Privacy Policy Nextoto –
Indonesia User Data Protection

This Privacy Policy applies to all services operated by Nextoto, including the website at the nextoto.vu domain, the Nextoto mobile app for Android and iOS, and all APIs and integrated services that form part of the Nextoto platform ecosystem.

When you create an account, make a deposit, play games, or simply visit a Nextoto page, certain data is collected as part of normal platform operations. This Policy clearly explains what data is collected, how it is used, how long it is retained, who it may be shared with, and what your rights are as the data owner.

By using Nextoto services, you confirm that you have read and understood this Privacy Policy. If you do not agree with the terms stated, please refrain from using our services.

Nextoto collects various categories of data necessary to operate its services safely, fairly, and in compliance with regulations. Below are details of the data collected and its intended purposes:

Data We Never Store

• Full credit/debit card numbers — only the last four digits are stored for identification purposes.
• PINs or passwords in plain text — all passwords are hashed using the bcrypt algorithm.
• Biometric data unless explicitly requested for identity verification with user consent.

Every use of your personal data at Nextoto is always based on at least one of the following legal grounds: fulfillment of the service contract, compliance with legal obligations, legitimate interests that do not infringe on your privacy rights, or your explicit consent for specific purposes.

Primary Data Usage

• Account Operations: Process registration, identity verification, account management, and deposit and withdrawal transaction processing.
• Platform Security: Detect and prevent fraudulent activity, unauthorized access, money laundering, and other violations of the Terms and Conditions.
• Regulatory Compliance: Fulfill reporting obligations to licensed regulatory authorities and competent law enforcement agencies.
• Service Improvement: Analyze usage patterns in aggregate and anonymized form to improve platform performance, user interface, and gaming experience.
• Service Communications: Send important account-related information, policy updates, or relevant service notifications.
• Responsible Gaming: Monitor play patterns to identify signs of problem gambling and provide timely support.

Use for Marketing Communications

Nextoto will only send marketing communications — such as promotional information, bonuses, or new features — to users who have explicitly consented to receive such communications. This consent can be withdrawn at any time through the notification preference settings in your account.

Nextoto does not sell, rent, or trade users' personal data to third parties for their own commercial purposes. However, in operating the platform, Nextoto works with selected partners who may require limited access to certain user data.

Data Recipient Category

• Payment Provider: Transaction information required to process deposits and withdrawals. This data is transmitted over encrypted connections and includes only the minimum data necessary.
• Game Provider: Technical game session data required to ensure game integrity and fairness. Game providers do not receive any personally identifiable information that could be used to identify you directly.
• KYC Service Provider: Identity documents required for the verification process. KYC partners are bound by strict confidentiality agreements and security standards no lower than those of Nextoto.
• Legal & Regulatory Authorities: Data that must be disclosed pursuant to a court order, regulatory reporting obligations, or official requests from authorized law enforcement authorities.

Nextoto uses cookies and similar technologies to ensure the platform functions properly, enhance login session security, and understand how users interact with our services. The following cookie categories are used:

Essential Cookies (Cannot Be Disabled)

These cookies are required for core platform functions: secure login session management, protection against CSRF (Cross-Site Request Forgery) attacks, and storing language and currency preferences. Without these cookies, the platform cannot operate securely.

Analytics Cookies (Can Be Disabled)

Used to understand how users interact with the platform in aggregate — which pages are visited most frequently, which features are used most, and where users encounter obstacles. Analytics data is collected anonymously and is not linked to individual identities.

Functional Cookies (Can Be Disabled)

Store user preferences such as selected interface layout, favorite game filters, and notification settings. Disabling these cookies will not affect core platform functionality, but some preferences may need to be reset on each visit.

You can manage your cookie preferences through your browser settings at any time. Please note that disabling all cookies, including essential ones, may affect platform security functions.

Nextoto invests significant resources in maintaining the security of its data infrastructure. The technical and organizational measures in place include:

• Data encryption at rest using AES-256 for all databases storing sensitive user information.
• Data encryption in transit using TLS 1.3 for all communications between client and server.
• Network segmentation ensuring that production, development, and security systems operate on physically and logically separate networks.
• Penetration testing conducted periodically by independent third parties to identify and remediate vulnerabilities before they can be exploited.
• Intrusion detection systems (IDS/IPS) that monitor network traffic in real time to detect and block suspicious activity.
• Access to user data by Nextoto employees follows the principle of least privilege — each employee only has access to the data strictly necessary to perform their job duties.

Nextoto retains your personal data only for as long as necessary for the purposes described in this policy, or as required by applicable legal and regulatory obligations. The following retention policies apply to each data category:

• Active Account Data: For the duration the account remains active, plus 5 years after account closure, in accordance with anti-money laundering regulatory requirements.
• Financial Transaction History: 7 years from the date of transaction, in accordance with international financial audit standards.
• Security & Activity Logs: 2 years for security investigation and fraud detection purposes.
• Cookie and Analytics Data: Maximum 13 months from the date of collection.
• Customer Support Communications: 3 years from the date of last interaction.

Once the retention period expires, data is permanently deleted using methods that ensure it cannot be recovered. For data stored in physical format (if any), deletion is carried out through documented secure destruction procedures.

As the owner of your personal data, Nextoto acknowledges and respects the following rights, which you may exercise at any time:

To submit a request regarding the above rights, contact the Nextoto privacy team through the customer support feature within the platform. We are committed to responding to every request within 30 calendar days.

Nextoto operates globally, and some of our technology partners may be located outside Indonesia. When your data needs to be transferred abroad — for example, for processing by international payment gateway providers or cloud infrastructure — Nextoto ensures that such transfers are protected by adequate safeguards.

The protection mechanisms in place include Standard Contractual Clauses (SCC), which require data recipients in destination countries to apply equivalent data protection standards, as well as comprehensive data processing agreements with every partner that receives international data transfers.

Nextoto does not transfer data to countries that lack an adequate data protection framework without approved additional safeguards.

Nextoto may update this Privacy Policy from time to time to reflect changes in data processing practices, applicable legal requirements, or changes to the services we offer. Material changes will be communicated to registered users via email and in-platform notifications at least 14 days before the changes take effect.

The currently applicable version of this policy is always accessible on this page. The effective date shown at the top of the document indicates when the latest version took effect. Continued use of the platform after the effective date of any changes constitutes acceptance of the updated policy.

If you have any questions, concerns, or wish to submit a privacy rights request, the Nextoto privacy team can be reached via:

• Email: [email protected] (displayed as text, not an active link)
• Live Chat: Available on the Nextoto platform, 24 hours a day, 7 days a week
• Help Center: Via the FAQ for general privacy inquiries