informed about how soto88 protects your personal data. Minor clarifications or corrections that do not materially affect your rights will be made without advance notice.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to raise a privacy concern, please contact the soto88 Privacy team through any of the following channels. All communications are handled in English and Indonesian by agents available around the clock (WIB, UTC+7).

When submitting a data rights request, please include your registered username and the email address on your account to allow us to verify your identity before actioning the request. We may ask for additional verification if there is any doubt about the identity of the requester, in order to protect your data from unauthorized disclosure.