Privacy Policy

This Privacy Policy (hereinafter "Policy") describes the manner in which Rajatoto (hereinafter "Rajatoto", "we", "us", "our") collects, processes, uses, discloses, stores, and protects personal data submitted by users (hereinafter "you", "User "Player", "Account Holder") in connection with the online gaming and sports betting platform accessible atrajatoto.cam.

Rajatoto is committed to handling your personal data responsibly, in accordance with applicable data protection laws and principles. By accessing or using the Rajatoto Platform — including by registering an Account, making a deposit, placing a wager, or simply browsing our website — you acknowledge that you have read and understood this Policy and that you consent to the collection and processing of your personal data as described herein.

This Policy should be read in conjunction with our Terms & Conditions and our Responsible Gambling Policy, both of which form part of our overall governance framework for the Rajatoto Platform.

The following terms carry the meanings defined below throughout this Policy:

• "Personal Data" means any information relating to an identified or identifiable natural person — including name, identification number, email address, phone number, IP address, device identifiers, financial data, and any other information that can be used to identify you directly or indirectly.
• "Processing" means any operation performed on Personal Data, whether automated or manual, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, transmission, or deletion.
• "Data Controller" means the entity that determines the purposes and means of Processing Personal Data — in this context, Rajatoto.
• "Data Processor" means any third party that Processes Personal Data on behalf of Rajatoto pursuant to a written agreement and under Rajatoto's documented instructions.
• "Consent" means freely given, specific, informed, and unambiguous agreement by the User to the Processing of their Personal Data for a stated purpose.
• "KYC" means Know Your Customer — the identity and age verification process required by Rajatoto and mandated by applicable regulatory standards before processing withdrawals or confirming account eligibility.
• "Platform" means the Rajatoto website, all associated game interfaces, betting tools, account management features, and payment systems accessible via rajatoto.cam.
• "Cookie" means a small text file placed on your device by the Platform for the purposes of session management, analytics, and user experience personalisation.

Rajatoto acts as the Data Controller in respect of all Personal Data collected and Processed through the Platform. As Data Controller, Rajatoto is responsible for determining the purposes for which and the manner in which your Personal Data is Processed.

Where Rajatoto engages third-party service providers — including payment processors, identity verification services, game studio technology providers, and customer support platforms — those providers act as Data Processors operating under binding data processing agreements with Rajatoto. In all such arrangements, Rajatoto remains responsible for ensuring that your data is handled in accordance with this Policy and applicable data protection obligations.

If you have any questions about our role as Data Controller or about any aspect of our data handling practices, please contact our Data Protection team at the address provided in Section 17 of this Policy.

Rajatoto collects the following categories of Personal Data from Users of the Platform:

4.1 Identity and Registration Data

• Full legal name
• Date of birth (for age verification purposes — minimum age 21)
• Nationality and country of residence
• Government-issued identification number (e.g., Malaysian MyKad number, passport number)
• Copies of identity documents submitted during KYC verification
• Username and account credentials (password stored in encrypted form only)

4.2 Contact Data

• Email address
• Mobile phone number
• Correspondence records including live chat transcripts and support email exchanges

4.3 Financial and Payment Data

• Deposit and withdrawal transaction records (amounts, timestamps, methods)
• Payment method identifiers — including e-wallet account references for Touch'n Go eWallet, Boost, GrabPay; bank account references for Maybank, CIMB, Public Bank, Hong Leong, DuitNow, and FPX; and cryptocurrency wallet addresses for USDT TRC20 transactions
• Account balance and transaction history

4.4 Gaming and Wagering Data

• Game session records including game type, stakes, outcomes, and session duration
• Sports betting slip data including markets selected, odds, stake amounts, and settlement results
• Bonus activation and wagering requirement fulfilment records
• VIP tier status and loyalty programme activity

4.5 Technical and Device Data

• IP address
• Device type, operating system, and browser information
• Geolocation data derived from IP address (country/region level)
• Session timestamps and navigation logs within the Platform
• Cookie and tracking technology data (see Section 9)

Rajatoto collects Personal Data through the following means:

• Directly from you: through account registration forms, KYC document uploads, payment transactions, live chat interactions, email correspondence, and any other communications you initiate with Rajatoto.
• Automatically through Platform use: via server logs, cookies, session tracking technologies, and analytics tools that record your interactions with the Platform from the moment you access rajatoto.cam.
• From third-party service providers: including identity verification agencies that process and return KYC verification outcomes; payment processors that confirm transaction status; and fraud prevention services that return risk-scoring information to assist with account security.
• From publicly available sources: where necessary for fraud prevention, compliance, or responsible gambling purposes — for example, self-exclusion registers operated by recognised gambling regulatory bodies.

