Polototo Privacy Policy – Your Personal Data Protection

Polototo ("we", "our platform") is an online entertainment platform fully committed to protecting the privacy of our users. We understand that your personal information is a trust placed in us, and we take this responsibility seriously.

This Privacy Policy is prepared in accordance with the provisions of the Personal Data Protection Act 2010 (PDPA) Malaysia and international best practices on data protection. This document explains:

• The types of personal data we collect from you;
• The purpose and legal basis for processing the data;
• How we protect and securely store your data;
• Your rights regarding personal data and how to exercise them;
• How you can contact us with any privacy-related enquiries.

Polototo will never use your personal data for purposes not stated in this policy without obtaining your consent beforehand. This is our commitment to every polototo user.

Polototo collects various types of personal data depending on how you interact with our platform. Below is a summary of the data types collected and their purposes:

We may also collect data you voluntarily provide, such as feedback provided through customer satisfaction surveys or additional information shared when contacting our support team.

Polototo uses your personal data responsibly and only for legitimate purposes. The following are the primary purposes for which your data is used:

• Account management: Creating and maintaining your account, verifying your identity, and managing login and account security;
• Transaction processing: Processing deposits and withdrawals securely and efficiently through your chosen payment method;
• Legal compliance: Fulfilling our obligations under Malaysian law, including anti-money laundering (AML) and KYC requirements;
• Service communications: Sending you important notifications regarding your account, transactions, and policy updates;
• Responsible gaming: Monitoring gaming habits to identify signs of problem gambling and provide the necessary support;
• Platform improvements: Analysing aggregated usage data to improve the user experience and functionality of polototo;
• Fraud prevention: Detecting and preventing fraudulent activity, money laundering, and other security threats to our platform and users.

Polototo does not sell your personal data to any third party. However, in the following limited circumstances, we may share your data with trusted parties:

• Payment service providers: To securely process your deposits and withdrawals via FPX, DuitNow, Touch 'n Go, and Boost. These providers are bound by strict confidentiality agreements;
• Game software providers: Gaming companies providing slots, live casino, and other games may receive the minimum technical data required to operate games smoothly;
• Competent authorities: When required by Malaysian law, court order, or a relevant regulatory authority, polototo will disclose the necessary data;
• Technology service providers: Cloud computing, cybersecurity, and analytics service providers that help us operate the platform — all bound by strict data processing agreements.

All third parties who receive personal data from polototo users are required to meet data protection standards equal to or higher than those we uphold. We conduct regular compliance checks on all our partners.

Polototo continuously invests in high-grade security infrastructure to protect your personal data. The key security measures we practise include:

• 256-bit SSL encryption for all data transmitted between your device and our servers;
• Encryption of stored data using AES-256 standards for all sensitive data in our databases;
• Two-factor authentication (2FA) available to all user accounts as an additional security layer;
• 24/7 security monitoring by our cybersecurity team to detect and respond to any threats;
• Penetration testing periodically by independent security experts to identify and address vulnerabilities;
• Strict internal access controls — only polototo staff who genuinely require access to your data to carry out their authorised duties are permitted to do so.

Polototo uses cookies and similar tracking technologies to enhance your experience on our platform. Below are the types of cookies we use:

• Essential cookies: Required for core platform functionality, such as maintaining your login session and remembering your language preference. These cookies cannot be disabled;
• Performance cookies: Collecting information on how you use the platform to help us improve its functionality and user experience;
• Functional cookies: Allowing the platform to remember your preferences (such as display settings) to deliver a more personalised experience;
• Analytics cookies: Used to understand aggregate usage patterns, helping us make better decisions about platform development.

You can manage your cookie preferences through your web browser settings. However, disabling certain cookies may affect the functionality of the polototo platform.

Polototo retains your personal data only for as long as necessary to fulfil the original purpose of collection or as required by Malaysian law. General data retention guidelines are as follows:

• Active account data: Retained for the duration your account remains active on polototo;
• Financial transaction data: Retained for a minimum of 7 years in accordance with Malaysian accounting and anti-money laundering legal requirements;
• KYC and identity verification data: Retained for 5 years after account closure in line with compliance requirements;
• Activity and security logs: Retained for 2 years for security investigation and dispute resolution purposes;
• Marketing data (with consent): Retained until you withdraw your consent.

Once the relevant retention period expires, your data will be securely deleted or anonymised so that it can no longer be personally associated with you.

Polototo platform is strictly for individuals aged 18 and above. We do not intentionally collect or process personal data from individuals under the age of 18.

Polototo takes the following proactive steps to prevent underage registration:

• Age verification during new account registration;
• KYC processes requiring valid identification documents with date of birth;
• Regular reviews of accounts flagged for age-related concerns.

Polototo reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or technological developments. Each new version will be published on this page with a clear effective date.

For significant amendments, we will provide notice through:

• A notice prominently displayed on the polototo homepage before the amendment takes effect;
• A notification email to your registered address at least 14 days before the effective date;
• An in-app notice within polototo upon your next login.

Your continued use of polototo after the effective date of any amendment constitutes your acceptance of the updated policy. We encourage you to review this page periodically.

If you have any questions, concerns, or wish to exercise your personal data rights, polototo's Data Protection Officer (DPO) team is ready to assist you.

For more information about your rights and responsibilities on the polototo platform, please also refer to Terms and Conditions and the Responsible Gaming us. FAQs can be found on the FAQ us.