Piktoto Privacy Policy

This Privacy Policy ("Policy") is published by Piktoto, the online gambling and sports betting platform accessible at piktoto.cam ("Platform", "we", "us", "our"). This Policy describes in detail how Piktoto collects, uses, stores, discloses, and safeguards the personal data of individuals ("you", "your", "User", "Player") who access or use the Platform.

Piktoto operates primarily for Malaysian users and is subject to applicable Malaysian data protection legislation. We are committed to handling personal data responsibly, transparently, and in accordance with the rights of our Players across Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and other locations throughout Malaysia.

By registering an Account, accessing the Platform, or providing personal information to Piktoto in any form, you acknowledge that you have read and understood this Policy. If you do not agree to the practices described herein, you should discontinue use of the Platform immediately.

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

• "Personal Data" means any information that relates to an identified or identifiable natural person, including name, identification number, contact details, financial data, and online identifiers.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, or deletion.
• "Data Controller" means Piktoto, being the entity that determines the purposes and means of Processing Personal Data.
• "Data Processor" means a third party that processes Personal Data on behalf of Piktoto under binding contractual obligations.
• "Cookies" means small text files placed on your device by our Platform to enable certain functionality and analytics.
• "KYC" means Know Your Customer — the identity and address verification process required before withdrawals are permitted.
• "Account" means the registered Player account on the Platform.
• "Third Party" means any person or entity that is not you or Piktoto.

Piktoto collects the following categories of Personal Data, depending on your level of engagement with the Platform:

Piktoto does not knowingly collect sensitive personal data beyond what is required for identity verification and legal compliance purposes (e.g., government-issued ID details required for KYC). We do not collect biometric data, racial or ethnic origin data, or health data except where incidentally disclosed in a support communication.

Piktoto collects Personal Data through the following channels:

• Direct Submission: Information you provide when registering an Account, completing KYC verification, making a deposit or withdrawal, contacting customer support, or updating your Account settings.
• Automated Technical Collection: Information collected automatically when you visit or use the Platform, including IP address, device identifiers, browser information, session duration, and page interaction data via cookies and similar technologies.
• Payment Processors: Limited transaction confirmation data received from our Malaysian payment partners including Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, DuitNow, FPX, and cryptocurrency processors, solely for the purpose of confirming deposit and withdrawal transactions.
• Third-Party Identity Verification Services: Where Piktoto uses a third-party KYC or AML verification provider to assist in document verification, that provider may return a verification result and associated data fields to Piktoto.
• Publicly Available Sources: In limited circumstances, Piktoto may verify information against publicly available databases for fraud prevention and AML compliance purposes.

Piktoto processes your Personal Data for the following specific purposes:

• Account Creation and Management: To create, maintain, and administer your Player Account, including authentication and Account recovery.
• Identity Verification (KYC): To verify your identity, age (21+ compliance), and address as required before processing withdrawals and as part of our anti-money laundering obligations.
• Transaction Processing: To process deposits and withdrawals via your chosen payment methods, including Touch 'n Go eWallet, Boost, FPX, DuitNow, bank transfers, and cryptocurrency.
• Service Delivery: To provide access to sports betting markets (including Liga Super Malaysia, EPL, and UFC), live casino games, slots, and all other Platform features.
• Customer Support: To respond to support queries, resolve disputes, and maintain records of communications for quality and training purposes.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, multi-accounting, bonus abuse, money laundering, and other prohibited conduct.
• Legal and Regulatory Compliance: To fulfil our obligations under applicable anti-money laundering laws, responsible gambling regulations, and other applicable Malaysian and international legal requirements.
• Responsible Gambling: To monitor gambling activity patterns and, where appropriate, proactively contact Players showing signs of problem gambling, and to administer self-exclusion and deposit limit requests.
• Marketing Communications: To send promotional offers, bonus notifications, and Platform updates to Players who have opted in to receive such communications. You may opt out at any time via Account settings or by contacting support.
• Platform Improvement: To analyse usage data and improve Platform performance, user experience, and service quality.

Piktoto processes your Personal Data on the following legal bases:

• Contractual Necessity: Processing required to perform our obligations under our Terms and Conditions — including Account management, transaction processing, and KYC — is carried out on the basis that it is necessary to fulfil our contract with you.
• Legal Obligation: Processing required to comply with anti-money laundering laws, age verification obligations, tax reporting requirements, and other applicable legal duties is carried out on the basis of legal obligation.
• Legitimate Interests: Processing for fraud prevention, security monitoring, Platform improvement, and responsible gambling monitoring is carried out on the basis of Piktoto's legitimate interests, where those interests are not overridden by your rights and interests.
• Consent: Processing for direct marketing communications is carried out on the basis of your explicit, freely given, and withdrawable consent. You may withdraw your consent at any time without affecting the lawfulness of prior processing.

Piktoto does not sell or rent your Personal Data to third parties. We share your data only in the following limited and controlled circumstances:

• Payment Processors: We share necessary transaction data with our Malaysian payment partners (Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, DuitNow, FPX, and cryptocurrency processors) solely to facilitate deposit and withdrawal processing.
• KYC and Identity Verification Providers: We may engage specialist third-party identity verification service providers to assist with KYC document verification. These providers process data solely on our instructions under binding data processing agreements.
• Fraud Prevention and AML Services: We may share limited data with fraud prevention databases and AML compliance tools to detect and prevent financial crime.
• Game Providers and Platform Technology Partners: Limited technical identifiers may be shared with our game content providers and platform infrastructure providers to enable game delivery, session management, and technical operations.
• Legal and Regulatory Authorities: We may disclose Personal Data to law enforcement agencies, regulatory bodies, or courts where required by applicable law, a valid court order, or a legitimate regulatory request.
• Corporate Transactions: In the event of a merger, acquisition, or sale of assets, Personal Data held by Piktoto may be transferred to the relevant successor entity, subject to that entity honouring this Privacy Policy.

