Merahtoto Privacy Policy — How We Handle Your Data

This Privacy Policy ("Policy") describes how Merahtoto ("Company", "we", "us", "our") collects, processes, stores, discloses, and protects personal data relating to users ("User", "you", "your") of the merahtoto online platform accessible at https://merahtoto.cam ("Platform"). This Policy applies to all interactions with the Platform, including account registration, deposits, wagering activity, customer support communications, and browsing activity.

Merahtoto is committed to responsible and transparent data handling practices. We process personal data only for defined, legitimate purposes and take reasonable technical and organisational measures to protect the data entrusted to us by players across Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and all other parts of Malaysia.

By accessing the Platform and creating an account, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree with this Policy, you should discontinue use of the Platform immediately.

For the purposes of this Privacy Policy, the following terms have the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including name, identification number, contact details, financial information, and online identifiers such as IP addresses and device identifiers.
• "Processing" means any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, restriction, erasure, or destruction.
• "Data Controller" means Merahtoto, as the entity that determines the purposes and means of processing your personal data.
• "Data Processor" means a third party that processes personal data on behalf of Merahtoto pursuant to a data processing agreement, such as our payment gateway operators, cloud infrastructure providers, and customer support platform providers.
• "Consent" means a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your personal data for one or more specified purposes.
• "Cookies" means small text files placed on your device by the Platform for the purposes of session management, analytics, personalisation, and security.
• "KYC Data" means identity verification documents and related personal data collected in fulfilment of Know Your Customer obligations, including government-issued identification, proof of address, and source of funds documentation.
• "Sensitive Data" means personal data that warrants heightened protection due to its nature, including financial account details, identification document numbers, and responsible gambling self-declaration data.

Merahtoto collects personal data that is necessary to provide our services, meet legal obligations, and maintain the security and integrity of the Platform. The categories of personal data we collect are set out in the table below:

Merahtoto does not intentionally collect Special Categories of sensitive personal data (such as health data, religious beliefs, or political opinions) unless explicitly required for responsible gambling compliance or legal process.

We collect personal data through the following channels and mechanisms:

4.1 Direct Collection

Data you provide directly to us when you register an account, complete KYC verification, make a deposit or withdrawal, contact our customer support team via live chat, WhatsApp, or email, participate in promotions, or respond to surveys and feedback requests.

4.2 Automated Collection

Data collected automatically when you interact with the Platform, including through cookies, web beacons, pixel tags, server log files, and other tracking technologies. This includes your IP address, device identifiers, browser fingerprint, session activity, and in-game behaviour patterns.

4.3 Third-Party Sources

Data received from third parties in the course of providing our services, including:

• Payment providers (Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong) — transaction confirmation and payment status data;
• Identity verification service providers — confirmation of document authenticity and match results during KYC;
• Fraud and AML screening services — risk scores and sanction list match results;
• Analytics providers — aggregated behavioural data used for Platform improvement.

Merahtoto processes your personal data for the following specific, defined purposes:

1. Account Management: To create, maintain, and administer your merahtoto account, including verifying your identity, processing login sessions, and managing account settings and preferences.
2. Service Delivery: To enable you to place wagers, participate in live casino games, access the sportsbook (including Liga Super Malaysia, EPL, and other markets), deposit funds, and request withdrawals in MYR.
3. KYC and Regulatory Compliance: To verify your identity and age (21+) as required by applicable law, to conduct anti-money laundering (AML) checks, to screen against sanction lists, and to maintain records required by regulatory frameworks.
4. Fraud and Security: To detect, investigate, and prevent fraudulent transactions, account takeovers, bonus abuse, money laundering, and other prohibited activities as defined in our Terms and Conditions.
5. Customer Support: To respond to your enquiries, resolve disputes, process complaints, and maintain records of our communications with you for quality assurance purposes.
6. Responsible Gambling: To monitor your gambling activity for indicators of problem gambling behaviour, to administer deposit limits, self-exclusion requests, cooling-off periods, and reality checks, and to comply with responsible gambling obligations.
7. Platform Improvement: To analyse usage patterns, diagnose technical issues, test new features, and improve the overall performance, security, and user experience of the Platform for Malaysian players.
8. Marketing Communications: To send you promotional offers, bonus notifications, and platform updates where you have given your express consent. You may withdraw this consent at any time from your account notification settings.
9. Legal Obligations: To comply with applicable laws, respond to lawful requests from regulatory authorities or law enforcement, and to exercise or defend legal claims.

