Bobatoto Privacy Policy – Data Protection for Malaysian Players

Welcome to the bobatoto Privacy Policy. This document is published by bobatoto ("we", "the platform", or "bobatoto"), the operator of an online entertainment platform accessible at bobatoto.im, and applies to all registered members and visitors of our website.

We understand that the trust of Malaysian players is the foundation of everything we do. When you register an account, make a deposit via DuitNow or FPX, play online slots, join a live casino table, or place a bet on a Malaysia Super League or EPL match — you are entrusting us with your personal information. We do not take that responsibility lightly.

This Privacy Policy explains:

• The types of personal information we collect from you.
• How we use that information to operate and improve the bobatoto platform.
• Who we may disclose your information to, under the limited circumstances defined.
• How we protect your information from unauthorised access.
• Your rights regarding your personal data and how to exercise them.

Bobatoto collects your personal information through various means when you use our platform. The types of data collected are as set out in the table below:

We only collect data that is genuinely necessary for the stated purposes. bobatoto does not collect sensitive personal information such as health data unless you voluntarily provide it in the context of our responsible gambling programme.

The personal information we collect is used solely for legitimate and transparent purposes. Bobatoto uses your data for the following:

• Account Management: Creating and maintaining your bobatoto account, verifying your identity through the KYC process, and enabling you to log in securely.
• Transaction Processing: Processing your deposits via DuitNow, FPX (Maybank2u, CIMB Clicks), Touch 'n Go eWallet, GrabPay, Boost, or ShopeePay, and processing withdrawals to your Malaysian bank account.
• Service Delivery: Enabling you to access all games and services on the bobatoto platform, including online slots, Live Casino, Jackpot, and Sports Betting.
• Security & Fraud Prevention: Detecting and preventing fraudulent activity, money laundering, account abuse, and any security threats to the platform and other users.
• Legal Compliance: Fulfilling our obligations under Malaysian law, including the PDPA 2010 and applicable financial compliance requirements.
• Customer Support: Responding to enquiries and resolving issues you report via live chat, email, or Telegram.
• Platform Improvement: Analysing aggregated, anonymised usage patterns to improve the design, speed, and functionality of the bobatoto platform.
• Service-Related Communications: Sends important notifications about your account, changes to our terms, or security issues that require your attention.
• Responsible Gaming Program: Monitoring gaming patterns and identifying signs of problem gambling for support and protection purposes.

Bobatoto does not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes. Full stop. That said, in the course of operating the platform safely and in accordance with the law, there are limited circumstances in which we may share your information:

• Payment Providers: To process deposit and withdrawal transactions, the required data is shared with payment providers such as Malaysian banks (for FPX), DuitNow, and e-wallet operators (Touch 'n Go, GrabPay, Boost, ShopeePay). This sharing is kept to a minimum and is solely for transaction processing purposes.
• Game Providers: To enable you to play games from specific providers, the required session information is shared with those providers. These providers are bound by strict data protection agreements with bobatoto.
• Security Services: We use third-party services for identity verification (KYC), fraud detection, and cybersecurity. All these providers are audited and must comply with our data security standards.
• Malaysian Authorities: Where required by law, court order, or a valid request from a Malaysian law enforcement agency, we will disclose the necessary information. We will notify you as far as reasonably possible if such a situation arises, unless prohibited from doing so by law.
• Business Transfers: If bobatoto is involved in a merger, acquisition, or asset sale, user data may be transferred as part of that transaction. You will be notified before this takes place and will have the right to delete your account prior to the transfer.

All third parties who receive your personal data from bobatoto are bound by confidentiality agreements and are prohibited from using that information for any purpose other than what is specified in their agreement with us.

Bobatoto invests seriously in security infrastructure to protect your data. The technical and organisational measures we have implemented include:

• 256-bit SSL Encryption: All data transmitted between your device and bobatoto's servers is encrypted using TLS protocol with a 256-bit key length. This means that even if someone were to intercept your connection, they would be unable to read its contents.
• Stored Data Encryption: Sensitive data such as passwords and financial details are stored in our database using additional encryption — not in plain readable text format.
• Strict Access Controls: Only bobatoto staff who genuinely require access to specific data to carry out their duties are permitted to do so. Every access is logged and audited on a regular basis.
• 24/7 Monitoring: Our systems are continuously monitored to detect any unusual activity, intrusion attempts, or suspicious access patterns.
• Regular Security Testing: We conduct regular penetration testing and vulnerability assessments to identify and remediate any security weaknesses before they can be exploited.
• Fund Segregation: Funds deposited by bobatoto players are held in accounts fully segregated from the company's operational accounts, with regular reconciliation checks.

Bobatoto retains your personal data only for as long as necessary for the purposes stated in this policy or as required by Malaysian law. Our data retention guidelines are:

• Active Account Data: For as long as your bobatoto account remains active, we retain all profile data, transaction records, and gaming records necessary to operate the service.
• Financial Records: Deposit and withdrawal transaction records are retained for a minimum of 7 years after a transaction, in line with financial record-keeping requirements under Malaysian law.
• KYC Data: Identity verification documents are retained for a minimum of 5 years after the account closure date, in order to meet anti-money laundering (AML) compliance requirements.
• System Logs: Technical logs such as IP addresses and session timestamps are retained for 12 months for security purposes and incident investigations.
• Customer Service Records: Customer support interaction records are retained for 3 years to allow us to provide consistent service and resolve any disputes that may arise at a later stage.
• Closed Account Data: Following account closure, data that is no longer required for legal or compliance purposes will be deleted or anonymised within 90 days.

