Privacy Policy

This Privacy Policy ("Policy") is issued by the operator of the Alitoto online gaming platform ("Alitoto", "Company", "we", "us", "our"), accessible at alitoto.cam. This Policy applies to all users ("User", "you", "your") of the Platform, including registered account holders and visitors who access the Platform without registering an account.

This Policy describes: the categories of personal data we collect; the purposes for which we process such data; the legal bases on which processing is conducted; the circumstances under which we share data with third parties; the safeguards we employ to protect your data; your rights as a data subject; and how to contact us with data-related enquiries or requests.

Alitoto operates with a particular awareness of its Malaysian user base. Players accessing the Platform from Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and other locations across Malaysia should be aware that the Platform is operated by an entity incorporated outside Malaysia, and that data processing activities are therefore conducted in accordance with the data protection framework applicable in the Company's jurisdiction of incorporation, rather than Malaysian domestic data protection law. We nonetheless apply international best-practice standards to all data processing activities.

For the purposes of this Policy, the following terms carry the meanings set out below:

Alitoto collects personal data through several distinct channels: data you provide directly when registering or using the Platform; data generated automatically by your use of the Platform; and data received from third parties such as payment service providers in the course of transaction processing.

3.1 Data You Provide Directly

• Registration data: Full legal name, date of birth, residential address (including city and postcode — relevant for users in Kuala Lumpur, Penang, Johor Bahru, and other Malaysian locations), email address, and telephone number.
• Identity verification documents: A copy of your Malaysian MyKad, passport, or other government-issued identity document submitted as part of KYC verification; and where applicable, proof of address documentation.
• Payment information: Details of the payment method used for deposit and withdrawal transactions, which may include e-wallet identifiers (for Touch 'n Go eWallet, Boost, or GrabPay), bank account references (for DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank, or Hong Leong Connect transactions), or partial card details. Full card numbers are not stored by Alitoto — they are handled directly by certified payment processors.
• Communications data: Records of your interactions with our support team via live chat, email, or other supported channels.
• Responsible gambling data: Any deposit limits, loss limits, self-exclusion requests, or other responsible gambling preferences you establish through your account settings.

3.2 Data Collected Automatically

• Device and technical data: IP address, browser type and version, operating system, device type, screen resolution, and approximate geographic location derived from IP.
• Usage data: Pages visited, games played, betting activity, session duration, click patterns, and navigation paths within the Platform.
• Transaction logs: A complete record of all deposits, withdrawals, wagers placed, game outcomes, and bonus transactions associated with your account.
• Cookie and tracking data: Data collected through cookies and similar technologies as described in Section 8 of this Policy.

3.3 Data Received from Third Parties

We may receive personal data about you from third-party payment service providers, fraud detection agencies, identity verification services, and — where applicable and permitted by law — from publicly accessible sources for the purposes of anti-money laundering and sanctions screening. Data received from third parties is subject to this Policy in the same manner as data you provide directly.

Alitoto processes personal data for the purposes set out in the table below. Each processing purpose is linked to an applicable lawful basis, which is described in Section 5 of this Policy.

Alitoto relies on the following legal bases for processing personal data, consistent with international data protection frameworks:

• Contractual Necessity: Processing that is required in order for Alitoto to perform its obligations under the User Agreement — including account creation, transaction processing, and the delivery of gaming services.
• Legal Obligation: Processing that is required in order to comply with applicable legal requirements, including anti-money laundering legislation, tax reporting obligations, and gaming licence conditions mandated by the Company's licensing authority.
• Legitimate Interests: Processing conducted for the purposes of preventing fraud, ensuring platform security, conducting internal analytics to improve service quality, and communicating relevant operational information to users — provided that such processing does not override the fundamental rights or interests of the data subject.
• Consent: Processing of data for optional purposes — such as sending promotional or marketing communications — which requires your freely given, specific, and informed consent. Where consent is the lawful basis, you retain the right to withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Alitoto does not sell, rent, or disclose your personal data to third parties for their own commercial purposes. We share personal data only in the following limited circumstances and only to the extent strictly necessary:

• Payment service providers: We share transaction-related data with the payment processors and financial institutions that facilitate your deposit and withdrawal transactions, including providers of DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank2u, CIMB Clicks, Public Bank, and Hong Leong Connect services, as well as card-processing networks. Each such provider operates under its own privacy and data security obligations.
• Identity verification providers: Third-party KYC and document verification service providers engaged to assist with age verification, identity confirmation, and sanctions screening. These providers process data as Data Processors under formal data processing agreements.
• Game technology providers: Licensed game studios and platform technology suppliers who require certain anonymised or pseudonymised technical data to operate game functions, enforce RNG integrity, and deliver live dealer streams.
• Fraud prevention agencies: Industry fraud and abuse databases used to identify, investigate, and prevent fraudulent account activity, bonus abuse, and money laundering.
• Regulatory and law enforcement authorities: Where required to do so by applicable law, court order, or binding regulatory direction, Alitoto may disclose personal data to competent governmental or law enforcement authorities. We will, where legally permissible, notify affected users of any such disclosure requirement.
• Professional advisers: Legal, accounting, or audit professionals engaged by the Company who require access to personal data in the course of their professional services, subject to applicable professional confidentiality obligations.

