Privacy Policy — Malukutoto Platform

Introduction

This Privacy Policy (hereinafter "this Policy") describes how Malukutoto (hereinafter "we", "us", "our", or "the Platform") collects, processes, stores, shares, and protects the personal data of individuals who access and use the Malukutoto website at malukutoto.asia and all associated services (collectively, "the Services").

Malukutoto operates as an online sports betting and live casino platform serving users across Malaysia, including players in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and other locations. We are committed to handling all personal data with transparency, integrity, and appropriate technical and organisational safeguards.

By registering an account, making a deposit, placing a wager, or otherwise using any part of the Services, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, you must not use the Services.

Definitions

For the purposes of this Policy, the following terms carry the meanings assigned below:

Data We Collect

Malukutoto collects the following categories of personal data in connection with the provision of our Services:

3.1 Registration & Identity Data

• Full legal name as it appears on your government-issued identification document
• Date of birth (for age verification — 21+ requirement)
• Residential address, including city and postcode
• Email address and mobile phone number
• Username and encrypted password
• Nationality and, where required, country of residence

3.2 KYC Verification Documents

• Copy of Malaysian MyKad, international passport, or equivalent government-issued photo identification
• Proof of payment method (e.g., screenshot of Touch 'n Go eWallet, Maybank account details, or equivalent) where required for withdrawal verification
• Proof of residential address (utility bill, bank statement) where required under enhanced KYC procedures
• Selfie or liveness-check image where required by our identity verification service provider

3.3 Financial Transaction Data

• Deposit and withdrawal transaction history, including amounts in MYR, timestamps, and payment method identifiers
• Cryptocurrency wallet addresses used for deposits or withdrawals (BTC, ETH, USDT, LTC)
• Bank account identifiers (partial, for DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank PBe) used for withdrawal matching
• Transaction reference numbers and payment gateway responses

3.4 Gaming Activity Data

• Wagering history, including games played, stakes placed, outcomes, and net win/loss figures
• Session duration and session frequency data
• Responsible gambling tool usage (e.g., deposit limit settings, self-exclusion status)
• Bonus and promotional credit history

3.5 Technical & Device Data

• IP address and approximate geolocation derived from IP
• Device type, operating system, browser type and version
• Session identifiers and authentication tokens
• Platform interaction logs (pages visited, features accessed, error reports)

3.6 Communication Data

• Content of live chat conversations with our support team
• Email correspondence submitted to [email protected]
• Feedback, complaints, and dispute records

How We Collect Your Data

Malukutoto collects personal data through the following mechanisms:

• Direct provision by you — when you register an account, complete KYC verification, submit a support query, or update your account settings.
• Automated technical collection — through cookies, server logs, and session tracking technologies as described in Section 10 of this Policy.
• Payment processors — when you make a deposit or withdrawal, our payment partners (including FPX, DuitNow, and e-wallet providers) transmit transaction confirmation data to us. We do not directly handle full bank credentials.
• Identity verification providers — where we engage third-party KYC service providers to assist with document verification, those providers may transmit verification outcomes and associated data to us.
• Responsible gambling tools — where you interact with deposit limits, self-exclusion, or cooling-off features, that interaction data is recorded to maintain the integrity of those safeguards.

Purpose of Data Processing

We process your personal data for the following specific purposes:

Legal Basis for Processing

Malukutoto processes personal data on the following legal grounds:

• Contractual necessity — processing required to enter into and perform our contract with you, including account creation, transaction processing, and wager settlement.
• Legal obligation — processing required to comply with the obligations of our international operating licence, including KYC procedures, AML record-keeping, and age verification.
• Legitimate interests — processing for fraud prevention, platform security, responsible gambling monitoring, and anonymised analytics, where these interests are not overridden by your fundamental rights and freedoms.
• Consent — processing for optional marketing communications, where you have provided explicit opt-in consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Data Sharing & Disclosure

Malukutoto does not sell, rent, or trade your personal data to third parties for commercial or marketing purposes. We share personal data only in the following limited and necessary circumstances:

7.1 Payment Service Providers

We share transaction-relevant data with our payment processing partners — including FPX, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, Maybank2u, CIMB, and Public Bank — to facilitate deposits and withdrawals. These providers receive only the minimum data necessary to process the transaction and are contractually bound to protect your data.

7.2 Identity Verification Providers

Where we engage third-party KYC service providers to assist with identity document verification, we share relevant KYC documents and personal identifiers with those providers. These providers are engaged under binding data processing agreements and are not permitted to use your data for any purpose other than identity verification on our behalf.

7.3 Licensing Authority

Our operating licence requires us to share specified categories of player data with our licensing authority for audit, compliance monitoring, and dispute resolution purposes. This sharing is a mandatory condition of our licence and is performed pursuant to our legal obligations.

7.4 Legal and Regulatory Authorities

We may disclose personal data to competent authorities — including law enforcement agencies, financial intelligence units, or courts — where we are legally compelled to do so by a valid legal process, court order, or regulatory direction. We will notify you of such disclosure to the extent permitted by law.

