Privacy Policy
Petanitoto Data Practices & Member Rights

Petanitoto ("we", "us", "our", or "the Platform") operates an online gaming platform accessible at petanitoto.cam, offering lottery draws, live casino games, sports betting markets, and related entertainment services to eligible members ("you", "the Member", "the User") primarily located in Malaysia.

This Privacy Policy ("Policy") describes how Petanitoto collects, uses, stores, shares, and protects your personal data in connection with your use of the Platform. It also outlines the rights you hold in relation to your personal information and how to exercise those rights.

This Policy applies to all personal data processed by Petanitoto, whether collected through the Platform's website, account management portal, payment processing functions, customer support channels, or marketing communications. It should be read in conjunction with our Terms & Conditions, which govern your overall use of the Platform.

The following terms have the meanings given below throughout this Policy:

• "Personal Data" — Any information relating to an identified or identifiable natural person, including name, identification number, contact details, financial data, and online identifiers.
• "Processing" — Any operation performed on personal data, including collection, recording, storage, retrieval, use, disclosure, or deletion.
• "Data Controller" — Petanitoto, being the entity that determines the purposes and means of processing personal data collected through the Platform.
• "Data Processor" — A third party that processes personal data on behalf of Petanitoto in accordance with written instructions and data processing agreements.
• "Member" / "User" — An individual who has registered an account on the Platform and whose personal data is processed in connection with that account.
• "KYC" — Know Your Customer; the identity and age verification process conducted pursuant to regulatory requirements.
• "Cookies" — Small text files placed on your device by the Platform to enable functionality, analytics, and session management.
• "Consent" — A freely given, specific, informed, and unambiguous indication of your agreement to the processing of your personal data for a stated purpose.

Petanitoto collects personal data in the following categories, depending on how you interact with the Platform:

We process your personal data only where we have a lawful basis to do so. The table below sets out the primary purposes for which we process your data and the corresponding legal basis in each case:

Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Petanitoto processes your personal data through the following mechanisms and operational procedures:

Your personal data may be shared with the following categories of recipients:

• Payment Service Providers — DuitNow, FPX, e-wallet operators (Touch 'n Go, Boost, GrabPay), banking partners (Maybank, CIMB, Public Bank, Hong Leong), and cryptocurrency infrastructure providers, solely for transaction processing purposes.
• Game Content Providers — Licensed international game studios that supply the Platform's slot, live casino, lottery, and sports betting content. These providers may receive anonymised session data for game performance and RNG audit purposes only.
• Identity Verification Services — Third-party KYC and age verification providers engaged to process identity documents as data processors under binding agreements.
• Fraud Prevention and Security Services — Specialist providers engaged to assist with detection of fraudulent activity, money laundering indicators, and prohibited conduct monitoring.
• Legal and Regulatory Authorities — Where required by applicable law, court order, regulatory directive, or in response to a legitimate law enforcement request. Petanitoto will disclose only the minimum information required to comply with such obligations.
• Professional Advisers — Legal counsel, auditors, and compliance consultants engaged in connection with the operation and regulatory compliance of the Platform, subject to professional confidentiality obligations.

Any third party receiving your data is required to process it only for the specific purpose for which it was shared, and in compliance with applicable data protection obligations. We do not permit our data processors to use your personal data for their own commercial purposes.

The Petanitoto Platform uses cookies and similar tracking technologies to enable core functionality, maintain session security, and improve your experience.

We retain personal data only for as long as is necessary for the purposes set out in this Policy, or as required by applicable legal and regulatory obligations. The following general retention periods apply:

Upon expiry of applicable retention periods, personal data is securely deleted or anonymised in accordance with our data disposal procedures.

Petanitoto implements appropriate technical and organisational security measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include:

• TLS/SSL encryption for all data transmitted between your device and the Platform;
• Encryption of sensitive data at rest, including KYC documents and financial records;
• Role-based access controls limiting staff access to personal data strictly to those with an operational need;
• Regular security assessments and penetration testing of Platform infrastructure;
• Multi-factor authentication requirements for all administrative and privileged system access;
• Incident response procedures with documented notification obligations in the event of a data breach.

Subject to applicable law and the constraints of our regulatory obligations, you hold the following rights in relation to your personal data:

• Right of Access — You may request a copy of the personal data Petanitoto holds about you and information about how it is being processed.
• Right to Rectification — You may request correction of any inaccurate or incomplete personal data held about you. You can update many basic account details directly within your account settings.
• Right to Erasure — You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and no other lawful basis applies. This right is subject to our ability to retain data required by law or for ongoing regulatory compliance.
• Right to Restriction of Processing — You may request that we restrict processing of your data in certain circumstances, including while the accuracy of data is being verified.
• Right to Data Portability — Where processing is based on consent or contractual necessity, you may request that your personal data be provided to you in a structured, machine-readable format.
• Right to Object — You may object to processing carried out on the basis of legitimate interests, including direct marketing. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent — Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Petanitoto applies age verification as a mandatory step in the account registration and KYC processes. Any account discovered to belong to an individual under the age of 21 will be immediately suspended, all balances frozen, and the matter reviewed in accordance with our compliance procedures.

If you are a parent or guardian and believe that a minor in your care has registered an account on the Platform, please contact us immediately at support@petanitoto.cam. We will take prompt action to close the account and, where applicable, return any deposited funds through appropriate channels subject to verification.

Some of the third-party service providers with whom Petanitoto works may be located outside Malaysia. Where personal data is transferred to providers in other jurisdictions, we ensure that appropriate safeguards are in place to protect your data in accordance with applicable data protection standards.

Safeguards may include:

• Contractual clauses or data processing agreements incorporating recognised data protection obligations;
• Transfers to service providers in jurisdictions that have been assessed as providing an adequate level of data protection;
• Binding corporate rules applicable to multinational corporate groups.

Details of the safeguards in place for specific cross-border transfers are available upon request. Please contact info@petanitoto.cam if you require further information about how your data is protected when processed internationally.

Petanitoto reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory requirements. The date of the most recent revision is indicated in the "Last Updated" field at the top of this document.

Where changes are material — such as a new category of data being collected, a new purpose for processing, or a new category of third-party recipient — we will provide advance notice to registered Members via the email address on record, or through a prominent notice on the Platform, no fewer than 14 calendar days before the changes take effect.

Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the updated Policy. If you do not accept the revised terms, you should cease using the Platform and may request account closure in accordance with our Terms & Conditions.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by Petanitoto, please contact us using the details below. We take all privacy enquiries seriously and aim to respond within the timeframes specified.

When submitting a data rights request, please include your registered email address, the specific right you wish to exercise, and sufficient detail for us to identify the relevant data and process your request efficiently. Identity verification will be required before any personal data is disclosed or deleted.