maktoto Privacy Policy

maktoto ("maktoto", "we", "us", "our") operates the online gaming platform accessible at maktoto.cam ("Platform", "Website"). As the data controller of personal information collected through the Platform, maktoto is committed to handling all personal data with integrity, transparency, and in accordance with applicable data protection principles.

This Privacy Policy ("Policy") describes the types of personal data we collect from registered players and visitors to maktoto.cam, the purposes for which that data is used, the circumstances under which it may be shared with third parties, the security measures we maintain to protect it, and the rights available to you as a data subject.

This Policy applies to all individuals who access or use the maktoto Platform, including registered players, visitors browsing the Website without a registered account, and persons who contact maktoto via our customer support channels. It applies regardless of whether access is made from Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, or any other location.

By registering an account, making a deposit, or otherwise using the maktoto Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree to this Policy, you should discontinue use of the Platform.

The following terms carry the meanings set out below throughout this Privacy Policy:

• "Personal Data" — Any information that identifies or could reasonably be used to identify a living individual, directly or indirectly. This includes name, email address, phone number, identification document details, IP address, and device identifiers.
• "Data Controller" — The entity that determines the purposes and means of processing personal data. For the purposes of this Policy, the Data Controller is maktoto, the operator of maktoto.cam.
• "Data Processor" — Any third party that processes personal data on behalf of maktoto under a contractual arrangement that restricts the processor to using the data only as directed by maktoto.
• "Processing" — Any operation performed on personal data, including collection, storage, organisation, use, disclosure, transfer, or deletion.
• "Consent" — Freely given, specific, informed, and unambiguous agreement by a data subject to the processing of their personal data for a stated purpose.
• "KYC Data" — Identity and address verification documents submitted by a Player pursuant to maktoto's Know Your Customer verification process, including government-issued photo ID and proof of address.
• "Transaction Data" — Records of deposits and withdrawals made via Malaysian payment methods including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank, or cryptocurrency networks.

maktoto collects personal data that is necessary and proportionate to the purposes described in this Policy. We do not collect personal data beyond what is reasonably required to operate the Platform, comply with regulatory obligations, and provide a secure and personalised gaming experience.

The categories of personal data we collect include:

maktoto collects personal data through the following methods:

• Direct Submission: Information you voluntarily provide when completing the registration form, submitting KYC documents, updating your account profile, or contacting our customer support team via live chat or email.
• Automated Collection: Technical data collected automatically when you access maktoto.cam, including IP address, device identifiers, browser information, and session activity logs. This data is collected via server logs, cookies, and similar tracking technologies described in Section 7.
• Payment Processing: Transaction reference data received from Malaysian payment providers — including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and bank networks — when you make a deposit or withdrawal. maktoto receives only the transaction confirmation and reference details necessary to credit or debit your account.
• Third-Party Verification Services: Where required for KYC compliance or fraud prevention, maktoto may use the services of identity verification providers who return verification results to maktoto without retaining your documents on their own systems beyond the verification period.
• Publicly Available Sources: In limited circumstances related to fraud prevention or compliance screening, maktoto may cross-reference your information against publicly available sanctions lists or adverse media databases.

maktoto processes your personal data only for defined, legitimate purposes. For each purpose, we rely on one or more recognised legal bases as set out below:

maktoto does not sell, rent, or commercially trade your personal data. We share personal data with third parties only in the limited circumstances described below, and only to the minimum extent necessary for the stated purpose:

• Payment Service Providers: We share transaction data with Malaysian payment processors and financial institutions — including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, and Hong Leong Bank — to facilitate deposits and withdrawals. These providers process data only as needed to execute transactions and are bound by their own regulatory obligations.
• Identity Verification Providers: KYC data is shared with third-party identity verification services contracted by maktoto solely for the purpose of verifying your identity and age. These providers operate under data processing agreements that restrict secondary use of your documents.
• Gaming Software Providers: Certain game providers who supply live dealer or RNG games to the maktoto Platform receive your account identifier and session token to initialise game sessions. They do not receive your full personal profile.
• Fraud Prevention & Security Services: We may share technical data (IP address, device fingerprint, transaction patterns) with fraud detection service providers to identify and prevent fraudulent activity on the Platform.
• Regulatory and Legal Authorities: Where required by applicable law, court order, or a valid regulatory request, maktoto may disclose personal data to law enforcement agencies, financial intelligence units, or other governmental authorities. We will notify you of such disclosures where permitted by law.
• Corporate Transactions: In the event of a merger, acquisition, or sale of all or part of maktoto's business, personal data held by maktoto may be transferred to the acquiring entity, subject to that entity being bound by privacy obligations substantially equivalent to those set out in this Policy. Affected Players will be notified of any such transfer in advance where practicable.

All third-party data processors engaged by maktoto are subject to contractual obligations requiring them to maintain appropriate security measures, process personal data only for the purposes specified by maktoto, and not to transfer data to further third parties without prior authorisation.

maktoto uses cookies and similar client-side technologies (including local storage and session storage) to operate the Platform, maintain your logged-in session, remember your display preferences, and collect aggregate analytical data about how the Platform is used. We do not use third-party advertising or behavioural tracking cookies.