7.5 Corporate Transactions

In the event of a merger, acquisition, or sale of all or substantially all of Malukutoto's business assets, personal data held by the Platform may be transferred to the acquiring entity as part of that transaction, subject to the acquirer assuming equivalent data protection obligations.

International Data Transfers

Malukutoto's services are operated internationally in accordance with our operating licence. Personal data collected from Malaysian users may be transferred to and stored on servers located outside of Malaysia. Where such transfers occur, Malukutoto ensures that appropriate safeguards are in place to protect your personal data, including:

• Standard contractual clauses in agreements with data processors located outside Malaysia;
• Technical encryption measures applied to data in transit and at rest;
• Access controls limiting data access to personnel with an operational need.

By using the Platform, you acknowledge and consent to the international transfer of your personal data as described in this section, on the understanding that such transfers are governed by appropriate safeguards.

Data Retention

Malukutoto retains personal data for as long as is necessary to fulfil the purposes for which it was collected, subject to the following retention principles:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Data subject to an ongoing investigation, legal proceeding, or regulatory inquiry will be retained until that matter is fully resolved.

Cookies & Tracking Technologies

Malukutoto uses cookies and similar technologies to ensure the Platform functions correctly, to remember your preferences, and to collect anonymised usage analytics. We do not use third-party advertising cookies or cross-site tracking technologies.

10.1 Types of Cookies We Use

10.2 Managing Cookies

You may configure your browser to block or delete cookies at any time. Please note that blocking strictly necessary cookies will impair your ability to log in and use the Platform. Instructions for managing cookies are available in the help documentation of all major browsers.

Your Data Rights

Subject to applicable law and to any overriding obligations Malukutoto holds under its operating licence, you have the following rights in respect of your personal data:

To exercise any of the above rights, please submit your request via live chat or by email to [email protected]. We will verify your identity before processing any request and will respond within 30 calendar days. For complex or multiple requests, we may extend this period by a further 30 days with prior notification.

Data Security

Malukutoto implements and maintains a comprehensive set of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and the Platform;
• Encryption at rest applied to all databases containing personal data;
• Role-based access controls ensuring that internal personnel may only access data that is directly necessary for their specific operational role;
• Two-factor authentication (2FA) available to all registered Users and mandatory for internal administrative access;
• Intrusion detection systems and real-time monitoring for anomalous access patterns;
• Regular penetration testing and third-party security audits conducted in line with our licensing requirements;
• Data minimisation — we collect and retain only the personal data that is strictly necessary for the stated processing purposes.

Notwithstanding these measures, no data transmission over the internet or data storage system can be guaranteed to be 100% secure. Users are responsible for maintaining the security of their own account credentials. If you suspect that your account has been compromised, please contact support immediately.

In the event of a personal data breach that is likely to result in risk to your rights and freedoms, Malukutoto will notify affected Users within a reasonable timeframe in accordance with our licence obligations.

Third-Party Links & Integrations

The Platform may reference or integrate with third-party services in the course of delivering its features, including payment gateways for Maybank2u, CIMB Clicks, Public Bank PBe, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, and FPX, as well as identity verification providers. When you interact with these third-party integrations, your data is governed by those parties' own privacy policies in respect of the interaction with their service.

Malukutoto is not responsible for the privacy practices of third-party services. We recommend reviewing the privacy policies of any third-party payment provider before initiating a transaction. Our contractual arrangements with payment partners require them to treat your data with appropriate care, but we cannot guarantee their compliance.

Children & Minors

The Malukutoto Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect or process personal data from individuals under the age of 21. Age verification is a mandatory requirement of our registration and KYC processes.

If Malukutoto becomes aware that personal data has been collected from an individual who does not meet the minimum age requirement, we will take immediate steps to delete that data, close the associated account, and return any funds held in that account where practicable.

Amendments to This Policy

Malukutoto reserves the right to modify, update, or replace this Privacy Policy at any time. Where amendments are material — including changes to the categories of data collected, the purposes of processing, or User rights — we will endeavour to notify registered Users via email or a prominent on-Platform notice prior to the changes taking effect.

The "Last Updated" date displayed at the top of this page reflects the date of the most recent revision. Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Policy. Users who do not accept the amended Policy should cease using the Platform and may request account closure as described in our Terms & Conditions.

We encourage you to review this Policy periodically to remain informed of how Malukutoto handles your personal data.

Contact Us

If you have any questions about this Privacy Policy, wish to exercise a data right, or would like to raise a data protection concern, please contact Malukutoto through the following channels:

• Live Chat: Available on-site daily from 10:00 AM to 2:00 AM MYT. For urgent account-related data concerns, live chat provides the fastest response.
• Email: [email protected] — for formal data access requests, rectification requests, erasure requests, and formal complaints. We will acknowledge all written requests within 5 business days and provide a substantive response within 30 calendar days.

When submitting a data rights request, please include your registered username, a description of your request, and a copy of a valid identity document to enable us to verify your identity before processing the request.