Privacy Policy — Mikitoto

This Privacy Policy ("Policy") is published by Mikitoto ("Company", "we", "us", "our"), the operator of the online gaming platform accessible at https://mikitoto.cam (the "Platform"). Mikitoto is an English-language online casino and sports betting platform designed and marketed for the Malaysian market, including players in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and surrounding areas.

This Policy describes how Mikitoto collects, uses, stores, discloses, and protects the personal data of individuals who visit, register on, or use the Platform ("you", "User", "Member"). It applies to all personal data we process in connection with the provision of our gaming services, customer support, payment processing, and related activities.

By accessing the Platform or creating an account, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree to this Policy, you must not use the Platform.

This Policy should be read alongside our Terms & Conditions and our Responsible Gambling guidelines, both of which form part of the contractual relationship between you and Mikitoto.

For the purposes of this Privacy Policy, the following terms carry the meanings assigned to them below:

• "Personal Data" means any information relating to an identified or identifiable natural person — including but not limited to name, email address, phone number, identification number, payment details, and device identifiers.
• "Data Processing" means any operation performed on Personal Data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data — in this context, Mikitoto.
• "Data Processor" means a third party that processes Personal Data on behalf of the Data Controller — for example, our payment gateway providers.
• "KYC" means Know Your Customer — the identity verification process required to confirm a Member's identity and comply with anti-money laundering (AML) obligations.
• "Cookies" means small data files stored on your device by your browser when you visit the Platform.
• "MYR" means Malaysian Ringgit, the primary transaction currency of the Platform.

Mikitoto collects personal data only to the extent necessary to provide our services, comply with applicable regulations, and maintain the security of the Platform. The categories of personal data we collect include:

3.1 Registration & Identity Data

When you create a Mikitoto account, we collect your full legal name, date of birth, Malaysian residential address, email address, and mobile phone number. This information is necessary to establish your account identity and verify that you meet our eligibility requirements, including the minimum age of 21 years.

3.2 KYC Verification Documents

To comply with our anti-money laundering (AML) obligations and to unlock full withdrawal privileges, we may collect copies of your valid Malaysian NRIC (MyKad), Driver's Licence, or Passport; a proof of residential address document dated within the last three months (such as a utility bill or bank statement); and a selfie photograph holding your identification document. Payment method verification documents — such as a screenshot of your registered e-wallet or bank account — may also be collected.

3.3 Financial & Transaction Data

We collect records of all deposits, withdrawals, and wagering activity on your account. This includes transaction amounts in MYR, the payment methods used (such as Touch 'n Go eWallet, Boost, GrabPay, Maybank2u, CIMB Clicks, Public Bank Online, Hong Leong Connect, DuitNow, and FPX), transaction timestamps, and any associated reference numbers. We do not store complete payment card numbers or full bank account credentials on our servers.

3.4 Technical & Usage Data

We automatically collect certain technical data when you access the Platform, including your IP address, browser type and version, operating system, device type, session duration, pages visited, game activity logs, and referring URLs. This data is used to maintain Platform security, optimise user experience, and comply with regulatory requirements.

3.5 Communication Data

If you contact our support team via live chat, email, or any other communication channel, we retain records of those interactions, including timestamps and the content of the exchange, for customer service quality, dispute resolution, and regulatory compliance purposes.

Mikitoto collects personal data through the following channels and mechanisms:

• Directly from you — through account registration forms, KYC document upload portals, deposit and withdrawal requests, support communications, and voluntary profile updates.
• Automatically — through cookies, web beacons, server logs, and other tracking technologies when you browse or interact with the Platform.
• From payment service providers — transaction confirmation data and payment status information received from Malaysian payment processing partners (e.g., DuitNow, FPX, e-wallet gateways).
• From identity verification services — where we use third-party KYC tools to assist in document verification, such services may return verification status data to us.
• From fraud prevention systems — automated risk scoring and fraud detection services may provide signals that inform our security decision-making.

Mikitoto processes your personal data for the following specific purposes. Each purpose is associated with a lawful basis for processing as described in Section 6 of this Policy.

Mikitoto processes personal data only where a recognised legal basis exists. The primary legal bases applicable to our processing activities are:

• Contract Performance: Processing that is necessary to fulfil our obligations to you as a registered Member — including account management, payment processing, and game provision.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including anti-money laundering (AML) requirements, identity verification mandates, and regulatory reporting obligations.
• Legitimate Interest: Processing that serves Mikitoto's legitimate business interests — such as fraud prevention, Platform security, and improving our services — where those interests are not overridden by your rights and freedoms.
• Consent: Where we send you promotional or marketing communications, we do so only with your explicit consent. You may withdraw this consent at any time by updating your communication preferences in your account settings or contacting support.

Mikitoto does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. We may share your personal data with carefully selected third parties only in the following circumstances:

7.1 Payment Processing Partners

To process deposits and withdrawals in MYR, we share necessary transaction data with our licensed payment processing partners. These include the operators behind Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank Online, and Hong Leong Connect. Data shared is limited to what is strictly necessary to complete the transaction.