Rajatoto Processes Personal Data only where a lawful basis exists for doing so. The legal bases on which Rajatoto relies are as follows:

Rajatoto uses your Personal Data for the following purposes:

• To create, verify, and manage your Account on the Platform;
• To process deposits via your preferred Malaysian payment method (Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong USDT TRC20) and to process withdrawal requests to your verified payment instrument;
• To verify your identity and age (minimum 21 years) through our KYC process, as required by our responsible gambling obligations;
• To detect, prevent, and investigate fraud, money laundering, bonus abuse, duplicate accounts, and other prohibited activities;
• To monitor your account activity for responsible gambling purposes — including the application of deposit limits, session, and self-exclusion tools you have activated;
• To provide customer support through our English-language live chat and email channels;
• To send you service communications relating to your Account — including transaction confirmations, security alerts, and policy update notices;
• To send you marketing communications about promotions, bonuses, and new features — where you have provided explicit consent to receive such communications, and only until such consent is withdrawn;
• To improve the Platform's performance, features, and user experience through aggregated analytics;
• To comply with legal and regulatory obligations applicable to Rajatoto's operations;
• To enforce our Terms & Conditions and to resolve disputes.

Rajatoto may share your Personal Data with the following categories of third parties, strictly on a need-to-know basis and subject to appropriate data protection agreements:

• Payment Processors: Malaysian payment infrastructure providers including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and the banking systems of Maybank, CIMB, Public Bank, Hong Leong, and other FPX-participating banks — for the sole purpose of processing your deposits and withdrawals.
• Identity Verification Providers: Third-party KYC service providers that process submitted identity documents to verify your identity and age on Rajatoto's behalf.
• Fraud Prevention and AML Services: Specialist providers that assist in detecting and preventing fraudulent transactions, money laundering, and other financial crimes.
• Game Studio Technology Providers: The studios and aggregators whose games are hosted on the Platform may receive session and outcome data necessary for game operation and RTP auditing. No unnecessary personal identifiers are shared with game studios.
• Customer Support Platforms: Third-party software providers powering our live chat and email ticketing systems, which may process your contact data and support conversation records on our behalf.
• Regulatory and Law Enforcement Authorities: Where Rajatoto is legally obligated to disclose Personal Data in response to a lawful request, court order, or regulatory investigation, we will do so in compliance with our legal obligations.
• Business Successors: In the event of a merger, acquisition, or transfer of Rajatoto's business, Personal Data may be disclosed to the successor entity as part of the transaction, subject to equivalent data protection commitments.

The Rajatoto Platform uses cookies and similar tracking technologies to provide core functionality, improve your experience, and analyse how the Platform is used. By continuing to use rajatoto.cam, you consent to the use of cookies as described in this Section.

The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the Platform to function correctly. These include session cookies that maintain your logged-in state, shopping basket equivalents for the bet slip, and security tokens. These cannot be disabled without impairing Platform functionality.
• Functional Cookies: Remember your preferences such as language settings, display preferences, and last-used payment method for a more personalised experience across sessions.
• Analytics Cookies: Collect anonymised or pseudonymised data about how users interact with the Platform — pages visited, game categories explored, session duration, and device type. This data is used in aggregate to improve Platform performance and content.
• Security Cookies: Support fraud detection and account security functions, including recognition of trusted devices and flaging of anomalous login patterns.

Most web browsers allow you to control cookie settings through their preferences menu. You may choose to block or delete cookies; however, doing so may impair your ability to log in to your Account or use certain Platform features. Strictly necessary cookies cannot be disabled without losing access to core Platform functionality.

Rajatoto retains Personal Data for as long as is necessary for the purposes for which it was collected, or for as long as is required by applicable legal and regulatory obligations, whichever is longer.

General retention principles applied by Rajatoto include:

• Active Account Data: Retained throughout the lifetime of your Account and for a minimum period thereafter as required for regulatory compliance, dispute resolution, and audit purposes.
• KYC and Identity Verification Documents: Retained for a minimum of five (5) years following account closure, consistent with anti-money laundering record-keeping requirements applicable to gaming operators.
• Transaction and Financial Records: Retained for a minimum of five (5) years following the date of the transaction, in line with applicable financial record-keeping obligations.
• Support and Communications Records: Retained for a period of three (3) years following resolution of the relevant support interaction, unless the matter is subject to ongoing dispute or legal proceedings.
• Analytics and Technical Logs: Typically retained for twelve (12) to twenty-four (24) months, after which data is aggregated, anonymised, or deleted.