Alitoto retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, licensing, or audit obligations. The following indicative retention periods apply:

Upon expiry of the applicable retention period, personal data will be securely deleted or irreversibly anonymised in a manner that ensures it can no longer be attributed to an individual data subject.

Alitoto uses cookies and similar tracking technologies — including web beacons and local storage objects — to operate and improve the Platform. Cookies serve several distinct functions:

8.1 Essential Cookies

These cookies are strictly necessary for the Platform to function. They manage user sessions, maintain authentication state, preserve account security, and enable core gaming functionality. Essential cookies cannot be disabled through user preference controls without significantly impairing Platform functionality.

8.2 Analytics Cookies

We use analytics cookies to collect aggregated, pseudonymised data about how users interact with the Platform — including which pages are visited most frequently, where users encounter navigation difficulties, and how long sessions typically last. This data informs ongoing Platform improvements. Analytics cookies are not used to identify individual users.

8.3 Functional Cookies

Functional cookies remember user preferences such as language settings, display preferences, and previously entered (non-sensitive) form data, reducing the need to re-enter information on subsequent visits.

8.4 Managing Cookies

You may manage non-essential cookie preferences through your browser's privacy settings. Most modern browsers allow you to block, delete, or receive notifications before cookies are set. Note that disabling certain cookies may affect the performance or availability of specific Platform features. Detailed instructions for managing cookies in commonly used browsers are available through each browser's help documentation.

Alitoto implements a multi-layered data security framework designed to protect personal data against unauthorised access, loss, destruction, or disclosure. Our security measures include, but are not limited to:

• Transport Layer Security (TLS) encryption for all data transmissions between user devices and Platform servers, displayed as HTTPS with a valid SSL certificate.
• Encryption at rest for sensitive personal data stored within our database infrastructure.
• Role-based access controls restricting internal access to personal data to authorised personnel whose job functions require such access.
• Regular security audits, vulnerability assessments, and penetration testing conducted by qualified internal and external security professionals.
• Incident response procedures that specify the steps to be taken in the event of a suspected or confirmed personal data breach, including notification protocols where legally required.
• Secure disposal procedures for physical and digital storage media containing personal data at the end of their operational lifecycle.

Alitoto operates internationally and may transfer your personal data to, and process it in, countries other than Malaysia. Where personal data is transferred across international borders, the Company ensures that appropriate safeguards are in place to protect such data to a standard at least equivalent to the protections afforded under this Policy. Applicable safeguards may include:

• Standard contractual clauses approved by relevant data protection authorities and incorporated into agreements with recipient entities.
• The recipient entity's participation in internationally recognised data protection frameworks or certification schemes.
• A determination by the Company that the destination jurisdiction provides an adequate level of data protection as assessed against internationally accepted benchmarks.

By using the Alitoto Platform, you acknowledge that your personal data may be transferred to and processed in jurisdictions outside Malaysia, and that such transfers are conducted in accordance with the safeguards described in this section.

As a data subject, you hold the following rights in relation to your personal data processed by Alitoto. These rights may be exercised by contacting our support team using the details set out in Section 15 of this Policy. The Company will respond to all data subject requests within a reasonable timeframe and without charge, except in cases of manifestly unfounded or excessive requests.

The Alitoto Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect or process personal data from any person under the age of 21. If, following identity verification or otherwise, we become aware that personal data has been collected from an individual under the age of 21, we will promptly delete all such data and suspend the associated account.

Parents or guardians who believe that a minor under their care may have registered an account or provided personal data to Alitoto are requested to contact us immediately at [email protected] so that appropriate action can be taken without delay.

The Alitoto Platform may incorporate functionality provided by third-party technology vendors, including game software providers, live streaming infrastructure, payment gateway integrations, and customer support tools. Where such third-party services involve the processing of personal data, Alitoto ensures that appropriate data processing agreements are in place with each vendor. However, any third-party service that operates under its own distinct privacy practices is not covered by this Policy, and Alitoto accepts no responsibility for the data practices of independent third parties beyond the scope of the data processing agreements in place.

Users are encouraged to review the privacy policies of any third-party payment service providers through which they transact, including the operators of Touch 'n Go eWallet, Boost, GrabPay, DuitNow, and FPX services, to understand how those parties handle their personal data in connection with payment transactions.

Alitoto reserves the right to amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable legal requirements, or Platform operations. Where any amendment is material in nature — that is, where it significantly affects your rights or the way in which your personal data is processed — we will notify you by posting a prominent notice on the Platform and updating the effective date at the top of this document.

Your continued use of the Alitoto Platform following the publication of an amended Privacy Policy constitutes your acceptance of the revised terms. If you do not accept any amendment to this Policy, you must cease using the Platform and may request the deletion of your account and personal data in accordance with the procedures described in Section 11.

For any enquiries, requests, or complaints relating to your personal data or to this Privacy Policy, please contact our Data Support Team through the channels listed below. We are committed to addressing all data-related requests with appropriate priority and within the timeframes required by applicable law.

If you are not satisfied with our response to a data-related complaint, you may have the right to lodge a complaint with the relevant data protection supervisory authority in the jurisdiction applicable to your situation. The Company will provide further guidance on applicable complaint channels upon request.