Privacy Policy

1. Definitions

In this Privacy Policy, the following terms carry the meanings set out below:

• "bobato", "we", "us", or "our" refers to the company operating the bobato platform at https://bobato.cam.
• "Platform" refers to the bobato website, all sub-pages, mobile interfaces, APIs, and associated digital services.
• "User", "you", or "your" refers to any individual who accesses, browses, registers on, or uses the bobato platform.
• "Personal Data" means any information that identifies or can reasonably identify a natural person, either directly (e.g., full name, national identity number) or indirectly (e.g., device ID combined with behavioral data).
• "Processing" means any operation performed on Personal Data, including collection, storage, use, transmission, deletion, or any combination thereof.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data. For the purposes of this Policy, bobato is the Data Controller of all Personal Data collected through the Platform.
• "Data Processor" means a third party that processes Personal Data on behalf of bobato under a written data processing agreement.
• "KYC" refers to the Know Your Customer identity and age verification process required of all Users prior to withdrawal processing.

2. Scope & Application

This Privacy Policy applies to all Personal Data collected by bobato in connection with the operation of the Platform, including data collected from Indonesian residents accessing the Platform from Jakarta, Surabaya, Medan, Bandung, Yogyakarta, Bali, and all other regions of Indonesia.

This Policy covers Personal Data collected through the following channels:

• Direct account registration and profile completion on the bobato Platform.
• Identity verification (KYC) document submissions.
• Deposit and withdrawal transactions processed via BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja.
• Customer support communications via email or live chat.
• Passive collection through cookies, server logs, and device analytics during Platform use.
• Participation in promotions, surveys, or responsible gaming self-assessment tools.

This Policy does not apply to third-party websites or services linked from the Platform, to the extent those third parties operate their own independent privacy frameworks.

3. Data We Collect

bobato collects the following categories of Personal Data from its Users:

bobato does not intentionally collect Sensitive Personal Data (including racial or ethnic origin, religious beliefs, health information, or biometric data beyond KYC selfie requirements). If you voluntarily disclose sensitive information in a support communication, we will handle it with heightened confidentiality and will not retain it beyond the minimum period necessary to resolve your query.

4. How We Collect Data

bobato collects Personal Data through the following methods:

• Direct submission: Information you actively provide when creating an account, completing KYC, making a deposit or withdrawal, or contacting support.
• Automated technical collection: Server logs, session cookies, and device fingerprinting technologies that record Technical and Behavioral Data automatically when you access the Platform.
• Payment processor callbacks: Transaction confirmation data transmitted to bobato by our payment processing partners (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja) upon completion of a financial transaction.
• Third-party verification services: Identity and document verification data returned by our KYC service providers as part of the account verification process.
• Responsible gaming interactions: Data generated when you interact with deposit limit tools, self-exclusion features, or session time reminders within your account dashboard.

5. Legal Basis for Processing

bobato processes your Personal Data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing required to fulfill our contractual obligations to you under our Terms & Conditions, including account management, payment processing, and KYC verification.
• Legitimate interests: Processing carried out to pursue our legitimate business interests — including fraud prevention, platform security, anti-money laundering compliance, and service improvement — provided those interests are not overridden by your data protection rights.
• Legal obligation: Processing required to comply with applicable laws and regulatory obligations, including anti-money laundering (AML) legislation, financial record-keeping requirements, and responses to lawful authority requests.
• Consent: Where we rely on your consent for a specific processing activity (such as sending promotional communications), you retain the right to withdraw that consent at any time without affecting the lawfulness of prior processing.

6. How We Use Your Data

bobato uses your Personal Data for the following purposes:

• Account management: Creating and maintaining your registered account, authenticating your identity at login, and managing your account p references and settings.
• Payment processing: Facilitating deposits and withdrawals via your chosen Indonesian payment method, reconciling transactions, and maintaining accurate financial records.
• KYC and compliance: Verifying your identity and age (21+), screening against sanctions lists, and fulfilling our anti-money laundering obligations.
• Platform delivery: Providing access to football betting markets (BRI Liga 1, EPL, La Liga, Serie A, Bundesliga, Champions League), live casino games, togel (Indonesia's traditional numbers lottery), slot gacor (high-payout slot games), and sabung ayam (cockfighting) streaming services.
• Customer support: Responding to your queries, resolving disputes, and maintaining records of support interactions for quality assurance and training.
• Responsible gaming: Monitoring wagering patterns to identify potential problem gambling behaviors, administering self-exclusion and deposit limit tools, and proactively contacting Users whose activity triggers responsible gaming alerts.
• Security and fraud prevention: Detecting, investigating, and preventing unauthorized access, account takeover attempts, bonus abuse, and financial fraud.
• Service improvement: Analyzing aggregate behavioral and technical data to improve Platform performance, user experience, and product offerings.
• Marketing communications: Sending promotional emails and platform notifications about offers relevant to your betting activity — only where you have provided consent and have not subsequently opted out.
• Legal compliance: Retaining records as required by applicable laws and responding to lawful requests from regulatory or law enforcement authorities.

