Privacy Policy

Introduction

This Privacy Policy ("Policy") is published by Jatengtoto ("Company", "we", "us", "our") and applies to all personal data collected, processed, and stored in connection with your use of the Jatengtoto website and online gaming platform located at https://jatengtoto.cam ("Platform").

Jatengtoto operates Malaysia's premier online betting and live casino platform, serving players across Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, and Shah Alam. In the course of providing our services — which include sports betting on Liga Super Malaysia and the English Premier League (EPL), live dealer casino games, slot games, crash games, and associated account management functions — we necessarily collect and process certain personal data about you.

We are committed to handling your personal data responsibly, securely, and in accordance with applicable data protection legislation and best practices. This Policy explains precisely what data we collect, why we collect it, how we process it, and what rights you hold with respect to that data.

This Policy should be read in conjunction with our Terms & Conditions and Responsible Gambling Policy, both of which are incorporated herein by reference.

Definitions

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial information, device identifiers, and behavioural data.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, deletion, or any combination thereof.
• "Data Controller" means Jatengtoto, the entity that determines the purposes and means of Processing Personal Data collected through the Platform.
• "Data Processor" means a third party that Processes Personal Data on behalf of Jatengtoto under a contractual arrangement, subject to this Policy's obligations.
• "Cookies" means small text files placed on your device by the Platform to enable functionality, analytics, and personalisation features.
• "KYC" means Know Your Customer — the mandatory identity, age, and source-of-funds verification process applied to registered Players.
• "Player" or "User" means any individual who accesses, registers, or uses the Jatengtoto Platform.

Data We Collect

Jatengtoto collects several categories of Personal Data, depending on your level of engagement with the Platform. The following table summarises the main data categories we process:

We collect only the Personal Data that is necessary for the specific purposes outlined in Section 5 of this Policy. We do not collect special category data (such as health data, racial or ethnic origin, or religious beliefs) except where strictly necessary for responsible gambling interventions and with your explicit consent.

How We Collect Data

4.1 Data You Provide Directly

We collect Personal Data that you provide voluntarily when you register an Account, complete KYC verification, make a deposit or withdrawal, contact our customer support team, participate in promotions, or complete any form on the Platform. You are responsible for ensuring the accuracy and completeness of all data you provide to us.

4.2 Data Collected Automatically

When you access the Platform, our servers and analytics tools automatically record technical and behavioural data including your IP address, device type, browser version, referring URL, pages visited, time spent on the Platform, and game interaction patterns. This data is collected via server logs, cookies, and similar technologies as described in Section 10.

4.3 Data from Third Parties

We may receive Personal Data about you from the following third-party sources:

• Payment Processors: Confirmation of transaction completion, chargeback notices, and fraud flags from payment partners including Maybank, CIMB, Hong Leong Bank, Public Bank, DuitNow, FPX, Touch 'n Go eWallet, Boost, and GrabPay.
• Identity Verification Providers: Results of identity document authenticity checks and sanctions screening from our KYC service partners.
• Fraud Prevention Services: Risk scores and device fingerprint data from fraud detection tools used to protect the integrity of the Platform.

Purposes of Processing

Jatengtoto processes your Personal Data for the following specific purposes:

• Account Management: Creating, maintaining, verifying, and administering your player account, including processing deposits and withdrawals via DuitNow, FPX, and other Supported Payment Methods.
• Service Delivery: Providing access to sports betting, live casino, slots, and all other gaming products available on the Platform, including personalising your game recommendations and promotions.
• Identity & Age Verification (KYC): Confirming that you meet the minimum age requirement of 21 years and verifying your identity in accordance with regulatory obligations.
• Financial Crime Prevention: Conducting Anti-Money Laundering (AML) checks, sanctions screening, and fraud detection to protect both the Platform and its players.
• Customer Support: Responding to enquiries, resolving disputes, and maintaining records of communications for quality assurance.
• Responsible Gambling: Monitoring betting patterns to identify potential problem gambling behaviour and, where appropriate, applying responsible gambling interventions in line with our Responsible Gambling Policy.
• Marketing Communications: Sending you promotional offers, bonus notifications, and updates about the Platform, where you have provided your consent or where we have a legitimate interest to do so.
• Platform Improvement: Analysing usage data and technical performance metrics to improve the functionality, security, and user experience of the Platform.
• Legal Compliance: Meeting our legal and regulatory obligations, including responding to lawful requests from government authorities and law enforcement agencies.

