Does Operatoto sell my personal data to third parties?

Absolutely not. operatoto never sells, rents, or shares your personal data with third parties for their own marketing purposes. Your data is only shared with selected, contractually bound service partners, solely for platform operational purposes such as payment processing and identity verification.

How do I request a copy of the personal data held by Operatoto?

You may request a copy of your personal data by contacting our support team via email at support@operatoto.my or through the platform's live chat. Please include your full name and registered email address in your request. We will process your request and respond within 21 business days.

How long does Operatoto retain my personal data?

Retention periods vary by data type. Identity and KYC information is retained for the full account lifetime plus 5 years after closure. Financial transaction data is kept for a minimum of 7 years to meet audit and legal compliance requirements. Game session data is retained for 3 years, while support communication logs are retained for 2 years.

Can I request Operatoto to delete all my personal data?

You may submit a data deletion request to us. However, full deletion may not be possible where we are still under a legal obligation to retain the data, such as financial transaction records required under Malaysian law. We will clearly inform you which data can be deleted and which must be retained, along with the reasons.

Does Operatoto store my bank card or digital wallet information?

operatoto does not store your full bank card details directly. All payment processing is handled by trusted payment gateways that comply with PCI-DSS security standards. We only retain the minimum information required — such as bank name and verified bank account number — for the purpose of processing your winnings withdrawals.

How do I opt out of marketing emails from Operatoto?

You can opt out of marketing emails by clicking the "Unsubscribe" link at the bottom of any marketing email we send. You may also manage your communication preferences through your account settings or by contacting our support team. Unsubscribe requests will be processed within 5 to 10 business days.

operatoto | Privacy Policy – How We Protect Your Data

1

Introduction

Welcome to the operatoto website. We, operatoto, are committed to protecting the privacy and personal data of every user who registers and uses our online gaming platform at operatoto.my. This Privacy Policy explains in detail our practices regarding the collection, use, storage, and disclosure of your personal data.

By accessing or using Operatoto's services, you acknowledge that you have read, understood, and agreed to this Privacy Policy. If you do not agree with any part of this policy, please discontinue use of our platform.

This policy applies to all registered players, website visitors, and any individuals who interact with Operatoto's services through our website, mobile app, or official communication channels.

Important Note: This Privacy Policy should be read together with Terms and Conditions operatoto, which constitutes the entire agreement between you and our platform.

2

Personal Data We Collect

Operatoto collects various types of personal data to enable us to provide a secure, transparent, and player-focused service. The data we collect falls into two main categories:

Data You Provide Directly:

Full name as per identity document (MyKad or passport)
Date of birth and gender
Active email address used during registration
Mobile phone number
Current residential address
Bank account or digital wallet details for processing deposits and withdrawals
Identity verification documents (KYC) uploaded for account verification purposes
Any information you provide when contacting our customer support

Automatically Collected Data:

IP address and general IP-based location information
Device type, operating system, and browser model used
Game session data including login time, logout time, and play duration
Deposit and withdrawal transaction history
Betting records and gaming activity
Cookie data and website tracking technologies

Data Minimisation Principle: operatoto only collects data that is strictly necessary for the stated purposes. We do not collect sensitive information unrelated to platform operations or legal compliance requirements.

Data Types	Purpose of Collection	Retention Period
Identity information	Account registration & KYC	Full account lifetime + 5 years
Payment data	Deposit & withdrawal processing	Minimum 7 years
Session & game data	Security & Responsible Gaming	3 years
Communication logs	Customer support & audit	2 years
Cookie data	User experience & analytics	Up to 13 months

3

How We Use Your Personal Data

Every piece of data we collect has a clear and legitimate purpose. operatoto uses your personal data solely for the following purposes:

Account Management: Creating, verifying, and managing your player account, including the identity verification (KYC) process required by industry standards.
Financial Transaction Processing: Processing deposits via methods such as DuitNow, FPX, Touch 'n Go eWallet, and ShopeePay, and managing withdrawal of winnings to verified accounts.
Service Delivery: Allowing you to access all games, promotions, and features on the operatoto platform smoothly and securely.
Customer Support: Handling inquiries, complaints, and support requests you submit through live chat, email, or other support channels.
Security & Fraud Prevention: Identifying and investigating suspicious activity, money laundering attempts, or platform abuse.
Responsible Gaming: Monitoring gameplay patterns to identify players who may need assistance and to ensure that the protection limits set are functioning correctly.
Legal Compliance: Meeting reporting and compliance obligations to relevant authorities as required by Malaysian law.
Marketing Communications: Sending information about promotions, bonuses, and the latest offers — subject to your consent, which may be withdrawn at any time.

Lawful Use: operatoto only processes your personal data on a valid legal basis — whether based on your consent, performance of a contract, legal obligation, or our legitimate interests that do not override your rights and freedoms.

