Privacy Policy

01 Introduction

This Privacy Policy ("Policy") is published by ojktoto ("Company", "we", "us", "our"), the operator of the online gaming and sports betting platform accessible at https://ojktoto.cam ("Platform"). It describes how we collect, use, store, disclose, and protect the personal data of individuals ("Users", "Players", "you") who access or use our Platform.

This Policy applies to all personal data processed in connection with your use of the ojktoto Platform, including data collected during account registration, identity verification (KYC), financial transactions, customer support interactions, and general Platform usage. It should be read in conjunction with our Terms and Conditions, which govern the contractual relationship between you and ojktoto.

By registering an account on ojktoto or by continuing to use the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, you should not use the Platform and should contact us to close your account.

02 Definitions

For the purposes of this Privacy Policy, the following terms have the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, identification number, location data, email address, phone number, and financial account details.
• "Processing" means any operation or set of operations performed on personal data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, and deletion.
• "Data Controller" means the entity that determines the purposes and means of processing personal data. For the purposes of this Policy, ojktoto is the Data Controller.
• "Data Processor" means a third party that processes personal data on behalf of the Data Controller under a written agreement.
• "KYC" or "Know Your Customer" means the identity verification process required by ojktoto to confirm a User's identity and age prior to authorising withdrawal transactions or as otherwise required by applicable regulatory obligations.
• "Cookies" means small text files placed on your device by a website that enable the website to remember information about your visit, preferences, and usage patterns.
• "Sensitive Personal Data" means personal data requiring heightened protection under applicable law, including financial information, government-issued identification numbers, and data relating to health or criminal history.

03 Data Controller

ojktoto is the Data Controller responsible for the personal data collected through this Platform. As Data Controller, we determine the purposes for which personal data is collected and the manner in which it is processed.

Where we engage third-party service providers — such as payment processors, fraud prevention services, or analytics providers — to process personal data on our behalf, those providers act as Data Processors and are bound by written data processing agreements that require them to process data only in accordance with our instructions and to implement appropriate technical and organisational security measures.

For all data-related enquiries, requests to exercise your rights, or concerns about how ojktoto handles your personal information, please contact us using the details provided in Section 15 of this Policy.

04 Data We Collect

ojktoto collects personal data through several channels: directly from you when you register and use the Platform, automatically through your use of the Platform, and from third parties where applicable. The categories of data we collect are set out in the table below.

05 How We Use Your Data

ojktoto processes your personal data for the following specific purposes:

Account Management & Service Delivery

• To create, maintain, and manage your account on the Platform.
• To process deposits and withdrawals via your chosen payment method, including Touch 'n Go eWallet, GrabPay, Boost, DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank Online, and USDT.
• To provide access to sports betting markets, live casino games, slots, and all other Platform services.
• To deliver customer support via live chat, email, and other communication channels.

Identity Verification & Compliance

• To verify your identity and age (21+ requirement) through the KYC process prior to authorising withdrawals or where otherwise required.
• To comply with applicable anti-money laundering (AML) regulations, including monitoring transactions for suspicious activity and reporting to relevant authorities as required by law.
• To prevent, investigate, and respond to fraud, abuse of promotional terms, or any other activity that violates our Terms and Conditions.

Platform Improvement & Analytics

• To analyse Platform usage patterns in aggregate to identify technical issues, improve user experience, and guide product development decisions.
• To personalise your Platform experience, including recommending games or promotions that match your preferences, where you have consented to such personalisation.

Responsible Gambling

• To monitor account activity for indicators of problematic gambling behaviour and to administer responsible gambling tools, including deposit limits, loss limits, cool-off periods, and self-exclusion.
• To maintain records of self-exclusion requests and enforce exclusion periods to prevent re-registration during active exclusion windows.

Legal & Regulatory Obligations

• To retain records of all transactions and account activity as required by applicable regulatory and licensing obligations.
• To respond to lawful requests from competent authorities, including regulatory bodies, law enforcement agencies, and courts of competent jurisdiction.

