Privacy Policy

1 Introduction

This Privacy Policy ("Policy") is published by Ciatoto, the operator of the online gaming platform accessible at ciatoto.cam (the "Platform"). It governs the collection, processing, storage, and use of personal data belonging to registered Players, visitors, and any other individuals who interact with the Platform or its associated services.

Ciatoto takes data privacy seriously. We recognise that the trust of our players — particularly those in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and across Malaysia — depends on the responsible stewardship of their personal information. This Policy is designed to be transparent, readable, and genuinely informative.

By creating an Account on the Platform, making a deposit, or otherwise interacting with our services, you confirm that you have read and understood this Policy and that you consent to the processing of your personal data as described herein. If you do not agree with this Policy, you must not use the Platform.

2 Definitions

For the purposes of this Policy, the following terms carry the meanings assigned below:

3 Data We Collect

Ciatoto collects personal data through several channels: directly from you when you register or interact with the Platform, automatically as you use our services, and from third-party sources where applicable and lawful. The categories of data we collect are described below.

When you create an Account, we collect:

• Full legal name
• Date of birth (to verify you are aged 21 or above)
• Residential address (including city — e.g., Kuala Lumpur, Penang, Johor Bahru)
• Email address
• Mobile phone number
• Username and encrypted password
• Preferred language and communication preferences

To comply with our obligations and to process withdrawal requests, we collect identity verification documents, which may include:

• Copies of government-issued photo identification (e.g., Malaysian MyKad, passport)
• Proof of residential address (e.g., utility bill, bank statement)
• Selfie or liveness check image for biometric verification
• Documentation confirming the source of funds, where required

When you make deposits or withdrawal requests, we collect data relating to your payment transactions. This includes your preferred payment method (e.g., Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank, USDT TRC20), transaction amounts in MYR, transaction timestamps, and partial payment identifiers sufficient to process and audit transactions. Ciatoto does not store full payment card numbers or complete e-wallet account credentials.

We automatically collect data about how you use the Platform, including:

• Games played, wagers placed, and betting history
• Session timestamps, duration, and frequency of visits
• Device type, operating system, and browser version
• IP address and approximate geographic location
• Referral source (how you arrived at the Platform)
• Bonus usage and promotion interactions

When you contact our customer support team — via Live Chat, email, or any other channel — we retain records of those communications, including their content, timestamps, and resolution outcome. This data is used for quality assurance, dispute resolution, and regulatory compliance.

4 How We Use Your Data

The personal data we collect from Players and platform users is used for the following purposes:

5 Legal Basis for Processing

Ciatoto processes your personal data on the following legal bases:

• Contractual Necessity: Processing required to fulfil our obligations to you under the Terms & Conditions — including account administration, payment processing, and customer support.
• Legal Obligation: Processing required to comply with applicable laws, including anti-money laundering regulations, KYC requirements, and regulatory reporting obligations.
• Legitimate Interests: Processing undertaken for Ciatoto's legitimate business interests, including fraud prevention, platform security, and analytics — provided these interests are not overridden by your fundamental rights.
• Consent: Processing carried out based on your freely given and specific consent — most notably, the sending of direct marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

6 Data Sharing & Disclosure

Ciatoto does not sell, rent, or trade your personal data to unaffiliated third parties. We may, however, share your data with the following categories of recipients where necessary and lawful:

To process your deposits and withdrawals, we share relevant transaction data with our verified Malaysian payment partners. This includes providers facilitating transactions via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank, and cryptocurrency channels. These providers are contractually bound to process your data only for the purpose of facilitating your transactions.

KYC and identity verification services may be provided by accredited third-party verification partners. These partners receive only the data necessary to conduct the verification and are prohibited from using it for any other purpose.

Ciatoto uses third-party providers for hosting, security, analytics, and customer support infrastructure. These providers act as Data Processors under written data processing agreements and may only process your data in accordance with our documented instructions.

We may disclose personal data to competent regulatory authorities, law enforcement agencies, or courts where we are legally obligated to do so, or where we have a good-faith belief that such disclosure is necessary to prevent serious harm, detect criminal activity, or comply with a lawful order.

7 Data Retention

Ciatoto retains personal data for as long as is necessary to fulfil the purposes for which it was collected, and for so long as we are required or permitted to retain it by applicable law. The following general retention principles apply:

• Active Account Data: Retained for the duration of your active Account relationship with Ciatoto.
• KYC and Identity Documents: Retained for a minimum of five (5) years following Account closure, in accordance with applicable anti-money laundering regulations.
• Transaction Records: Financial transaction records are retained for a minimum of seven (7) years from the date of the transaction.
• Support Communications: Customer support correspondence is retained for three (3) years from the date of the final communication.
• Marketing Opt-In Records: Records of your marketing consent and opt-in history are retained for as long as we hold your contact details.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Requests for earlier deletion are handled in accordance with Section 10 (Your Rights) of this Policy.

8 Cookies & Tracking Technologies

The Platform uses cookies and similar tracking technologies to operate correctly and to deliver a consistent, personalised user experience. The following categories of cookies may be active on the Platform:

These cookies are essential for the Platform to function. They enable core services such as secure login sessions, navigation, and access to authenticated areas of the Platform. These cookies cannot be disabled without affecting Platform functionality.

Functional cookies remember your preferences — such as your preferred language (English, Bahasa Melayu, or Mandarin), display settings, and game lobby preferences — so that you do not need to reconfigure these on every visit.

We use first-party analytics cookies to collect aggregated, anonymised data about how visitors use the Platform. This data helps us understand which pages are most popular, where users encounter difficulties, and how overall platform performance can be improved. No individual player profile is built for advertising purposes.

You may control and delete cookies through your browser settings at any time. Please note that disabling certain cookies may affect the functionality of the Platform. Most browsers provide options to view, delete, or block cookies via their privacy or security settings menus.

9 Data Security

Ciatoto implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the Platform is encrypted in transit using industry-standard TLS protocols.
• Encrypted Data Storage: Sensitive personal data — including identity documents and payment information — is stored in encrypted form at rest.
• Access Controls: Access to personal data within Ciatoto is strictly limited to personnel who require it to perform their job functions. Access logs are maintained and reviewed regularly.
• Multi-Factor Authentication: Administrative access to systems holding personal data requires multi-factor authentication.
• Regular Security Audits: The Platform undergoes periodic security assessments and vulnerability testing by qualified security professionals.
• Incident Response: Ciatoto maintains a documented data breach response procedure. In the event of a breach that poses a risk to your rights, we will notify affected Players as required under applicable obligations.

10 Your Rights

Subject to applicable law and verification of your identity, you have the following rights in relation to the personal data that Ciatoto holds about you:

To exercise any of these rights, please contact our Data Privacy team via Live Chat or by written request to the email address listed in Section 15. We will acknowledge your request within five (5) business days and endeavour to respond fully within thirty (30) days. In complex cases, this period may be extended by up to a further sixty (60) days, with notification of the extension provided to you.

11 Children & Minors

The Platform is strictly intended for adults aged 21 years and above. Ciatoto does not knowingly collect personal data from individuals under the age of 21. If you are under 21, you are not permitted to register an Account, make deposits, or use any features of the Platform.

If we become aware that we have inadvertently collected personal data from a person under the age of 21, we will take prompt steps to delete that data and close the associated Account. If you believe that a minor has registered an Account on the Platform, please contact our support team immediately via Live Chat.

12 Third-Party Services

The Platform may incorporate third-party services — including game content from certified gaming providers, payment processing via Malaysian financial institutions and e-wallet operators, and customer support tooling. While we exercise due diligence in selecting partners and require contractual data protection commitments from all Data Processors, Ciatoto is not responsible for the independent privacy practices of third parties operating under their own privacy frameworks.

We do not embed third-party advertising networks or social media tracking scripts on the Platform. Our analytics tooling is configured to respect user privacy and does not cross-reference Platform activity with data from external sources for profiling purposes.

13 International Data Transfers

In certain circumstances, personal data collected by Ciatoto may be transferred to, stored, or processed in jurisdictions outside of Malaysia. Where such transfers occur, Ciatoto takes appropriate steps to ensure that your personal data receives an equivalent level of protection, including the implementation of contractual safeguards with receiving parties and the application of technical security measures to data in transit.

By using the Platform and providing your personal data, you acknowledge that your data may be transferred and processed internationally as described in this section.

14 Changes to This Privacy Policy

Ciatoto may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or operational requirements. When material changes are made, we will update the "Last Reviewed" date at the top of this page. Where practicable, we may notify registered Players of significant changes via their registered email address or by an on-Platform notification.

Your continued use of the Platform following the posting of any revised Policy constitutes your acceptance of the updated terms. We encourage you to review this page periodically to stay informed about how we protect your personal data.

15 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to the personal data Ciatoto holds about you, please contact our team. We are committed to addressing all privacy-related enquiries promptly and thoroughly.

Our customer support team is available 24 hours a day, 7 days a week via Live Chat on the Platform, with an average response time of 3–5 minutes. Support is provided in English, Bahasa Melayu, and Mandarin Chinese.

For formal data subject requests — including access, rectification, erasure, or portability requests — please submit a written request to the following address (plain text — not a clickable link):

[email protected]

Please include your registered username, Account ID, and a clear description of your request to allow us to process it as efficiently as possible. We will acknowledge receipt within five (5) business days.