1. Introduction
Exototo ("we", "Platform") values the privacy of every member who uses our services. This Privacy Policy explains in detail how we collect, use, disclose, and protect your personal information when you use our website, mobile app, and all services provided by Exototo.
By registering or continuing to use the Exototo platform, you acknowledge that you have read, understood, and agreed to the terms set out in this Privacy Policy. This document should be read together with Terms and Conditions and Responsible Gaming Policy us.
This Privacy Policy applies to all registered members and visitors of the Exototo platform regardless of location, subject to applicable local laws in Malaysia.
2. Information We Collect
Exototo collects various categories of information to enable us to provide safe, fair, and high-quality services. The following are the types of information we collect:
2.1 Information You Provide Directly
- Registration information — full name, date of birth, email address, phone number, and your chosen username.
- Identity verification documents — a copy of your MyKad, passport, or other identity document for KYC verification purposes.
- Financial information — bank account details, e-wallet account numbers, and records of deposit and withdrawal transactions.
- Communications with us — any messages, complaints, or feedback you submit to the exototo support team.
2.2 Information Collected Automatically
- Device and technical data — IP address, browser type, operating system, screen resolution, and device identifier.
- Usage data — pages visited, games played, session duration, and navigation patterns within the platform.
- Location data — general location information based on your IP address to ensure compliance with geographical restrictions.
- Cookies and tracking technologies — information collected via cookies, web pixels, and similar technologies to enhance the user experience.
3. Purpose of Data Collection and Use
Exototo uses your personal information only for lawful and necessary purposes. We do not collect data beyond what is required to operate the platform. Below is a summary table of our data use purposes:
| Purpose of Use | Data Type | Legal Basis |
|---|---|---|
| Account management and verification | Name, email, phone number, KYC documents | Contract fulfilment |
| Deposit & withdrawal processing | Financial information, transaction records | Contract fulfilment |
| Fraud prevention & anti-money laundering | IP, device data, transaction patterns | Legitimate interest & legal compliance |
| Platform improvement & analytics | Usage data, technical data | Legitimate interest |
| Service & support communications | Email, phone number | Contract fulfilment |
| Marketing and promotions (with consent) | Email, game preferences | Member consent |
4. Information Sharing and Disclosure
Exototo does not sell your personal information. However, in certain situations, we may share your data with the following parties to enable us to deliver our services in full:
- Technical service providers — cloud infrastructure providers, gaming software suppliers, and payment processors that assist in operating our platform. All such third parties are bound by strict confidentiality agreements.
- Regulatory authorities and law enforcement agencies — when required by law, court order, or a lawful request from a competent enforcement authority.
- Fraud prevention partners — specialist services that help us identify and block fraudulent activity, money laundering, and platform abuse.
- Intra-group sharing — affiliated companies within the exototo group for internal operational purposes, subject to the same Privacy Policy.
In all data-sharing scenarios, Exototo ensures that receiving parties adhere to security and confidentiality standards equivalent to or higher than those we maintain ourselves.
5. Cookies and Tracking Technologies
Exototo uses cookies and similar technologies to enhance your experience on our platform. Cookies are small text files stored on your device when you visit our website. They help us remember your preferences, maintain login sessions, and understand how you use the platform.
5.1 Types of Cookies We Use
- Essential Cookies — required for core platform functions such as login session authentication and security. These cookies cannot be disabled.
- Performance Cookies — collecting information on how you use the platform to help us improve its performance.
- Functional Cookies — remembering your preferences such as language and display settings to provide a more personalised experience.
- Analytics Cookies — used by trusted third-party analytics tools to understand overall platform usage patterns in aggregate.
You may manage or disable non-essential cookies through your browser settings at any time. Please note, however, that disabling essential cookies may affect platform functionality.
6. Data Storage and Security
Your data is stored on secure servers protected by multiple layers of physical and digital security. Retention periods vary depending on the type of information and applicable legal requirements:
- Active account data — retained for the duration your account remains active on the exototo platform.
- Financial transaction records — retained for a minimum of 7 years in compliance with anti-money laundering legal requirements.
- KYC Documents — retained for the period specified by applicable law, typically 5 to 7 years after account closure.
- Support communication logs — retained for 3 years for dispute resolution purposes.
On the security front, Exototo implements comprehensive technical and organisational measures including data encryption in transit and at rest, role-based access control (RBAC), two-factor authentication (2FA) for internal system access, and regular security audits and penetration testing.
7. Your Rights as a Data Subject
As an exototo member and data subject under applicable data protection laws, you have the following rights regarding your personal information:
Right to Access
You have the right to request a copy of the personal information we hold about you at any time.
Right to Rectification
You may request that we amend or correct any personal information that is inaccurate or incomplete.
Right to Erasure
In certain circumstances, you may request the deletion of your personal data, subject to any applicable legal retention obligations.
Right to Withdraw Consent
You may withdraw your marketing consent at any time through account settings or by contacting our support team.
Right to Data Portability
You have the right to receive a copy of your personal data in a structured, machine-readable format to enable transfer to another provider.
Right to Object to Processing
You may object to the processing of your data for direct marketing purposes or on the grounds of legitimate interest in certain situations.
To exercise any of the rights above, please contact our data protection team via email at [email protected] or via live chat on the platform. We will process your request within 30 business days.
8. Cross-Border Data Transfers
As part of our global operations, your personal data may be transferred to and stored on servers located outside Malaysia. For every such transfer, Exototo ensures:
- The recipient country has an adequate level of data protection, or
- Legally binding and appropriate data transfer agreements have been executed with the recipient, or
- Other legally recognised protection mechanisms are applied to safeguard your rights.
9. Children's Privacy
The exototo platform is intended for individuals aged 18 and above only. We do not knowingly collect personal information from minors. If you believe your child has registered an account on our platform, please contact us immediately and we will take action to close the account and delete the associated data.
10. Links to Third-Party Websites
The exototo platform may from time to time contain links to third-party websites or services. Our Privacy Policy does not apply to those websites. We encourage you to read the privacy policies of any other websites you visit. exototo is not responsible for the privacy practices or content of any third-party websites.
11. Changes to This Privacy Policy
Exototo reserves the right to update this Privacy Policy from time to time to reflect changes in our practices, technologies used, legal requirements, or other relevant factors. When significant changes are made, we will notify you via in-platform notification or your registered email at least 7 days before the changes take effect.
The "Last Updated" date at the top of this page indicates when this Privacy Policy was last revised. We encourage you to review this page periodically to stay informed about how we protect your information.
12. Contact Our Data Protection Officer
Exototo has appointed a Data Protection Officer (DPO) responsible for ensuring compliance with all data protection requirements. If you have any questions, concerns, or complaints regarding this Privacy Policy or the processing of your personal data, please contact us through the following channels:
- Email: [email protected]
- Live Chat: Available 24/7 on the exototo platform
- Support section: Via the page FAQ for general enquiries
We are committed to addressing every privacy inquiry seriously and responding within a reasonable timeframe. Your trust is exototo's most valuable asset.