Privacy Policy

This Privacy Policy ("Policy") is issued by Pulitoto ("we", "us", "our", "the Platform") and governs the collection, use, storage, disclosure, and protection of personal data belonging to users ("you", "User", "Player") of the Pulitoto online gaming and sports betting platform accessible at pulitoto.cam.

We are committed to handling your personal data with integrity, transparency, and care. This Policy is designed to give you a complete and honest picture of our data practices so you can make informed decisions about your use of the Platform. By registering an account or accessing our services, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data in accordance with its terms.

This Policy applies to all personal data collected through the Platform, including through our website, mobile-optimised site, customer support interactions, and any associated communications. It should be read alongside our Terms & Conditions and Responsible Gambling Policy, which together form the full agreement governing your use of Pulitoto.

For the purposes of this Policy, the following definitions shall apply:

• "Personal Data" means any information that identifies or could reasonably be used to identify you as an individual, directly or indirectly.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, alteration, and deletion.
• "Data Controller" means Pulitoto, as the entity that determines the purposes and means of processing your personal data.
• "Data Processor" means any third party that processes personal data on behalf of Pulitoto under a contractual agreement and according to our instructions.
• "Consent" means a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your personal data for a stated purpose.
• "KYC Data" means identity and address verification documents submitted by you during the Know Your Customer process, including Malaysian IC (MyKad), Passport, Driver's Licence, and proof of address.
• "Cookies" means small text files placed on your device by the Platform to maintain session state, preferences, and anonymous usage analytics.

Pulitoto collects personal data through several channels. The categories of data we collect, and the circumstances in which each category arises, are set out in the table below:

We do not collect special categories of sensitive personal data (such as health data, religious beliefs, or political opinions) except where you voluntarily disclose such information in the context of a responsible gambling interaction — for example, when requesting self-exclusion or citing a gambling-related health concern.

We process your personal data for the following clearly defined purposes:

• Account creation and management: To register, maintain, and administer your Pulitoto account, including updating account details and managing login security.
• Identity and age verification: To confirm that you are aged 21 or above and that your identity matches the details provided during registration, in compliance with our KYC obligations.
• Payment processing: To facilitate deposits and withdrawals via your chosen Malaysian payment method, and to match payment sources to your account for fraud prevention purposes.
• Gaming and betting services: To deliver, record, and settle your bets and game sessions accurately and in accordance with the applicable game and sports betting rules.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, money laundering, collusion, underage access, and other security threats.
• Regulatory compliance: To meet our obligations under applicable anti-money laundering (AML), responsible gambling, and data protection regulations.
• Customer support: To respond to your enquiries, resolve disputes, and maintain records of support interactions for quality assurance.
• Responsible gambling: To monitor playing patterns, apply player-requested limits, and proactively contact players who show signs of harmful gambling behaviour.
• Platform improvement: To analyse aggregated, anonymised usage data in order to improve platform performance, game selection, and user experience.
• Marketing communications: To send you promotional offers, bonus notifications, and platform updates — but only where you have opted in to receive such communications.

Each instance of data processing at Pulitoto is grounded in one or more of the following legal bases:

• Contractual necessity: Processing required to perform the contract between you and Pulitoto — including account management, payment processing, and game settlement — is lawful as a necessary element of that contract.
• Legal obligation: Processing required to comply with applicable law, including KYC identity verification, AML screening, age verification, and responsible gambling obligations.
• Legitimate interests: Processing carried out to pursue our legitimate interests in fraud prevention, platform security, and service improvement, provided such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing of your data for optional purposes — most notably, the sending of marketing and promotional communications — is conducted solely on the basis of your explicit, revocable consent. You may withdraw this consent at any time via your account settings without affecting the lawfulness of prior processing.

Pulitoto does not sell, rent, or trade your personal data to any third party. We share personal data only in the following limited and controlled circumstances:

• Payment service providers: We share the minimum data necessary with payment processors — including the operators of Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, and cryptocurrency network validators — to process your deposits and withdrawals securely.
• KYC and identity verification providers: We may use third-party identity verification services to conduct document authentication and facial verification checks as part of our KYC process. These providers process your data strictly under our instruction and are prohibited from using it for any other purpose.
• Game studio providers: Licensed game studios and sports data providers receive session-level data (such as bet amounts and game outcomes) necessary to deliver and settle game results. They do not receive personally identifiable information such as your name or contact details.
• Customer support platforms: Our live chat and ticketing infrastructure is operated by a third-party provider that processes support communication data on our behalf.
• Regulatory and law enforcement authorities: We will disclose personal data to competent authorities — including financial regulatory bodies and law enforcement agencies — where required by law, legal process, or court order. We will notify you of such disclosure where legally permitted to do so.
• Business successors: In the event of a merger, acquisition, or sale of the Platform or its assets, personal data may be transferred to the acquiring entity, subject to equivalent data protection commitments.