Piktoto uses cookies and similar tracking technologies to provide, maintain, and improve the Platform. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the Platform to function correctly — including session management, login authentication, and security features. These cannot be disabled without impairing Platform functionality.
• Performance and Analytics Cookies: Used to collect aggregated, anonymised data about how users interact with the Platform, including pages visited, time spent, and error occurrences. This helps us improve Platform performance and user experience.
• Functional Cookies: Used to remember your preferences and settings, such as preferred language, currency display, and notification preferences.
• Marketing Cookies: Used to deliver relevant promotional content to you based on your activity on the Platform. These are only placed where you have consented to receive marketing communications.

You may control cookie preferences through your browser settings. Please note that disabling certain categories of cookies may affect the functionality and performance of the Platform. Detailed cookie settings are configurable within the Platform's account privacy settings.

Piktoto retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our general data retention approach is as follows:

• Active Account Data: Retained for the duration of your Account's active status and for a period of at least five (5) years following Account closure, in accordance with anti-money laundering regulatory requirements applicable to online gambling operators.
• KYC and Identity Documents: Retained for a minimum of five (5) years from the date of verification, or longer if required by applicable law or an ongoing regulatory investigation.
• Transaction Records: Retained for a minimum of five (5) years from the date of transaction for AML compliance and financial audit purposes.
• Customer Support Communications: Retained for up to three (3) years from the date of the interaction unless a longer period is required in connection with an unresolved dispute.
• Marketing Preferences: Retained for the duration of your Account and for a reasonable suppression period following opt-out to ensure no further communications are sent.
• Technical and Log Data: Retained for up to twelve (12) months for security monitoring and fraud detection purposes.

When Personal Data is no longer required, it is securely deleted or anonymised in accordance with our internal data disposal procedures.

Piktoto implements a range of technical and organisational security measures designed to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encryption in Transit: All data transmitted between your browser or mobile device and Piktoto's servers is encrypted using 256-bit SSL/TLS protocols. Our Platform operates exclusively over HTTPS.
• Encryption at Rest: Sensitive Personal Data and financial records stored in Piktoto's databases are encrypted at rest using industry-standard encryption algorithms.
• Access Controls: Access to Personal Data within Piktoto's systems is restricted to authorised personnel on a strict need-to-know basis. All internal access is logged and audited.
• Penetration Testing and Security Audits: Piktoto conducts regular security assessments and vulnerability testing to identify and remediate potential weaknesses in our systems.
• Incident Response: Piktoto maintains a documented data breach response procedure. In the event of a security incident affecting your Personal Data, we will notify affected Players and relevant authorities in accordance with applicable legal obligations.

Subject to applicable Malaysian data protection legislation, you have the following rights in respect of your Personal Data held by Piktoto. To exercise any of these rights, contact us at [email protected] with the subject line "Data Rights Request" and provide sufficient information to verify your identity.

Piktoto will respond to verified data rights requests within a reasonable timeframe. We may need to verify your identity before processing a request. In some cases, we may be required by law to retain certain data despite a deletion request — we will inform you if this applies.

The Platform is strictly intended for adults aged 21 years and above. Piktoto does not knowingly collect Personal Data from individuals under the age of 21. Age verification is a mandatory step in the KYC process, and any Account found to belong to a minor will be immediately and permanently closed, with all associated funds subject to applicable regulatory requirements.

Piktoto's primary operations and data storage are oriented towards serving Malaysian users. In certain operational circumstances — such as the use of cloud-based infrastructure, KYC verification providers, or game platform technology partners — Personal Data may be processed or stored on servers located outside Malaysia.

Where such international transfers occur, Piktoto ensures that adequate safeguards are in place to protect your Personal Data, including:

• Contractual data processing agreements incorporating standard data protection clauses.
• Transfer only to jurisdictions or service providers offering an adequate level of data protection.
• Technical and organisational security measures equivalent to those applied to data held within Malaysia.

By using the Platform, you acknowledge that your Personal Data may be transferred to and processed in locations outside Malaysia as described in this section.

Piktoto reserves the right to update, revise, or replace this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or Platform services. Material changes to this Policy will be communicated to registered Players via email notification and/or a prominent notice on the Platform prior to the changes taking effect.

The updated Policy will include a revised effective date at the top of the page. Your continued use of the Platform following the publication of a revised Policy constitutes your acceptance of the changes. If you do not agree to a revised Policy, you should contact us to request Account closure prior to the new Policy taking effect.

We encourage you to review this Privacy Policy periodically to stay informed about how Piktoto protects your personal information.

If you have any questions, concerns, or requests regarding this Privacy Policy or Piktoto's data processing practices, please contact us through the following channels:

• Live Chat: Available 24/7 on the Platform. Average first response time is under 3 minutes. Recommended for urgent privacy queries.
• Email: [email protected] (plain text only — not a clickable link). Please include "Privacy Policy" or "Data Rights Request" in the subject line. We aim to respond within 2 to 4 hours for general queries and within a reasonable timeframe for formal data rights requests.

For related legal documentation, please refer to our Terms & Conditions and our Responsible Gambling page, both of which contain provisions relevant to your personal data and Account security.