Privacy Policy

Introduction

m11to ("we", "us", "our") operates the online gaming and sportsbook platform accessible at https://m11to.app (the "Platform"). This Privacy Policy describes how m11to collects, uses, stores, shares, and protects personal information relating to individuals who visit, register on, or otherwise interact with the Platform ("you", "your").

m11to is committed to handling your personal data with transparency, integrity, and respect for your privacy. We apply internationally recognised data protection principles across all of our data processing activities, regardless of where that processing occurs technically. Our platform is designed for use by residents of Indonesia who are at least 21 years of age; accordingly, many of the data-handling practices described in this policy are specifically tailored to the Indonesian market context.

This Privacy Policy is to be read alongside our Terms & Conditions and our Responsible Gaming policy, both of which contain additional provisions relevant to how your account data is managed.

Definitions

The following defined terms are used throughout this Privacy Policy:

• "Personal Data" means any information that identifies or could reasonably be used to identify a living individual, either on its own or in combination with other data held by m11to.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Member" means any individual who has completed registration and holds an active or suspended account on the m11to Platform.
• "KYC Data" means identity verification documents and information submitted by a Member as part of the Know Your Customer process, including government-issued photo identification, proof of address, and source-of-funds documentation.
• "Transaction Data" means records of deposits, withdrawals, bets, game rounds, and balance adjustments associated with a Member's account, including associated timestamps, amounts in Indonesian Rupiah (IDR), and payment method identifiers.
• "Device Data" means technical information automatically collected from the device and network connection used to access the Platform, including IP address, browser type and version, operating system, device model, and screen resolution.
• "Cookies" means small text files placed on your device by the Platform for the purposes described in Section 8 of this policy.
• "Data Controller" means the entity that determines the purposes and means of Processing Personal Data — in this context, m11to.
• "Third-Party Processor" means an external service provider engaged by m11to that processes Personal Data on m11to's behalf and under m11to's documented instructions, such as a payment processor or KYC verification provider.

Data We Collect

m11to collects the following categories of Personal Data about you, depending on how you interact with the Platform:

3.1 Registration Data

When you create an account on m11to, we collect: your chosen username, full legal name, date of birth, email address, mobile phone number, and residential address within Indonesia. This data is required to create and administer your account, verify your eligibility (21+ and Indonesian residency), and comply with our anti-money-laundering obligations.

3.2 KYC Data

Before your first withdrawal is processed, we require identity verification documents. These typically include a scan or photograph of your Indonesian national identity card (KTP) or passport, and may include a selfie for liveness verification. Additional documentation — such as proof of address or a bank statement — may be requested where required by our compliance framework. KYC Data is processed by our certified third-party identity verification partner on our behalf.

3.3 Financial & Transaction Data

We record all financial transactions on your account, including deposit amounts and timestamps, the payment method used (e.g., BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, LinkAja), withdrawal requests and their processing status, bet histories across all product verticals (sportsbook, live casino, slots, togel (Indonesia's traditional numbers lottery)), and bonus and promotional credit movements. Financial account identifiers — such as your registered bank account number or e-wallet registered phone number — are stored in encrypted form.

3.4 Device & Usage Data

We automatically collect Device Data each time you access the Platform. We also collect usage data including pages visited, features used, session start and end times, game rounds initiated, and navigation paths through the Platform. This data is used for fraud detection, responsible gaming monitoring, platform security, and aggregate analytics to improve the user experience.

3.5 Communications Data

We retain records of communications you have with m11to's support team, including live chat transcripts, email correspondence, and any documents or screenshots submitted as part of a complaint or dispute. These records are retained for the periods set out in Section 9 and may be used to resolve ongoing disputes, train our support staff, and improve service quality.

3.6 Responsible Gaming Data

Where you set deposit limits, loss limits, session time alerts, or initiate a self-exclusion through the Platform's responsible gaming tools, we record those settings and their effective dates. This data is used strictly to enforce the protections you have requested and is never used for marketing profiling purposes.