06 Legal Basis for Processing

ojktoto processes your personal data on the following legal bases:

• Contractual necessity: Processing is required to perform our contractual obligations under the Terms and Conditions, including account creation, transaction processing, and service delivery.
• Legal obligation: Processing is required for compliance with applicable legal and regulatory obligations, including KYC verification, AML monitoring, and record-keeping mandates.
• Legitimate interests: Processing is necessary for purposes of fraud prevention, platform security, responsible gambling monitoring, and the general improvement of our services, where those interests are not overridden by your rights and interests.
• Consent: Where we seek to process your data for purposes not covered by the above bases — such as optional marketing communications or non-essential personalisation — we will obtain your explicit consent in advance. You may withdraw such consent at any time without affecting the lawfulness of prior processing.

07 Data Sharing & Disclosure

ojktoto does not sell, rent, or trade your personal data to any third party for commercial, advertising, or marketing purposes. Data is shared externally only in the following circumstances and with appropriate safeguards in place:

• Payment Processors: Transaction data is shared with our verified Malaysian payment partners (including Touch 'n Go eWallet, GrabPay, Boost, DuitNow, FPX, and major Malaysian bank platforms) solely to process your requested financial transactions. These partners are contractually prohibited from using your data for any purpose other than transaction processing.
• Identity Verification Providers: KYC documentation may be processed by specialist identity verification service providers who assist us in verifying the authenticity of documents submitted. These providers are bound by strict data processing agreements.
• Fraud Prevention Services: Aggregated technical and behavioural data may be shared with third-party fraud prevention platforms to identify and mitigate fraudulent activity, in accordance with our legitimate interest in maintaining platform integrity.
• Legal & Regulatory Authorities: We may disclose personal data to competent regulatory bodies, law enforcement agencies, financial intelligence units, or courts where required by a lawful order, applicable legislation, or regulatory direction. We will endeavour to notify you of such disclosure where legally permitted to do so.
• Business Transfers: In the event of a merger, acquisition, or sale of all or a portion of ojktoto's business assets, personal data held by us may be transferred to the acquiring entity as part of that transaction, subject to equivalent data protection commitments.

08 Payment Data & Financial Information

ojktoto integrates with verified Malaysian payment service providers to facilitate deposits and withdrawals. These providers include Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX (Financial Process Exchange), Maybank2u, CIMB Clicks, Public Bank Online, Hong Leong Connect, and USDT cryptocurrency networks.

When you initiate a payment transaction, you will typically be redirected to the relevant payment provider's secure interface to complete the transaction. ojktoto does not directly capture or store your banking passwords, full card numbers, or CVV codes. The payment reference information returned to us following a completed transaction — such as a transaction ID or masked account identifier — is stored solely to maintain an accurate financial record of your account activity.

For USDT cryptocurrency deposits, wallet address information is collected to facilitate processing and to maintain a record of cryptocurrency transactions associated with your account in accordance with AML obligations.

09 Cookies & Tracking Technologies

ojktoto uses cookies and similar tracking technologies to operate the Platform, improve functionality, and understand how users interact with our services. The following categories of cookies are used:

Essential Cookies

These cookies are strictly necessary for the Platform to function. They manage user authentication (keeping you logged in), maintain session state across pages, and support essential security functions including CSRF protection. These cookies cannot be disabled without impairing core Platform functionality.

Analytics & Performance Cookies

These cookies collect information about how users navigate the Platform — including pages visited, time spent per page, and error messages encountered. This data is used in aggregate and anonymised form to identify performance issues and guide product improvements. You may opt out of analytics cookies by adjusting your browser settings, though this will not affect Platform functionality.

Preference Cookies

These cookies store your Platform preferences — such as language settings, display preferences, and your most recently used payment method — to provide a more personalised experience on return visits.

You can manage cookie preferences through your browser settings. Most modern browsers allow you to refuse new cookies, delete existing cookies, and configure alerts when new cookies are set. Note that restricting essential cookies may affect your ability to use certain Platform features.

10 Data Retention

ojktoto retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law or regulation. The following retention periods apply as a general guide:

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised such that it can no longer be associated with any identified individual. Data that has been anonymised in this manner may be retained indefinitely for statistical and analytical purposes.

