Privacy Policy

This Privacy Policy ("Policy") is issued by posototo (referred to herein as "posototo", "we", "us", or "our"), the operator of the online gambling platform located at https://posototo.cam (the "Platform"). This Policy describes our practices regarding the collection, use, storage, disclosure, and protection of personal data relating to players and visitors who interact with our Platform (collectively referred to as "you" or "the User").

posototo is an internationally licensed online gambling operator. As part of our licensing obligations, we are required to implement robust data protection practices that comply with applicable privacy law and anti-money laundering (AML) regulations. This Policy has been drafted in accordance with those obligations and reflects our genuine commitment to handling your personal data with respect and transparency.

By registering an account, making a deposit, placing a bet, or continuing to use the Platform, you confirm that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, please discontinue your use of the Platform and contact our support team to arrange account closure.

For the purposes of this Privacy Policy, the following terms shall have the meanings ascribed to them below:

• "Personal Data" — Any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial account information, location data, and online identifiers.
• "Processing" — Any operation or set of operations performed on personal data, whether or not by automated means, including collection, recording, storage, adaptation, retrieval, use, disclosure, or deletion.
• "Data Controller" — posototo, the entity that determines the purposes and means of processing your personal data.
• "Data Processor" — A third party that processes personal data on behalf of posototo pursuant to a written contract, such as a payment gateway operator or identity verification service provider.
• "Consent" — Any freely given, specific, informed, and unambiguous indication of your agreement to the processing of your personal data for a stated purpose.
• "KYC" — Know Your Customer; the identity and age verification process that posototo is required to conduct under its international gaming licence and applicable AML regulations.
• "Cookie" — A small data file placed on your device by the Platform for the purposes of session management, personalisation, analytics, and fraud prevention.

posototo collects the following categories of personal data from players and Platform visitors:

We do not intentionally collect sensitive personal data beyond what is strictly required for KYC compliance and responsible gambling obligations (e.g., data regarding a player's financial vulnerability or self-exclusion history). Such data, where collected, is handled with the highest level of protection.

posototo collects your personal data through the following channels and mechanisms:

• Direct provision by you: When you complete the registration form, submit KYC documents, make a deposit or withdrawal request, contact customer support, or update your account settings, you directly provide us with personal data.
• Automated collection: When you visit and interact with the Platform, our servers automatically record technical data including your IP address, device identifiers, and browsing behaviour. This occurs whether or not you are logged into an account.
• Cookies and similar technologies: The Platform uses cookies, local storage, and similar technologies to maintain session state, prevent fraud, personalise your experience, and collect analytics data. See Section 8 (Cookies & Tracking) for full details.
• Third-party sources: We may receive data about you from payment processing partners (e.g., confirmation of a DuitNow or Touch 'n Go eWallet transaction), identity verification service providers, and fraud prevention agencies where such data sharing is necessary for the lawful operation of the Platform.
• Publicly available sources: In connection with AML and fraud prevention obligations, posototo may consult publicly available databases or sanctions lists maintained by regulatory authorities.

posototo processes your personal data on the following legal bases:

• Contractual necessity: Processing is necessary to perform our contractual obligations to you as a registered player, including operating your account, processing transactions, and delivering gaming services.
• Legal obligation: Processing is required to comply with applicable legal and regulatory requirements, including AML obligations, KYC verification mandates, and the record-keeping requirements of our international gaming licence.
• Legitimate interests: posototo has legitimate interests in preventing fraud, ensuring platform security, conducting analytics to improve user experience, and communicating with you about changes to our services. We process data for these purposes only where our legitimate interests are not overridden by your fundamental rights.
• Consent: For marketing communications and certain types of behavioural tracking, we rely on your consent. You may withdraw this consent at any time by contacting our support team or updating your account communication preferences.

posototo uses your personal data for the following specific purposes:

• Account creation and management: To register your account, maintain accurate account records, and provide you with access to all Platform features.
• Identity verification (KYC): To verify your age (21+), identity, and address in accordance with our licensing obligations and AML regulations.
• Payment processing: To facilitate deposits and withdrawals through your chosen payment method — including Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, DuitNow, FPX, and cryptocurrency channels (BTC, ETH, USDT, LTC).
• Fraud prevention and security: To detect, investigate, and prevent fraudulent transactions, account takeovers, money laundering, and other prohibited activities.
• Responsible gambling compliance: To monitor gambling patterns, apply deposit limits and self-exclusion arrangements, and identify players who may be experiencing gambling-related harm.
• Customer support: To respond to your queries and complaints, and to maintain records of your support interactions.
• Legal and regulatory compliance: To fulfil reporting obligations to licensing authorities, law enforcement agencies, and financial intelligence units.
• Service improvement: To analyse aggregate usage patterns, improve Platform functionality, and inform product development decisions.
• Marketing communications: To send you promotional offers, bonus notifications, and news about posototo where you have consented to receive such communications.

posototo does not sell your personal data to third parties. We share your data only in the following limited circumstances:

• Payment service providers: We share transaction data with the operators of the payment methods you use — including DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, and cryptocurrency network operators — to the extent necessary to process your transactions.
• Identity verification and KYC partners: We share identity document data with licensed third-party KYC verification service providers who are contractually bound to process your data solely for the purpose of verifying your identity on our behalf.
• Fraud prevention and AML service providers: We share relevant account and transaction data with fraud detection and anti-money laundering platform providers for screening purposes.
• Regulatory and law enforcement authorities: We will disclose personal data to competent authorities, including gaming regulators, financial intelligence units, and law enforcement agencies, where we are legally required or compelled to do so by a court of competent jurisdiction.
• Business successors: In the event of a merger, acquisition, or sale of all or substantially all of posototo's assets, your personal data may be transferred to the acquiring entity, subject to equivalent privacy protections.