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply as a general guide:

• Account data and transaction records: Retained for a minimum of five (5) years from the date of your last account activity or account closure, to comply with our AML and financial record-keeping obligations.
• KYC documents: Retained for a minimum of five (5) years from the date of verification, or longer where required by applicable regulatory guidance.
• Customer support communications: Retained for up to three (3) years from the date of the interaction for quality assurance and dispute resolution purposes.
• Marketing preference records: Retained for the duration of your account. Consent records (opt-in timestamps) are retained for a minimum of three (3) years as evidence of lawful processing.
• Technical and session data: Retained in identifiable form for up to twelve (12) months, after which it is anonymised or deleted.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that makes re-identification impossible.

The Pulitoto platform uses cookies and similar tracking technologies to ensure the Platform operates correctly and to deliver a consistent experience across visits. We use the following categories of cookies:

• Strictly necessary cookies: Essential for the Platform to function. These include session cookies that maintain your logged-in state and security tokens that protect against cross-site request forgery. These cannot be disabled without impairing Platform functionality.
• Performance cookies: Used to collect anonymised, aggregated information about how Players use the Platform — such as page visit frequency and error rates — to help us improve performance. No personal identity is associated with this data.
• Functional cookies: Used to remember your preferences — such as language settings and responsible gambling limit configurations — so you do not need to re-enter them on each visit.

We do not use third-party advertising cookies, cross-site tracking cookies, or social media tracking pixels. Your Platform activity is not shared with external advertising networks.

You can manage or delete cookies through your browser settings at any time. Note that disabling strictly necessary cookies will prevent you from accessing the Platform and may impair the functionality of payment and gaming features.

Pulitoto implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and our servers.
• Encryption at rest for all sensitive personal data and KYC documents stored in our systems.
• Two-factor authentication (2FA) available for all accounts, and mandatory for withdrawal transactions above defined thresholds.
• Role-based access controls ensuring that only authorised personnel with a documented operational need can access personal data.
• Continuous monitoring of system activity for anomalous patterns indicative of a breach or unauthorised access attempt.
• Regular security assessments including vulnerability scanning and penetration testing of platform infrastructure.
• Data breach response procedures in place to notify affected users and relevant authorities within required timeframes in the event of a confirmed data breach.

You also play a role in keeping your account secure. You must maintain the confidentiality of your login credentials and must not share your password with any third party. Pulitoto will never ask for your password via email, live chat, or any external channel. If you suspect your account has been compromised, contact our support team immediately.

Subject to applicable data protection law and certain legal exceptions, you hold the following rights in relation to your personal data held by Pulitoto:

• Right of Access: You may request a copy of the personal data we hold about you, together with information about how it is being used.
• Right to Rectification: If your personal data is inaccurate or incomplete, you may request that we correct or update it without undue delay.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to our overriding legal obligations to retain certain records.
• Right to Restriction of Processing: You may request that we limit the processing of your data — for example, while a rectification request is being assessed.
• Right to Data Portability: You may request that we provide your personal data in a structured, commonly used, machine-readable format for transfer to another service provider, where technically feasible.
• Right to Object: You may object to the processing of your personal data on the basis of our legitimate interests, or to the use of your data for direct marketing purposes at any time.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, please contact our customer support team via live chat on the Platform or at the email address provided in Section 15 of this Policy. We will respond to all verified requests within 30 days, or earlier where feasible.

Pulitoto strictly prohibits access to or use of the Platform by any person under 21 years of age. We do not knowingly collect, store, or process personal data from individuals under 21. Our age verification procedures — including KYC document checks — are specifically designed to identify and reject underage registration attempts.

If we become aware that we have inadvertently collected personal data from a person under 21 years of age, we will take immediate steps to delete that data, suspend the associated account, and void any transactions processed during the period of underage access.

The Pulitoto platform does not contain links to external third-party websites as part of its standard navigation. However, where third-party game content or services are embedded within the Platform (such as live dealer studio streams or sports data feeds), those providers operate under separate contractual arrangements with Pulitoto and are prohibited from collecting your personally identifiable data independently.

Pulitoto is not responsible for the privacy practices of any third-party service whose content appears within the Platform's gaming environment. If you have concerns about the data practices of a specific game provider, please contact our support team and we will clarify the arrangement applicable to that provider.

Pulitoto operates as an international online gaming platform. As a result, your personal data may be processed and stored on servers or by service providers located outside Malaysia. Where such transfers occur, we take appropriate steps to ensure your data is afforded an equivalent level of protection to that which it would receive in Malaysia, including:

• Requiring all data processors in other jurisdictions to be bound by contractual data protection obligations consistent with the standards set out in this Policy.
• Transferring data only to jurisdictions or entities that maintain recognised data protection frameworks or which have been assessed as providing adequate protection by our compliance team.
• Maintaining the same encryption and access control standards across all processing locations regardless of geography.

Pulitoto reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform functionality. When material changes are made, we will update the "Last Updated" date at the top of this page and, where appropriate, notify registered Players via their registered email address or an in-platform notification.

Your continued use of the Platform following the publication of a revised Privacy Policy constitutes your acknowledgement of the updated terms. We strongly recommend that you review this Policy periodically. The current version of this Policy is always available at pulitoto.cam/privacy-policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact our Data Protection team using the details below. We are committed to responding to all privacy-related enquiries within five (5) business days.

For guidance on the responsible gambling tools available on the Platform, including deposit limits, loss limits, and self-exclusion, please visit our Responsible Gambling page.