tor55 Privacy Policy — How We Protect Your Data

The following terms carry the meanings assigned below throughout this Privacy Policy:

tor55 collects Personal Data through three primary channels: data you provide directly, data collected automatically during your use of the Platform, and data obtained from verified third-party sources for compliance purposes.

2.1 Data You Provide Directly

2.2 Data Collected Automatically

When you access or use the tor55 Platform, we automatically collect the following technical data through server logs, cookies, and similar tracking technologies:

• Device Information: Device type (mobile/desktop/tablet), operating system, browser type and version, screen resolution, and unique device identifiers.
• Network Information: IP address, internet service provider (ISP), and approximate geolocation derived from IP (city-level only; we do not use GPS-level tracking).
• Session Data: Pages visited, time spent on each page, click paths, game sessions initiated, bets placed, login timestamps, and logout timestamps.
• Performance Data: Page load times, error logs, crash reports, and latency metrics used to maintain and improve Platform performance.

2.3 Data from Third Parties

tor55 may receive Personal Data about you from the following third-party sources in limited and specific circumstances:

• Identity Verification Providers: Third-party KYC bureaus that confirm the authenticity of the identity documents you submit.
• Payment Processors: Confirmation of payment status from Indonesian bank transfer gateways and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja).
• Fraud Detection Services: Risk scoring data from third-party fraud prevention and AML monitoring platforms.
• Regulatory Authorities: In limited circumstances, regulatory or law enforcement bodies may provide information about a Player in the context of a formal investigation.

tor55 uses your Personal Data only for the purposes listed below. We do not use your data for any purpose not described in this policy without first obtaining your consent or where otherwise required by law.

3.1 Account Management. We use your registration data, login credentials, and Account settings to create, maintain, and secure your Account, process your deposits and withdrawals in IDR via your chosen payment method (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja, or other supported channels), and deliver the full suite of gaming and sportsbook services offered on the Platform.

3.2 Identity Verification and KYC Compliance. We use your KYC Data to verify that you are who you claim to be, that you meet the minimum age requirement of 21 years, and that your use of the Platform complies with our anti-money-laundering obligations. KYC verification is required by our international gaming licence and is non-negotiable for any Player wishing to withdraw funds.

3.3 Transaction Processing. Financial Data is used exclusively to execute and record your deposit and withdrawal transactions, calculate your Account balance, apply bonus credits where applicable, and generate transaction history records accessible through your Account dashboard.

3.4 Fraud Prevention and Security. Automatically collected technical data — including IP address, device fingerprint, and session behaviour — is analysed by our security systems to detect and prevent account takeovers, bonus abuse, multi-accounting, money laundering, and other fraudulent or prohibited activity. This processing is essential to maintaining a fair and secure platform for all players.

3.5 Customer Support. Communications Data collected through live chat, email, and support tickets is used solely to respond to your enquiries, resolve disputes, and improve the quality of our support service. Support transcripts may be retained for quality assurance and regulatory audit purposes.

3.6 Platform Improvement. Aggregated and anonymised session and performance data is used to analyse player behaviour patterns, identify usability issues, optimise page load times, improve game lobby design, and guide product development decisions. This analysis does not involve individual-level profiling beyond what is necessary for security purposes.

3.7 Responsible Gaming. Your deposit limit settings, loss limit activations, self-exclusion status, and session time data are used to enforce the responsible gaming controls you set and to identify accounts showing patterns consistent with problem gambling, enabling our responsible gaming team to reach out proactively where appropriate.

3.8 Marketing Communications. If you provided explicit consent at registration, we may use your email address and mobile number to send you promotional offers, bonus notifications, and platform updates. We do not send unsolicited marketing to players who have not consented, or to players who have subsequently withdrawn consent.

3.9 Legal and Regulatory Compliance. We may process and disclose your Personal Data where required by applicable law, court order, or regulatory authority — including our licensing jurisdiction's regulatory body and, where legally compelled, Indonesian law enforcement agencies acting under valid legal process.

tor55 processes your Personal Data on one or more of the following legal bases, consistent with internationally recognised data protection standards:

5.1 Principle of Minimum Disclosure. tor55 shares your Personal Data with third parties only to the extent strictly necessary for the purposes described in this policy. We do not sell, rent, trade, or otherwise disclose Personal Data for commercial purposes unrelated to operating the Platform.