posototo uses cookies and similar tracking technologies (including local storage and session tokens) on the Platform. These technologies serve the following functions:

• Strictly Necessary Cookies: Required for the Platform to function. These maintain your login session, preserve your account preferences, and prevent cross-site request forgery (CSRF) attacks. These cookies cannot be disabled without impairing Platform functionality.
• Analytics Cookies: Used to collect aggregated, anonymised information about how visitors use the Platform — which pages are visited most frequently, how long sessions last, and where users encounter errors. This data informs Platform improvement decisions.
• Fraud Prevention Tokens: Technical identifiers used by our fraud detection systems to recognise devices and flag unusual account activity. These are essential for protecting your account.
• Marketing and Preference Cookies: Used, with your consent, to personalise the content and promotional offers displayed to you on the Platform. You may withdraw consent for these cookies at any time through your account settings.

Most web browsers allow you to control cookie acceptance through their settings. Note that disabling certain cookies may limit your ability to use all features of the Platform. Strictly necessary cookies cannot be disabled through browser settings without logging out of your account.

posototo implements technical and organisational security measures proportionate to the sensitivity of the personal data we process. These measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the Platform is encrypted in transit. This is indicated by the padlock icon and "https://" prefix in your browser's address bar.
• Encryption at rest: Sensitive personal data stored in our systems — including KYC documents, payment account references, and identity information — is encrypted using industry-standard algorithms.
• Access controls: Internal access to personal data is restricted on a need-to-know basis. Staff with access to sensitive player data are subject to confidentiality obligations and receive regular privacy and security training.
• Two-factor authentication (2FA): posototo offers 2FA for all player accounts and strongly recommends its use to prevent unauthorised access.
• Regular security audits: Our infrastructure undergoes periodic third-party penetration testing and security reviews to identify and remediate vulnerabilities.
• Incident response: posototo maintains a data breach response plan. In the event of a security incident that is likely to result in risk to your rights and freedoms, we will notify you and the relevant authorities in accordance with applicable law.

While we take all reasonable steps to protect your data, no internet-based platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for logging out of the Platform when using shared or public devices.

posototo retains your personal data only for as long as is necessary for the purposes for which it was collected, or as required by law. The following retention periods apply:

• Account and transaction data: Retained for a minimum of five (5) years following the closure or termination of your account, in accordance with AML record-keeping obligations under our international gaming licence.
• KYC documents: Retained for a minimum of five (5) years from the date of submission, as required by applicable financial crime prevention regulations.
• Customer support communications: Retained for three (3) years from the date of the interaction, for quality assurance and dispute resolution purposes.
• Technical and analytics data: Aggregated and anonymised analytics data may be retained indefinitely. Identifiable technical logs (e.g., IP address logs) are retained for no longer than 12 months unless required for an ongoing investigation.
• Marketing consent records: Retained for the duration of your account's active period and for three (3) years thereafter, to evidence compliance with consent-based marketing obligations.

Where you request deletion of your personal data (and we are not legally required to retain it), we will permanently delete or irreversibly anonymise the relevant data within 30 days of receiving your verified request.

Subject to applicable law and our legal obligations as a licensed gambling operator, you have the following rights with respect to your personal data held by posototo. To exercise any of these rights, please contact our Data Protection team via live chat or at [email protected].

As an internationally licensed online gambling operator, posototo may process and store your personal data in jurisdictions outside Malaysia. This may occur when we use service providers — such as cloud infrastructure providers, KYC verification platforms, or payment processors — that operate in other countries.

Where such transfers occur, posototo ensures that appropriate safeguards are in place to protect your personal data, including:

• Data Processing Agreements incorporating standard contractual clauses that impose equivalent data protection obligations on the recipient;
• Transfer to jurisdictions that the relevant regulatory framework recognises as providing an adequate level of data protection;
• Technical security measures (encryption in transit and at rest) that apply regardless of the jurisdiction in which data is stored.

You may request further information about the specific safeguards applicable to any international transfer of your personal data by contacting our support team.

The posototo Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect, solicit, or process personal data from any person under the age of 21. Age verification is a mandatory step in our registration and KYC processes.

If posototo discovers or is notified that personal data has been collected from a person under 21 years of age, we will immediately suspend the relevant account, void any associated transactions, and delete or securely dispose of the personal data in question. If you believe that a person under 21 has provided data to posototo, please contact us immediately at [email protected].

The posototo Platform may contain references to or integrations with third-party services — including payment gateway interfaces for Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, DuitNow, and FPX — that are governed by their own privacy policies and terms of service.

When you are redirected to a third-party payment interface to complete a transaction, your interaction with that interface is subject to the privacy policy of the relevant financial service provider, not this Policy. posototo is not responsible for the privacy practices of third-party services and encourages you to review the privacy policies of any external services you use in connection with the Platform.

posototo reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law, or operational requirements. The "Last Updated" date at the top of this Policy will be revised accordingly whenever material changes are made.

For material changes that significantly affect how we process your personal data, we will notify you by email (to the address registered on your account) and/or by a prominent notice on the Platform at least 14 days before the changes take effect. For minor or clarificatory amendments, the updated Policy will be published on this page without advance notice.

Your continued use of the Platform following the effective date of any amendment to this Policy constitutes your acceptance of the amended terms. If you do not agree with any amendment, you must discontinue your use of the Platform and contact us to close your account.

If you have any questions about this Privacy Policy, wish to exercise your data subject rights, or want to raise a concern about how posototo handles your personal data, please contact our Data Protection team through the following channels:

Please include your registered account email address and a brief description of your request or concern when contacting us, to ensure prompt and accurate handling of your query.