cpgto Privacy Policy

In this Privacy Policy, the following terms have the meanings assigned to them below:

2.1   cpgto acts as the Data Controller in respect of all Personal Data collected from Users of the Platform. As Data Controller, we determine the purposes and means of processing your Personal Data and are responsible for ensuring that such processing complies with applicable data protection laws and regulations.

2.2   We are an internationally licensed and regulated online gaming operator. Our data handling practices are designed to meet the standards required by our licensing jurisdiction and are applied consistently to all members, including those located throughout Indonesia.

2.3   All data protection inquiries, subject access requests, and complaints relating to this Privacy Policy should be directed to our Data Protection contact — details are provided in Section 14 of this Policy.

3.1   cpgto collects Personal Data from Users across several categories, depending on the nature of your interaction with the Platform. The table below summarizes the main categories of data we collect and the primary sources from which they are obtained:

3.2   We do not knowingly collect or retain sensitive personal data — such as racial or ethnic origin, political opinions, religious beliefs, health records, or biometric data — except where identity document verification inherently surfaces such information and only to the extent strictly required for regulatory compliance.

3.3   Where you provide data relating to a third party (for example, when naming a beneficiary), you warrant that you have the appropriate authority or consent from that person to provide their information to us for the stated purpose.

4.1   cpgto uses Personal Data collected from Users for the following purposes:

• Account Management: To create, maintain, and administer your registered account, including verifying your identity, managing your balance, and processing your account settings.
• Transaction Processing: To process deposi ts and withdrawals via local Indonesian bank accounts (BCA, BRI, BNI, Mandiri, CIMB Niaga) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja), and to maintain accurate financial records.
• Identity Verification (KYC): To verify your age (minimum 21 years) and identity in compliance with our licensing obligations and anti-money laundering requirements before authorizing withdrawals.
• Customer Support: To respond to your queries, resolve disputes, investigate complaints, and maintain records of communications for quality assurance and compliance purposes.
• Platform Security & Fraud Prevention: To monitor account activity for suspicious behavior, detect and prevent fraud, collusion, money laundering, and other prohibited conduct as defined in our Terms & Conditions.
• Responsible Gaming: To monitor betting patterns that may indicate problem gambling behavior, to enforce deposit limits and self-exclusion requests, and to provide access to responsible gaming resources.
• Legal & Regulatory Compliance: To fulfill our obligations under applicable laws, respond to lawful requests from regulatory or law enforcement authorities, and maintain records required by our licensing jurisdiction.
• Platform Improvement: To analyze anonymized usage data, identify technical issues, and improve the features, performance, and user experience of the cpgto platform.
• Marketing Communications: To send you promotional offers, bonus notifications, and news about new features — but only where you have given your explicit consent to receive such communications. You may withdraw consent at any time via your account settings.

4.2   We do not use your Personal Data to make fully automated decisions that produce legal or similarly significant effects on you without providing an opportunity for human review. Where automated tools are used for fraud screening or responsible gaming monitoring, a human compliance officer reviews all resulting actions before they are applied to your account.

5.1   cpgto processes your Personal Data on one or more of the following legal grounds, depending on the specific processing activity:

• Contractual Necessity: Processing required to perform our contract with you — including account management, transaction processing, and customer support — is carried out on the basis that it is necessary to deliver the services you have requested.
• Legal Obligation: Processing required to comply with applicable laws and regulatory requirements — including KYC, anti-money laundering checks, and tax record-keeping — is carried out on the basis of legal obligation.
• Legitimate Interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and platform analytics is carried out on the basis of our legitimate interests, provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for direct marketing communications is carried out solely on the basis of your freely given, specific, and informed consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

6.1   cpgto does not sell, rent, or trade your Personal Data to any third party for commercial purposes. We share your data only in the following limited and controlled circumstances:

• Payment Processors: We share the financial details necessary to process your deposits and withdrawals with our approved payment partners, including local Indonesian bank networks and e-wallet providers. These partners are contractually bound to use your data solely for payment processing purposes.
• Identity Verification Providers: KYC document data is shared with our approved identity verification partners to conduct age and identity checks required by our licensing obligations.
• Game Studio Partners: Usage data relating to your game sessions may be shared with platform game providers — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft — for the purpose of game delivery, dispute resolution, and fairness auditing.
• Regulatory & Law Enforcement Authorities: We may disclose Personal Data to competent regulatory or law enforcement authorities where required to do so by applicable law, court order, or our licensing obligations, or where we reasonably believe disclosure is necessary to prevent fraud or protect the safety of any person.
• Professional Advisors: We may share data with our legal counsel, auditors, and compliance consultants where strictly necessary for the provision of their professional services, subject to obligations of confidentiality.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of our business, your Personal Data may be transferred to the acquiring entity, subject to equivalent privacy protections. You will be notified in advance of any such transfer that materially affects your data rights.

6.2   All third parties with whom we share Personal Data are required to implement appropriate technical and organizational security measures and to process your data only for the purposes for which it was shared.