How We Collect Your Data

m11to collects Personal Data through the following channels:

• Directly from you: Information you provide during registration, during KYC verification, when you contact support, when you update your account settings, or when you voluntarily participate in surveys or promotions.
• Automatically during Platform use: Device Data and usage data collected via server logs, session tracking technology, and first-party analytics when you access and navigate the Platform.
• From payment processors: Confirmation and status data relating to deposit and withdrawal transactions processed through Indonesian bank transfer gateways and e-wallet integrations (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, LinkAja).
• From KYC verification partners: Verification outcome data (pass/fail/refer) returned by our third-party identity verification provider following document review.
• From fraud detection and risk systems: Device fingerprint signals, IP reputation data, and behavioural analytics generated by our fraud and responsible gaming monitoring systems.

m11to does not purchase Personal Data from data brokers, and we do not collect data from social media platforms about you without your explicit consent.

How We Use Your Data

m11to processes your Personal Data for the following purposes:

• Account management: Creating, maintaining, and administering your m11to account; processing login authentication; managing account settings and communication preferences.
• Transaction processing: Executing deposit and withdrawal requests through your chosen Indonesian payment method; recording bet and game-round outcomes; calculating and applying bonus and promotional credits in accordance with our Terms & Conditions.
• Identity verification and compliance: Verifying your identity and age (21+) during KYC; fulfilling our anti-money-laundering (AML) and counter-terrorism financing (CTF) obligations; maintaining records required by our international licensing authority.
• Fraud prevention and security: Detecting and preventing unauthorised account access, bonus abuse, multi-accounting, collusion, and other forms of Prohibited Conduct as defined in our Terms & Conditions; protecting the integrity of games and financial transactions on the Platform.
• Responsible gaming: Monitoring session patterns to identify indicators of problem gambling; enforcing deposit limits, loss limits, and self-exclusion periods set by you or applied by m11to; providing reality check notifications.
• Customer support: Responding to support enquiries, resolving account disputes, and maintaining records of interactions for quality assurance and staff training purposes.
• Platform improvement: Analysing aggregate usage data to improve game selection, navigation, page performance, and user experience across devices (desktop, mobile browser on Android and iOS).
• Marketing communications (consent-based only): Sending promotional offers, seasonal campaign communications (e.g., aligned with Idul Fitri, Imlek, Nyepi, and major sporting events such as BRI Liga 1, Champions League, and AFF Cup), and new product notifications — but only to Members who have opted in. You may withdraw this consent at any time.
• Legal and regulatory compliance: Retaining records as required by applicable law or the instructions of our licensing authority; responding to valid legal process from competent authorities.

Legal Basis for Processing

m11to processes your Personal Data on the following legal bases:

• Contractual necessity: Processing required to perform the contract between you and m11to — specifically, the Terms & Conditions you accepted at registration. This covers account management, transaction processing, KYC, and customer support.
• Legal obligation: Processing required to comply with applicable law and our licensing authority's requirements, including AML/CTF record-keeping, age verification, and responding to lawful authority requests.
• Legitimate interests: Processing carried out to pursue m11to's legitimate business interests where those interests are not overridden by your privacy rights. This includes fraud prevention, platform security, aggregate analytics, and responsible gaming monitoring. We conduct a balancing assessment for each legitimate-interest processing activity to ensure proportionality.
• Consent: Processing carried out only with your explicit, freely given, and withdrawable consent. This applies specifically to marketing communications. You may withdraw consent at any time through your account settings or by contacting support, without affecting the lawfulness of prior processing.

Data Sharing & Disclosure

m11to shares your Personal Data only in the following circumstances and only to the extent necessary for the stated purpose:

7.1 Third-Party Processors

We engage the following categories of Third-Party Processors who handle Personal Data on our behalf under written data processing agreements that require them to maintain appropriate technical and organisational security measures:

• Payment processors: To execute deposit and withdrawal instructions through Indonesian bank and e-wallet networks.
• KYC and identity verification providers: To verify the identity documents you submit before your first withdrawal.
• Game studio partners: Including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft — game round data is passed to studio systems to resolve bets and calculate outcomes. Studios receive only the minimum data required for game functionality.
• Cloud infrastructure and hosting providers: Who store and process Platform data on servers subject to appropriate security certifications.
• Fraud detection and device intelligence providers: Who analyse Device Data and behavioural signals to identify suspicious activity patterns.
• Customer support platform providers: Who host our live chat and email ticketing infrastructure.