Merahtoto processes your personal data on the following legal bases, each of which applies to the respective processing activities described:

• Contractual Necessity: Processing required to perform the contract between you and merahtoto — including account management, deposit and withdrawal processing, and game access — is carried out on the basis that it is necessary to fulfil our contractual obligations to you.
• Legal Obligation: Processing required to comply with applicable laws, including KYC/AML obligations, age verification (21+), responsible gambling requirements, and responses to lawful regulatory or law enforcement requests.
• Legitimate Interests: Processing carried out on the basis of merahtoto's legitimate business interests, including fraud detection, platform security, analytics for service improvement, and responsible gambling monitoring — provided these interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing activities that depend on your explicit opt-in, primarily marketing communications. Where consent is the legal basis, you retain the right to withdraw it at any time without penalty.

Merahtoto does not sell your personal data. We may share your personal data with third parties only in the following strictly defined circumstances:

7.1 Service Providers (Data Processors)

We engage third-party service providers who process personal data on our behalf under written data processing agreements. These providers are permitted to use your data only for the specific purposes we have contracted them for. Categories of such providers include:

• Payment processing infrastructure (DuitNow, FPX network operators, card scheme processors);
• Cloud hosting and database services;
• Identity verification and KYC screening providers;
• AML and fraud detection platforms;
• Customer support and live chat platform providers;
• Email and SMS communication infrastructure providers.

7.2 Game Software Providers

Where you access games provided by third-party software developers integrated into the Platform, limited technical data (such as session tokens and game round identifiers) is shared with those providers solely to enable game functionality and resolve game-related disputes. No additional personal data is shared beyond what is technically necessary.

7.3 Legal and Regulatory Disclosure

Merahtoto may disclose your personal data to regulatory authorities, law enforcement agencies, courts, or other governmental bodies where required to do so by applicable law, court order, or in connection with an investigation into fraud, money laundering, or other illegal activity.

7.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or a substantial portion of our business assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and any material change to how your data is processed as a result.

Merahtoto uses cookies and similar tracking technologies to operate the Platform, enhance your experience, maintain session security, and gather analytics data. The categories of cookies used are as follows:

• Strictly Necessary Cookies: Required for the Platform to function correctly. These include session authentication cookies, CSRF protection tokens, and load-balancing cookies. These cannot be disabled without impairing your ability to use the Platform.
• Functional Cookies: Used to remember your preferences such as preferred language, last-visited game category, and notification settings. These enhance your experience but are not essential to core functionality.
• Analytical Cookies: Used to collect aggregated data about how users interact with the Platform, including pages visited, time on page, and navigation paths. This data helps us identify areas for improvement. We use privacy-focused analytics tools that do not profile individual users.
• Security Cookies: Used to detect and prevent fraudulent sessions, credential stuffing, and bot activity. These cookies form part of our platform security infrastructure.

You may control non-essential cookies through your browser settings. Please note that disabling functional cookies may affect your experience on the Platform. Strictly necessary and security cookies cannot be disabled, as they are essential to service operation and your account security.

Merahtoto does not use third-party advertising cookies or permit ad-tech networks to place tracking technologies on the Platform.

Merahtoto implements a layered approach to data security, combining technical, administrative, and physical measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Our security measures include:

• Encryption in Transit: All data transmitted between your device and our servers is protected using TLS 1.3 encryption. All Platform endpoints enforce HTTPS with HSTS headers.
• Encryption at Rest: Sensitive personal data, including KYC documents and financial records, is encrypted at rest using AES-256 encryption within our database infrastructure.
• Access Controls: Access to personal data within merahtoto is strictly limited on a need-to-know basis. All staff with access to personal data undergo background checks and regular data protection training.
• Two-Factor Authentication: All merahtoto system administrator accounts require multi-factor authentication. We strongly recommend all users enable 2FA on their accounts.
• Payment Data Security: We are PCI-DSS compliant for card data handling. Full card numbers are never stored on merahtoto systems — payment data is tokenised at the point of entry via our certified payment gateway providers.
• Incident Response: We maintain a documented data breach response plan. In the event of a data breach affecting your personal data, we will notify affected users and, where required, applicable regulatory authorities within the legally required timeframe.

No data transmission over the internet is entirely without risk. While we take all reasonable steps to protect your data, we cannot guarantee the absolute security of data transmitted to or from the Platform. You are responsible for maintaining the security of your account credentials.

