Privacy Policy

Section 1

Introduction

This Privacy Policy ("Policy") describes how Operatoto ("we", "us", "our", "the Company", "the Platform") collects, processes, stores, and protects the personal data of individuals ("you", "User "Player") who access or use the website located at https://operatoto.cam and any associated products, services, or features.

Operatoto operates as an online gaming brand serving the Malaysian market, offering live dealer casino games, slot products, and sports betting markets denominated in Malaysian Ringgit (MYR). In the course of providing these services, we necessarily collect and process certain personal data about registered Players and website visitors.

By accessing the Platform, creating an Account, or otherwise engaging with our services, you acknowledge that you have read and understood this Policy and consent to the collection and use of your personal data as described herein. If you do not accept this Policy, please discontinue use of the Platform immediately.

Section 2

Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" — Any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial data, and online identifiers.
• "Processing" — Any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, and erasure.
• "Data Controller" — The entity that determines the purposes and means of processing Personal Data. Operatoto acts as Data Controller for all Personal Data collected via the Platform.
• "Data Processor" — A third party that processes Personal Data on behalf of and under the instruction of the Data Controller.
• "Consent" — A freely given, specific, informed, and unambiguous indication of agreement by the data subject to the processing of their Personal Data.
• "Cookies" — Small text files placed on a User's device by the Platform for the purposes of session management, analytics, and functionality.
• "KYC" — Know Your Customer: identity and age verification procedures required before account activation or withdrawal processing.
• "Third Party" — Any natural or legal person other than Operatoto and the User, including service providers, payment processors, and regulatory bodies.

Section 3

Data Controller

Operatoto acts as the Data Controller for all Personal Data collected through the Platform. This means we determine the purposes for which your data is collected and the means by which it is processed. Where third-party service providers process data on our behalf, they do so as Data Processors acting under contractual obligations to Operatoto.

Our principal contact for all data protection-related enquiries is our support team, reachable via live chat (24/7, Malaysian time MYT GMT+8) or by email at [email protected].

Section 4

Data We Collect

Operatoto collects Personal Data from Users through multiple channels and at various stages of the user lifecycle. The categories of data we collect are outlined below.

4.1 Registration Data

When you create an Account, we collect information necessary to establish and verify your identity, including: full legal name, date of birth, residential address (which may include references to locations such as Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru, Shah Alam, or other Malaysian cities), email address, and phone number.

4.2 Identity Verification (KYC) Data

To comply with our obligations under applicable anti-money laundering (AML) and age verification requirements, we collect government-issued identification documents, including copies of Malaysian MyKad, passport, or equivalent documents.

4.3 Financial Data

We collect data related to your financial transactions on the Platform, including deposit and withdrawal amounts in MYR, payment method details (such as masked account numbers associated with Touch'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, DuitNow, FPX, or USDT TRC20 wallet addresses), transaction timestamps, and account balance history.

4.4 Technical and Device Data

We automatically collect certain technical data when you access the Platform, including IP address, browser type and version, operating system, device identifiers, screen resolution, and referring URL. This data is used for security monitoring, fraud prevention, and platform optimisation.

4.5 Usage and Behavioural Data

We collect data about how you interact with the Platform, including pages visited, games played, session duration, bet history, bonus usage, and feature engagement. This data is used to improve the user experience, personalise promotions, and identify responsible gambling concerns.

Section 5

Purposes of Processing

Operatoto processes your Personal Data for the following purposes:

• Account Management: Creating, maintaining, and administering your registered Account, including processing login requests and managing Account settings.
• Transaction Processing: Facilitating deposits and withdrawals in MYR via supported payment methods, and maintaining accurate financial records.
• Identity and Age Verification: Confirming that Account holders are at least 21 years of age and are who they represent themselves to be, in accordance with KYC obligations.
• Regulatory Compliance: Meeting obligations under applicable anti-money laundering, counter-terrorist financing, and data protection regulations.
• Fraud Prevention and Security: Detecting and preventing unauthorised access, account fraud, payment fraud, and other malicious activity.
• Responsible Gambling: Monitoring gameplay patterns to identify potential indicators of problem gambling behaviour and delivering responsible gambling interventions where appropriate.
• Customer Support: Responding to queries, resolving complaints, and maintaining quality of service across our24/7 live chat and email channels.
• Service Improvement: Analysing aggregate usage data to improve platform features, game selection, and the overall player experience.
• Promotional Communications: Where you have opted in, sending relevant bonus offers, VIP programme updates, and platform news to your registered email address.

Section 6

Legal Basis for Processing

Operatoto relies on the following legal bases to process your Personal Data, consistent with applicable data protection frameworks:

• Contractual Necessity: Processing required to perform our obligations under the Terms & Conditions you accepted at registration — including Account management and payment processing.
• Legal Obligation: Processing required to comply with our AML, KYC, age verification, and regulatory reporting obligations.
• Legitimate Interests: Processing conducted for fraud prevention, platform security, responsible gambling monitoring, and service improvement, where these interests are not overridden by your rights.
• Consent: Processing for optional marketing communications, where you have given explicit consent and retain the right to withdraw it at any time.

Section 7

Data Sharing & Disclosure

7.1 Service Providers

We share Personal Data with third-party service providers who assist in the operation of the Platform, including payment processors (such as those facilitating Touch 'n Go, Boost, GrabPay, Maybank, CIMB, DuitNow, FPX, and USDT TRC20 transactions), identity verification providers, cloud hosting services, and analytics platforms. All such providers are bound by contractual data processing agreements and are prohibited from using your data for independent purposes.