7.2 Legal Disclosures

m11to may disclose your Personal Data to law enforcement agencies, regulatory authorities, or other competent governmental bodies where required to do so by applicable law, valid legal process, or the instructions of our licensing authority. We will notify you of such a disclosure unless we are legally prohibited from doing so or doing so would compromise an ongoing investigation.

7.3 Business Transfers

In the event that m11to undergoes a merger, acquisition, restructuring, or sale of all or a substantial portion of its assets, your Personal Data may be transferred to the acquiring entity as part of that transaction. We will notify you of any such transfer via a prominent notice on the Platform and by email (where held) at least 30 days before the transfer takes effect, giving you the opportunity to request account closure if you do not wish your data to be transferred.

7.4 Aggregated and Anonymised Data

m11to may use and share aggregated, anonymised statistical data (from which no individual can be identified) for business analysis, industry reporting, and marketing purposes. This is not Personal Data and is not subject to the restrictions in this Privacy Policy.

Cookies & Tracking Technologies

The m11to Platform uses the following types of cookies and similar technologies:

m11to does not use third-party advertising cookies, retargeting pixels, or cross-site tracking technologies. You may configure your browser to block or delete cookies; however, blocking strictly necessary cookies will prevent you from logging in to your account and using core Platform features.

Data Retention

m11to retains Personal Data for only as long as necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods driven by legal and regulatory obligations:

Following the expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised. Where data subject to a longer legal retention period overlaps with a shorter operational retention period, the longer period prevails.

Data Security

m11to implements a layered technical and organisational security framework to protect your Personal Data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Key measures include:

• Encryption in transit: All data exchanges between your device and the Platform are encrypted using 256-bit TLS/SSL. Connections over HTTP are automatically redirected to HTTPS.
• Encryption at rest: Sensitive data fields — including financial account identifiers, passwords (stored as salted hashes only), and KYC document files — are encrypted in our databases using AES-256.
• Access controls: Access to systems holding Personal Data is restricted on a strict need-to-know basis. All internal access is authenticated via multi-factor authentication and logged for audit review.
• Network security: Platform infrastructure is protected by web application firewalls (WAF), DDoS mitigation, and intrusion detection systems operating continuously.
• Security testing: m11to conducts regular penetration testing and vulnerability assessments by qualified third-party security professionals. Critical findings are remediated within defined SLA timeframes.
• Incident response: m11to maintains a documented data breach response procedure. In the event of a breach likely to result in a risk to your rights or freedoms, we will notify you without undue delay and in any event within 72 hours of becoming aware of the breach.
• Staff training: All m11to personnel who handle Personal Data receive mandatory privacy and security training on joining the organisation and annually thereafter.

While we apply industry-leading safeguards, no security measure is infallible. You are responsible for maintaining the security of your own account credentials. m11to will never contact you to request your password — any such communication should be treated as fraudulent and reported to [email protected] immediately.

Your Rights Over Your Personal Data

Subject to applicable law and our legitimate interests in maintaining platform integrity and AML compliance, you hold the following rights in relation to your Personal Data held by m11to:

• Right of access: You may request a copy of the Personal Data we hold about you, together with information about how it is processed. We will respond within 30 calendar days of receiving a verified request.
• Right to rectification: You may request correction of inaccurate or incomplete Personal Data. For registration details, many fields are directly editable within your account settings. For KYC data corrections, contact support with updated documentation.
• Right to erasure ("right to be forgotten"): You may request deletion of your Personal Data in certain circumstances — for example, where the data is no longer necessary for the purpose it was collected. Note that erasure requests cannot be fulfilled where the data must be retained under AML legislation or our licensing authority's requirements; in such cases we will explain the applicable legal basis for retention.
• Right to restriction of processing: You may request that we limit our processing of your data to storage only while a dispute over its accuracy or our right to process it is resolved.
• Right to data portability: You may request that we provide your account and transaction data in a structured, machine-readable format (CSV or JSON) for transfer to another service provider, where technically feasible.
• Right to object: You may object to processing carried out on the basis of legitimate interests. We will cease that processing unless we can demonstrate compelling legitimate grounds that override your privacy interests.
• Right to withdraw consent: Where processing is based on consent (specifically, marketing communications), you may withdraw that consent at any time with immediate effect, without affecting the lawfulness of prior processing.

To exercise any of the above rights, contact our support team via live chat at https://m11to.app or by email at [email protected]. We will require identity verification before fulfilling any data rights request. Requests are processed free of charge unless they are manifestly unfounded or excessive.

Children & Minors

The m11to Platform is strictly for adults aged 21 and over. We do not knowingly collect Personal Data from any individual under the age of 21. If you are under 21, you are not permitted to register an account, make a deposit, or use any feature of the Platform.

If m11to becomes aware that Personal Data has been collected from a person under the age of 21 — whether through our own detection, a complaint, or notification from a parent or guardian — we will immediately suspend the associated account, delete all Personal Data relating to that individual to the extent permitted by law, and return any deposited funds to the payment source. If you believe a minor may have accessed the Platform using your device or account details, contact us immediately at [email protected] and consider enabling parental controls on your device.

International Data Transfers

m11to operates globally and may process or store your Personal Data on servers located outside Indonesia. Where Personal Data is transferred to a jurisdiction that does not provide an equivalent level of data protection to that applicable in Indonesia, m11to implements appropriate safeguards to protect that data, including:

• Entering into standard contractual clauses or equivalent data transfer agreements with the receiving entity;
• Conducting transfer impact assessments to confirm that transferred data will receive adequate protection in the destination jurisdiction;
• Requiring all Third-Party Processors to maintain equivalent technical and organisational security measures regardless of where their processing infrastructure is located.

By using the m11to Platform, you acknowledge that your Personal Data may be transferred, stored, and processed outside Indonesia in accordance with the safeguards described in this section.

Third-Party Links

The m11to Platform does not include links to third-party websites, social media platforms, or external services beyond those strictly necessary for payment processing and game delivery. To the extent that any third-party content is accessible from the Platform — for example, game interfaces delivered by studio partners — those third parties operate under their own privacy policies, and m11to is not responsible for their data practices. We encourage you to review the privacy policies of any third-party service you interact with in the context of using the m11to Platform.

Changes to This Privacy Policy

m11to reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or our licensing authority's requirements. Where a change is material — meaning it substantively affects your privacy rights or how we process your Personal Data — we will provide at least 14 days' advance notice via a prominent notice on the Platform and, where we hold a valid email address for your account, by email to that address.

Your continued use of the Platform following the effective date of any updated Privacy Policy constitutes your acknowledgement of the changes. The effective date of the current version appears at the top of this page. If you do not accept the changes, you must stop using the Platform and may request account closure in accordance with our Terms & Conditions.

All previous versions of this Privacy Policy are archived and available on request from our support team.

Contact & Complaints

If you have questions about this Privacy Policy, wish to exercise your data rights, or want to raise a concern about how m11to has handled your Personal Data, please contact us through the following channels:

• Live Chat: Available 24/7 in English and Indonesian via the Platform at https://m11to.app — this is the fastest route for most enquiries.
• Email: [email protected] — responses are provided within 24 hours during business hours WIB (Western Indonesia Time, UTC+7).

When raising a privacy concern, please include your registered username and the email address associated with your account so that our team can locate your records promptly. Identity verification will be required before any data rights request is fulfilled.

We are committed to resolving privacy complaints fairly and promptly. If you are not satisfied with our response to a complaint, you may escalate the matter to our licensing authority's dispute resolution mechanism as described in our Terms & Conditions.