nettoto Privacy Policy for Malaysian Players

Introduction

This Privacy Policy governs the collection, use, storage, disclosure and protection of personal data relating to individuals who access or use nettoto, including players from Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam and other locations in Malaysia.

By registering a nettoto account, depositing funds, using any nettoto feature or browsing the website, a user acknowledges having read and understood this policy. Where a user does not accept these practices, they should discontinue use of nettoto before submitting personal data.

nettoto may update this policy to reflect operational, technical, legal or regulatory developments. An updated version takes effect from the date shown above. Continued use of nettoto after the effective date constitutes acceptance of the revised policy. Users are encouraged to review this page periodically to remain informed.

Definitions

The following terms carry the meanings set out below throughout this Privacy Policy.

• Personal data — any information that identifies or could reasonably identify a living individual, including name, identification number, contact details, payment references and device identifiers.
• Processing — any operation performed on personal data, including collection, storage, use, disclosure, transfer and deletion.
• Data subject — the individual to whom personal data relates, typically a registered or prospective nettoto user.
• Controller — the entity that determines the purpose and means of processing personal data in connection with nettoto.
• Processor — a third party that processes personal data on behalf of nettoto under a documented instruction.
• Cookies — small data files placed on a device when a user visits nettoto, used for session management, analytics and preference storage.

Data collection

nettoto may collect personal data in several ways: directly from a user during registration and account use, automatically through technical interactions with the website, and from identity or payment verification services engaged to support compliance. The categories below describe what nettoto may hold and for what general purpose.

Users should not supply information belonging to another person unless lawfully authorised. Supplying inaccurate data may affect account verification, payment processing and access to nettoto services.

Data processing and legal bases

nettoto processes personal data only where a lawful basis applies. The principal bases are:

• Contractual necessity — processing required to register a nettoto account, execute a transaction, settle a wager or fulfil another service obligation.
• Legal obligation — processing required to comply with identity verification, anti-money laundering, fraud prevention or other applicable regulatory requirements.
• Legitimate interests — processing for security monitoring, fraud detection, system improvement and responsible gambling controls, provided such interests do not override the rights of data subjects.
• Consent — where processing relies on consent, nettoto will seek that consent explicitly before the relevant activity begins, and a user may withdraw consent at any time without affecting prior processing.

nettoto does not use personal data for undisclosed automated decision-making that produces legal or similarly significant effects on a user without human review where required. Marketing communications, where applicable, are subject to separate consent arrangements.

Disclosure to third parties

nettoto may share personal data with third parties only in the following circumstances:

• Payment processors and financial institutions — to facilitate MYR deposits and withdrawals through FPX, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank and eligible digital asset channels.
• Identity and compliance service providers — to carry out age verification, KYC checks and anti-fraud screening as required by applicable rules.
• Technology providers — hosting, security, analytics and platform infrastructure suppliers operating under data processing agreements that restrict use to permitted purposes.
• Regulatory and law enforcement authorities — where nettoto is required by law, regulation, court order or official request to disclose data.
• Business transfers — in the event of a merger, acquisition or restructure where personal data is a transferred asset, subject to the same privacy protections described in this policy.

nettoto does not sell personal data to third parties for their own marketing purposes.

Cookies and tracking technologies

nettoto uses cookies and similar technologies to maintain sessions, remember preferences, measure website performance and detect unusual access patterns. The principal categories of cookies used are:

• Strictly necessary cookies — required for the website to function correctly. These cannot be disabled without preventing core nettoto features from working.
• Functional cookies — store user preferences such as language settings and display options to improve the experience across sessions.
• Analytics cookies — collect aggregated information about how pages and features are used, helping nettoto improve navigation and content organisation. These do not identify individual users.
• Security cookies — support fraud detection, session integrity and account protection measures.

Users may manage cookie preferences through their browser settings. Disabling certain cookies may limit the availability of nettoto features, affect session continuity and prevent personalisation from functioning as described.

Data retention

nettoto retains personal data for as long as necessary to fulfil the purposes described in this policy. The following general principles apply:

• Account data is retained for the duration of the account relationship and for a further period as required by applicable laws, such as financial record-keeping, anti-money laundering or tax obligations.
• Transaction records, betting history and payment references may be retained for a minimum period specified under the relevant regulatory requirements applicable to the jurisdiction in which nettoto operates.
• Support communications and complaint records are retained for a reasonable period after closure to support dispute resolution and quality review.
• Technical and usage logs are retained for security and fraud monitoring purposes and are typically held for a shorter period unless a specific investigation requires extended retention.

Where a user requests account closure, nettoto may continue to hold data for the minimum period required by applicable obligations before completing any deletion or anonymisation process.

User rights

Subject to applicable law, registered nettoto users may have rights in relation to their personal data. The rights described below are not absolute and may be subject to exemptions, proportionality assessments or competing obligations.

Requests should be submitted using the contact details shown in Section 10. nettoto will respond within a reasonable period, acknowledging receipt and advising of any information needed to verify identity and process the request. A response may take longer where the request is complex or multiple requests are received simultaneously.

Security measures

Contact and privacy enquiries

Questions, correction requests, deletion requests or other communications about this Privacy Policy should be directed to the nettoto support team using the website email address shown in the footer below. Please include a clear description of the request, the account email address used at registration and any supporting context that will assist with identification and review.

nettoto will acknowledge receipt and aim to respond within a reasonable timeframe. Where a request is declined, nettoto will explain the reason. Where required by applicable law, users may have the right to raise a concern with a relevant data protection supervisory authority.