Privacy Policy Dumaitoto — Personal Data Protection for Malaysian Players

1 Introduction

Dumaitoto ("we", "Platform") deeply respects the privacy of every user who registers and uses our services. This Privacy Policy is provided to ensure you have a clear understanding of what data we collect, why we need it, how we use it and the rights you hold over that data.

We operate in compliance with Malaysia's Personal Data Protection Act 2010 (PDPA) and international data protection best practices. Privacy is not merely a legal obligation for us — it is a reflection of the trust you place in dumaitoto every time you log in and play.

If you ever have questions about how we handle your data, our customer support team is available via live chat 24 hours a day, 7 days a week.

2 Personal Data We Collect

We only collect data that is strictly necessary to provide a safe, seamless service and to meet legal compliance requirements. Below is a summary of the types of data we collect:

2.1 Data We Do Not Collect

We do not collect sensitive information such as biometric data, political affiliations, or religious beliefs unless specifically required by law. We also do not store full credit or debit card numbers — any card processing is handled directly by PCI-DSS certified third-party payment providers.

3 How We Use Your Data

Every piece of data we collect is used for a clear and legitimate purpose. We do not use your data for any purpose beyond what is stated here without obtaining additional consent from you:

• Account Management: Securely creating, verifying, and managing your player account
• Payment Processing: Processing deposits and withdrawals accurately and efficiently through your preferred payment methods
• KYC/AML Compliance: Meeting Know Your Customer (KYC) and anti-money laundering (AML) legal requirements
• Platform Security: Detecting and preventing fraud, multi-account use, and suspicious activity that could affect other players
• Service Improvement: Analysing usage patterns in aggregate (without identifying individuals) to improve the gaming experience
• Service Communications: Sending important notifications related to your account, transactions, and security updates
• Customer Support: Resolving enquiries, complaints, and technical issues you report to us
• Responsible Gaming: Monitoring gameplay patterns to identify signs of problem gambling and offer appropriate assistance

4 Data Sharing With Third Parties

We do not sell or rent your personal data. However, in the course of operating the platform, we may share data with selected third parties in the following limited circumstances:

4.1 Authorised Service Providers

• Payment Providers: DuitNow, FPX, eWallet providers and card processors that require transaction data to process your payments
• Game Providers: Third-party game developers who need to verify player eligibility and process game results
• KYC Services: Third-party identity verification providers that help us securely verify documents
• Cloud Infrastructure: Hosting and database providers that store your data in a protected environment

4.2 Legal Obligations

We may disclose your personal data to government authorities or law enforcement agencies when required by court order, law, or direction from a competent authority. In such situations, we will endeavour to notify you in advance if legally permitted to do so.

4.3 Partner Protection

All third parties with whom we share your data must sign strict data processing agreements and comply with security standards equal to or exceeding our own. We regularly audit our partners' compliance with these privacy requirements.

5 Data Security

We invest seriously in security infrastructure to ensure your data is always protected. The technical and organisational security measures we implement include:

• Encryption of Data in Transit: All communications between your device and our servers are secured by TLS 1.3 — the latest and most secure encryption protocol available
• Encryption of Data at Rest: Sensitive data such as financial information is encrypted using AES-256 at rest in the database
• Layered Access Control: Access to user data is restricted based on the principle of least privilege — staff can only access data required for their specific role
• Two-Factor Authentication (2FA): Available and recommended for all user accounts as an added layer of security
• 24/7 Monitoring: Automated monitoring systems run around the clock to detect suspicious activity or intrusion attempts
• Regular Security Audits: Penetration testing and security audits conducted regularly by independent third parties
• Incident Response Plan: A comprehensive security incident response procedure is in place and tested on a regular basis

6 Cookies and Tracking Technologies

Dumaitoto uses cookies and similar tracking technologies to enhance your experience on our platform. The following are the types of cookies we use:

6.1 Essential Cookies

These cookies are required for the platform's core functions such as login authentication, session security and account preferences. Without them, the platform will not function properly and they cannot be disabled.

6.2 Performance Cookies

These cookies collect information about how you use our platform — which pages you visit, how long you spend there and any errors encountered. All information is collected in aggregate form without personally identifying you.

6.3 Functional Cookies

These cookies allow the platform to remember your preferences such as language, preferred currency and display settings, providing a more personalised experience on future visits.

6.4 Managing Cookies

You can control and delete cookies through your web browser settings. Please note that disabling certain cookies may affect the functionality of some areas of our platform. More information on managing cookies can be found in your browser's help documentation.

7 Your Rights Over Personal Data

Under Malaysia's PDPA and our own policies, you have the following rights regarding your personal data at dumaitoto:

8 Data Retention Period

We retain your personal data only for as long as necessary for the purposes stated in this policy or as required by law. General retention periods are as follows:

• Active Account Data: Retained for the duration your account remains active on our platform
• Data After Account Closure: Basic account information is retained for 5 years after account closure to comply with legal and anti-money laundering requirements
• Financial Transaction Records: Retained for 7 years in line with financial reporting and tax legislation requirements
• Support Communication Logs: Retained for 2 years for reference purposes and service improvement
• Technical Log Data: Retained for 90 days for security purposes and technical troubleshooting

Once the retention period expires, data will be securely deleted or anonymised so it can no longer be linked to any individual.

9 Cross-Border Data Transfers

As part of our global operations, your personal data may be transferred to and stored on servers located outside Malaysia. When this occurs, we ensure protection equivalent to that provided in Malaysia through the following measures:

• Use of approved standard contractual clauses for international data transfers
• Transfers only to countries or organisations with adequate data protection standards
• Binding data processing agreements with all data recipients outside the country
• Data protection impact assessments are completed before any new data transfer is approved

10 Children's Privacy

The dumaitoto platform is exclusively for individuals aged 18 and above. We do not intentionally collect any personal data from individuals under the age of 18. If we discover that a child's data has been collected without proper age verification, we will promptly delete that data and close the account in question.

If you are a parent or guardian and believe your underage child has registered an account on our platform, please contact us immediately so we can take the appropriate action.

11 Changes to This Privacy Policy

Dumaitoto reserves the right to update this Privacy Policy from time to time to reflect changes in our practices, legal requirements or technological developments. When material changes are made, we will:

• Updating the "Last Updated" date at the top of this page
• Displaying a clear notice on the platform regarding such changes
• Sending email notifications to all registered users when changes are significant

We encourage you to review this page periodically to stay informed about how we protect your information. Continued use of the platform after any changes take effect will be considered acceptance of the updated policy.

12 Contact Us About Privacy

If you have any questions, concerns, or complaints about how we handle your personal data, we encourage you to reach out to us directly. Our Data Protection Officer team is ready to assist:

• Live Chat: Available 24/7 on the dumaitoto platform — the fastest way to get a response
• Email: [email protected] — for written enquiries requiring documentation
• Response Time: We are committed to responding to all privacy enquiries within 3 business days

If you are not satisfied with our response, you have the right to lodge a complaint with the Malaysia Personal Data Protection Department or the relevant data protection authority in your jurisdiction.