Privacy Policy

Introduction

pmtoto ("we", "us", "our", or "the Platform") is committed to protecting the personal data and privacy of all individuals who interact with our online gaming and sports betting platform, accessible at pmtoto.cam. This Privacy Policy ("Policy") sets out in clear terms how we collect, use, store, share, and protect the personal data of our registered players and website visitors ("you", "your", or "the User").

This Policy applies to all personal data processed by pmtoto in connection with your use of the Platform, including data collected during account registration, identity verification (KYC), deposits and withdrawals, gameplay activity, and communications with our customer support team.

By registering an account with pmtoto or by continuing to use the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. This Policy should be read in conjunction with our Terms & Conditions.

Definitions

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

• "Personal Data" — Any information that relates to an identified or identifiable natural person, including name, identification number, email address, phone number, financial account details, IP address, and device identifiers.
• "Processing" — Any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, restriction, erasure, or destruction.
• "Data Controller" — pmtoto, as the entity that determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Processor" — Any third-party service provider engaged by pmtoto to process Personal Data on our behalf, subject to a binding data processing agreement.
• "KYC" — Know Your Customer; the identity and address verification process conducted prior to the processing of withdrawal requests.
• "Cookie" — A small text file placed on your device by the Platform for the purpose of storing session data, preferences, or analytical information.
• "Consent" — A freely given, specific, informed, and unambiguous indication of your agreement to the processing of your Personal Data.
• "Platform" / "Site" — The pmtoto website at pmtoto.cam and all associated interfaces, services, and functionality.

Data We Collect

pmtoto collects Personal Data through several channels in the course of providing our services. The categories of data we collect include, but are not limited to, the following:

3.1 Registration Data

When you create an account on the Platform, we collect your chosen username, email address, phone number, and the password you set (stored in hashed form). This data is required to create and maintain your account.

3.2 Identity Verification (KYC) Data

Prior to the processing of withdrawal requests, we collect identity verification documents including a copy of your government-issued Malaysian identification document (MyKad, Driver's Licence, or Passport), a proof-of-address document (such as a Tenaga Nasional utility bill, CIMB or Maybank bank statement, or equivalent document dated within three months), and a selfie photograph taken while holding your identity document. This data is processed solely for the purpose of verifying your identity and complying with anti-money laundering obligations.

3.3 Financial & Transaction Data

We collect records of deposits and withdrawals made through your Account, including the payment method used (e.g., Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, BTC, ETH, USDT TRC20, or BNB), transaction amounts in MYR or cryptocurrency equivalent, and timestamps. We do not store full payment card numbers or banking login credentials.

3.4 Gameplay & Activity Data

We collect records of your gaming activity on the Platform, including games played, bets placed, wager amounts, winnings, and session durations. This data is used for account management, responsible gambling monitoring, and dispute resolution.

3.5 Technical & Device Data

We automatically collect technical information when you access the Platform, including your IP address, browser type and version, operating system, device type, screen resolution, referring URLs, and pages visited. This data is used for security monitoring, fraud prevention, and platform analytics.

3.6 Communications Data

If you contact our customer support team via live chat or email, we retain records of those communications for quality assurance, training, and dispute resolution purposes.

Data Processing

The Personal Data we collect is processed for the following specific and legitimate purposes:

Legal Basis for Processing

pmtoto processes your Personal Data on one or more of the following legal grounds, depending on the nature of the processing activity:

• Performance of a Contract: Processing necessary to provide the services you have contracted for when registering an account, including account management, payment processing, and gameplay facilitation.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including anti-money laundering (AML) requirements, identity verification mandates, and data retention obligations.
• Legitimate Interests: Processing necessary for the legitimate interests of pmtoto, including fraud prevention, platform security, responsible gambling monitoring, and analytics — provided these interests are not overridden by your rights and freedoms.
• Consent: Processing carried out on the basis of your explicit consent, such as the sending of promotional communications. You may withdraw consent at any time by contacting our support team.

Data Sharing & Disclosure

pmtoto does not sell your Personal Data. We may share your data only in the limited circumstances described below:

6.1 Service Providers and Data Processors

We engage carefully selected third-party service providers to assist in operating the Platform, including payment processing partners (such as those facilitating Touch 'n Go eWallet, DuitNow, and FPX transactions), KYC verification technology providers, fraud detection services, and cloud infrastructure providers. These third parties process Personal Data solely on our instruction and are bound by contractual data processing obligations that prohibit them from using your data for their own purposes.

6.2 Legal and Regulatory Disclosure

We may disclose Personal Data to competent authorities, regulators, law enforcement agencies, or courts where we are legally required to do so, or where disclosure is necessary to protect the rights, property, or safety of pmtoto, our players, or the general public.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of the assets of pmtoto, Personal Data held by us may be transferred to the acquiring or successor entity. Any such transfer would be subject to the acquirer's agreement to continue to process your data in a manner consistent with this Policy.

Data Retention

We retain your Personal Data for as long as is necessary to fulfil the purposes for which it was collected, unless a longer retention period is required by applicable law or regulation.