Legal Basis for Processing

Jatengtoto processes your Personal Data on the following legal bases, depending on the specific purpose of processing:

• Contractual Necessity: Processing necessary to perform the contract between you and Jatengtoto — including account creation, transaction processing, and game access — is based on contractual necessity.
• Legal Obligation: Processing required to comply with applicable laws and regulations — including KYC, AML, age verification, and responding to regulatory or law enforcement requests — is based on legal obligation.
• Legitimate Interests: Processing for fraud prevention, security monitoring, platform analytics, and responsible gambling monitoring is based on our legitimate interests, provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for optional marketing communications and non-essential cookies is based on your freely given, informed, and specific consent. You may withdraw consent at any time without prejudice to processing carried out prior to withdrawal.

Data Sharing & Disclosure

Jatengtoto does not sell, rent, or commercially transfer your Personal Data to any third party. We share Personal Data only in the following limited circumstances and only to the extent strictly necessary:

7.1 Service Providers and Data Processors

We engage carefully veted third-party service providers who process Personal Data on our behalf under written data processing agreements that impose equivalent data protection standards to those in this Policy. These include payment processors (Maybank, CIMB, Public Bank, DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, and cryptocurrency custodians), identity verification providers, IT infrastructure and hosting providers, fraud detection services, and customer support software providers.

7.2 Regulatory and Legal Authorities

We may disclose Personal Data to competent governmental authorities, regulators, law enforcement agencies, or courts where we are legally required to do so, or where such disclosure is necessary to protect Jatengtoto's legal rights, enforce our Terms & Conditions, or prevent fraud or criminal activity.

7.3 Business Transfers

In the event of a merger, acquisition, corporate restructuring, or sale of all or substantially all of Jatengtoto's assets, your Personal Data may be transferred to the relevant successor entity as part of that transaction. You will be notified of any such transfer and the applicable privacy terms will continue to govern your data.

International Data Transfers

Jatengtoto's primary operations and data infrastructure are maintained in secure, access-controlled data centres. In the course of delivering our services, certain Personal Data may be processed by our service providers in jurisdictions outside of Malaysia. Wherever such cross-border data transfers occur, we ensure that adequate safeguards are in place, including:

• Contractual clauses equivalent to internationally recognised data transfer mechanisms;
• Processing agreements requiring recipient organisations to apply data protection standards no less stringent than those contained in this Policy;
• Transfers only to jurisdictions that maintain adequate data protection frameworks or where specific safeguards have been implemented.

If you would like further information about the specific safeguards applied to any particular cross-border transfer, please contact using the details in Section 16.

Data Retention

Jatengtoto retains Personal Data for as long as is necessary to fulfil the purposes for which it was collected, and for such additional periods as are required by applicable law or regulatory mandate. The following general retention periods apply:

• Active Account Data: Retained for the duration of your active account relationship with Jatengtoto.
• Post-Closure Account Data: Following account closure, identity and transaction data is retained for a minimum of 5 years to meet AML and regulatory record-keeping requirements.
• KYC Documentation: Retained for at least 5 years from the date of verification or date of account closure, whichever is later.
• Customer Support Records: Retained for up to 3 years from the date of the last communication.
• Technical & Log Data: Retained for up to 12 months in active systems, with anonymised aggregates held for a further period for statistical analysis.

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised in accordance with our data disposal procedures.

Cookies & Tracking Technologies

Jatengtoto uses cookies and similar tracking technologies to ensure the proper functioning of the Platform, remember your preferences, and gather aggregate analytics data to improve our services. The main categories of cookies we use are as follows:

10.1 Strictly Necessary Cookies

These cookies are essential for the Platform to function. They enable core features such as account login sessions, security checks, and basic navigation. These cookies cannot be disabled without impairing your ability to use the Platform.