5.2 Service Providers (Processors). tor55 engages trusted third-party service providers to support the operation of the Platform. Each provider is bound by a data processing agreement that restricts their use of your data to the specific service they provide. Categories of processors include:

• Payment Gateway Operators: Process IDR deposit and withdrawal transactions via Indonesian bank transfer rails and e-wallet APIs.
• KYC & Identity Verification Services: Verify the authenticity of identity documents and perform liveness checks on selfie submissions.
• Cloud Infrastructure Providers: Host the Platform's servers, databases, and data storage in secure, access-controlled cloud environments.
• Fraud & AML Monitoring Platforms: Screen transactions and account behaviour against risk models to detect suspicious activity.
• Email & SMS Gateway Providers: Deliver transactional notifications (deposit confirmations, withdrawal updates, KYC status) and, where consented, marketing messages.
• Customer Support Platform: Power the live chat and ticketing system through which you communicate with the tor55 support team.
• Analytics Providers: Provide aggregated, anonymised insights into platform usage patterns to guide product improvement.

5.3 Regulatory and Law Enforcement Disclosure. tor55 may disclose Personal Data to regulatory bodies, licensing authorities, courts, or law enforcement agencies where required by a valid legal obligation. Such disclosures are made on a minimum-necessary basis and, where legally permissible, we will notify you of any such request before complying.

5.4 Business Transfers. In the event that tor55 undergoes a merger, acquisition, or sale of substantially all of its assets, your Personal Data may be transferred to the acquiring entity as part of that transaction. You will be notified via email and a prominent Platform notice in advance of any such transfer, and the receiving entity will be bound by this Privacy Policy or a substantially equivalent replacement.

6.1 What Are Cookies. Cookies are small text files stored on your device when you visit the tor55 Platform. They allow the Platform to remember your session, preferences, and certain behaviours between visits. Some cookies are essential for the Platform to function; others are used for analytics and security purposes.

6.2 Types of Cookies We Use.

6.3 Managing Cookies. You can control non-essential cookies through your browser settings or through your tor55 Account preferences page. Please note that disabling functional or analytics cookies will not prevent you from using the Platform but may affect the quality of your experience. Disabling strictly necessary or security cookies may impair core Platform functionality.

6.4 No Third-Party Ad Tracking. tor55 does not deploy third-party advertising cookies, retargeting pixels, or social media tracking scripts on the Platform. We do not share cookie-derived data with advertising networks.

7.1 Retention Principle. tor55 retains Personal Data only for as long as is necessary for the purposes for which it was collected, or as required by our legal and regulatory obligations. The following retention periods apply:

7.2 Deletion Requests. Where you request deletion of your Personal Data and no legal retention obligation prevents this, tor55 will complete the deletion within 30 days of receiving a verified request. Data subject to a legal hold (e.g., records flagged during an active AML investigation) will be retained until the hold is lifted, at which point deletion will be carried out promptly.

tor55 respects your rights in relation to your Personal Data and has processes in place to honour those rights promptly and without undue restriction. The following rights are available to all tor55 players:

9.1 Cross-Border Processing. tor55 is an internationally operated platform. Your Personal Data may be stored on and processed by servers located outside Indonesia, in the jurisdiction where tor55 holds its gaming licence and where its primary infrastructure providers operate. Such transfers are necessary for the performance of the contract between you and tor55.

9.2 Safeguards. Where Personal Data is transferred internationally, tor55 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that afforded within the originating jurisdiction. These safeguards include contractual data processing agreements with all third-party processors that incorporate internationally recognised data protection clauses.

9.3 Your Acknowledgement. By registering an Account and using the Platform, you acknowledge and consent to the transfer of your Personal Data to servers and processors located outside Indonesia, as described in this section. If you do not consent to cross-border data transfer, you should not register or use the Platform.

