Privacy Policy

Polototo ("we", "us", "our", "the Platform") operates the online casino and sports betting service available at polototo.cam. We are committed to handling the personal data of our players — the majority of whom are based in Malaysia — with care, transparency, and in accordance with applicable data protection principles.

This Privacy Policy ("Policy") describes the types of personal data we collect from users ("you", "your", "Player") of our Platform, the purposes for which that data is processed, the parties with whom it may be shared, the security measures we employ to protect it, and the rights you hold in relation to your own personal information.

By registering an account or continuing to use the Polototo Platform, you acknowledge that you have read, understood, and agree to the data practices described in this Policy. If you do not agree, you should discontinue use of the Platform and contact our support team to close your account.

The following terms carry the meanings set out below throughout this Policy:

• "Personal Data" — any information that identifies or could reasonably be used to identify a living natural person, directly or indirectly. Examples include name, email address, telephone number, IP address, device identifiers, and financial account details.
• "Processing" — any operation performed on Personal Data, whether automated or manual, including collection, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" — the entity that determines the purposes and means of processing Personal Data. For the purposes of this Policy, Polototo acts as the Data Controller.
• "Data Processor" — a third party that processes Personal Data on Polototo's behalf and under Polototo's documented instructions.
• "Consent" — a freely given, specific, informed, and unambiguous indication of a Player's agreement to the processing of their Personal Data for a stated purpose.
• "KYC Data" — identity verification documents and associated information collected as part of Polototo's Know Your Customer compliance process, including copies of identity documents, proof of address, and selfie images.
• "Cookies" — small text files stored on a user's device by a website to remember preferences, session data, and usage behaviour.

Polototo collects Personal Data across several categories, depending on how you interact with the Platform. The table below sets out the specific categories of data we collect and the context in which they arise.

Polototo collects Personal Data through the following mechanisms:

4.1 Data You Provide Directly

• Account registration forms — name, date of birth, email, password, telephone number
• KYC document uploads — identity documents, proof of address, selfie verification
• Payment transactions — bank account details, e-wallet credentials, cryptocurrency wallet addresses
• Customer support communications — live chat, email, or any other channel through which you contact us
• Responsible gambling tool submissions — deposit limit requests, self-exclusion applications

4.2 Data Collected Automatically

• Server logs — IP address, browser, device, access timestamps, pages visited
• Cookies and similar tracking technologies — session management, platform analytics, fraud detection
• Gameplay data — game session logs, bet placement records, RNG outcome records

4.3 Data From Third Parties

• Payment processors (e.g., DuitNow, FPX, Maybank, CIMB, Public Bank) — transaction confirmation and status data
• KYC verification service providers — identity cross-check results and fraud screening outputs
• Analytics partners — aggregated platform usage data (no individual profiling without consent)

Polototo processes Personal Data only for specific, legitimate purposes. The following sets out our primary processing purposes and the categories of data involved in each:

• Account creation and management: Identity Data, Contact Data — to establish your account, verify your identity at registration, and maintain your account profile.
• Payment processing and fraud prevention: Financial Data, Identity Data — to process deposits and withdrawals, verify payment method ownership, and detect fraudulent or suspicious transactions in accordance with our AML obligations.
• KYC and regulatory compliance: KYC Documents, Identity Data — to fulfil our obligations under applicable anti-money-laundering, know-your-customer, and licensing regulations. This processing is not optional — failure to provide KYC data will prevent withdrawal processing.
• Providing and improving Platform services: Transactional Data, Technical Data — to deliver games and betting markets, personalise your Platform experience, diagnose technical issues, and improve Platform stability and performance.
• Customer support: Communication Data, Identity Data — to respond to your queries, resolve disputes, and maintain records of support interactions for quality assurance and training purposes.
• Responsible gambling monitoring: Transactional Data, Contact Data — to monitor for indicators of problem gambling, enforce deposit and loss limits, apply self-exclusion decisions, and comply with responsible gambling obligations.
• Marketing communications (with your consent): Contact Data, Marketing Preferences — to send promotional offers, reload bonuses, and platform news via email or SMS, only where you have explicitly opted in.
• Security and fraud detection: Technical Data, Financial Data — to detect, prevent, and investigate fraud, account takeover attempts, multi-accounting, and other prohibited conduct.

Polototo relies on the following legal bases for processing your Personal Data, consistent with internationally recognised data protection principles:

• Contractual necessity: Processing required to perform the contract between you and Polototo — including account registration, payment processing, game provision, and KYC verification. Without this processing, we cannot provide the services you have requested.
• Legal obligation: Processing required for compliance with applicable laws and regulations, including anti-money-laundering obligations, licensing requirements, and cooperation with lawfully issued regulatory or judicial requests.
• Legitimate interests: Processing necessary for Polototo's legitimate business interests, including fraud prevention, platform security, platform improvement, and direct marketing to existing players — provided these interests are not overridden by your data protection rights.
• Consent: Processing based on your freely given, specific consent — primarily for optional marketing communications. You may withdraw consent at any time by contacting our support team or updating your account marketing preferences.

Polototo does not sell, rent, or trade your Personal Data to any third party for their own marketing or commercial purposes. We may, however, share your data with the following categories of recipients where necessary and in accordance with this Policy:

7.1 Service Providers (Data Processors)

We engage third-party service providers who process data on our behalf under strict contractual data processing agreements. These include payment gateway providers (including Malaysian banks and e-wallet operators such as Touch 'n Go, Boost, and GrabPay), identity verification and KYC service providers, cloud hosting and data storage infrastructure providers, customer support platform operators, and anti-fraud analytics providers. All such processors are required to implement appropriate technical and organisational security measures and may only process data for the purposes we have specified.

