Privacy Policy

This Privacy Policy ("Policy") describes how Koitoto ("the Company", "We", "Us", or "Our") collects, uses, stores, discloses, and protects the personal data of individuals ("Users", "You", or "Your") who access or use the Koitoto platform available at koitoto.casa ("the Platform"), including all associated games, sports betting products, account features, and customer support services.

Koitoto takes data privacy seriously. We are committed to handling your personal information responsibly and in accordance with applicable data protection standards. This Policy is designed to give you a clear, honest account of our data practices — not to obscure them behind unnecessarily complex language.

By registering an Account, accessing the Platform, or otherwise providing your personal information to Koitoto, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree to this Policy, please do not use the Platform.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

Koitoto collects personal data in several ways: directly from you when you register or interact with the Platform, automatically through your use of the Platform, and from third-party sources where applicable. The categories of personal data we collect include:

3.1 Registration & Account Data

• Full legal name, date of birth, gender, and nationality.
• Email address, contact number, and residential address.
• Username, password (stored in encrypted form), and account preferences.
• Country of residence and, where applicable, preferred language.

3.2 KYC & Verification Data

• Copies of government-issued photo identification, such as a Malaysian MyKad or passport.
• Proof of address documentation, such as utility bills or bank statements.
• Proof of ownership of payment methods, including bank account details and e-wallet account information (Touch 'n Go eWallet, Boost, GrabPay, and similar).

3.3 Financial & Transaction Data

• Deposit and withdrawal history, including payment method used, amounts, timestamps, and transaction reference numbers.
• Bank account details and e-wallet identifiers used for transactions via Maybank, CIMB, Public Bank, Hong Leong Bank, DuitNow, FPX, or cryptocurrency wallets.
• Bonus and promotional credits claimed and wagering activity associated with those credits.

3.4 Gaming & Betting Activity Data

• Game session history, bet amounts, game types selected, win/loss records, and wagering patterns.
• Sports betting selections, live betting activity, and odds accepted for each wager.
• Responsible gambling tool settings, including deposit limits, session limits, and self-exclusion records.

3.5 Technical & Device Data

• IP address, device type, operating system, browser type and version.
• Geolocation data derived from your IP address (general location only, not precise GPS coordinates unless explicitly granted).
• Session duration, pages visited, click paths, and interaction logs.
• Cookie identifiers and similar tracking technology data, as described in Section 7.

3.6 Communication Data

• Records of live chat conversations, email correspondence, and any other written communication between you and our support team.
• Feedback, complaints, and survey responses you submit through the Platform.

Koitoto processes your personal data for the following purposes. In each case, we have identified the relevant legal basis for processing in Section 5.

Koitoto processes your personal data on the following legal bases, depending on the nature and purpose of the processing activity:

• Contractual Necessity: Processing required to fulfil our obligations to you under the Terms & Conditions, including account management, payment processing, and service delivery.
• Legal Obligation: Processing required to comply with applicable laws, including anti-money laundering regulations, age verification requirements, and responses to lawful authority requests.
• Legitimate Interests: Processing carried out for purposes that are in our legitimate business interests, such as fraud prevention, platform security, and service improvement — where these interests are not overridden by your fundamental rights.
• Consent: Processing based on your explicit consent, most notably in relation to optional marketing communications. Where consent is the legal basis, you may withdraw it at any time without affecting the lawfulness of processing that took place before withdrawal.

Koitoto does not sell your personal data to third parties. We may share your data in the following limited and controlled circumstances:

• Payment Service Providers: We share transaction-relevant data with banks, e-wallet providers, and payment processors (such as DuitNow, FPX, and cryptocurrency payment gateways) to facilitate deposits and withdrawals. These providers are contractually bound to process data only for specified payment purposes.
• KYC and Identity Verification Partners: Accredited third-party identity verification providers may process your KYC documentation on our behalf. All such providers operate under strict data processing agreements and applicable privacy law obligations.
• Game and Software Providers: Licensed game studios and sports data providers receive the minimum data necessary to deliver their services on the Platform. This typically includes session tokens and bet identifiers, not your full personal profile.
• Regulatory Authorities: Koitoto may be required to disclose personal data to regulatory bodies, gaming authorities, or law enforcement agencies pursuant to a lawful order or as required to meet our compliance obligations.
• Anti-Fraud and AML Services: We may share transaction data with third-party fraud detection and anti-money laundering screening services to detect and prevent financial crime on the Platform.
• Corporate Transactions: In the event of a merger, acquisition, or sale of all or part of our business, personal data may be transferred to the relevant successor entity, subject to equivalent privacy protections.

Koitoto uses cookies and similar tracking technologies on the Platform to enable core functionality, improve performance, and provide a more relevant user experience. The categories of cookies we use are as follows:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication cookies, security tokens, and cookies that maintain your login state. These cannot be disabled without impairing your ability to use the Platform.
• Functional Cookies: Enable the Platform to remember your preferences, such as preferred language, display settings, and game favourites. Disabling these does not prevent access to the Platform but may reduce personalisation.
• Analytical Cookies: Used to collect aggregated, anonymised data about how users navigate the Platform — including pages visited, session duration, and click paths. This data is used solely to improve Platform design and performance.
• Marketing Cookies: Used, with your consent, to deliver promotional content relevant to your gaming activity and to measure the effectiveness of our marketing communications.

You may manage your cookie preferences through your browser settings at any time. Please note that disabling certain categories of cookies may affect the functionality of the Platform. Koitoto does not use cookies to collect sensitive financial information or to share data with third-party advertisers without your consent.

Koitoto retains personal data only for as long as it is necessary to fulfil the purposes outlined in this Policy, or as required by applicable law. The following general retention guidelines apply:

• Active Account Data: Retained for the duration of your account being active on the Platform and for a period of up to five years following account closure, unless a longer period is required by law.
• Financial and Transaction Records: Retained for a minimum of five years following the relevant transaction, in accordance with anti-money laundering regulatory requirements.
• KYC Documentation: Retained for a minimum of five years following account closure or the conclusion of any investigation or legal proceding in which the data is relevant.
• Customer Support Records: Retained for up to three years following the resolution of the relevant support interaction, to assist with quality assurance and the handling of any related subsequent queries.
• Marketing Data: Retained until you withdraw your marketing consent or request erasure, after which it will be deleted or anonymised within 30 days.
• Technical Logs: Server and access logs are generally retained for 12 months for security and debugging purposes, after which they are purged or anonymised.

At the end of applicable retention periods, personal data is securely deleted or permanently anonymised so that it can no longer be linked to an identifiable individual.

Koitoto employs a multi-layered approach to data security, combining technical, organisational, and procedural safeguards to protect your personal information from unauthorised access, disclosure, alteration, and destruction. Key measures include:

• Encryption in Transit: All data transmitted between your device and our servers is protected using256-bit SSL/TLS encryption, the same standard used by major financial institutions and recognised as the current industry benchmark for data security.
• Encryption at Rest: Sensitive stored data, including passwords and KYC documentation, is encrypted at rest using strong encryption algorithms. Passwords are stored using one-way hashing functions and are never held or transmitted in plain text.
• Access Controls: Internal access to personal data is restricted on a strict need-to-know basis. Employees and contractors with access to personal data are bound by confidentiality obligations and undergo data security training.
• Infrastructure Security: Our systems are hosted on secure, regularly audited infrastructure. Firewalls, intrusion detection systems, and regular vulnerability assessments are in place to protect against external threats.
• Account Security: Users are encouraged to use strong, unique passwords and to enable any additional account security options available on the Platform. Koitoto will never ask for your password through any communication channel.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, Koitoto will notify you and any applicable supervisory authorities within the timeframes required by applicable law, providing full details of the nature of the breach and the steps we have taken to address it.

Subject to applicable law and certain exceptions, you have the following rights in relation to the personal data Koitoto holds about you. To exercise any of these rights, please contact us using the details in Section 14.