Merahtoto retains personal data for the minimum period necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by law. The following retention periods apply:

Following the expiry of the applicable retention period, personal data is either permanently deleted from our systems or, where deletion is not technically feasible for specific records, irreversibly anonymised so that it can no longer be associated with any identified or identifiable individual.

As a user whose personal data is processed by merahtoto, you hold the following rights in relation to your personal data. You may exercise any of these rights by contacting us at [email protected] (plain text — not a link):

1. Right of Access: You have the right to request a copy of the personal data that merahtoto holds about you, together with information about how that data is being processed. We will respond to verified access requests within 30 days.
2. Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request correction. For most account data, you can update information directly in your account settings. For KYC-related corrections, contact our support team.
3. Right to Erasure ("Right to be Forgotten"): You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where consent has been withdrawn (and there is no other legal basis for processing), or where processing is unlawful. Please note that we may be required to retain certain data for legal compliance purposes even following an erasure request — we will inform you of any such limitation.
4. Right to Restriction: You may request that we restrict processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or where you have objected to processing pending verification of our legitimate grounds.
5. Right to Data Portability: Where processing is based on consent or contractual necessity, and is carried out by automated means, you may request that we provide your personal data in a structured, commonly used, machine-readable format, or that we transfer it directly to another data controller where technically feasible.
6. Right to Object: You have the right to object at any time to processing of your personal data where that processing is based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, or where processing is necessary for legal claims.
7. Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to the withdrawal. Marketing opt-outs take effect within 48 hours.

We will respond to all data rights requests without undue delay and within 30 days of receipt of a verified request. Where the complexity or volume of requests requires an extension, we will notify you within 30 days and provide a revised timeline. Most requests are processed free of charge; however, we reserve the right to charge a reasonable administrative fee for manifestly unfounded or excessive requests.

The merahtoto Platform is strictly for adults aged 21 years and above. We do not knowingly collect, solicit, or process personal data from any person under the age of 21. Age verification is a mandatory step in the account registration process and is enforced again prior to processing withdrawal requests.

If we become aware that we have inadvertently collected personal data from a person under 21, we will take immediate steps to delete that data, close the associated account, and return any deposited funds to the originating payment method following a fraud review. If you believe that a person under 21 has created an account on our Platform, please notify us immediately at [email protected] (plain text — not a link).

Parents and guardians are encouraged to make use of internet filtering and parental control tools to prevent minors from accessing online gambling platforms. Merahtoto supports the use of such tools and provides guidance on responsible gambling resources on our Responsible Gambling page.

Merahtoto operates as a platform serving Malaysian users. Some of our service providers and technology partners are located in countries outside Malaysia. Where personal data is transferred outside of Malaysia in connection with the provision of our services, we take appropriate measures to ensure that such transfers comply with applicable data protection requirements and that adequate safeguards are in place to protect your personal data.

Such safeguards may include contractual data protection clauses in our agreements with recipient service providers, ensuring that recipient entities maintain data security standards at least equivalent to those described in this Policy.

We will not transfer your personal data to countries or territories that do not provide an adequate level of data protection without first implementing appropriate safeguards and, where required, obtaining your consent.

Merahtoto reserves the right to update or amend this Privacy Policy at any time. We will notify registered users of material changes via email to the address on file and/or through a prominent notice on the Platform, at least 14 days before the changes take effect — except where immediate changes are required for legal, security, or regulatory reasons.

The "Last Updated" date at the top of this document reflects the most recent revision. Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Policy. We encourage you to review this Policy periodically to stay informed about how we are protecting your personal data.

Previous versions of this Privacy Policy are available upon written request to [email protected] (plain text — not a link).

If you have any questions, concerns, or complaints regarding this Privacy Policy or merahtoto's data processing practices, please contact us through the following channels. All privacy-related correspondence will be handled with strict confidentiality:

• Email: [email protected] (plain text — not a clickable link). Please use the subject line "Privacy Enquiry — [Your Account Username]" for faster routing. We aim to acknowledge all privacy enquiries within 24 hours and provide a substantive response within 7 business days.
• Live Chat: Available 24/7 via the Platform. Our support team can handle routine privacy enquiries directly, or escalate complex requests to our data protection team. Available in English, Mandarin, and Bahasa Melayu.
• WhatsApp: Available 24/7 for English, Bahasa Melayu, and Mandarin support. Details available after account login.

For formal data rights requests (access, erasure, portability, rectification, restriction, objection), please contact us via email with the subject line "Data Rights Request — [Your Account Username]" and include sufficient information for us to verify your identity and locate your account records.