Privacy Policy — iyatoto

1 Introduction

This Privacy Policy ("Policy") describes how iyatoto ("we", "us", "our", "Platform") collects, processes, stores, uses, and protects the personal data of users ("you", "Player", "Member") who access and use the iyatoto online gaming platform atiyatoto.cam, including all associated services, mobile-optimised interfaces, and communications channels.

iyatoto is committed to handling your personal data with transparency, integrity, and respect. We recognise that our players trust us with sensitive information — including identity documents, payment details, and account activity — and we take that responsibility seriously. This Policy is designed to give you a clear and complete picture of our data practices so you can make informed decisions about your use of the platform.

This Policy should be read together with our Terms and Conditions and Responsible Gambling Policy, both of which form part of the overarching agreement between you and iyatoto.

2 Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" — any information that identifies or can reasonably be used to identify a living individual, directly or in combination with other data. This includes your name, email address, date of birth, payment details, and device identifiers.
• "Processing" — any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" — the entity that determines the purposes and means of processing personal data. For the purposes of this Policy, iyatoto acts as Data Controller in respect of all Member personal data.
• "Data Processor" — a third party that processes personal data on behalf of the Data Controller in accordance with documented instructions (e.g., payment processors, KYC verification providers).
• "Sensitive Data" — a subset of personal data requiring heightened protection, including government-issued identification numbers, financial account details, and biometric data submitted for identity verification purposes.
• "Cookie" — a small data file placed on your device by a website to store information about your session, preferences, or behaviour for subsequent use.
• "KYC" — Know Your Customer. The identity and document verification process conducted in compliance with anti-money laundering obligations and platform integrity requirements.

3 Data We Collect

iyatoto collects the following categories of personal data from Members and prospective Members:

3.1 Registration & Account Data

• Full legal name as it appears on government-issued identification;
• Date of birth (to verify the21+ minimum age requirement);
• Email address and contact telephone number;
• Residential address (including city, state, and postcode);
• Username and encrypted password credentials;
• Preferred currency (Malaysian Ringgit / MYR by default).

3.2 Identity Verification (KYC) Data

• Copies of government-issued photo identification (e.g., Malaysian MyKad, passport, driver's licence);
• Proof of residential address (e.g., utility bill, bank statement, dated within three months);
• Selfie photograph with identification document;
• Proof of ownership of payment methods used for deposits.

3.3 Financial & Transaction Data

• Deposit and withdrawal transaction records including amount, method, date, and status;
• Payment method identifiers (e.g., masked bank account numbers, e-wallet IDs for Touch'n Go, Boost, GrabPay, Maybank, CIMB, DuitNow, FPX);
• Cryptocurrency wallet addresses where crypto deposits (BTC, ETH, USDT, LTC) are used;
• Bonus redemption history and VIP tier progression records.

3.4 Gaming & Behavioural Data

• Game play history including bet amounts, game categories, wager outcomes, and session durations;
• Sports betting selections, odds accepted, and market preferences;
• Login timestamps, session length, and platform navigation patterns;
• Responsible gambling tool usage (deposit limits set, self-exclusion requests, cooling-off periods).

3.5 Technical & Device Data

• IP address and geolocation data (country and city level);
• Device type, operating system, browser type and version;
• Unique device identifiers;
• Cookie and session data as described in Section 8.

3.6 Communications Data

• Records of live chat support interactions, email correspondence, and complaint submissions;
• Marketing communication preferences and opt-in/opt-out records.

4 How We Collect Data

iyatoto collects personal data through the following channels and mechanisms:

• Direct provision: Information you voluntarily submit during account registration, the KYC verification process, payment setup, form submissions, or live support interactions;
• Automated platform activity: Technical and behavioural data collected automatically as you navigate and interact with the platform, including via cookies and server-side logging;
• Payment providers: Transaction confirmation data received from payment processors including FPX, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, Visa, Mastercard, and cryptocurrency network confirmations;
• Identity verification services: Data outputs from third-party KYC service providers engaged to verify Member identity and document authenticity;
• Fraud detection systems: Risk signals and behavioural indicators from automated fraud prevention tools operating within the platform.

5 Data Processing & Use

iyatoto processes Member personal data for the following specific purposes:

6 Legal Basis for Processing

iyatoto processes your personal data on the following legal bases:

• Contractual necessity: Processing required to fulfil our obligations under the Member agreement, including account creation, payment processing, and game delivery;
• Legal obligation: Processing required to comply with our obligations under applicable anti-money laundering regulations, licensing conditions, and responsible gambling frameworks;
• Legitimate interests: Processing necessary for fraud prevention, platform security, service improvement, and responsible gambling monitoring — where these interests do not override your fundamental rights;
• Consent: Where you have explicitly opted in to marketing communications or the use of non-essential cookies, we process that data on the basis of your consent, which you may withdraw at any time.

7 Data Sharing & Disclosure

iyatoto does not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes. We share personal data only in the following limited and necessary circumstances:

• Payment service providers: Transaction data is shared with payment processors (including those operating FPX, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, Visa, Mastercard, and cryptocurrency networks) solely to facilitate deposit and withdrawal processing;
• KYC and identity verification providers: Identity document data is shared with third-party KYC service providers engaged to verify member identity and age in accordance with our compliance obligations;
• Fraud prevention and security services: Technical and behavioural data may be shared with fraud detection service providers operating as Data Processors under contractual data protection obligations;
• Game content providers: Aggregated, anonymised gameplay data may be shared with game software providers for game performance monitoring and technical support purposes;
• Regulatory and legal authorities: Where required by applicable law, a court order, or regulatory directiveiyatoto may disclose personal data to relevant authorities. We will notify affected Members where legally permitted to do so;
• Business transfers: In the event of a merger, acquisition, or sale of assets involving iyatoto, Member personal data may be transferred to the successor entity, subject to the same privacy obligations set out in this Policy.

