lakuto Privacy Policy

lakuto ("we", "us", "our", or "the Company") is committed to protecting and respecting the privacy of every individual who interacts with our online betting platform at https://lakuto.cam (the "Platform"). This Privacy Policy sets out in clear, plain English exactly what personal data we collect from you, why we collect it, how we use and protect it, how long we keep it, and what rights you have in relation to it.

This Policy applies to all personal data processed by lakuto in connection with your use of the Platform, whether you are a registered account holder, a prospective player browsing our pages, or an individual who contacts us through our support channels. It covers data collected via the website, email, live chat, and any other interaction channel operated by the Company.

This Privacy Policy should be read alongside lakuto's Terms & Conditions and our Responsible Gaming Policy, all of which form part of the agreement between you and the Company when you use the Platform.

For the purposes of applicable data protection law, lakuto is the data controller responsible for your personal data. This means we determine the purposes and means by which your personal data is processed when you use our Platform.

Our primary market is Indonesia, and the Platform is operated to serve English-preference players across cities including Jakarta, Surabaya, Bandung, Medan, Semarang, Yogyakarta, Makassar, Bali, and Palembang. While we target the Indonesian player base, the Platform is operated under international jurisdiction, and data processing is conducted in accordance with internationally recognised privacy standards.

For all data-related enquiries, please contact our Data Privacy team at the contact details provided in Section 14 of this Policy.

We collect personal data from you in several ways — directly when you provide it to us, automatically when you use the Platform, and occasionally from third parties. The categories of data we collect are described below.

In limited circumstances, we may receive personal data about you from third parties, including:

• Payment processors and banking partners — transaction confirmation data from BCA, BRI, BNI, Mandiri, and e-wallet providers to verify deposit and withdrawal status.
• Identity verification service providers — automated document verification results used to supplement our KYC process.
• Fraud prevention and AML screening services — risk scores and flagging results used to protect the Platform from financial crime.
• Game studios (Pragmatic Play, Evolution Gaming, Spribe, Pocket Games Soft, NetEnt, Microgaming) — game outcome and session data necessary for bet settlement and dispute resolution.

lakuto uses your personal data for the following purposes. We do not use your data for any purpose not listed here without first obtaining your explicit consent or being required to do so by law.

• Account Creation and Management: To register your account, verify your identity, maintain your account settings, and provide you with access to Platform features.
• Transaction Processing: To process deposits via BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, OVO, DANA, GoPay, ShopeePay, LinkAja, USDT, BTC, and ETH; to process withdrawal requests to your registered payment method; and to maintain accurate financial records.
• KYC and Regulatory Compliance: To verify your age (21+) and identity in compliance with our anti-money laundering (AML) and know-your-customer (KYC) obligations.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, account compromise, bonus abuse, and other security threats to the Platform and its players.
• Responsible Gaming: To monitor gaming behaviour patterns that may indicate problem gambling; to enforce deposit limits, loss limits, and self-exclusion requests; and to contact players where we have genuine concern about their welfare.
• Customer Support: To respond to your enquiries, resolve disputes, and improve our support processes based on interaction history.
• Platform Improvement: To analyse usage patterns, understand player preferences, and develop, test, and improve Platform features and game offerings.
• Marketing Communications (with consent): To send you promotional emails, bonus offers, and news about Platform updates — only where you have explicitly opted in. We may personalise these communications based on your betting preferences and activity on the Platform.
• Legal Obligations: To comply with applicable laws, court orders, regulatory requirements, or requests from lawfully authorised government bodies.

Every instance of personal data processing carried out by lakuto is grounded in at least one of the following lawful bases. We identify the applicable basis for each processing activity in the table below.

Where we rely on legitimate interests as our lawful basis, we have assessed that our interests do not override your fundamental rights and freedoms, taking into account the reasonable expectations of Platform users in the online gaming context.

lakuto does not sell, rent, or trade your personal data to any third party for commercial gain. We share your data only in the limited circumstances described below, and only to the minimum extent necessary for each purpose.

We engage carefully vetted third-party service providers who process data on our behalf and under our instruction. These include:

• Payment infrastructure providers — to facilitate transfers to and from BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, and LinkAja, as well as cryptocurrency network processors.
• KYC and identity verification platforms — to perform automated document checks and liveness verification on submitted identity documents.
• AML and fraud screening services — to screen transactions and player profiles against sanctions lists and known fraud databases.
• Cloud hosting and infrastructure providers — to store data securely on servers with appropriate access controls and encryption.
• Customer support platform providers — to power our live chat and ticketing systems, enabling our 24/7 Indonesian-speaking support team to assist you.
• Game studio partners (Pragmatic Play, Evolution Gaming, Spribe, Pocket Games Soft, NetEnt, Microgaming) — to receive game outcome and session data required for bet settlement.

All service providers are contractually bound to process your data only as instructed by lakuto, to maintain appropriate security standards, and not to use your data for their own purposes.

We may disclose your personal data to government authorities, law enforcement agencies, courts, or regulatory bodies where we are legally required to do so, or where we have a good-faith belief that disclosure is necessary to:

• Comply with a legal obligation or court order.
• Protect and defend the rights or property of lakuto.
• Prevent or investigate possible wrongdoing in connection with the Platform.
• Protect the personal safety of Platform users or the public.