10.1 Minimum Age. The tor55 Platform is strictly for adults aged 21 and over. We do not knowingly collect Personal Data from any individual under the age of 21. The 21+ age threshold is enforced at registration through our date-of-birth verification process, and further confirmed through KYC identity verification before any withdrawal is permitted.

10.2 Underage Access. If tor55 becomes aware that Personal Data has been collected from an individual under 21 — whether through misrepresentation at registration or any other means — we will take immediate action to close the Account, void any transactions, and permanently delete all associated Personal Data without undue delay.

11.1 Technical Safeguards. tor55 employs industry-standard technical security measures to protect your Personal Data against unauthorised access, accidental loss, destruction, or damage. These measures include:

• TLS 1.3 Encryption: All data transmitted between your device and tor55 servers is encrypted using Transport Layer Security version 1.3 — the same encryption protocol used by online banking platforms.
• Database Encryption: Sensitive data fields — including passwords, KYC documents, and financial records — are encrypted at rest using AES-256 encryption.
• Firewall & Intrusion Detection: Our infrastructure is protected by enterprise-grade firewalls and intrusion detection systems that monitor and block suspicious access attempts 24/7.
• Secure Access Controls: Access to live production databases is restricted to authorised personnel only, on a need-to-know basis, with all access logged and audited quarterly.
• Two-Factor Authentication: Available optionally for player Accounts and mandatory for all administrative user Accounts.
• Regular Security Audits: tor55 undergoes quarterly security assessments conducted by independent third-party auditors to identify and remediate vulnerabilities.

11.2 Organisational Safeguards. Beyond technical measures, tor55 implements organisational policies and procedures to safeguard Personal Data:

• All tor55 staff with access to Personal Data are bound by confidentiality agreements and receive regular data protection training.
• KYC documents are segregated into secure vaults accessible only to compliance officers authorised for identity verification duties.
• Personal Data is never stored on local employee devices; all processing occurs on centralised, access-controlled servers.
• Data breach response protocols are documented and tested semi-annually to ensure rapid incident response.

11.3 Breach Notification. In the unlikely event of a data breach that poses a risk to your rights and freedoms, tor55 will notify affected players via email within 72 hours of becoming aware of the breach, in accordance with applicable data protection regulations. The notification will describe the nature of the breach, the data categories affected, the likely consequences, and the measures tor55 has taken or proposes to take to address the breach and mitigate its potential adverse effects.

12.1 Right to Amend. tor55 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or operational requirements. When material changes are made, we will take reasonable steps to notify you in advance.

12.2 Notification of Material Changes. Material changes to this policy — including any change that expands the categories of Personal Data collected, introduces new purposes for processing, or alters your rights — will be communicated to you via email to your registered email address and via a prominent notice displayed on the Platform for at least 30 days prior to the change taking effect.

12.3 Continued Use Constitutes Acceptance. Your continued use of the Platform after the effective date of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the updated policy, you may close your Account at any time by contacting tor55 customer support. Account closure requests must be honoured within 14 days, subject to the completion of any pending transactions or investigations.

12.4 Version Control. The current version of this Privacy Policy is dated January 2026 and supersedes all prior versions. Previous versions are archived and available upon request for reference purposes.

13.1 Privacy Enquiries. If you have any questions, concerns, or complaints regarding this Privacy Policy or tor55's handling of your Personal Data, please contact our Data Protection Officer using the details below:

13.2 Regulatory Authority. You have the right to lodge a complaint with the data protection supervisory authority in the jurisdiction where tor55 is licensed if you believe we have not handled your Personal Data lawfully. Contact details for the relevant authority are available upon request.

13.3 Indonesian Players. While tor55 is licensed and regulated internationally, we recognise the expectations of our Indonesian player base. We handle Personal Data in accordance with internationally recognised data protection standards, including principles equivalent to those set out in Indonesia's Personal Data Protection Law (UU Pelindungan Data Pribadi). For Indonesia-specific data protection enquiries, please use the email contact above and reference "Indonesia Data Protection" in your subject line.