Privacy Policy koitoto

Koitoto collects various types of personal information from our users across different contexts. This data collection is necessary to enable us to provide a safe, responsible, and trustworthy service to all our players in Malaysia.

Information you provide directly:

• Registration data: Full name, date of birth, identity card or passport number, email address, phone number, residential address, and preferred username.
• Verification documents (KYC): Copies of your identification card, passport, or driving licence for identity verification and anti-money laundering (AML) compliance purposes.
• Financial information: Bank account details, e-wallet account numbers (Touch 'n Go, GrabPay), and records of deposit and withdrawal transactions.
• Communications: Any messages, complaints, or inquiries you submit to our customer support team via live chat or email.

Information collected automatically:

• Technical data: IP address, device type, operating system, browser type, screen resolution, and network information.
• Behavioural data: Pages you visit, games you play, session duration, connection time, and navigation patterns within the platform.
• Location data: General geographic location based on IP address for jurisdictional compliance purposes.
• Game data: Wagering history, wins, losses, and bonus activity associated with your account.

Every piece of information we collect is used for a clear and legitimate purpose. koitoto does not use user data for any purpose not stated in this Privacy Policy. The following are the primary purposes for which your data is used:

We will not use your data to make automated decisions that materially affect you without human oversight, except in cases of real-time security monitoring and fraud detection that require immediate action.

Koitoto does not sell, rent, or trade your personal data to any third party for their own commercial purposes. We only share your information in the following limited and controlled circumstances:

• Service providers: We share necessary data with trusted third-party service providers such as payment processors, licensed game providers, and technology infrastructure providers. All such providers are bound by strict data protection agreements.
• Legal obligations: We may be required to disclose your information to government authorities, regulators, or law enforcement bodies when mandated by applicable laws in Malaysia.
• Interest protection: In situations where there is a serious threat to the safety of a person or the platform, we reserve the right to share relevant information for protection purposes.
• Business transfers: In the event of a merger, acquisition, or sale of koitoto assets, user data may be transferred to the new entity provided they adhere to equivalent data protection standards.

The security of your personal data is a responsibility we take seriously. koitoto implements a range of technical and organisational security measures to protect your information from unauthorised access, alteration, disclosure, or destruction.

• Data encryption in transit: All communications between your browser and our servers are encrypted using TLS 1.3 protocol with 256-bit SSL certificates that are kept continuously up to date.
• Data encryption at rest: Sensitive data such as financial information and KYC documents are encrypted at the database level using AES-256 standard.
• Two-factor authentication (2FA): Users are encouraged to enable 2FA, which adds an extra layer of security to their account.
• Internal access controls: Access to user data at the Koitoto staff level is governed by the need-to-know principle, with all access recorded in audit logs that are continuously monitored.
• Penetration testing: We conduct regular security testing, including penetration testing and code reviews by independent security experts.
• 24/7 monitoring: Our real-time threat monitoring system operates around the clock to detect and respond to any suspicious activity.

Koitoto uses cookies and similar tracking technologies to enhance user experience, analyse platform traffic, and deliver relevant content. The following are the types of cookies we use:

• Essential cookies: These cookies are required for core platform functions such as login sessions, language preferences, and security. They cannot be disabled.
• Performance cookies: Collecting information on how you use our platform to help us improve the user experience. All data is collected anonymously.
• Functionality cookies: Saving your preferences such as username, display settings, and game preferences so you do not need to reconfigure them each time.
• Analytics cookies: Helping us understand platform usage patterns through internal analytics tools. Data collected is used solely for service improvement.

You can manage your cookie settings through your browser. Please note that disabling certain cookies may affect the functionality of some parts of the Koitoto platform. More information on managing cookies is available in your account settings.

Under Malaysia's Personal Data Protection Act 2010 (PDPA) and Koitoto's internal policies, you have the following rights regarding your personal data:

To exercise any of the above rights, please contact our privacy team by email at [email protected]. We will process your request within 30 working days. In complex cases, this period may be extended up to 60 days with written notice to you.

Koitoto retains your personal data only for as long as necessary to fulfil the purposes stated in this Privacy Policy, or as required by applicable law.

• Active account data: Retained for as long as your account is active and for a reasonable period after account closure for the purpose of resolving any claims or disputes.
• Financial transaction records: Retained for seven (7) years in accordance with Malaysia's financial reporting and AML legal requirements.
• KYC documents: Retained for five (5) years after account closure or the period prescribed by the regulatory authority.
• Support communication logs: Retained for three (3) years for reference and dispute resolution.
• Analytics and technical log data: Retained for twelve (12) months before being anonymised or deleted.

Once the retention period expires, your data will be securely deleted or anonymised so it can no longer be linked to your identity.

The koitoto platform may contain links or integrations to third-party services such as game providers, payment processors, and communication platforms. Please note that this Privacy Policy applies solely to the koitoto platform and does not cover the privacy practices of any third parties.

We encourage you to read the privacy policy of each third-party service you access through our platform. koitoto is not responsible for the privacy practices or content of any third party, even if they are our trusted business partners.

Koitoto reserves the right to update or modify this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other operational reasons. When we make material changes, we will:

• Updating the "Last Updated" date at the top of this page.
• Sending a notice to your registered email address at least seven (7) days before the changes take effect.
• Displaying a clear notice on the main page of our platform.

Continued use of the koitoto platform after the effective date of any changes constitutes your acceptance of the updated Privacy Policy. If you do not agree with the changes, you have the right to stop using the platform and request account closure.

We maintain an archive of previous Privacy Policy versions, which can be requested through our support team for reference.

If you have any questions, concerns, or complaints regarding this Privacy Policy or how we handle your personal data, the koitoto privacy team is ready to assist.

You may contact us via:

• Email: [email protected]
• Live Chat: Available 24 hours a day, 7 days a week via the koitoto platform

We are committed to responding to all privacy-related enquiries within 24 business hours. For formal complaints, we will provide a comprehensive response within 14 business days.