Exototo takes every aspect of member personal data protection seriously. This document clearly and transparently explains how we collect, use, store and protect your information throughout your time on our platform.
Six layers of protection that exototo has implemented to keep every Malaysian member's personal data safe at all times.
Every piece of information you submit to exototo — from login credentials to payment card details — is encrypted using 256-bit SSL/TLS protocols. No external party can intercept or read your data during transmission.
Member data is stored in data centres equipped with strict physical access controls, 24/7 monitoring systems and automated backup procedures. Our infrastructure is designed to ensure high availability while maintaining uncompromising security standards.
Only exototo staff with specific authorisation may access member personal data, and solely for customer support or required compliance purposes. All access is logged and continuously monitored to prevent internal misuse.
Identity verification documents submitted during the KYC process are stored in a separate, independently encrypted system. They are never shared with game providers or business partners and are deleted once compliance requirements have been met.
Exototo never sells, rents or trades member personal data to any third party for marketing or commercial purposes. Your data belongs entirely to you and we use it solely for the purposes stated in this policy.
Exototo's security systems undergo regular independent audits by qualified third parties. Any identified vulnerabilities are addressed promptly. Audit records are retained and available for review by relevant authorities when required.
Exototo collects your personal data through several different methods depending on how you interact with our platform. The following are the main categories of data we collect:
When you browse the exototo website or use the app, we automatically collect certain technical information to ensure the platform operates smoothly and securely:
Every piece of data we collect is used for a specific, legitimate purpose necessary to operate exototo's services properly. We do not use your data for any purpose beyond what is stated below:
| Purpose of Use | Types of Data Used | Legal Basis |
|---|---|---|
| Account Registration & Verification | Name, email, IC, date of birth | Contract performance |
| Deposit & Withdrawal Processing | Bank details, digital wallet | Contract performance |
| KYC & Anti-Fraud Compliance | IC, verification documents, address | Legal obligation |
| Customer Support | Communication records, account details | Legitimate interest |
| Marketing & Promotions | Email, phone number | Your consent |
| Analytics & Platform Improvement | Usage data, session records | Legitimate interest |
For marketing communications, you may withdraw your consent at any time through your account settings or by contacting our support team. Withdrawing consent does not affect your right to continue using the platform.
Exototo does not sell or trade your personal data. However, there are certain situations where we need to share data with specific parties to enable our services to function:
We work with trusted technical service providers — including cloud service providers, payment processors, and identity verification companies — who require limited access to certain data to perform their functions. All such providers are bound by strict confidentiality agreements and may only use your data in accordance with exototo's instructions.
Exototo will disclose personal data when required by applicable law, court order or instruction from a competent authority. In such situations, we will notify you unless prohibited from doing so by law.
The exototo website uses cookies to enhance your browsing experience, analyse platform performance, and maintain login session security. The following are the types of cookies we use:
These cookies are required for core website functions to operate correctly, including login session authentication, CSRF security, and language preferences. They cannot be disabled as they are critical to your account security.
These cookies help us understand how members use the platform so we can make improvements. Data collected is anonymous and aggregated — no personally identifiable information can be derived from these cookies.
These cookies store your preferences such as display language, interface theme, and game settings so you don't need to reset them every time you log in.
Exototo retains your personal data only for as long as necessary for the purposes stated in this policy or as required by applicable law. The following are data retention period guidelines by data category:
| Data Category | Retention Period | Reason |
|---|---|---|
| Active account data | Throughout the active account period | Service delivery |
| Financial transaction records | 7 years after transaction | Legal obligation |
| KYC Documents | 5 years after account closure | Anti-money laundering compliance |
| Support communication logs | 3 years | Historical reference & dispute resolution |
| Usage data & technical logs | 12 months | Security & troubleshooting |
| Marketing data (with consent) | Until consent is withdrawn | Your consent |
Once the retention period expires, data will be securely deleted or anonymised so that it can no longer be associated with any individual.
As a data subject, you have clear rights regarding your personal data held by exototo. We are committed to facilitating the exercise of these rights at no additional cost:
You may request a copy of the personal data we hold about you at any time. We will provide this information within 14 business days.
If your data is inaccurate or incomplete, you may request a correction through your account settings or by contacting our customer support.
You may request the deletion of your personal data, subject to our legal obligations to retain certain records for specified periods.
You may object to the processing of your data for direct marketing purposes at any time, and we will cease such processing immediately.
You may request your personal data in a machine-readable format for transfer to another platform of your choice.
In certain circumstances, you may request that we restrict the processing of your data while a dispute or review is in progress.
Exototo is an online gambling platform designed exclusively for adults aged 18 and above. We do not knowingly collect any personal data from individuals under the age of 18.
If we discover that a child's personal data has been collected without our knowledge, we will take immediate action to delete that data and close the associated account. Parents or guardians who suspect their child has registered on our platform are urged to contact our support team immediately.
Exototo reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, legal requirements or service improvements. Here is how we manage amendments:
We encourage you to review this page periodically. If you disagree with any amendments made, please contact our team or close your account before the new policy takes effect.
Exototo is committed to protecting your privacy every step of the way. Register now and enjoy a safe, fair and responsible gaming experience alongside more Malaysian players on a platform you can trust.