Specifically, account data and transaction records are typically retained for a minimum of five (5) years following account closure, in order to comply with anti-money laundering and financial record-keeping obligations. KYC documents are retained for a minimum of five (5) years from the date of submission.

Technical and analytical data is retained in aggregated and anonymised form for platform improvement purposes and does not constitute Personal Data once anonymised. Communications data is retained for a period of two (2) years from the date of the relevant interaction.

Upon the expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised in accordance with our data deletion procedures.

Data Security

pmtoto takes the security of your Personal Data seriously. We implement a combination of technical and organisational measures designed to protect your data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• Transport Layer Security (TLS 1.3): All data transmitted between your device and the Platform is encrypted using TLS, protecting your information in transit against interception.
• AES-256 Encryption: Sensitive data stored on our servers — including KYC documents and personal identifiers — is encrypted at rest using AES-256 encryption.
• Password Hashing: User passwords are hashed using a one-way cryptographic function. We do not store plaintext passwords under any circumstances.
• Access Controls: Access to Personal Data within pmtoto is restricted on a strict need-to-know basis. All internal access is logged and subject to periodic review.
• Fraud Monitoring: Automated systems monitor transaction patterns and login activity in real time to detect and respond to potential security threats or account compromise.
• Penetration Testing: Our platform undergoes periodic security assessments to identify and remediate vulnerabilities.

While we employ robust security measures, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your Account login credentials and for notifying us promptly if you suspect any unauthorised access.

Cookies & Tracking Technologies

pmtoto uses cookies and similar tracking technologies to enhance your experience on the Platform, maintain session state, and gather anonymous analytical data. The categories of cookies we use are as follows:

• Strictly Necessary Cookies: Essential for the Platform to function correctly. These include session authentication cookies and security tokens. These cookies cannot be disabled.
• Functional Cookies: Used to remember your preferences, such as language settings and display configurations, to provide a more personalised experience.
• Analytical Cookies: Used to collect anonymised information about how visitors use the Platform — such as pages visited and session duration — to help us improve the user experience. Data collected is aggregated and does not identify individual users.
• Security Cookies: Used for fraud prevention and to detect and respond to unusual account activity or bot traffic.

You may configure your browser to refuse or delete cookies. Please note that disabling strictly necessary cookies may impair the functionality of the Platform, including your ability to log in or maintain a session. Our Platform does not currently respond to "Do Not Track" browser signals.

Your Rights

Subject to applicable law, you have the following rights in relation to your Personal Data held by pmtoto:

• Right of Access: You may request a copy of the Personal Data we hold about you, together with information about how it is processed.
• Right of Rectification: You may request the correction of any inaccurate or incomplete Personal Data we hold about you.
• Right of Erasure: You may request the deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations. Note that we are required to retain certain data (such as KYC and transaction records) for regulatory compliance purposes and cannot delete such data on request alone.
• Right to Restrict Processing: You may request that we restrict the processing of your Personal Data in certain circumstances, such as where you contest the accuracy of the data or object to our processing.
• Right to Data Portability: Where processing is based on consent or contract, you may request a machine-readable copy of your Personal Data for the purpose of transferring it to another service provider.
• Right to Object: You may object to processing carried out on the basis of legitimate interests, including direct marketing communications.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal.

To exercise any of the above rights, please contact our Data Protection team at the email address listed in Section 14. We will respond to all verifiable requests within 30 days.

Children's Privacy

The Platform is strictly intended for adults aged 21 and above. pmtoto does not knowingly collect Personal Data from individuals under the age of 21. If we become aware that Personal Data has been collected from a person who is underage, we will take immediate steps to delete that data and close the associated account.

If you have reason to believe that a minor has submitted Personal Data to pmtoto, please contact us immediately at [email protected] so that we can investigate and take appropriate action.

International Data Transfers

The Platform serves players primarily located in Malaysia, and we process the majority of Personal Data within our primary infrastructure environment. In some cases, Personal Data may be processed by our third-party service providers in locations outside Malaysia, such as cloud infrastructure providers or payment processing partners operating in other jurisdictions.

Where such cross-border transfers occur, pmtoto ensures that appropriate safeguards are in place — including contractual data protection clauses — to ensure that your Personal Data receives a standard of protection consistent with this Policy and applicable data protection laws.

Changes to This Policy

pmtoto reserves the right to update or amend this Privacy Policy at any time. Where changes are material, we will provide advance notice to active players via email or a prominent notice on the Platform prior to the revised Policy taking effect.

The effective date displayed at the top of this page indicates when the most recent substantive revision was made. Your continued use of the Platform following the publication of a revised Privacy Policy constitutes your acceptance of the updated terms.

We recommend that you review this page periodically to remain informed of any updates to our data practices.

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data by pmtoto, please contact our support and data protection team using the details below:

Our customer support team is available 24 hours a day via live chat for general account and service enquiries. For formal data rights requests, email is the required channel to ensure a proper audit trail.

pmtoto operates in English and serves players throughout Malaysia, including Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and all other regions. All privacy correspondence is handled in English.