7.2 Regulatory and Legal Authorities

Polototo may disclose Personal Data to regulatory bodies, law enforcement agencies, financial intelligence units, or courts where we are legally required to do so under applicable laws, a valid court order, or a lawful regulatory request. Such disclosures are made only to the extent required and are subject to applicable confidentiality obligations.

7.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of some or all of Polototo's business assets, your Personal Data may be transferred to the acquiring entity as part of that transaction, subject to equivalent privacy protections. You will be notified of any such transfer and the implications for your Personal Data.

The nature of Polototo's operations means that some of your Personal Data may be stored or processed in jurisdictions outside of Malaysia. Where such transfers occur, Polototo ensures that appropriate safeguards are in place to protect your data to a standard at least equivalent to that which applies domestically. These safeguards include contractual data protection clauses incorporated into agreements with service providers, requirements that recipient jurisdictions maintain adequate data protection frameworks, and technical encryption measures applied to all data in transit.

KYC documents submitted by Malaysian players are stored on encrypted servers with access controls that restrict who may access the data. Document images are retained only for the period required by applicable regulatory obligations and are then securely destroyed.

Polototo retains Personal Data for as long as is necessary to fulfil the purposes for which it was collected and to comply with applicable legal, regulatory, and contractual obligations. The following general retention periods apply:

• Account data and transaction records: Retained for a minimum of five (5) years following account closure, in accordance with standard AML record-keeping requirements applicable to licensed gambling operators.
• KYC documents: Retained for a minimum of five (5) years following account closure or the date of the last transaction, whichever is later, to fulfil regulatory obligations. Documents are securely destroyed at the end of the retention period.
• Customer support records: Retained for a minimum of two (2) years following the resolution of the relevant interaction, for quality assurance and dispute resolution purposes.
• Marketing consent records: Retained for as long as the consent remains active, plus a minimum of one (1) year following withdrawal of consent, for accountability purposes.
• Technical and log data: Retained for up to twelve (12) months, after which it is anonymised or deleted, unless retained for active fraud or security investigations.

Where your Personal Data is no longer required, Polototo will securely delete or anonymise it. If deletion is not immediately practicable (for example, because data is stored in backup archives), we will isolate it from further processing until deletion is possible.

Polototo implements a range of technical and organisational security measures to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption applied to all data transmissions between your device and polototo.cam
• Encryption at rest for all sensitive personal data stored on Polototo's servers, including KYC documents, financial data, and account credentials
• Role-based access controls ensuring that only authorised personnel with a documented business need may access specific categories of Personal Data
• Two-factor authentication required for account operations involving withdrawal requests and sensitive account changes
• Regular independent security audits conducted by third-party cybersecurity specialists
• Intrusion detection and prevention systems monitoring for abnormal access patterns and potential data breaches in real time
• Staff training and confidentiality obligations — all Polototo personnel with access to Personal Data are bound by confidentiality agreements and undergo regular data protection training

Polototo uses cookies and similar tracking technologies to operate the Platform, remember your preferences, maintain session security, and analyse how the Platform is used. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for core Platform functionality including session management, authentication, and security. These cookies cannot be disabled as they are essential to the operation of the Platform. They do not collect Personal Data for marketing purposes.
• Functional Cookies: Used to remember your preferences such as language setting, display preferences, and previously entered information to improve your experience. Stored for the duration of your session or up to 30 days.
• Analytics Cookies: Used to collect aggregated data about how users interact with polototo.cam — such as which pages are most visited and how long sessions last — to help us improve the Platform. Analytics data is anonymised where possible.
• Security and Fraud Detection Cookies: Used to identify and flag suspicious activity, detect automated bot behaviour, and protect against account takeover attempts.

You may configure your browser to refuse or delete cookies. Note that disabling certain cookies may affect the functionality of the Platform, including your ability to log in or maintain a session. Instructions for managing cookies are available in your browser's help documentation.

Subject to applicable law and any overriding legal obligations (such as AML record-keeping requirements), you hold the following rights in relation to the Personal Data that Polototo holds about you. To exercise any of these rights, please contact our support team via live chat or email.

Polototo aims to respond to all valid data rights requests within 30 calendar days. Where a request is complex or involves a high volume of data, we may extend this period by a further 30 days with notification to you. We will not charge a fee for reasonable requests but reserve the right to charge a reasonable administrative fee for manifestly unfounded or repetitive requests.

The Polototo Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect or process Personal Data relating to individuals under the age of 21. All account registrations are subject to age verification through our KYC process, and accounts found to belong to individuals under 21 are closed immediately with deposits returned.

If you have reason to believe that a person under the age of 21 has registered an account on polototo.cam or has provided us with Personal Data without appropriate authorisation, please contact our support team immediately so that we can take corrective action.

Polototo reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, our data processing practices, or the features of the Platform. When material changes are made, we will notify registered players via email and display a prominent update notice on the Platform for a period of not less than fourteen (14) days before the revised Policy takes effect.

We encourage you to review this Policy periodically. The "Last updated" date at the top of this document indicates when it was most recently revised. Continued use of the Platform following the effective date of any amendment constitutes your acceptance of the updated Policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way in which Polototo processes your Personal Data, please contact our support team using one of the following channels: