Exototo is committed to protecting the privacy and personal data of every Malaysian player on our platform. This policy explains exactly what we collect, why we collect it, how it is used, and the rights you hold over your own information.
Six principles that govern how Exototo handles your personal data — always in line with responsible data practices.
All personal and financial data is encrypted at rest and in transit using 256-bit SSL/TLS protocols. Your information is never stored in plain text on our systems.
Exototo does not sell, rent, or trade your personal data to third-party marketers. Your data is used solely to operate and improve the Exototo service.
You have the right to access, correct, and request deletion of your personal data at any time by contacting our support team.
Every instance of data processing by Exototo is carried out on a clear and documented legal basis — consent, contractual necessity, or legitimate interest.
We do not hold your data indefinitely. Retention periods are defined by purpose and legal obligation — and data is securely deleted or anonymised when no longer required.
We collect only the data necessary to deliver and improve the Exototo service. We do not collect data speculatively or for purposes beyond those stated in this policy.
This Privacy Policy ("Policy") describes how Exototo ("we", "us", "our", "the Platform") collects, uses, stores, and protects personal data provided by or collected from users ("Members", "Players", "you") of the website located at https://exototo.cam and all associated products and services.
Exototo recognises that the protection of personal data is a responsibility we take seriously. We are committed to handling all personal information in a manner that respects your privacy and complies with applicable data protection principles. This Policy has been written in plain, accessible English so that every Malaysian player on our platform can clearly understand their rights and our obligations.
By registering an Account on Exototo, or by continuing to use the Platform after the effective date of this Policy, you acknowledge that you have read and understood this Policy and consent to the collection and use of your personal data as described herein.
This Policy should be read in conjunction with our Terms & Conditions, which govern the overall use of the Exototo Platform.
The following defined terms are used throughout this Policy:
| Term | Meaning |
|---|---|
| Personal Data | Any information that identifies or can be used to identify a natural person, directly or indirectly — including name, identification number, contact details, location data, and online identifiers. |
| Processing | Any operation performed on personal data, including collection, recording, storage, use, disclosure, erasure, or destruction — whether automated or manual. |
| Data Controller | The party that determines the purposes and means of processing personal data. For data collected on this Platform, Exototo acts as the Data Controller. |
| Data Processor | A third party that processes personal data on behalf of Exototo, under contractual obligation and Exototo's instructions. |
| Consent | A freely given, specific, informed, and unambiguous indication of agreement to the processing of personal data for a defined purpose. |
| Cookie | A small text file placed on a user's device by a website to store session and preference information. |
| KYC | Know Your Customer — the identity verification procedure used to confirm a Member's identity, age, and eligibility to use the Platform. |
Exototo collects personal data across several categories, depending on the nature of your interaction with the Platform. The categories of data we may collect are as follows:
Personal data is collected through the following channels and mechanisms:
Exototo processes personal data only where a valid legal basis exists. The following table outlines the primary legal bases applicable to our processing activities:
Exototo uses the personal data we collect for the following purposes:
Exototo does not sell or rent your personal data to third parties. We may share your data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection agreements:
Financial data is shared with payment processors such as DuitNow, FPX operators, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and Hong Leong solely for the purpose of processing transactions. These providers operate under their own privacy frameworks and applicable Malaysian financial regulations.
Where a third-party KYC or identity verification service is used, relevant identity documents and data are shared with that provider solely for the purpose of verifying your identity and age. These providers are contractually bound to use your data only for verification purposes.
Exototo engages trusted third-party service providers for hosting, data storage, cybersecurity, analytics, and customer support tooling. These providers act as Data Processors under contract with Exototo and are prohibited from using your data for any purpose other than providing the contracted service.
Exototo will disclose personal data to law enforcement agencies, regulatory bodies, or courts where required to do so by applicable law, valid legal process, or where disclosure is necessary to protect the safety of our Members or the integrity of the Platform.
In the event of a merger, acquisition, or sale of all or a material part of Exototo's assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and of any changes to this Privacy Policy that may result from it.
Exototo retains personal data for no longer than is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following general retention periods apply:
Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be associated with any identifiable individual.
The Exototo Platform uses cookies and similar tracking technologies to enhance your experience, maintain session state, and gather usage analytics. The following categories of cookies are used:
These cookies are essential for the Platform to function. They enable core features such as user authentication, session management, and security controls. These cookies cannot be disabled without materially impairing your ability to use the Platform.
These cookies collect anonymised data about how Members interact with the Platform — including pages visited, time spent on pages, and error events. This data is used to improve Platform performance and user experience. No personally identifiable information is collected via these cookies.
These cookies remember your preferences — such as language settings, preferred deposit method, and display preferences — so that we can provide a more personalised experience on your return visits.
You may configure your browser to block or delete cookies at any time. Please note that disabling strictly necessary cookies will prevent you from logging in to your Exototo Account. Instructions for managing cookies are available through your browser's help documentation.
Exototo implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These measures include, but are not limited to:
While Exototo takes all reasonable precautions to protect your personal data, no online system can guarantee absolute security. You are responsible for maintaining the confidentiality of your Account credentials and for notifying Exototo immediately if you suspect any unauthorised access to your Account.
As a Member of Exototo, you hold the following rights with respect to your personal data. To exercise any of these rights, please contact our support team as described in Section 14.
Exototo will respond to all valid data subject requests within 30 days. We may need to verify your identity before processing your request. If we are unable to comply with a request — for example, due to a conflicting legal obligation — we will explain why in our response.
The Exototo Platform is strictly for individuals who are 21 years of age or older. We do not knowingly collect personal data from anyone under the age of 21. Age verification is conducted as part of the account registration and KYC process.
If Exototo discovers that personal data has been collected from a person under the age of 21, that data will be deleted immediately and the Account closed. Parents and guardians who become aware that a minor has accessed the Exototo Platform should contact our support team immediately so that the relevant Account can be closed and data removed.
Exototo reserves the right to update or revise this Privacy Policy at any time to reflect changes in our practices, legal requirements, or the services we offer. When material changes are made, we will provide advance notice to registered Members by email and/or by posting a prominent notice on the Platform prior to the changes taking effect.
The "Effective Date" at the top of this Policy will always reflect the date of the most recent update. We encourage you to review this Policy periodically to stay informed about how we protect your personal data.
Your continued use of the Exototo Platform following the notification of any changes constitutes your acceptance of the revised Privacy Policy. If you do not agree to any change, you should stop using the Platform and contact our support team to close your Account.
If you have any questions, concerns, or requests relating to this Privacy Policy or the way Exototo handles your personal data, please contact our support team using the details below. All contact information is provided as plain text — not as clickable links.
For responsible gambling support and self-exclusion requests, please visit our Responsible Gambling page. For the full terms governing your use of the Platform, please refer to our Terms & Conditions.
Have a question about how your data is handled? Our support team is available 24/7 and responds in under 90 seconds via live chat. You can also visit our FAQ for quick answers to common privacy questions.