Privacy Policy

inatog operates an online betting and gaming platform serving players primarily based in Indonesia. In the course of providing our services, we necessarily collect and process certain categories of personal data relating to our members, prospective members, and visitors to the Platform. We take our responsibilities as a data processor seriously and are committed to handling all personal data in a manner that is transparent, proportionate, and secure.

This Privacy Policy has been drafted in accordance with internationally recognised data protection principles, including those reflected in the General Data Protection Regulation (GDPR) framework, which we adopt as a benchmark for best practice even where it does not apply as a matter of law in Indonesia. We believe that the highest standard of data governance is a competitive advantage and a mark of the trust that inatog places in its members.

By registering an account on the inatog Platform, you acknowledge that you have read and understood this Privacy Policy and that you consent to the collection and processing of your personal data in the ways described herein. This Policy should be read in conjunction with our Terms & Conditions.

For the purposes of this Privacy Policy, the following terms have the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person ("data subject"), including name, identification number, location data, online identifiers, and any factors specific to the physical, economic, cultural, or social identity of that person.
• "Processing" means any operation performed on personal data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation, retrieval, use, disclosure, or erasure.
• "Data Controller" means the entity that determines the purposes and means of processing personal data — in this context, inatog.
• "Data Processor" means any third party that processes personal data on behalf of inatog under a written data processing agreement.
• "Consent" means any freely given, specific, informed, and unambiguous indication of the data subject's agreement to the processing of their personal data for one or more specific purposes.
• "KYC" means Know Your Customer — the identity and document verification process applied to all inatog members as part of our compliance obligations.

The data controller responsible for personal data processed in connection with the inatog Platform is inatog, the operator of https://inatog.cam. inatog operates under an international gaming license and maintains its primary data processing infrastructure in accordance with the requirements of that license.

All enquiries, requests, and formal complaints relating to personal data should be directed to our dedicated data privacy contact in the first instance:

inatog collects personal data in the following categories, depending on the nature of your interaction with the Platform:

inatog does not collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, health data (beyond responsible gaming data), or biometric data for identification purposes, unless expressly required by our KYC process in a specific context.

inatog collects personal data through the following channels:

• Direct Submissions: Information you provide when completing the account registration form, submitting KYC documents, contacting customer support, or responding to surveys and promotions;
• Automated Technologies: Technical data collected automatically via cookies, web beacons, server logs, and similar technologies when you access or interact with the Platform;
• Third-Party Providers: Data received from KYC verification partners, payment processors (such as BCA, BRI, OVO, and DANA), fraud prevention services, and analytics providers operating under data processing agreements with inatog;
• Public Sources: In limited circumstances, inatog may supplement member data with information from publicly available sources for the purposes of fraud detection and compliance screening.

inatog processes personal data only where a lawful basis for doing so exists. The primary purposes and corresponding legal bases are set out below:

Where inatog relies on legitimate interest as the legal basis for processing, we have conducted a balancing assessment to confirm that our interests are not overridden by your fundamental rights and freedoms. You may request a copy of that assessment by contacting our data privacy team.

Where processing is based on consent — particularly for marketing communications — you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. To opt out of promotional communications, contact us at [email protected] or use the unsubscribe mechanism included in any marketing email.

inatog does not sell, rent, or trade your personal data to third parties for commercial or marketing purposes. We may share your personal data with the following categories of recipients, solely to the extent necessary for the stated purpose:

• Payment Processors: Indonesian bank transfer intermediaries and e-wallet platforms — including BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, and LinkAja — to facilitate deposits and withdrawals. These providers operate under their own privacy policies and are subject to applicable Indonesian banking regulations.
• KYC & Identity Verification Partners: Third-party identity verification services engaged to validate the authenticity of identity documents and to screen members against sanctions and politically exposed persons (PEP) lists. These providers act as data processors under binding data processing agreements.
• Fraud Prevention & Security Services: Specialist providers that help inatog detect, investigate, and prevent fraudulent activity, money laundering, and account takeover attempts.
• IT Infrastructure & Cloud Providers: Hosting, database, and security service providers that maintain the technical infrastructure of the Platform. All such providers are contractually required to implement appropriate technical and organisational security measures.
• Customer Support Platforms: Third-party helpdesk and live chat tools used to deliver our 24/7 support service. Agents have access only to the data necessary to resolve a specific support query.
• Legal & Regulatory Authorities: Law enforcement agencies, regulatory bodies, courts, or other governmental authorities where inatog is legally compelled to disclose information, or where disclosure is necessary to protect the rights and safety of inatog or its members.
• Professional Advisors: Lawyers, auditors, and compliance consultants acting under obligations of professional confidentiality.

inatog operates under an international gaming license and may process or store personal data on servers located outside Indonesia. Where personal data is transferred to a jurisdiction that does not provide an equivalent level of data protection to that available in Indonesia, inatog will implement appropriate safeguards to ensure your data remains protected. These safeguards may include:

• Standard contractual clauses (SCCs) approved by relevant data protection authorities, incorporated into agreements with receiving parties;
• Binding corporate rules where data is transferred within a group of companies subject to a unified data governance framework;
• Transfers to jurisdictions that have been assessed as providing an adequate level of data protection by a recognised supervisory authority.

