Privacy Policy
Koitoto Malaysia

1Introduction and Scope of This Policy

Koitoto takes the responsibility of protecting user privacy very seriously. We understand that your personal information is a trust placed in us, and we are committed to managing it with full integrity and transparency.

This Privacy Policy applies to all information we collect through the Koitoto website, mobile app, customer service interactions and any of our official communication channels. It also covers data you provide directly as well as data collected automatically while you use our platform.

2Types of Personal Data We Collect

Koitoto collects various types of information depending on how you interact with our platform. The following is a detailed summary of the data we collect:

We do not collect sensitive information such as biometric data, health records or religious information unless specifically required by applicable law.

3How We Use Your Data

Every piece of information we collect has a clear and legitimate purpose. Koitoto uses your personal data for the following purposes:

• Account management — opening, verifying, and maintaining your user account and ensuring secure access to the platform;
• Transaction processing — managing deposits, withdrawals, and all financial activity within your account accurately and securely;
• Legal compliance — fulfilling KYC (Know Your Customer), AML (Anti-Money Laundering), and reporting obligations set by the relevant authorities;
• Fraud prevention — detecting and blocking suspicious activity, intercepting fraud attempts, and protecting your account from unauthorised access;
• Customer Support — responding to enquiries, resolving complaints, and providing effective technical support;
• Service improvement — analysing usage patterns to improve the user experience, platform performance, and game offerings;
• Platform communications — sending important notifications about your account, policy changes, promotions, and platform updates.

We do not use your data for any purpose not stated here without obtaining your prior consent. Every data processing activity we carry out has a solid legal basis, whether grounded in your consent, contractual obligation or legal requirement.

4Information Sharing and Disclosure

Koitoto does not sell your personal data. However, in certain situations, we may need to share your information with the following parties for legitimate reasons:

• Payment service providers — financial institutions, e-wallet providers, and payment processors engaged to handle your transactions, subject to strict confidentiality agreements;
• Technology providers — gaming software companies, cloud infrastructure providers, and security solution vendors that help us operate the platform;
• Regulatory authorities — law enforcement agencies and regulatory bodies when required by court order or legal obligation;
• Independent auditors — audit and compliance firms engaged to ensure platform operations meet industry standards.

5Data Security Measures

The security of your personal data is Koitoto's absolute priority. We implement multiple layers of technical and organisational protection to ensure your data remains secure at all times:

• 256-bit SSL/TLS encryption for all data transmission between your browser and our servers;
• Encryption of data at rest using AES-256 standards for all stored data;
• Two-factor authentication (2FA) is available for all user accounts;
• Continuous 24/7 security monitoring with automated intrusion detection systems;
• Regular penetration testing by independent security experts;
• Mandatory data security training for all staff who handle user data;
• Clear and tested incident response procedures to address any data breaches.

While we take all reasonable measures, no security system is entirely foolproof. We therefore encourage users to play their part in keeping their accounts secure by using strong passwords and never sharing their login credentials with anyone.

6Cookies and Tracking Technologies

Koitoto uses cookies and similar tracking technologies to enhance the user experience and ensure the platform functions smoothly. The following are the types of cookies we use:

• Essential cookies — required for core platform functions such as login, session management, and security. These cookies cannot be disabled;
• Performance cookies — collecting anonymised data on how users interact with the platform to help us identify issues and improve performance;
• Functional cookies — storing your preferences such as language, display settings, and other choices to deliver a more personalised experience;
• Analytics cookies — used to understand aggregated usage patterns for service improvement purposes.

You can manage cookie settings through your web browser. Disabling certain cookies may affect the functionality of some parts of the platform. Our session cookies expire automatically when you close your browser, while persistent cookies are stored until a set period or until you delete them manually.

7Your Rights as a User

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding your personal data:

To exercise any of the above rights, you may contact Koitoto's customer support team via the in-platform live chat, available 24 hours a day, 7 days a week. We will process your request within the timeframe required by applicable law.

Please be aware that in certain situations, we may need to retain some data even after receiving a deletion request, for example when the data is required for legal compliance or resolution of an unresolved dispute.

8Data Retention and Disposal

Koitoto only retains your personal data for as long as necessary for the purposes stated in this policy. The following are our data retention period guidelines:

• Active account data is retained for the duration of the active account plus five (5) years after account closure, in line with PDPA requirements;
• Financial transaction records are retained for a minimum of seven (7) years in accordance with the requirements of the Inland Revenue Board and financial regulations;
• Customer support communication logs are retained for three (3) years;
• Technical logs and analytics data are retained for twelve (12) months;
• Marketing and communication preference data is retained until you withdraw your consent.

Once the retention period expires, your data will be securely deleted using methods that comply with information security standards. Data that cannot be fully deleted will be anonymised so that it can no longer be linked to your identity.

9Children's Privacy

The Koitoto platform is exclusively for users aged 18 years and above only. We do not intentionally collect or process personal data of individuals under the age of 18.

If we discover that data belonging to someone below this age limit has been collected inadvertently, we will take immediate steps to delete that data and terminate the account in question. Parents or guardians who have concerns that their child may have registered an account on our platform are encouraged to contact our support team right away.

10Amendments to This Privacy Policy

Koitoto reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or technological developments. When we make significant changes, we will:

• Updating the "Last Updated" date at the top of this document;
• Displaying clear in-platform notifications at least 14 days before changes take effect;
• Sending a notification to your registered email address for material changes.

Your continued use of the Koitoto platform after the effective date of any amendment is considered your acceptance of the updated policy. If you do not agree with the changes made, you have the right to close your account before the changes take effect.

11How to Contact Us

If you have any questions, concerns or wish to exercise your privacy rights, the Koitoto team is always ready to assist. You can reach us via:

• Live Chat — available 24/7 directly within the Koitoto platform, the fastest way to get a response;
• Support email — [email protected] for written enquiries that require documentation;
• FAQ Page — visit our FAQ page for answers to frequently asked questions.