All third-party Data Processors engaged by iyatoto are subject to contractual data processing agreements that require them to handle Member data confidentially, use it only for the specified purpose, and implement appropriate technical and organisational security measures.

8 Cookies & Tracking Technologies

iyatoto uses cookies and similar tracking technologies to provide, maintain, and improve the platform experience. The following cookie categories are used:

• Strictly necessary cookies: Required for core platform functionality including authentication sessions, security tokens, and load balancing. These cannot be disabled without impairing platform access.
• Functional cookies: Remember your preferences such as language, display settings, and game lobby filters across sessions.
• Analytics cookies: Collect aggregated, anonymised data about how Members navigate the platform to help us identify areas for improvement. These do not identify you personally.
• Marketing cookies (opt-in only): Used to tailor promotional communications and bonus offers based on your gaming activity and preferences. These are only activated with your explicit consent.

Most browsers allow you to manage cookie settings through the browser's privacy or settings menu. Disabling certain cookies may affect your ability to use specific platform features. Your cookie preferences can be updated at any time through your account settings or by contacting our support team.

9 Data Retention

iyatoto retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, and compliance obligations. Specific retention periods include:

• Active account data: Retained for the duration of your membership and for a period of at least five (5) years following permanent account closure, in accordance with anti-money laundering record-keeping requirements;
• KYC and identity verification documents: Retained for a minimum of five (5) years from the date of verification completion, as required under applicable regulatory frameworks;
• Financial transaction records: Retained for a minimum of five (5) years following each transaction;
• Support and communications records: Retained for three (3) years following the date of the communication or resolution of any associated complaint;
• Marketing data: Retained until you withdraw consent or opt out of marketing communications, after which marketing-specific data is deleted within thirty (30) days.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our internal data disposal procedures.

10 Security Measures

iyatoto implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, and misuse:

• 256-bit SSL/TLS encryption: All data transmitted between your device and theiyatoto platform is encrypted in transit using industry-standard TLS protocols;
• At-rest encryption: Sensitive personal data stored in our systems — including KYC documents and payment details — is encrypted at rest;
• Two-factor authentication (2FA): Available to all Members as an additional account security layer beyond username and password;
• Access controls: Access to Member personal data withiniyatoto's internal systems is restricted to personnel with a legitimate operational need, on a role-based access control basis;
• Regular security audits: The platform undergoes periodic penetration testing and security reviews to identify and remediate vulnerabilities;
• Fraud monitoring: Automated fraud detection systems continuously monitor account activity for anomalous patterns indicative of unauthorised access or malicious activity.

11 Your Rights

As a Member whose personal data is processed by iyatoto, you hold the following rights in respect of your personal data. To exercise any of these rights, please contact our support team via live chat or email:

• Right of Access: You may request a copy of the personal data iyatoto holds about you, together with information about how it is used and with whom it is shared;
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data held in your Account;
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected and no legal retention obligation applies. Note that regulatory and AML retention requirements may prevent full erasure in some cases;
• Right to Restriction of Processing: You may request that we limit how we process your data in certain circumstances, such as where you contest its accuracy;
• Right to Data Portability: Where technically feasible, you may request that personal data you provided to us be transferred to you or to another service provider in a structured, machine-readable format;
• Right to Object: You may object to processing based on legitimate interests, including the use of your data for direct marketing purposes. We will cease such processing unless we can demonstrate compelling legitimate grounds;
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

We aim to respond to all data rights requests within thirty (30) calendar days of receipt. Complex requests may require an extension of up to a further sixty (60) days, in which case we will notify you of the extension and the reason for it.

12 Children & Minors

The iyatoto platform is strictly intended for adult players aged21 years and above. We do not knowingly collect, process, or retain personal data from any individual under the age of 21. All accounts undergo age verification during the KYC process, and registration is immediately rejected or suspended where a Member is found to be below the minimum age.

If we become aware that personal data has been inadvertently collected from a person under the age of 21, we will immediately delete all such data and close the associated account. If you believe a minor has registered an account on the platform, please contact our support team immediately at [email protected].

13 Third-Party Links

The iyatoto platform may contain references or links to third-party services, such as payment provider portals accessed during deposit or withdrawal flows. These third-party services operate independently of iyatoto and are governed by their own privacy policies and data practices.

iyatoto is not responsible for the privacy practices, security standards, or content of any third-party service. We encourage you to review the privacy policies of any third-party services you interact with through or alongside the iyatoto platform.

14 Policy Amendments

iyatoto reserves the right to update or amend this Privacy Policy at any time. Where changes are material — such as modifications to the categories of data collected, the purposes of processing, or the rights available to Members — we will notify registered Members by email and display a prominent notice on the platform prior to the changes taking effect.

The "Last Updated" date at the top of this Policy reflects the date on which the most recent version became effective. Your continued use of the platform following the effective date of any amendment constitutes your acceptance of the updated Policy. We recommend reviewing this page periodically to stay informed of any changes.

15 Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or wish to submit a complaint regarding our handling of your personal data, please contact us through the following channels:

• Live Chat: Available 24/7 directly within the iyatoto platform — fastest channel for most account and data queries;
• Email: [email protected] — formal data rights requests and complaints. We aim to acknowledge receipt within two (2) business days and resolve within thirty (30) calendar days.

Our support team includes personnel with specific data privacy responsibilities who handle all personal data queries with appropriate care and confidentiality. Formal complaints are reviewed by senior platform management.

Where you are not satisfied with our response to a data complaint, you may refer the matter to the data protection supervisory authority applicable to your jurisdiction of residence or the platform's licensing jurisdiction.