10.2 Functional Cookies

Functional cookies remember your preferences — such as language settings, currency display, and previously selected game categories — to provide a more personalised experience. These cookies are not strictly necessary but improve usability.

10.3 Analytics Cookies

We use analytics cookies to collect anonymised and aggregated data about how players navigate the Platform — including pages visited, session durations, and game interaction patterns. This data is used exclusively for internal Platform improvement purposes.

10.4 Your Cookie Choices

Strictly necessary cookies operate without your consent as they are technically required for Platform access. Functional and analytics cookies are deployed only with your consent, which you may provide or withdraw via the cookie preference centre accessible from the Platform. Note that disabling certain cookies may affect Platform functionality and your personalised experience.

Children's Privacy

If you have reason to believe that a person under 21 years of age has registered an Account or provided Personal Data to Jatengtoto, please notify us immediately via our support channels so that we may take appropriate action.

Your Data Rights

Subject to applicable data protection law and any overiding legal obligations Jatengtoto may hold, you have the following rights with respect to your Personal Data:

• Right of Access: You may request a copy of all Personal Data we hold about you, together with information about how it is processed.
• Right to Rectification: You may request that inaccurate or incomplete Personal Data be corrected or completed without undue delay.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to overiding legal retention requirements.
• Right to Restriction of Processing: You may request that we restrict the processing of your Personal Data in certain circumstances, for example while a rectification request is being assessed.
• Right to Data Portability: Where processing is based on your consent or on a contract, you may request copy of your Personal Data in a structured, machine-readable format.
• Right to Object: You may object to processing based on legitimate interests, and you have an absolute right to object to direct marketing at any time.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, please contact our Data Privacy team using the details provided in Section 16. We will acknowledge your request within 5 business days and aim to respond substantively within 30 calendar days. For complex requests, we may require an additional30-day extension, of which you will be notified.

Security Measures

Jatengtoto implements a comprehensive information security programme designed to protect Personal Data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security measures include, but are not limited to:

• Transport Layer Security (TLS 1.3) encryption for all data transmitted between your device and our servers;
• AES-256 encryption for Personal Data stored in our databases;
• Role-based access controls ensuring that only authorised personnel can access specific categories of Personal Data;
• Multi-factor authentication required for all staff accessing production systems;
• Regular penetration testing and vulnerability assessments conducted by independent security professionals;
• Continuous security monitoring and intrusion detection across all Platform infrastructure;
• Formal data breach response procedures, including notification obligations to affected individuals.

While we take all reasonable technical and organisational precautions to safeguard your Personal Data, no data transmission over the internet is entirely risk-free. You also have a responsibility to protect your own Account credentials and to notify us immediately if you suspect any unauthorised access to your Account.

Third-Party Links

The Jatengtoto Platform does not contain links to third-party websites. All content and functionality is hosted directly on https://jatengtoto.cam. Should any third-party integration be introduced in the future, this Policy will be updated accordingly, and players will be notified in advance.

Game content delivered by third-party game studios through Jatengtoto's platform is subject to the data processing terms of those studios where applicable. Jatengtoto has contractual arrangements with all studio partners to ensure Personal Data is handled in compliance with our privacy standards.

Policy Updates

Jatengtoto reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, or our data processing practices. When material changes are made, we will:

• Update the "Last Updated" date at the top of this Policy;
• Notify registered Players via the email address associated with their Account, providing at least 14 days' notice prior to the changes taking effect;
• Display a prominent notice on the Platform homepage for at least 14 days following publication of the update.

Your continued use of the Platform following the effective date of any updated Policy constitutes your acceptance of the revised terms. If you do not agree with the updated Policy, you must cease using the Platform and may request account closure and data deletion as described in Section 12.

Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data, please contact our Data Privacy team through the following channels:

• Live Chat: Available24/7 on the Platform in Bahasa Melayu, Mandarin Chinese, and English — the fastest way to reach us for account-specific matters.
• Email: [email protected] (plain text — not a clickable link; please type this address into your email client)

Please clearly state "Privacy Request" or "Data Rights Request" in the subject line of any email correspondence so that we may direct your query to the appropriate team promptly. We will acknowledge all privacy-related correspondence within 5 business days.