You may request further information about the specific safeguards applied to any international transfer of your personal data by contacting our data privacy team at [email protected].

inatog retains personal data for no longer than is necessary to fulfil the purposes for which it was collected, subject to any overriding legal, regulatory, or contractual retention obligations. The following general retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with inatog's data destruction procedures. Anonymised data (from which no individual can be identified) may be retained indefinitely for statistical and analytical purposes.

As an inatog member whose personal data we process, you hold the following rights with respect to your personal data. These rights may be subject to certain conditions and limitations under applicable law:

To exercise any of the above rights, please submit a written request to [email protected] with the subject line "Data Rights Request". We will respond within thirty (30) calendar days. We may need to verify your identity before processing your request.

inatog uses cookies and similar tracking technologies to operate the Platform, analyse usage patterns, and personalise your experience. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the operation of the Platform, including session management, login authentication, and security functions. These cookies cannot be disabled without impairing core Platform functionality.
• Performance & Analytics Cookies: Used to collect aggregated, anonymised data about how visitors interact with the Platform — including pages visited, session duration, and error events — to help inatog improve its service. These cookies do not identify individual users.
• Functionality Cookies: Enable the Platform to remember your preferences, such as your preferred language or display settings, to deliver a more personalised experience across sessions.
• Marketing & Targeting Cookies: Used to track your browsing activity across sessions for the purpose of delivering relevant promotional content. These cookies are only deployed with your consent and may be managed via your browser settings.

You can manage or disable non-essential cookies through your browser settings at any time. Note that disabling certain cookies may affect the availability or performance of some Platform features. For a full list of cookies in use, please contact [email protected].

inatog implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, or destruction. Key measures include:

• TLS 1.3 Encryption: All data transmitted between your browser and the inatog Platform is encrypted using Transport Layer Security version 1.3, preventing interception during transit;
• AES-256 Encryption at Rest: Stored personal data — including identity documents, financial records, and account credentials — is encrypted using AES-256 at the database level;
• Two-Factor Authentication (2FA): Available to all members and strongly recommended. inatog's internal systems require 2FA for all privileged administrative access;
• Role-Based Access Controls: Staff access to personal data is strictly limited to the minimum necessary for their role. Access is logged, audited, and reviewed on a regular basis;
• Penetration Testing: The Platform undergoes regular security assessments, including third-party penetration testing, to identify and remediate vulnerabilities before they can be exploited;
• Incident Response Plan: inatog maintains a documented data breach incident response plan. In the event of a breach affecting your personal data, you will be notified without undue delay.

The inatog Platform is strictly intended for adults aged 21 years and above. inatog does not knowingly collect, process, or retain personal data from any individual under the age of 21. Age verification is a mandatory component of our KYC process, and registration attempts by individuals below the minimum age threshold will be rejected.

If inatog becomes aware that personal data has been collected from a person under 21 years of age, we will take immediate steps to delete that data and close the associated account. If you believe that a minor has registered on the Platform, please notify us at [email protected] so that we can investigate and act promptly.

Parents and guardians who are concerned about minors accessing online gambling platforms are encouraged to review our Responsible Gaming page for guidance on available safeguards and parental control tools.

The inatog Platform may reference third-party services — including game studio providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft — whose software is integrated into the Platform. When you interact with a third-party game, certain technical data may be processed by that studio's own systems in accordance with their respective privacy policies.

inatog does not control the data practices of third-party game studios or payment providers and is not responsible for the privacy policies or data handling of any external service. We encourage you to review the privacy documentation of any third-party service you interact with through the Platform.

All third parties engaged as data processors by inatog are required to execute a data processing agreement with inatog that imposes obligations at least equivalent to those set out in this Privacy Policy, including appropriate security standards and restrictions on sub-processing.

inatog reserves the right to update or amend this Privacy Policy at any time in response to changes in applicable law, our data processing practices, or the services we offer. When material changes are made, we will notify registered members by email to the address associated with their Account and will update the "Last Updated" date at the top of this page.

We encourage you to review this Privacy Policy periodically to stay informed about how inatog is protecting your personal data. Your continued use of the Platform following notification of any amendment constitutes your acceptance of the revised Policy. If you do not agree with any amendment, you may request closure of your Account in accordance with the Terms & Conditions.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or wish to raise a formal complaint about inatog's data processing practices, please contact our data privacy team using the details below. All formal privacy correspondence must be submitted in writing via email.

If you are not satisfied with our response to a complaint or data rights request, you have the right to escalate your complaint to the relevant supervisory authority in your jurisdiction. inatog will cooperate fully with any such investigation and will not take any retaliatory action against a member who exercises their right to complain.

For matters relating to your account terms, please refer to our Terms & Conditions. For guidance on responsible gambling tools and player protection measures, please visit our Responsible Gaming page.