Oppatoto Privacy Policy – Malaysian Player Data Protection

This Privacy Policy ("Policy") is issued by oppatoto and applies to all users who access or use our platform via our website, mobile app, or any other official channel.

When you register an account, make a deposit, play games, or simply browse our website, you are entrusting us with certain personal information. We take this responsibility very seriously and are committed to:

• Collect only the information genuinely necessary to provide our services.
• Store your data securely using the latest encryption technology.
• We do not share your information without a valid and legitimate reason.
• Give you full control over your personal information.
• Notify you promptly should any data security incident occur.

By using the oppatoto platform, you agree to the terms set out in this Privacy Policy. If you do not agree, please stop using our platform and contact us for further enquiries.

We collect information across several main categories depending on how you interact with our platform:

Every piece of information we collect has a clear purpose. Below is a full breakdown of how your data is used:

• Account Management: Create and maintain your account, verify your identity at login, and handle account-related requests.
• Transaction Processing: Process deposits, withdrawals, and bonus payments securely and accurately.
• Legal Compliance (KYC/AML): Meet legal requirements related to identity verification and anti-money laundering.
• Platform Security: Detect and prevent fraud, suspicious activity, multiple account usage, and other security threats.
• Service Improvement: Analyze usage patterns to improve the user experience, fix bugs, and develop new features.
• Service Communications: Send important account notifications, transaction confirmations, and security updates.
• Customer Support: Resolve inquiries, complaints, and support requests more efficiently.
• Marketing (with consent): Send promotional information and special offers if you have consented to receive marketing communications.
• Responsible Gaming: Monitor gameplay patterns to identify players who may need responsible gaming support.

We will not use your information for any other purpose without first obtaining your additional consent.

Oppatoto does not sell or rent your personal data. However, in the course of operating our platform, there are certain situations where we need to share your information with trusted parties:

• Payment Providers: Transaction information is shared with payment service providers such as banks, FPX, DuitNow, Touch 'n Go eWallet, and Boost solely to process your transactions.
• Game Providers: Basic account data is shared with third-party game providers to allow you to play within their platforms integrated into oppatoto.
• KYC Services: Identity verification documents may be processed through approved third-party KYC platforms for verification purposes only.
• Authorities: We will disclose the required information to authorities such as the Royal Malaysia Police, Bank Negara Malaysia, or the courts when mandated by law or court order.
• Analytics Services: Anonymized usage data may be shared with analytics platforms for service improvement purposes.

Protecting your data is one of the biggest investments we make as a company. We use a combination of technology, procedures, and access controls to ensure your information remains secure at all times:

• 256-bit SSL Encryption: All data transmitted between your device and our servers is encrypted using TLS 1.3 with 256-bit encryption — the same standard used by leading financial institutions.
• Data at Rest Encryption: Data stored in our databases is also encrypted using AES-256, ensuring it remains unreadable even in the event of unauthorized access to our systems.
• Strict Access Controls: Only approved personnel with a legitimate business need may access user data. All access is recorded and regularly audited.
• Two-Factor Authentication (2FA): All internal staff accounts with access to user data are required to use 2FA.
• Regular Penetration Testing: We conduct regular independent penetration testing to identify and address any system vulnerabilities.
• 24/7 Monitoring: Our security monitoring system operates around the clock to detect any suspicious activity or intrusion attempts.
• Incident Response Plan: We have tested incident response procedures in place to address any security breaches swiftly and effectively.

While we take every reasonable precaution, no security system can guarantee 100% absolute protection. We therefore also encourage you to take protective measures on your end, such as using a strong password and not sharing your login credentials.

The oppatoto website and app use cookies and similar tracking technologies to enhance your experience and keep the platform running smoothly. Here are the types of cookies we use:

• Essential Cookies (Required): These cookies are required for the platform's basic functionality — including login sessions, CSRF security, and remembering your privacy preferences. They cannot be disabled.
• Functional Cookies: Remember your preferences such as display language, game sound settings, and currency display options for a more personalized experience.
• Analytics Cookies: Help us understand how players use our platform — which pages are most popular, how long sessions last, and where players frequently encounter difficulties. This data is collected in aggregate and without personal identifiers.

You can manage your cookie settings through your web browser at any time. Please note that disabling certain cookies may affect the functionality of some parts of our platform.

Under Malaysia's Personal Data Protection Act 2010 and international best practices, you have the following rights regarding your personal data:

To exercise any of the above rights, please contact our privacy team via email or Live Chat. We will process your request within 14 business days. For more complex cases, this period may be extended to up to 30 days, with prior notice to you.

We retain your personal data only for as long as necessary for the stated purposes or as required by law:

• Active Account Data: Retained for the duration your account is active and for 6 years after account closure for audit and legal compliance purposes.
• Financial Transaction Records: Retained for a minimum of 7 years in line with Malaysia's tax and anti-money laundering legal requirements.
• KYC Documents: Retained for 5 years after the date of verification or account closure, whichever is later.
• Security Logs: Retained for 2 years for security incident investigation purposes.
• Support Communication Data: Retained for 3 years to assist with back-reference cases and service improvements.

Once the retention period expires, your data will be securely deleted using methods that ensure it cannot be recovered. For data in physical format, we use certified document destruction.

The oppatoto platform is strictly for individuals aged 18 and above. We do not knowingly collect, store, or process any personal information from minors.

• All users are required to confirm they are aged 18 or above during registration.
• Our KYC process actively verifies user age through valid identification documents.
• If we discover that a minor's information has been collected without parental or guardian consent, we will immediately delete that information and close the associated account.