In the event that lakuto undergoes a merger, acquisition, corporate restructuring, or sale of all or substantially all of its assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer via email or a prominent notice on the Platform prior to your data being transferred and becoming subject to a different privacy policy.

As an internationally operated platform serving players primarily in Indonesia, lakuto may transfer your personal data to servers or service providers located outside Indonesia. Where such transfers occur, we ensure that appropriate safeguards are in place to protect your data to a standard equivalent to that required under applicable international privacy frameworks.

Safeguards we apply to international data transfers include:

• Contractual clauses requiring recipient organisations to maintain data protection standards equivalent to those applied by lakuto.
• Transfers only to jurisdictions that maintain adequate data protection regimes or to recipients certified under recognised international data transfer frameworks.
• Technical measures — including encryption in transit and at rest — applied regardless of the transfer destination.

If you would like specific information about the safeguards applied to any particular international data transfer involving your personal data, please contact our Data Privacy team at the details provided in Section 14.

lakuto retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, to comply with legal and regulatory obligations, or to resolve disputes and enforce our agreements. The following retention periods apply:

When personal data is no longer required, it is securely deleted or anonymised so that it can no longer be associated with any individual. Anonymised or aggregated data (which cannot identify you) may be retained indefinitely for statistical analysis and platform development purposes.

lakuto uses cookies and similar tracking technologies to operate the Platform effectively and to improve your experience. This section explains what cookies we use, why we use them, and how you can manage your cookie preferences.

Cookies are small text files placed on your device by a website when you visit it. They are widely used to make websites work correctly, to remember your preferences, and to provide site operators with information about how the site is being used. Cookies do not contain executable code and cannot access other files on your device.

Strictly necessary cookies cannot be disabled as they are essential to the Platform's core functionality. You may disable functional and analytics cookies through your browser settings. Most modern browsers allow you to view, delete, and block cookies on a per-site basis. Please note that disabling functional cookies may affect your experience on the Platform — for example, your preferences may not be remembered between sessions.

As an individual whose personal data we process, you hold the following rights. We are committed to honouring these rights promptly and transparently. To exercise any of the rights below, please contact us using the details in Section 14.

We will respond to all data subject requests within 30 calendar days of receipt. Where a request is complex or we have received a high volume of requests, we may extend this period by a further 60 days, in which case we will notify you of the extension and the reason for it within the initial 30-day window.

The security of your personal data is a top priority for lakuto. We implement a comprehensive set of technical and organisational security measures to protect your data against unauthorised access, accidental loss, destruction, or disclosure.

• 256-bit SSL/TLS encryption on all data transmitted between your device and our servers.
• Encryption at rest for all stored personal data, including KYC documents and financial records.
• Multi-factor authentication (MFA) available for all player accounts and enforced for all internal administrative access.
• Role-based access controls (RBAC) — staff can only access personal data relevant to their specific job function. No employee has unrestricted access to the full database.
• Automated intrusion detection and DDoS mitigation systems monitoring the Platform around the clock.
• Regular penetration testing conducted by independent third-party security specialists.

• All staff with access to personal data receive mandatory data protection training upon onboarding and annually thereafter.
• A documented data breach response procedure is in place. In the event of a breach that poses a risk to your rights and freedoms, we will notify affected individuals and the appropriate regulatory authority within 72 hours of becoming aware of the breach.
• Third-party vendors are subject to security due diligence before engagement and are contractually required to maintain equivalent security standards.

The lakuto Platform is strictly intended for adults aged 21 years and over. We do not knowingly collect, store, or process personal data from individuals under the age of 21. This restriction applies to all markets in which we operate, including Indonesia, where 21+ is our enforced minimum age for account registration and wagering.

During the KYC verification process, every account holder's date of birth is verified against a government-issued identity document. Any account found to belong to a person under 21 will be immediately suspended, all data associated with that account will be reviewed, and any balance will be handled in accordance with our Terms & Conditions and applicable law.

If you are a parent or guardian and believe that a minor in your care has registered an account on the Platform without your knowledge, please contact us immediately at [email protected] (plain text address — not a clickable link). We will investigate and take prompt action, including account closure and data deletion where legally permissible.

We reserve the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or our Platform's features and services. The most current version of this Policy will always be accessible at https://lakuto.cam/privacy-policy.

Where an amendment materially affects your rights or how we handle your personal data, we will notify you by email to your registered address and/or through a prominent in-Platform notification at least 14 days before the change takes effect. This notice period gives you the opportunity to review the updated Policy and, if you do not agree with the changes, to close your account and withdraw your funds before the revised terms apply to you.

Minor amendments — such as typographical corrections, formatting updates, or clarifications that do not alter the substance of our data practices — may be published without advance notice, although the "Last Updated" date at the top of this page will always be revised accordingly.

Your continued use of the Platform following the effective date of any amendment to this Privacy Policy constitutes your acceptance of the revised terms.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to raise a concern about how lakuto handles your personal data, please reach out to our Data Privacy team using the contact details below.

We take all privacy complaints seriously and will work with you in good faith to resolve any concern. If you are not satisfied with our response, you have the right to escalate your complaint to the relevant data protection supervisory authority in your jurisdiction. We will provide you with the appropriate authority's contact information upon request.

For responsible gaming concerns — including requests for self-exclusion, deposit limits, or welfare support — please visit our dedicated Responsible Gaming page, where comprehensive tools and guidance are available.