Privacy Policy — Padangtoto

1. Introduction

This Privacy Policy ("Policy") is issued by Padangtoto ("we", "us", "the Company", "the Platform") and applies to all personal data collected from individuals who access or use the Padangtoto website, mobile applications, and associated online services (collectively, the "Services").

Padangtoto is committed to handling your personal data responsibly and transparently. This Policy describes what personal information we collect, the purposes for which it is processed, the circumstances under which it may be disclosed to third parties, the security measures we employ to protect it, and the rights available to you as a data subject.

2. Definitions

For the purposes of this Policy, the following key terms apply:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial information, IP address, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, or deletion.
• "Data Controller" means Padangtoto, as the entity that determines the purposes and means of processing your Personal Data.
• "Data Processor" means any third party that processes Personal Data on behalf of Padangtoto pursuant to a written agreement.
• "User" or "Player" means any natural person who registers for and uses the Padangtoto platform, including prospective users who visit the website without registering.
• "KYC" means Know Your Customer — the identity verification process mandated under our licensing obligations.
• "Cookies" means small data files placed on your browser or device for the purposes described in Section 10 of this Policy.

3. Personal Data We Collect

Padangtoto collects the following categories of Personal Data, depending on how you interact with the platform:

3.1 Registration & Identity Data

• Full legal name
• Date of birth (to verify minimum age of 21 years)
• Email address
• Mobile phone number
• Residential address (including city — e.g., Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam)
• Government-issued identification documents (e.g., Malaysian MyKad, passport) submitted for KYC purposes
• Selfie or photograph (where required for identity verification)

3.2 Financial & Transaction Data

• Bank account details (account number, bank name — e.g., Maybank, CIMB, Public Bank, Hong Leong)
• E-wallet account identifiers (e.g., Touch 'n Go eWallet phone number, Boost account, GrabPay account)
• Deposit and withdrawal transaction records
• Cryptocurrency wallet addresses (where applicable)
• Transaction amounts in MYR or equivalent cryptocurrency
• Payment method used (Maybank2u, CIMB Clicks, DuitNow, FPX, etc.)

3.3 Betting & Gaming Activity Data

• Bets placed, markets selected, and outcomes
• Game session data (session duration, games played, bet sizes, RTP data)
• Sports betting preferences (e.g., EPL, Liga Super Malaysia, UFC)
• Bonus and promotion usage history
• Responsible gambling tool settings (deposit limits, self-exclusion status)

3.4 Technical & Device Data

• IP address and geolocation data (country and city level)
• Device type, operating system, and browser version
• Mobile device identifiers (where applicable)
• Session logs, access times, and pages visited
• Cookie data and similar tracking identifiers (see Section 10)

3.5 Communications Data

• Live chat transcripts and support ticket content
• Email and in-platform message correspondence
• Complaint records and dispute documentation
• Survey responses and feedback (where voluntarily provided)

4. How We Collect Your Data

Padangtoto collects Personal Data through the following channels:

• Directly from you: When you register an account, complete KYC, make a deposit or withdrawal, contact our support team, or interact with any feature of the platform.
• Automatically: Through cookies, web beacons, and analytics tools when you browse or use the platform (see Section 10).
• From third parties: From identity verification services, payment processors (e.g., DuitNow, FPX networks), fraud prevention providers, and our licensing authority where required for compliance purposes.
• From public sources: Publicly available databases used for anti-money laundering (AML) screening and sanctions checking, where required under our licensing obligations.

5. How We Use Your Personal Data

Padangtoto processes your Personal Data for the following purposes:

6. Legal Basis for Processing

Padangtoto processes your Personal Data on the following legal bases:

• Contract Performance: Processing necessary to fulfil our contractual obligations to you under our Terms & Conditions, including account management, payment processing, and service delivery.
• Legal Obligation: Processing required to comply with applicable laws and our licensing obligations, including KYC, AML screening, and age verification.
• Legitimate Interests: Processing for fraud prevention, platform security, responsible gambling monitoring, and internal analytics — where our legitimate interests are not overridden by your data protection rights.
• Consent: Where we send you optional marketing communications or place non-essential cookies on your device. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

7. Data Sharing & Disclosure

Padangtoto does not sell your Personal Data. We may share your data with the following categories of recipients, strictly for the purposes outlined in this Policy:

• Payment Service Providers: Banks, e-wallet operators, and payment processors (including those facilitating Maybank, CIMB, DuitNow, FPX, Touch 'n Go eWallet, Boost, and GrabPay transactions) necessary to process deposits and withdrawals.
• Identity & Fraud Verification Providers: Third-party KYC and AML screening services that assist us in verifying player identity and detecting prohibited activity.
• Game Providers & Platform Technology Vendors: Software providers and platform operators who supply game content and infrastructure used to deliver our Services, subject to contractual data protection obligations.
• Regulatory & Licensing Authorities: Our licensing body and other competent regulatory authorities, where disclosure is required under the terms of our licence or by law.
• Law Enforcement & Government Agencies: Where Padangtoto is subject to a lawful order, subpoena, court order, or legal obligation requiring disclosure of personal data.
• Professional Advisors: Lawyers, accountants, auditors, and insurers engaged by Padangtoto, subject to confidentiality obligations.

All third-party Data Processors engaged by Padangtoto are required to implement appropriate technical and organisational security measures and to process data only in accordance with our written instructions.

8. Data Retention

Padangtoto retains Personal Data for as long as necessary to fulfil the purposes for which it was collected, including compliance with legal, regulatory, and licensing obligations.

In general, account data and transaction records are retained for a minimum of five (5) years following account closure, consistent with standard AML record-keeping requirements applicable to licensed gaming operators. KYC documentation is retained for the same minimum period.

Where you exercise your right to erasure (see Section 11), Padangtoto will delete or anonymise your Personal Data to the extent permitted by law. Data that must be retained for legal or regulatory compliance purposes will be held for the minimum required period before deletion.

9. Data Security

Padangtoto implements a range of technical and organisational measures to protect your Personal Data from unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and our servers
• Encryption of sensitive data at rest, including financial information and identity documents
• Access controls restricting Personal Data access to authorised personnel only, on a need-to-know basis
• Regular security assessments and penetration testing of platform infrastructure
• Staff training on data handling and privacy obligations
• Incident response procedures for managing and reporting data security breaches

10. Cookies & Tracking Technologies

Padangtoto uses cookies and similar technologies (including web beacons and local storage) to operate and improve the platform. The following categories of cookies may be used:

• Strictly Necessary Cookies: Essential for the platform to function correctly. These cannot be disabled. They include session authentication cookies and security tokens.
• Performance & Analytics Cookies: Used to understand how players use the platform, which pages are visited most frequently, and how users navigate between sections. This data is aggregated and anonymised.
• Functional Cookies: Used to remember your preferences (such as language and display settings) to improve your experience across sessions.
• Marketing Cookies: Used (with your consent) to deliver relevant promotional content and track the effectiveness of our marketing activities.

You may manage or disable non-essential cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the Padangtoto platform.

11. Your Data Rights

Subject to applicable law and our licensing obligations, you have the following rights with respect to your Personal Data held by Padangtoto:

To exercise any of these rights, please contact us using the details in Section 15. We will respond within thirty (30) days of receiving your request, which may be extended by a further two (2) months in complex cases. We may need to verify your identity before processing your request.

12. Protection of Minors

Padangtoto does not knowingly collect Personal Data from individuals under the age of 21. Our platform is strictly intended for adults aged 21 years and above. As part of our KYC process, we verify the age of all registered users before permitting withdrawals or continued platform access.

If we become aware that Personal Data has been collected from an individual under the age of 21, we will take prompt steps to delete that data and close the associated account. If you believe a minor has registered on Padangtoto, please contact us immediately at the address provided in Section 15.

13. International Data Transfers

As an internationally licensed platform serving players including those in Malaysia, Padangtoto may transfer your Personal Data to servers or service providers located outside of Malaysia. Where such transfers occur, we take steps to ensure that your data receives an adequate level of protection, including through contractual data protection agreements with our third-party processors that reflect applicable data protection standards.

By using the Padangtoto platform, you acknowledge that your Personal Data may be transferred to and processed in jurisdictions outside Malaysia, including jurisdictions that may have data protection laws different from those in Malaysia.

14. Amendments to This Policy

Padangtoto reserves the right to update this Privacy Policy at any time. Where changes are material, we will provide reasonable prior notice through in-platform notification or email. The "Effective Date" at the top of this page reflects when the current version came into force.

We encourage you to review this Policy periodically. Your continued use of the platform following any updates constitutes your acceptance of the revised Policy.

15. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way in which Padangtoto processes your Personal Data, please contact our Data Privacy team using the details below:

This Privacy Policy is provided for informational purposes in connection with your use of the Padangtoto platform. Nothing herein constitutes legal advice. Padangtoto operates under international online gaming licensing. Malaysian users seeking specific legal guidance regarding data privacy rights should consult a qualified legal professional.