The cookies used on maktoto.cam fall into the following categories:

• Essential Cookies: Required for the Platform to function. These include session authentication tokens, CSRF protection tokens, and load-balancing cookies. These cookies cannot be disabled without impairing Platform functionality.
• Functional Cookies: Used to remember your preferences — such as language settings, responsible gambling limit configurations, and display preferences — so that they persist across sessions. Disabling these cookies may result in loss of personalised settings.
• Analytical Cookies: Used to collect anonymised and aggregated data about how visitors navigate maktoto.cam — such as which pages are most visited, average session duration, and common entry/exit points. This data is used exclusively to improve Platform performance. No individual player is identifiable from this data.

You can control and manage cookies through your browser settings. Most modern browsers allow you to refuse certain types of cookies, delete existing cookies, or receive notification before a new cookie is set. Please note that disabling essential cookies will prevent you from logging into your maktoto account. Detailed instructions for managing cookies are available through the help documentation of your browser (Chrome, Firefox, Safari, Edge, or others).

maktoto implements a layered set of technical and organisational security measures designed to protect personal data against unauthorised access, accidental loss, disclosure, alteration, or destruction. These measures are reviewed and updated on a regular basis in line with evolving security standards and threat landscapes.

Our security infrastructure includes the following:

• TLS Encryption in Transit: All data transmitted between your browser or mobile device and maktoto.cam is encrypted using Transport Layer Security (TLS 1.2 or 1.3). This applies to all page requests, login sessions, account updates, and payment interactions.
• AES-256 Encryption at Rest: Sensitive personal data stored on maktoto's servers — including KYC documents, identity records, and payment references — is encrypted at rest using AES-256 encryption.
• Password Hashing: Player passwords are never stored in plain text. All passwords are stored as salted cryptographic hashes using industry-standard algorithms. maktoto staff cannot view or retrieve your password.
• Access Controls: Access to personal data within maktoto's internal systems is restricted on a strict need-to-know basis. Staff members who handle personal data are subject to confidentiality obligations and regular privacy training.
• Two-Factor Authentication (2FA): Players are encouraged to activate 2FA on their accounts. Internal systems that process personal data require 2FA for all staff access.
• Intrusion Detection & Monitoring: maktoto's infrastructure is monitored continuously for anomalous access patterns, potential data breaches, and other security incidents. Automated alerting systems are in place to flag and contain potential threats in real time.

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected players, maktoto will notify affected individuals without undue delay following discovery of the breach, and will take all reasonable steps to contain, investigate, and remediate the incident.

maktoto retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required to comply with applicable legal, regulatory, and contractual obligations. The following retention periods apply as a general guide:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification. Where anonymisation is used, the resulting anonymised data is no longer treated as personal data and may be retained for longer periods for statistical and operational analysis purposes.

As a data subject whose personal information is processed by maktoto, you hold the following rights. These rights may be exercised by submitting a written request to [email protected] with the subject line "Data Rights Request". maktoto will respond to all valid requests within 30 days of receipt.

maktoto strictly prohibits the use of its Platform by any person under the age of 21 years. We do not knowingly collect, store, or process personal data from individuals under 21 years of age. Our registration process requires users to declare their date of birth, and accounts are subject to age verification as part of the mandatory KYC process.

Where maktoto discovers or has reason to believe that an account has been registered by a person under 21 years of age, the account will be immediately suspended. Any funds held in the account will be subject to investigation, and the account will be permanently closed following completion of that investigation. All personal data collected in relation to the underage account will be deleted in accordance with applicable legal requirements.

Parents and guardians who believe that a minor may have accessed the maktoto Platform are encouraged to contact our support team immediately at [email protected]. maktoto takes all reports of potential underage access seriously and will investigate promptly.

maktoto reserves the right to amend this Privacy Policy from time to time to reflect changes in our data processing practices, applicable legal or regulatory requirements, or improvements to our platform operations. The date on which the current version of the Policy took effect is stated at the top of this document.

Where changes to the Policy are material — meaning they substantially affect the rights of existing registered players or significantly alter how personal data is used — maktoto will notify affected players via the email address registered to their account prior to the changes taking effect. A summary of the key changes will be included in that notification.

For minor or administrative changes, the updated Policy will be published on this page without individual notification. It is your responsibility to review this Privacy Policy periodically to stay informed of any updates. Your continued use of the Platform following the effective date of any revised Policy constitutes your acceptance of the updated terms.

Previous versions of this Privacy Policy are available upon request by contacting [email protected] with the subject line "Previous Privacy Policy Version Request".

If you have any questions, concerns, or formal requests relating to this Privacy Policy or the processing of your personal data by maktoto, please use the contact details below. We are committed to responding to all privacy-related enquiries in a timely and thorough manner.

When submitting a data rights request, please include your registered username and the email address associated with your account so that we can verify your identity before processing the request. maktoto may request additional identity verification information before fulfilling a data access or deletion request to ensure that we do not disclose or delete data belonging to the wrong individual.

For further information about your rights and maktoto's obligations under applicable data protection frameworks, or to access our full Terms & Conditions and Responsible Gambling Policy, please visit the respective pages on this website.