Privacy Policy — taro89

This Privacy Policy applies to all personal data collected, processed, and stored by taro89 in connection with your use of the online gambling platform accessible at https://taro89.app (the "Platform"), including all associated subdomains, mobile-optimized interfaces, and any software applications made available to registered players.

For the purposes of this Policy, taro89 and its affiliated operating entities act as the data controller responsible for determining how and why your personal data is processed. By registering an account on the Platform, you acknowledge that you have read, understood, and accepted the practices described in this Privacy Policy. If you do not agree with any part of this Policy, you must not use the Platform.

This Policy should be read in conjunction with our Terms & Conditions, which govern the overall legal relationship between you and taro89. Our Responsible Gaming page also contains important information relevant to the processing of data related to player-protection tools such as self-exclusion and deposit limits.

taro89 collects personal data through several channels: directly from you at registration and during ongoing use of the Platform; automatically through your device and browser as you interact with the Platform; and from third-party service providers as part of our fraud prevention and payment processing operations.

The categories of personal data we collect are set out in the table below:

taro89 processes your personal data only for specific, legitimate purposes. We do not use your data for any purpose that is incompatible with the purposes disclosed below:

• Account Management: To create, maintain, and administer your taro89 account, including verifying your identity, processing login requests, and managing account security settings such as password resets and two-factor authentication.
• Service Delivery: To provide you with access to sportsbook markets, live casino games, slot titles from providers including Pragmatic Play, Evolution Gaming, NetEnt, and Pocket Games Soft, esports betting, and all other features of the Platform.
• Financial Transactions: To process deposits and withdrawals via your chosen Indonesian payment method — including local bank transfers (BCA, BRI, BNI, Mandiri) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja) — and to maintain accurate transaction records.
• KYC & Fraud Prevention: To verify your age (21+), confirm that you are who you claim to be, and detect and prevent fraudulent activity, money laundering, multiple-account abuse, and other prohibited conduct.
• Responsible Gaming: To apply and monitor responsible-gaming limits you have set, to identify patterns of play that may indicate problematic gambling behavior, and to enforce self-exclusion requests.
• Customer Support: To respond to your inquiries, resolve disputes, and maintain records of support interactions for quality assurance and training purposes.
• Legal & Regulatory Compliance: To meet our obligations under applicable international gaming regulations, anti-money laundering (AML) requirements, and any lawful requests from competent regulatory or law enforcement authorities.
• Platform Improvement: To analyze aggregated, anonymized usage data to improve Platform performance, fix bugs, optimize game loading times, and enhance the overall user experience for players across Indonesia.
• Marketing Communications: To send you promotional offers, bonus notifications, and news about taro89 — but only where you have given explicit consent or where we have a legitimate interest that does not override your privacy rights. You may opt out of marketing communications at any time by contacting [email protected].

taro89 relies on the following legal bases for processing your personal data:

• Contractual Necessity: Processing is necessary to perform our contract with you — specifically, to operate your account, process your bets, and handle your deposits and withdrawals.
• Legal Obligation: Processing is necessary to comply with applicable law, including KYC/AML obligations, age verification requirements (21+), and mandatory record-keeping requirements imposed by our international gaming license.
• Legitimate Interests: Processing is necessary for our legitimate interests — including fraud prevention, Platform security, and improving our services — provided those interests are not overridden by your privacy rights.
• Consent: Where processing is based on your consent (for example, receiving marketing emails), you may withdraw that consent at any time by contacting our support team. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

taro89 does not sell your personal data. We may share your personal data with the following categories of third parties, strictly for the purposes described:

• Payment Processors & Banking Partners: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the financial data necessary to process your deposit and withdrawal transactions. Each payment partner operates under its own privacy policy and applicable Indonesian financial regulation.
• Identity Verification Providers: Third-party KYC service providers may receive copies of your identity documents and verification selfies for the purpose of automated identity checking. These providers are contractually bound to process your data only on our behalf and in accordance with our instructions.
• Game Content Providers: Game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft receive limited technical session data (e.g., a session token and bet amount) in order to deliver their games. They do not receive your full identity profile.
• Regulatory & Law Enforcement Authorities: taro89 may disclose personal data to competent regulatory bodies or law enforcement agencies where required to do so by law, court order, or in connection with a fraud or money-laundering investigation.
• Professional Advisors: Our legal advisors, auditors, and insurers may access personal data on a strictly need-to-know basis, subject to binding confidentiality obligations.

taro89 uses cookies and similar technologies — including local storage and session storage — to operate the Platform effectively. Cookies are small text files placed on your device when you visit the Platform. They allow us to recognize your browser, maintain your session, and remember your preferences.