When data is no longer needed and the mandatory retention period has lapsed, bobatoto will delete or anonymise that data securely and irreversibly.

Under Malaysia's Personal Data Protection Act 2010 (PDPA) and bobatoto's privacy policy, you have the following rights regarding your personal data:

To exercise any of the above rights, you may contact the bobatoto support team via live chat or email us at support@bobatoto.im, or via our official Telegram. We will process your request within 14 business days. In complex cases, we may require up to 30 days, and we will keep you updated on progress should this occur.

The bobatoto platform uses cookies and similar tracking technologies to enable essential platform functions, enhance the user experience, and analyse usage patterns. The types of cookies we use are:

• Essential Cookies: Required for core platform functions such as login, navigation, and transaction processing. The bobatoto platform cannot function properly without these cookies.
• Session & Authentication Cookies: Keeps you logged in so you do not have to sign in again each time you open a new page. This cookie expires when you close your browser or log out.
• Analytics Cookies: Collects anonymised data on how players use the platform — the most frequently visited pages, most popular games, and navigation patterns. This data helps us improve the bobatoto platform for all Malaysian players.
• User Preference Cookies: Saves your preferences — such as interface language and display settings — so you don't have to reconfigure them at the start of every session.
• Security Cookies: Helps detect suspicious activity and protects your account from unauthorized access and CSRF attacks.

You can manage cookies through your web browser settings. However, disabling essential cookies may affect your ability to fully use the bobatoto platform. For more information on managing cookies in popular browsers (Chrome, Firefox, Safari), refer to your browser's help section.

The bobatoto platform is an adult service designed exclusively for Malaysian citizens aged 18 years of age and above. We do not knowingly collect, process, or store any personal information from individuals under the age of 18.

We take active steps to prevent minors from accessing the platform:

• Age verification during account registration, which requires your date of birth.
• A KYC process that verifies identity documents to confirm that players are of legal age.
• Continuous monitoring to detect accounts that may have been registered by or on behalf of minors.

Bobatoto reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our privacy practices, new legal requirements, or developments in the services we offer to Malaysian players.

When we make material changes to this Privacy Policy:

• The "Updated" date at the top of this document will be revised to reflect the date of the most recent change.
• For significant changes, we will notify members via their registered email and/or display a prominent notice on the bobatoto platform.
• For minor changes that do not affect your fundamental rights, an update to the document date serves as sufficient notice.
• Your continued use of the bobatoto platform after notice of any changes will be considered your acceptance of the updated Privacy Policy.

We encourage you to review this Privacy Policy periodically. Previous versions of the bobatoto Privacy Policy are available upon request by contacting our support team.

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way bobatoto handles your personal data, please contact us through the following channels:

• Email: support@bobatoto.im (use the subject line "Privacy Enquiry – [Your Account Number]")
• Live Chat: Available 24/7 on the bobatoto platform (response within 2–5 minutes)
• Telegram: bobatoto's official support channels (check the platform for the latest links)

Our support team operates in both Bahasa Malaysia and English, 24 hours a day, 7 days a week including Malaysian public holidays. We are committed to responding to all privacy-related enquiries within 5 business days.

If you are not satisfied with our response after contacting bobatoto, you have the right to lodge a complaint with the Malaysian Communications and Multimedia Commission (MCMC) or the relevant data protection authority in Malaysia.

In today's digital world, personal data is an extremely valuable asset. When you register an account on any online platform — including bobatoto — you share some of your personal information. You have every right to know exactly how that information is used, protected, and shared.

In Malaysia, awareness around data privacy has been growing steadily, particularly in the wake of various data breach incidents reported in recent years. Malaysian players using online entertainment platforms like bobatoto have every right to demand transparency and robust protection. That is why bobatoto has invested seriously in security infrastructure and built a truly comprehensive privacy policy — not merely to satisfy legal requirements, but because we believe it is simply the right thing to do.

When you use Touch 'n Go eWallet, GrabPay, or DuitNow to deposit funds into your bobatoto account, the transaction involves sensitive financial information. The 256-bit SSL encryption we use ensures this information cannot be intercepted in transit between your device and our servers. This is not just a technical statement — it means that anyone who manages to intercept your internet traffic will be unable to read or make use of that data.

One question Malaysian players frequently ask is about their gaming records. Can others see that they play online slots or bet on EPL matches? The answer is no — gaming records at bobatoto are genuinely confidential information. They are not shared with any third party without your consent, are not used for any purpose beyond operating the service, and are protected by strict access controls within our systems. Only specific employees who require access for customer support or authorised investigations are permitted to view these records, and every instance of such access is logged and audited.

Another important aspect is your right to access and control your own data. Unlike some platforms that make this process unnecessarily difficult, bobatoto is committed to processing your data access requests within 14 business days. If you want to know what we hold about you, request a correction of inaccurate information, or wish to delete your data after closing your account — the process is available through our customer support team, which operates 24/7 in Bahasa Melayu.

Bobatoto's responsible gambling programme also has an important privacy dimension. When you use self-control tools such as deposit limits or temporary breaks, your usage records for these tools are kept strictly confidential. We use this information solely for player support purposes and do not share it with any party. Our goal is to ensure every Malaysian player can enjoy entertainment on the bobatoto platform in a way that is safe, responsible, and with their privacy fully protected.

Finally, we want to emphasize that the bobatoto Privacy Policy is a living document that will continue to be updated in line with developments in law, technology, and industry best practices. We are committed to keeping you informed of any material changes and to maintaining high privacy standards across all aspects of our operations. Your trust is not something we take lightly — and protecting your privacy is one of the most tangible ways we demonstrate that your trust is well placed.