7.1   The cpgto platform uses cookies and similar tracking technologies to deliver a functional, personalized, and secure user experience. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the Platform to function correctly — including session management, login authentication, security tokens, and fraud detection signals. These cannot be disabled without significantly impairing Platform functionality.
• Functional Cookies: Used to remember your preferences — such as your preferred language, display settings, and last-visited game categories — to provide a more personalized experience on return visits.
• Analytics Cookies: Used to collect anonymized data about how Users navigate the Platform, which pages are visited most, and where technical errors occur. This data is aggregated and does not identify you personally. It is used solely to improve Platform performance and usability.
• Marketing Cookies: Used — only with your consent — to track whether promotional offers displayed to you have been viewed or clicked, enabling us to assess the relevance of our communications and avoid showing you offers you have already seen.

7.2   You may manage your cookie preferences through your browser settings. Disabling all cookies may prevent certain features of the Platform from functioning correctly. Strictly necessary cookies cannot be disabled via browser settings without affecting your ability to log in and use the Platform.

7.3   We do not use cross-site tracking technologies that follow your activity across third-party websites outside of the cpgto platform.

8.1   cpgto retains Personal Data for the following periods, after which data is securely deleted or irreversibly anonymized:

8.2   Where a legal dispute is ongoing at the time a retention period would otherwise expire, we will retain the relevant data until the dispute is finally resolved, after which it will be deleted in accordance with the schedule above.

9.1   cpgto implements a comprehensive set of technical and organizational security measures to protect your Personal Data against unauthorized access, accidental loss, destruction, or disclosure. Key measures include:

• TLS 1.3 encryption for all data in transit between your device and our servers.
• AES-256 encryption for sensitive data at rest, including KYC documents and financial records.
• Multi-factor authentication options for registered account holders.
• Role-based access controls ensuring that staff can only access Personal Data relevant to their specific job function.
• Regular independent security audits and penetration testing of Platform infrastructure.
• Automated intrusion detection and real-time alerting systems monitored 24/7 by our security team.
• Strict vendor security assessment requirements applied to all third-party service providers before engagement.

9.2   In the event of a Personal Data breach that is likely to result in a risk to your rights and freedoms, cpgto will notify the relevant regulatory authority and, where required, affected Users within the timeframe prescribed by applicable law.

9.3   While we implement robust security measures, no data transmission over the internet or electronic storage system is completely immune to risk. You are responsible for keeping your own account credentials secure and for notifying us immediately at [email protected] (plain text — not a link) if you suspect unauthorized access to your account.

10.1   As a cpgto member, you have the following rights with respect to your Personal Data. To exercise any of these rights, please contact us using the details in Section 14. We will respond within 30 calendar days of receiving a valid request:

10.2   Exercising your rights will not result in any penalty or restriction to your account services, except where the exercise of a right (such as the right to erasure) makes it technically impossible for us to continue providing the platform services to you — in which case we will close your account and return any verified real-money balance through a verified payment channel.

11.1   The cpgto platform is strictly for adults aged 21 and above. We do not knowingly collect, store, or process any Personal Data from individuals under the age of 21. Age verification is a mandatory step in our account registration and KYC process.

11.2   If we discover or are notified that we have inadvertently collected Personal Data from a person under 21 years of age, we will immediately suspend the relevant account, delete all associated Personal Data, and return any deposited funds to the originating payment source.

11.3   If you have reason to believe that a minor has registered an account on our platform, please contact us immediately using the details in Section 14. We treat all such reports as urgent and will investigate and act within 24 hours of notification.

12.1   As an internationally operating platform, cpgto may transfer your Personal Data to servers and service providers located outside of Indonesia. In all such cases, we ensure that appropriate safeguards are in place to protect your data to a standard equivalent to that described in this Privacy Policy.

12.2   Safeguards used for international transfers include contractual clauses that impose data protection obligations on the receiving party, and selection of third-party partners who operate under data protection frameworks recognized as providing an adequate level of protection.

12.3   By registering an account and using the cpgto platform, you acknowledge and consent to the transfer of your Personal Data to our servers and partner infrastructure, which may be located in jurisdictions outside Indonesia, subject to the protections described in this Policy.

13.1   cpgto reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or platform functionality. The "Last Updated" date at the top of this page will be revised accordingly.

13.2   Where a change is material — meaning it significantly affects your rights or how we use your data — we will notify you by email to your registered address and by a prominent notice on the Platform at least 14 days before the change takes effect.

13.3   Your continued use of the cpgto platform following the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. If you do not accept the revised Policy, you must cease using the Platform and may request closure of your account and return of any verified real-money balance.

13.4   We recommend that you review this Privacy Policy periodically. Previous versions are available upon request by contacting our support team.

14.1   If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to raise a data protection concern, please contact the cpgto Data Protection team through the following channel:

14.2   When submitting a data rights request, please include your full registered name, the email address associated with your cpgto account, a clear description of the right you wish to exercise, and any relevant details that will help us locate and process your request efficiently. We may ask you to verify your identity before processing the request.

14.3   If you are not satisfied with our response to a data protection concern, you have the right to raise a complaint with the relevant data protection supervisory authority in the jurisdiction applicable to your circumstances. We will always provide details of the appropriate authority upon request.