4

Data Sharing With Third Parties

Operatoto does not sell or rent your personal data to any party. However, in certain limited situations, we may need to share your data with trusted third parties for the following purposes:

Payment Providers: Payment gateways and financial institutions that process your deposits and withdrawals. All our payment providers are held to strict PCI-DSS security standards.
Game Providers: Gaming software companies that provide slots, live casino games, and fish shooting games on the operatoto platform — limited to data required for game session management.
Technical Service Providers: Companies that help us manage technical infrastructure, website analytics, and customer support services, all bound by strict confidentiality agreements.
Registered Authority: When required by a court order, regulatory directive, or applicable legal requirement in Malaysia.
Fraud Prevention Agency: Dedicated third-party services that help us identify and prevent fraudulent activity and money laundering.

Every third party we work with is contractually bound to protect your data and use it only for the specific agreed purpose. We do not permit any third party to use your personal data for their own marketing purposes without your explicit consent.

International Data Transfers: If your personal data needs to be transferred outside of Malaysia, operatoto ensures adequate protection is in place through appropriate contractual agreements, in compliance with the PDPA 2010.

5

Data Storage & Security Measures

The security of your personal data is operatoto's highest priority. We implement multiple layers of technical and organizational protection to ensure your data remains safe from unauthorized access, loss, or destruction at all times.

Technical Security Measures:

256-bit SSL/TLS encryption for all data communications between the platform and our servers
At-rest encryption for all databases containing sensitive information
Multi-layer firewall system with real-time intrusion detection
Two-factor authentication (2FA) for all internal system access by operatoto staff
Regular vulnerability scanning and penetration testing by independent security experts
Automated backup system with encryption to ensure secure data recovery

Organizational Security Measures:

Access to players' personal data is restricted to staff who require it on a need-to-know basis (principle of least privilege).
All operatoto staff undergo regular privacy and security training
Binding confidentiality agreements signed by all employees and contractors
Clear and detailed data breach response procedures in line with PDPA requirements

In the Event of a Data Breach: operatoto will notify affected players and the relevant authorities within the timeframe prescribed by law, in line with notification obligations under PDPA 2010.

6

Cookies & Tracking Technologies

The operatoto website uses cookies and similar tracking technologies to enhance the user experience, understand website usage patterns, and deliver more relevant content to you.

Types of Cookies We Use:

Essential Cookies: Required for basic website operations including login session management and security. Cannot be disabled.
Performance Cookies: Gathering information on how visitors use our website to help us improve the platform's functionality and performance.
Functional Cookies: Saving your preferences such as language settings and display options to provide a more personalized experience.
Analytics Cookies: Helping us understand website traffic and user interaction patterns for continuous improvement purposes.

You can control and manage cookies through your browser settings. However, disabling certain cookies may affect the functionality and user experience of the Operatoto platform.

7

Your Rights Regarding Personal Data

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have certain rights regarding the personal data we hold about you. Operatoto fully respects and supports the exercise of these rights.

Right of Access

You have the right to request a copy of the personal data we hold about you at any time.

Right to Rectification

You may ask us to correct any inaccurate or incomplete data we hold about you.

Right to Erasure

You may request deletion of your personal data, subject to our legal data retention obligations.

Right to Object

You may object to the processing of your data for direct marketing purposes at any time.

Right to Data Portability

You may request your data in a machine-readable format for transfer to another service.

Right to Restriction of Processing

You may request that we restrict the processing of your data under certain circumstances provided for by law.

To submit any requests related to the rights above, contact our privacy team via the support email or through your account settings. We will process your request within 21 business days.

8

Children's Data Protection

The operatoto platform is strictly for individuals aged 18 and above. We do not knowingly collect or process personal data from children or minors under the age of 18.

If we discover that personal data of a minor has been collected without our knowledge, we will take immediate steps to delete that data and close the account in question. Parents or guardians with concerns about this matter may contact us directly for prompt assistance.

Parental Responsibility: We encourage parents and guardians to monitor their children's online activities and use appropriate parental control software to prevent unauthorized access to online gaming websites.

9

Links to Third-Party Websites

The operatoto website may contain links or references to third-party websites for informational purposes. Please note that this Privacy Policy applies solely to the operatoto platform.

Operatoto is not responsible for the privacy practices or content of those third-party websites. We encourage you to read the privacy policy of every website you visit. The presence of a link to another website does not imply our endorsement or verification of its content or privacy practices.

10

Changes to This Privacy Policy

Operatoto reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, new legal requirements, or improvements to our services.

Any significant changes will be communicated to you via an in-platform notification or your registered email at least 14 days before taking effect. The "Last Updated" date at the top of this page will be updated to reflect the date of the latest amendment.

Your continued use of the operatoto platform after any changes to this Privacy Policy constitutes your acceptance of the latest version. We encourage you to review this page periodically.

11

Contact Us About Privacy

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, the operatoto privacy team is ready to assist you.

Privacy Email: [email protected]
Live Chat: Available 24 hours a day, 7 days a week via the chat icon at the bottom corner of the platform
Response Time: We aim to respond to all privacy-related inquiries within 3 business days

Our Commitment: The operatoto privacy team is dedicated to ensuring every inquiry and request relating to your personal data is handled thoroughly, promptly, and with complete confidentiality.

Privacy Policy operatoto – Your Personal Data Protection

Why Your Privacy Is Safe with operatoto

256-bit SSL Encryption

Secure Data Storage

No Data Selling

PDPA 2010 Compliance

Control in Your Hands

Opt-Out Options