Upon expiry of the relevant retention period, Personal Data will be securely deleted or irreversibly anonymised so that it can no longer be associated with an identifiable individual.

Rajatoto implements a comprehensive suite of technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• Transport Layer Encryption: All data transmitted between your device and Rajatoto's servers is encrypted using256-bit SSL/TLS encryption — the same standard used by major Malaysian financial institutions.
• Data Encryption at Rest: Sensitive data categories, including KYC documents, financial records, and account credentials, are encrypted at rest using industry-standard encryption protocols.
• Password Security: User passwords are stored exclusively in hashed and salted form. Rajatoto staff never have access to your plaintext password.
• Access Controls: Internal access to Personal Data is restricted on a strict need-to-know basis, with role-based access controls and comprehensive access audit logging.
• Security Monitoring: Rajatoto operates continuous security monitoring including intrusion detection, anomaly alerting, and regular vulnerability assessments.
• Incident Response: In the event of a data breach that poses a risk to affected Users, Rajatoto will take prompt remedial action and will notify affected individuals and relevant authorities in accordance with applicable legal obligations.

In the course of providing services to Malaysian players and operating the Platform, Rajatoto may transfer your Personal Data to service providers and infrastructure located outside of Malaysia. Such transfers may include cloud server infrastructure, identity verification services, and customer support platform providers operating internationally.

Where Personal Data is transferred internationally, Rajatoto ensures that appropriate safeguards are in place to protect that data to a standard equivalent to the protections afforded under this Policy. Safeguards may include contractual data processing agreements incorporating internationally recognised data protection clauses, binding corporate rules, or transfers to jurisdictions recognised as providing an adequate level of data protection.

As a User of the Rajatoto Platform, you have the following rights in relation to your Personal Data. You may exercise any of these rights by submitting a written request to our support team (see Section 17):

Rajatoto will respond to valid rights requests within thirty (30) calendar days of receipt, subject to identity verification. Requests may be declined where they conflict with Rajatoto's legal obligations — for example, where erasure of financial records is sought during a mandatory retention period.

The Rajatoto Platform is strictly intended for persons aged21 years and above. Rajatoto does not knowingly collect, process, or retain Personal Data relating to individuals under the age of 21.

All Accounts are subject to age verification through the KYC process. Where Rajatoto has reason to believe that an Account has been registered by or on behalf of a person under the age of 21, that Account will be immediately suspended, all associated Personal Data will be reviewed, and the Account will be closed following investigation. Any balance held in such an Account will be handled in accordance with our Terms & Conditions and applicable legal requirements.

The Rajatoto Platform may reference or link to the public-facing terms of third-party payment service providers such as Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, or banking platforms operated by Maybank, CIMB, Public Bank, and Hong Leong. These external services are governed by their own privacy policies and terms of service, which are independent of this Policy.

Rajatoto is not responsible for the data practices of third-party services. When you interact with a third-party payment provider to complete a deposit or withdrawal, the data you provide to that provider is subject to their own privacy policy. We encourage you to review the relevant privacy documentation of any third-party service you use in connection with your Rajatoto Account.

Rajatoto reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or Platform features. Where material changes are made to this Policy, we will notify affected Users by email to the address registered to their Account and/or by displaying a prominent notice on the Platform for minimum period prior to the updated Policy taking effect.

Your continued use of the Rajatoto Platform following the effective date of any updated Policy constitutes your acknowledgement of and agreement to the revised terms. If you do not accept the updated Policy, you should cease using the Platform and contact our support team to close your Account.

The current version of this Privacy Policy, along with the date on which it was last updated, will always be available at rajatoto.cam/privacy-policy.

If you wish to exercise any of your data subject rights, have a question about this Privacy Policy, or wish to make a complaint about Rajatoto's handling of your Personal Data, please contact our Protection and Privacy team through the following channels:

• Email: [email protected] — please include "Privacy Request" or "Data Protection Complaint" in the subject line of your message. Email addresses are displayed as plain text only and are not clickable links.
• Live Chat: Our24/7 live chat is available directly from the Rajatoto Platform. For data protection enquiries, please state "data protection request" at the start of your conversation so the query can be directed to the appropriate team.
• Support Hours for In-Depth Queries: 9:00 AM – 1:00 AM MYT. Complex data protection requests handled within5 business days, with an initial acknowledgement within 24 hours.

If you are not satisfied with our response to a data protection complaint, you have the right to escalate your complaint to the relevant data protection supervisory authority in your jurisdiction. For Malaysian users, you may refer matters to the relevant government body responsible for personal data protection oversight in Malaysia.