7.2 Regulatory and Legal Authorities

We may disclose Personal Data to regulatory bodies, law enforcement agencies, or other governmental authorities where required to do so by applicable law, court order, or regulatory direction. Such disclosures will be made in strict accordance with applicable legal requirements and limited to the minimum necessary.

7.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets involving Operatoto, Personal Data may be transferred to the acquiring or successor entity as part of that transaction. Users will be notified of any material change in data controllership as required by applicable law.

7.4 No Sale of Personal Data

Operatoto does not sell, rent, or otherwise commercially transfer your Personal Data to any third party for their independent marketing or commercial use. Full stop.

Section 8

Data Retention

Operatoto retains Personal Data for as long as is necessary to fulfil the purposes described in this Policy, comply with applicable legal and regulatory obligations, resolve disputes, and enforce our agreements.

As a general guideline:

• Account and transaction data is retained for a minimum of five (5) years following Account closure to satisfy AML record-keeping requirements.
• KYC documentation is retained for a minimum of five (5) years following the conclusion of the customer relationship.
• Usage and behavioural data is retained for up to three (3) years for analytical and responsible gambling monitoring purposes.
• Communication records (live chat transcripts, email correspondence) are retained for up to two (2) years for quality assurance and dispute resolution purposes.
• Marketing consent records are retained for as long as the consent is active, plus a reasonable period thereafter as evidence of prior consent.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised such that it can no longer be attributed to an identifiable individual.

Section 9

Data Security

Operatoto implements a range of technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and our servers;
• Encrypted storage of sensitive data, including financial records and KYC documents;
• Two-factor authentication (2FA) available for all Player Accounts;
• Role-based access controls limiting internal access to Personal Data;
• Regular security audits and penetration testing by independent security specialists;
• Incident response procedures for detecting, containing, and remediating data security events.

While we take all reasonable precautions, no internet-based platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your Account credentials and for immediately notifying us of any suspected unauthorised access.

Section 10

Cookies & Tracking Technologies

10.1 What Are Cookies

Cookies are small data files stored on your device when you visit a website. Operatoto uses cookies and similar tracking technologies (including web beacons and local storage objects) to operate the Platform, maintain session integrity, and gather analytics data.

10.2 Types of Cookies We Use

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication cookies and security tokens. You cannot opt out of these without ceasing to use the Platform.
• Functional Cookies: Used to remember your preferences, such as language settings and last-played game categories. These improve your experience but are not essential.
• Analytics Cookies: Used to collect aggregate data about how Users navigate the Platform — page views, session lengths, and feature usage — to guide product development decisions. Data is anonymised where possible.
• Security Cookies: Used to detect and prevent fraudulent activity, including bot detection and brute-force login protection.

10.3 Managing Cookies

You may manage or disable non-essential cookies through your browser settings. Please note that disabling certain cookies may impair Platform functionality. Detailed instructions for managing cookies in major browsers (Chrome, Firefox, Safari, Edge) are available via your browser's help documentation.

Section 11

International Data Transfers

As an internationally operating platform, Operatoto may transfer your Personal Data to servers and service providers located outside Malaysia. Where such transfers occur, we take appropriate steps to ensure that your data receives a level of protection consistent with applicable data protection standards, including through contractual safeguards with recipient parties.

By using the Platform, you acknowledge that your data may be transferred internationally as described in this Section.

Section 12

Your Data Rights

Subject to applicable law and certain exceptions, you have the following rights in relation to your Personal Data held by Operatoto:

• Right of Access: You may request a copy of the Personal Data we hold about you, along with information about how it is being used.
• Right to Rectification: You may request correction of inaccurate or incomplete Personal Data held your Account.
• Right to Erasure: You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to legal and regulatory retention obligations that may prevent immediate erasure.
• Right to Restriction of Processing: You may request that we limit the processing of your data in certain circumstances, such as while the accuracy of data is contested.
• Right to Data Portability: Where processing is based on consent or contract and carried out by automated means, you may request a machine-readable copy of data you have provided to us.
• Right to Object: You may object to processing of your Personal Data based on legitimate interests, including for direct marketing purposes.
• Right to Withdraw Consent: Where processing relies on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

Section 13

Minors and Age Verification

Operatoto's services are strictly intended for individuals who are 21 years of age or older. We do not knowingly collect Personal Data from individuals under the age of 21. Age verification is conducted as part of the KYC process for all registered Accounts.

If we become aware that Personal Data has been collected from an individual under 21 years of age, we will take immediate steps to delete such data and close the associated Account. If you believe a minor has registered an Account on our Platform, please contact our support team immediately.

Section 14

Changes to This Policy

Operatoto reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, Platform operations, or data processing practices. Material changes will be communicated to registered Users via the email address associated with their Account and/or through a prominent notice displayed on the Platform.

The "Last Updated" date at the top of this Policy reflects the date of the most recent revision. We encourage you to review this Policy periodically to stay informed about how we protect your data. Your continued use of the Platform following notification of any material amendment constitutes your acceptance of the revised Policy.

Section 15

Contact Us

For all enquiries, requests, or complaints relating to this Privacy Policy or the handling of your Personal Data, please contact us through the following channels:

• Live Chat: Available 24/7 directly on the Platform, staffed on Malaysian time (MYT, GMT+8). Select "Privacy & Data" as your query category for fastest routing.
• Email: [email protected] — please include "Privacy Request" in the subject line and your registered Account username in the body of the email.

We aim to acknowledge all data-related correspondence within 2 business days and to provide a substantive response within 30 calendar days. Complex requests may require additional time, in which case we will communicate an estimated timeline at the point of acknowledgement.