7. Data Sharing & Disclosure

bobato does not sell your Personal Data. We share Personal Data only in the limited circumstances described below:

• Payment processors: We share the minimum necessary financial and identity data with our payment processing partners (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja) solely to execute your deposit and withdrawal requests. These partners are contractually bound to process your data only for this purpose.
• KYC and identity verification providers: We transmit your identity documents and biometric data to our accredited KYC service providers for the purpose of age and identity verification. These providers operate under strict data processing agreements and are prohibited from retaining your data beyond the verification purpose.
• Game and software providers: Certain game providers (including Pragmatic Play, Evolution Gaming, and Spribe) may receive session and transaction data necessary to deliver their gaming services through the Platform. This data sharing is governed by data processing agreements with each provider.
• Legal and regulatory authorities: We may disclose Personal Data to Indonesian government authorities, international regulators, law enforcement agencies, or courts where we are legally required to do so, or where disclosure is necessary to prevent fraud, money laundering, or other criminal activity.
• Professional advisers: We may share Personal Data with our legal counsel, auditors, or insurers on a confidential basis where necessary for the operation of our business.
• Business transfers: In the event of a merger, acquisition, or sale of all or a substantial part of bobato's business, your Personal Data may be transferred to the acquiring entity. We will notify registered Users by email prior to any such transfer.

In all cases of data sharing, bobato applies the principle of data minimization — sharing only the data strictly necessary for the stated purpose — and requires all recipients to maintain appropriate technical and organizational security measures.

8. International Data Transfers

bobato operates as an internationally licensed platform, and some of the third parties we work with — including KYC verification providers, game software providers, and cloud infrastructure partners — may be located outside Indonesia. As a result, your Personal Data may be transferred to, stored in, or processed in countries other than Indonesia.

Where such transfers occur, bobato ensures that appropriate safeguards are in place to protect your Personal Data, including:

• Contractual clauses in data processing agreements that impose data protection obligations on the receiving party equivalent to those applied by bobato.
• Transfers only to recipients located in countries that maintain data protection standards recognized as adequate by internationally accepted frameworks.
• Technical measures including encryption in transit and at rest to protect data during international transfer.

By using the bobato platform, you acknowledge that your Personal Data may be transferred internationally in accordance with the safeguards described in this clause.

9. Data Retention

bobato retains Personal Data for the minimum period necessary to fulfill the purposes for which it was collected and to comply with our legal obligations. The following general retention schedules apply:

At the end of the applicable retention period, Personal Data is securely deleted or anonymized so that it can no longer be associated with an identifiable individual. Anonymized aggregate data may be retained indefinitely for statistical and research purposes.

10. Data Security

bobato implements a comprehensive set of technical and organizational security measures to protect your Personal Data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption applied to all data in transit between your device and our servers.
• AES-256 encryption at rest for all databases containing Personal Data and financial records.
• Multi-factor authentication (MFA) available for all user accounts and mandatory for all internal administrative access.
• Role-based access controls ensuring that bobato staff can access only the data necessary for their specific job function.
• Regular penetration testing and vulnerability assessments conducted by independent security specialists.
• Intrusion detection systems that monitor platform traffic in real time and generate alerts for anomalous activity.
• Secure data center infrastructure with physical access controls, redundant power systems, and continuous environmental monitoring.

In the event of a data security incident that is likely to result in a risk to your rights and freedoms, bobato will notify affected Users by email within 72 hours of becoming aware of the breach, in accordance with our incident response obligations.

While bobato takes all reasonable precautions, no internet-based platform can guarantee absolute security. You are responsible for maintaining the security of your own device and account credentials. Never share your bobato password or one-time authentication codes with any person.

11. Cookies & Tracking Technologies

bobato uses cookies and similar tracking technologies to operate the Platform effectively and to understand how Users interact with our services. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication tokens, security cookies, and load balancing cookies. These cookies cannot be disabled without significantly impairing Platform functionality.
• Functional Cookies: Remember your preferences such as your selected payment method, responsible gaming limit settings, and session display preferences. Disabling these cookies may result in loss of personalization between sessions.
• Analytics Cookies: Used to collect aggregate, anonymized data on Platform usage — including pages visited, session duration, and navigation paths — to help us improve Platform performance. bobato uses a self-hosted analytics solution and does not share analytics data with Google or other third-party analytics platforms.

bobato does not use advertising cookies, retargeting pixels, or any cross-site tracking technologies. You will not see bobato advertisements following you around other websites based on your Platform activity.

You may manage cookie preferences through your browser settings. Blocking strictly necessary cookies will prevent you from logging in to your account. Blocking functional or analytics cookies will not affect your ability to use core platform features.

12. Your Data Rights

As a User of the bobato platform, you hold the following rights in relation to your Personal Data. To exercise any of these rights, please contact us at the email address provided in Clause 16:

• Right of Access: You may request a copy of all Personal Data we hold about you, together with information about how it is being processed.
• Right to Rectification: You may request correction of any inaccurate or incomplete Personal Data we hold about you.
• Right to Erasure: You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations (see Clause 9). Note that we cannot erase data that we are legally required to retain, such as financial transaction records.
• Right to Restriction: You may request that we restrict the processing of your Personal Data in certain circumstances, for example while a dispute about data accuracy is under review.
• Right to Data Portability: You may request a machine-readable copy of the Personal Data you have provided to us, for the purpose of transferring it to another service provider.
• Right to Object: You may object to processing of your Personal Data carried out on the basis of our legitimate interests. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

We will respond to all verified data rights requests within 30 calendar days of receipt. We may request identity verification before fulfilling a data rights request to ensure we do not disclose your Personal Data to an unauthorized third party.

13. Minors & Age Restriction

bobato operates a strict 21+ age policy. The Platform is not intended for, and should not be accessed by, any person under the age of 21. We do not knowingly collect Personal Data from individuals under 21.

All registration applications undergo age verification as part of the KYC process. Where bobato discovers that a User under the age of 21 has accessed the Platform, we will immediately close that account, void all associated balances, delete the relevant Personal Data to the extent permitted by our legal retention obligations, and take appropriate remedial action.

If you believe a minor has registered an account on bobato, please notify us immediately at [email protected] so that we can investigate and take appropriate action.

14. Third-Party Services

The bobato platform integrates with a number of third-party service providers to deliver its full range of features. While bobato selects these providers carefully and requires them to maintain appropriate data protection standards, we are not responsible for the privacy practices of third-party services that operate under their own independent privacy policies.

The third-party service categories integrated into bobato include:

• Game providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft (PG Soft) — game session data is transmitted to these providers to power game delivery.
• Payment processors: BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja — payment data is shared as described in Clause 7.
• KYC verification providers: Accredited identity verification services — document and biometric data is transmitted for the sole purpose of age and identity verification.
• Cloud infrastructure: bobato's platform is hosted on internationally certified cloud infrastructure providers that maintain ISO 27001 and SOC 2 Type II security certifications.

This Policy does not govern the data practices of any third-party service provider. We encourage you to review the privacy policies of those services independently.

15. Policy Amendments

bobato may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or the services we offer. When we make material changes to this Policy, we will notify registered Users by email to the address on file and update the "Last Updated" date displayed at the top of this page.

We encourage you to review this Privacy Policy periodically. Your continued use of the bobato platform following the effective date of any revised Policy constitutes your acknowledgment of the changes. If you do not agree with a material amendment, you should discontinue use of the Platform and submit an account closure request before the amendment's effective date.

For non-material updates — such as typographical corrections, formatting improvements, or clarifications that do not alter the substance of our data processing practices — we may update this Policy without individual notification.

16. Contact & Data Protection Officer

If you have any questions, concerns, or complaints regarding this Privacy Policy or bobato's data processing practices, or if you wish to exercise any of your data rights as described in Clause 12, please contact our Data Protection team using the details below:

For questions about our responsible gaming tools, self-exclusion, or deposit limits, please visit our dedicated Responsible Gaming page. For general platform questions, our FAQ page covers the most common topics.