11 Data Security

ojktoto implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, alteration, disclosure, loss, and destruction. These measures include, but are not limited to:

• 256-bit SSL/TLS encryption for all data transmitted between your device and our servers;
• Encryption of sensitive data fields at rest within our database infrastructure;
• Role-based access controls limiting employee access to personal data to only those with a legitimate operational need;
• Multi-factor authentication requirements for all internal system access;
• Regular independent security assessments and penetration testing of our Platform infrastructure;
• Comprehensive audit logging of all access to personal data stores;
• Physical security controls governing access to data processing facilities.

While we take all reasonable steps to secure your personal data, no method of transmission over the internet or method of electronic storage is entirely infallible. In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the relevant authorities without undue delay, in accordance with applicable law.

12 Your Data Rights

Subject to applicable data protection law, you have the following rights in respect of your personal data held by ojktoto. To exercise any of these rights, please contact our support team via the channels listed in Section 15.

• Right of Access: You have the right to request a copy of the personal data we hold about you, together with information about how it is processed.
• Right of Rectification: You have the right to request correction of any inaccurate or incomplete personal data we hold about you. For account information such as email address or phone number, updates can also be made directly through your account settings.
• Right of Erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where processing is unlawful. This right is subject to our legal and regulatory retention obligations, which may require us to retain certain data notwithstanding an erasure request.
• Right to Restrict Processing: You have the right to request that we temporarily restrict the processing of your personal data while a query or complaint is being resolved.
• Right to Data Portability: Where processing is based on your consent or on a contractual basis, you have the right to receive a copy of the personal data you have provided to us in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing based on our legitimate interests. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing conducted prior to withdrawal.

We will respond to all verified rights requests within thirty (30) calendar days of receipt. Where a request is complex or numerous, this period may be extended by a further 30 days, and we will inform you of such extension within the initial 30-day period.

13 Minors & Age Restriction

The ojktoto Platform is strictly restricted to individuals who are at least twenty-one (21) years of age. We do not knowingly collect personal data from persons under this age. Account registration requires confirmation of age, and identity verification documents are requested prior to authorising any withdrawal.

Where we become aware that personal data has been collected from a person under the age of 21 — whether through a false declaration at registration or otherwise — we will take immediate steps to suspend the relevant account, delete the associated personal data, and, where applicable, report the matter to the relevant authorities in accordance with our regulatory obligations.

If you have reason to believe that a minor has registered an account on ojktoto, please notify our support team immediately via the contact channels in Section 15.

14 Amendments to This Policy

ojktoto reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. Where amendments are material — such as changes to the categories of data collected, the purposes for which data is used, or the rights available to you — we will provide advance notice to registered users via email or an on-Platform notification at least fourteen (14) days before the changes take effect.

For minor or administrative amendments — such as corrections to typographical errors or clarifications that do not alter the substance of the Policy — notice may not be provided and the updated Policy will take effect from the date of publication at https://ojktoto.cam/privacy-policy.

Your continued use of the Platform following the effective date of any amended Privacy Policy constitutes your acknowledgement of the changes. We recommend reviewing this Policy periodically. The "Last Updated" date at the top of this page reflects when the Policy was most recently revised.

15 Contact Us

For all privacy-related enquiries — including requests to exercise your data rights, questions about this Policy, or concerns about how ojktoto processes your personal data — please contact us through the following channels:

• Email: Send your written enquiry to [email protected]. Include your registered account username or email address, a clear description of your request, and any relevant details to help us respond promptly. We aim to respond to privacy-related emails within two (2) business hours during normal working hours.
• Live Chat: Available 24 hours a day, 7 days a week via the chat widget on the Platform. For data rights requests, our support agents will escalate your query to the appropriate internal team and confirm receipt in writing.
• Response Timeframe: We will acknowledge all data rights requests within two (2) business days and provide a substantive response within thirty (30) calendar days, subject to identity verification. For complex requests, a 30-day extension may apply and will be communicated to you in advance.