7.2 Identity Verification Service Providers

We may engage regulated third-party KYC and identity verification service providers to assist in the verification of your identity documents. These providers operate under strict data processing agreements and are permitted to use your data only for the purpose of verification on our behalf.

7.3 Regulatory and Law Enforcement Authorities

We may disclose personal data to relevant authorities — including financial regulators, tax authorities, law enforcement agencies, and courts — where we are legally required to do so, or where disclosure is necessary to protect the rights, property, or safety of Mikitoto, our Members, or the public.

7.4 Corporate Transactions

In the event of a merger, acquisition, corporate restructuring, or sale of assets involving Mikitoto, personal data held by the Platform may be transferred as part of that transaction, subject to equivalent data protection commitments being maintained by the acquiring entity.

Mikitoto retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations.

• Account and identity data is retained for the duration of your active membership and for a minimum of five (5) years following account closure, in compliance with AML and regulatory record-keeping requirements.
• Transaction records (deposits, withdrawals, betting history) are retained for a minimum of five (5) years from the date of each transaction.
• KYC documents are retained in accordance with applicable legal requirements, typically five (5) years from the end of the business relationship.
• Support communication records are retained for a minimum of two (2) years from the date of the last interaction.
• Technical and usage logs are typically retained for up to twelve (12) months for security monitoring purposes, after which they are deleted or anonymised.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. You may request early deletion of your data subject to legal retention obligations — see Section 11 (User Rights) for further details.

Mikitoto uses cookies and similar technologies to operate and improve the Platform, maintain session security, and understand how players use our services. By continuing to use the Platform after being presented with our cookie notice, you consent to our use of cookies as described below.

9.1 Types of Cookies We Use

• Essential Cookies: Strictly necessary for the Platform to function correctly — including session authentication, security tokens, and CSRF protection. These cannot be disabled without impairing platform functionality.
• Functional Cookies: Remember your preferences, such as language settings and display choices, to personalise your experience.
• Analytics Cookies: Collect anonymous statistical data about Platform usage to help us understand user behaviour and improve our services. Data collected by analytics cookies does not personally identify you.
• Security Cookies: Used by our fraud detection and bot-prevention systems to differentiate between genuine human players and automated scripts.

9.2 Managing Cookies

You may control and manage cookie preferences through your web browser settings. Most browsers allow you to refuse non-essential cookies or delete existing cookies. Please note that disabling essential cookies may affect your ability to log in or use certain features of the Platform. Consult your browser's help documentation for instructions on managing cookie settings.

Mikitoto implements a comprehensive range of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. Our security framework includes:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Platform.
• Encryption at rest for sensitive stored data, including KYC documents and payment records.
• Two-factor authentication (2FA) available for all Member accounts to provide an additional layer of access control.
• Restricted internal access controls ensuring that employee access to personal data is granted on a need-to-know basis only, with appropriate logging and audit trails.
• Regular security assessments and vulnerability testing to identify and remediate potential weaknesses in the Platform's infrastructure.
• Incident response procedures — in the event of a data breach that poses a risk to your rights, Mikitoto will notify affected Members and relevant authorities in a timely manner.

While we take all reasonable steps to protect your data, no internet transmission or electronic storage system is completely impervious to risk. We encourage Members to use strong, unique passwords, enable two-factor authentication, and report any suspected unauthorised access to their account immediately by contacting [email protected].

As a data subject, you have a number of rights in relation to your personal data held by Mikitoto. These rights are described below. To exercise any of these rights, please submit a written request to [email protected]. We will respond within a reasonable timeframe and in any event within thirty (30) days of receiving your request.

Please note that some rights are subject to limitations under applicable law — for example, we may be required by AML regulations to retain certain records even following an account closure or erasure request. We will always explain clearly if a limitation applies to your request.

The Mikitoto Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect, process, or retain personal data from persons under the age of 21.

Age verification is performed during the account registration process and reinforced through our KYC document verification procedures. If Mikitoto becomes aware that personal data has been collected from a person under the age of 21, we will take immediate steps to suspend the associated account, delete the personal data collected, and return any deposited funds in accordance with our Terms & Conditions.

The Mikitoto Platform may contain references to, or integrations with, third-party services — including our payment processing partners such as Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and the online banking portals of Maybank, CIMB, Public Bank, and Hong Leong. When you interact with these third-party services — for example, when completing a payment transaction through DuitNow or logging into your bank's FPX portal — you are subject to that third party's own privacy policy and terms of service.

Mikitoto is not responsible for the privacy practices or data handling of third-party services, and we encourage you to review the relevant privacy policies of any third-party provider you interact with in connection with your Mikitoto account.

Mikitoto reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. When material changes are made, we will update the "Last Updated" date at the top of this page and, where appropriate, notify registered Members via email or an in-Platform notification.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data. Your continued use of the Platform following the posting of any amended Policy constitutes your acceptance of the revised terms.

If you have any questions, concerns, or requests regarding this Privacy Policy or the way Mikitoto handles your personal data, please contact our Data Protection team using the details below. We are committed to responding to all privacy-related enquiries promptly and transparently.

For requests related to account data access, rectification, or deletion, please include your full registered name, email address, and account username in your communication so we can locate your records efficiently and verify your identity before processing the request.