Privacy Policy Birutoto –
Data Protection Your Privacy

Birutoto understands that your trust is the foundation of our relationship. When you register and use the Birutoto platform, you entrust us with valuable personal information. We take this responsibility very seriously.

This Privacy Policy clearly and transparently explains how Birutoto collects, stores, uses, and protects your personal data as a user of our platform in Malaysia. This document is written in plain language so you genuinely understand your rights and how we manage your information — not just legal jargon that is difficult to interpret.

This Privacy Policy applies to all services offered through the Birutoto website, the Birutoto mobile app, and any interaction you have with our customer support team through any communication channel provided. By accessing or using any Birutoto service, you agree to the terms set out in this Privacy Policy.

Birutoto collects various types of information depending on how you interact with our platform. Generally, the data we collect falls into three main categories:

Information You Provide Directly:

• Full name as stated on your identification card or passport.
• National identity card number (MyKad) or passport number for international users.
• Date of birth for minimum age verification of 18 years.
• Active email address used for account communications.
• Mobile phone number for two-factor authentication and transaction notifications.
• Current residential address for identity verification purposes.
• Bank account or e-wallet details for processing deposits and withdrawals.
• KYC supporting documents such as photos of your identity card, utility bills, or bank statements.

Automatically Collected Information:

• IP address and geographic location information based on IP.
• Device type, operating system, and browser version in use.
• Session data including pages visited, time spent, and navigation patterns.
• Complete transaction logs including date, time, amount, and game type.
• Cookie data and unique device identifiers.

Information From Third Parties:

• Verification data from trusted third-party KYC service providers.
• Payment verification information from the payment processors used.
• Blacklist screening data from relevant financial security authorities.

Data collected by Birutoto is used responsibly and only for legitimate purposes related to platform operations. We do not use your data beyond the scope stated here without your consent.

The primary purposes for which birutoto uses your data are as follows:

• Account Management: Creating and managing your account, processing logins, and maintaining account security at all times.
• Transaction Processing: Handling all deposits, withdrawals, bonuses, and other financial transactions accurately and securely.
• Identity Verification: Carrying out the KYC process required to meet compliance obligations and prevent identity fraud.
• Customer Support: Providing relevant and accurate assistance when you contact our support team.
• Platform Security: Detecting and preventing fraudulent activity, money laundering, or platform abuse.
• Responsible Gaming: Monitoring gameplay patterns to identify signs of problem gambling and offer appropriate support.
• Service Improvements: Analysing aggregated data to improve user experience, platform performance, and product offerings.
• Marketing Communications: Sending promotional information and exclusive offers to you — only if you have agreed to receive them.

Birutoto upholds the principle that your personal data belongs to you. We do not sell, rent, or transfer your data to third parties for their own commercial gain. However, there are limited situations where sharing data with certain parties is necessary to operate our platform:

All third parties working with birutoto are bound by strict confidentiality and data protection agreements. They are only permitted to use shared data for the specified purposes and may not use it for any other purpose without explicit consent from birutoto.

Birutoto uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored in your browser when you visit our website. They allow our platform to recognize your device and remember your preferences.

Types of cookies used by birutoto include:

• Essential Cookies: Required for core platform functions such as login session verification and security. These cookies cannot be disabled as the platform will not function properly without them.
• Performance Cookies: Collecting information about how you use the platform to help us identify areas for improvement. All data is aggregated and does not personally identify you.
• Functional Cookies: Remembering your preferences such as language, display settings, and saved login details for a more convenient return experience.
• Analytics Cookies: Helping us understand overall platform traffic and usage patterns to make better product decisions.

Birutoto invests seriously in security infrastructure to ensure your personal data is always protected against cyber threats, unauthorized access, and data breaches. The security measures we implement cover multiple layers of protection:

• Data is encrypted in transit using TLS 1.3 protocol and 256-bit SSL certificates.
• Data is encrypted at rest for all sensitive information stored in our database.
• Two-factor authentication (2FA) is available and strongly encouraged for all user accounts.
• Real-time 24/7 security threat monitoring by our cybersecurity team.
• Regular penetration testing by independent security experts to identify vulnerabilities.
• Role-based access controls for internal staff, enforcing the principle of least privilege.
• Regular data backups with tested disaster recovery procedures.
• Mandatory cybersecurity awareness training for all birutoto staff who handle user data.

While we take all reasonable measures, no security system can guarantee 100% protection against all possible threats. In the event of a data breach affecting your information, birutoto is committed to notifying you within a reasonable timeframe and taking immediate remedial action.

As a birutoto platform user, you have certain rights regarding your personal data that we take seriously and fully respect. These rights include:

• Right to Access: You have the right to request a copy of the personal data we hold about you at any time.
• Right to Rectification: If any of your data is inaccurate or outdated, you have the right to request that we correct it promptly.
• Right to Erasure: Under certain circumstances, you may request that we delete your personal data — subject to legal and operational requirements that oblige us to retain certain records.
• Right to Restrict Processing: You may request that we restrict how we process your data in certain situations as provided by law.
• Data Portability Rights: You have the right to receive your personal data in a structured, machine-readable format.
• Right to Object: You may object to the processing of your data for direct marketing purposes at any time.

To exercise any of these rights, contact the birutoto support team via Live Chat or the email address available on the platform. We will process your request within 30 working days of receipt. For more complex cases, we may require a little additional time but will notify you in advance.

Birutoto retains your personal data only for as long as necessary to fulfill the original purpose of collection, or as required by applicable laws and regulations. The following is a general guide to our data retention periods:

• Active Account Data: Retained for the duration your account remains active at Birutoto and for an additional period following account closure as required by financial regulations.
• Transaction Records: Retained for the minimum period stipulated by applicable financial and tax laws, typically between 5 and 7 years.
• KYC Documents: Retained in accordance with applicable anti-money laundering (AML) compliance requirements.
• Communication Logs: Customer support interaction records are retained for a limited period for quality control and dispute resolution purposes.
• Analytics Data: Aggregated and anonymized usage data may be retained for a longer period for trend analysis and service improvement purposes.

Birutoto reserves the right to update or amend this Privacy Policy from time to time in response to changes in law, technology, or our business practices. Any changes made will take effect once the latest version is published on this page.

For significant changes that affect how we handle your personal data, we will:

• Displaying clear notices on the birutoto platform's home page.
• Sending email notifications to the address registered in your account.
• Requesting your consent again if the changes require new authorisation under applicable law.

It is your responsibility to review this Privacy Policy page periodically. The date of the most recent update is always displayed at the top of this page. Continued use of the Birutoto platform after any amendments are published constitutes your acceptance of the updated privacy terms.

If you have any questions, concerns, or requests regarding this Privacy Policy or how birutoto handles your personal data, we encourage you to reach out to us directly. Our team is available 24 hours a day, 7 days a week.

You may contact the Birutoto privacy team through the following channels:

• Live Chat: The Live Chat function available at the bottom corner of every page on the Birutoto platform — the fastest way to get an immediate response.
• Telegram: Reach our support agents via birutoto's official Telegram channel for more personalised assistance.
• Email: Send your written enquiry to us at [email protected] — we aim to respond to all emails within 24 business hours.