You may configure your browser to refuse or delete cookies; however, disabling strictly necessary cookies will prevent you from logging in and using the Platform. taro89 does not use third-party advertising cookies or cross-site tracking pixels.

taro89 retains your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention periods apply:

• Account & Identity Data: Retained for the duration of your active account plus a minimum of five (5) years following account closure, to comply with anti-money laundering record-keeping requirements.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of the transaction, consistent with international AML standards applicable to the gaming industry.
• KYC Documents: Retained for the duration of your account plus five (5) years post-closure, or longer where required by applicable regulation.
• Customer Support Communications: Retained for three (3) years from the date of last interaction, to allow for dispute resolution and quality-assurance reviews.
• Marketing Consent Records: Retained until you withdraw consent plus three (3) years, as evidence of the consent basis on which communications were sent.
• Technical & Log Data: Retained for up to twelve (12) months from collection, after which it is either deleted or irreversibly anonymized.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in accordance with our internal data destruction procedures. Anonymized, aggregated data may be retained indefinitely for statistical and analytical purposes, as it no longer constitutes personal data.

As a user of the taro89 Platform, you hold the following rights with respect to the personal data we hold about you. To exercise any of these rights, please contact us at [email protected] with the subject line "Data Rights Request". We will respond within thirty (30) days of receiving a verified request.

taro89 implements a comprehensive set of technical and organizational security controls designed to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• Encryption in Transit: All data transmitted between your device and the taro89 Platform is encrypted using TLS 1.2 or higher. We enforce HTTPS across the entire Platform with HSTS (HTTP Strict Transport Security) headers.
• Encryption at Rest: Sensitive data fields — including identity document references, payment account details, and KYC records — are encrypted at rest using AES-256 encryption in our database layer.
• Password Hashing: User passwords are never stored in plaintext. They are processed through a one-way cryptographic hashing algorithm with per-user salting. taro89 staff cannot retrieve or read your password at any time.
• Access Controls: Access to production systems and player data is restricted to authorized personnel only, governed by role-based access control (RBAC) policies. All internal access is logged and subject to periodic access-rights reviews.
• Two-Factor Authentication: 2FA is available for all player accounts and is strongly recommended. Players can enable 2FA from their account security settings.
• Penetration Testing: taro89 commissions periodic third-party security assessments and penetration tests of its Platform infrastructure to identify and remediate vulnerabilities proactively.
• Incident Response: In the event of a data security breach that poses a material risk to your rights and freedoms, taro89 will notify affected players and the relevant regulatory authority within the timeframe required by applicable law.

The taro89 Platform is strictly intended for adults aged 21 years or older. We do not knowingly collect personal data from individuals under the age of 21. If you are under 21, you must not register an account, deposit funds, or place any wagers on the Platform.

If taro89 becomes aware that personal data has been collected from an individual under the age of 21 — whether through a verification review, a third-party report, or any other means — we will immediately suspend the associated account, forfeit any bonus balances, and delete the personal data in question in accordance with our data retention procedures. Any real-money deposits associated with an underage account will be returned to the originating payment method.

Parents and guardians who believe their child may have registered on taro89 are encouraged to contact us at [email protected] without delay so that we may take immediate action.

The taro89 Platform may display game content or promotional material that references third-party brands — such as Pragmatic Play, Evolution Gaming, and Spribe — solely for the purpose of identifying the game provider. taro89 does not embed outbound links to external websites within the Platform's main navigation, content pages, or footer.

When you interact with a live game session powered by a third-party game studio, limited technical data (as described in Section 5) is shared with that studio solely to deliver the gaming experience. Each game provider maintains its own privacy practices; however, taro89 contractually requires all game content providers to process player session data only for the purposes of delivering and auditing their games.

taro89 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform features. When we make material changes to this Policy — changes that meaningfully affect how we collect, use, or share your personal data — we will provide reasonable advance notice via email to your registered address and/or by displaying a prominent notice on the Platform.

The effective date displayed at the top of this page indicates when the current version of the Policy came into force. Your continued use of the Platform after a revised Policy takes effect constitutes your acceptance of the updated terms. If you do not agree with the changes, you must cease using the Platform and contact our support team to request account closure and data handling instructions.

We encourage you to review this Privacy Policy periodically, especially before submitting any new personal information through the Platform.

If you have any questions, concerns, or complaints regarding this Privacy Policy, or if you wish to exercise any of your data rights as described in Section 8, please reach out to the taro89 privacy and support team through the following channel:

If you believe that taro89 has not adequately addressed your privacy concern, you have the right to escalate your complaint to the relevant data protection or regulatory authority applicable in your jurisdiction.