Privacy Policy —
How Olxtoto Handles Your Data

This Privacy Policy ("Policy") is issued by olxtoto ("we", "us", "our"), the operator of the online casino and sports betting platform accessible at olxtoto.casa. This Policy explains how we collect, use, store, share, and protect personal information relating to users ("you", "your", "the Player") who access or use our platform and associated services.

Olxtoto is an internationally licensed gaming platform that primarily serves players in Malaysia, including residents of Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and other Malaysian cities. We take the privacy of our players seriously and are committed to handling personal data with transparency, integrity, and appropriate safeguards.

By registering an account, using the olxtoto platform, or submitting personal information to us in any context, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you must cease using the platform and contact us to request account closure.

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

• "Personal Data" means any information that identifies or can reasonably be used to identify an individual, whether directly or in combination with other information.
• "Processing" means any operation performed on personal data, including collection, storage, use, transmission, modification, deletion, or any other handling of the data.
• "Data Controller" means olxtoto, as the entity that determines the purposes and means of processing personal data collected through the platform.
• "Data Processor" means any third party that processes personal data on behalf of olxtoto under a contractual arrangement, such as payment service providers (e.g., Touch 'n Go eWallet, Boost, FPX processors) and cloud infrastructure providers.
• "KYC Data" means identity and age verification documentation submitted by Players as part of the Know Your Customer process, including copies of government-issued identification and proof of address.
• "Special Category Data" means sensitive categories of personal data that receive additional legal protection, including health data, financial vulnerability indicators, and responsible gambling status flags.
• "Consent" means a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your personal data for a stated purpose.

Olxtoto collects personal data from you through several channels. The categories of data we collect, and the primary source of each, are set out in the table below:

We do not collect unnecessary data categories. We do not collect your full bank account numbers, full card numbers, or payment authentication credentials — these are processed directly by our payment partners and are not stored on olxtoto systems.

Olxtoto processes personal data on the following legal bases, depending on the purpose of the processing:

• Contractual Necessity: Processing required to perform our contractual obligations to you as a registered player — including account creation, game delivery, payment processing, and withdrawal execution.
• Legal Obligation: Processing required to comply with applicable legal and regulatory requirements under our international gaming licence, including KYC identity verification, anti-money laundering (AML) checks, and age verification (minimum 21 years).
• Legitimate Interests: Processing conducted for our legitimate business interests where those interests are not overridden by your privacy rights — including fraud detection, responsible gambling monitoring, platform security, and general analytics to improve platform performance.
• Consent: For certain non-essential processing activities, such as sending promotional communications, we will seek your explicit consent in advance. You may withdraw consent at any time by contacting us or updating your communication preferences in your account settings.

Olxtoto uses personal data for the following specific purposes:

1. Account Management: Creating, maintaining, verifying, and administering your player account on the olxtoto platform.
2. Identity & Age Verification: Conducting mandatory KYC checks to verify that all players are aged 21 or above and are who they claim to be. This is a non-negotiable licensing obligation.
3. Payment Processing: Processing deposits and withdrawals through your chosen Malaysian payment channel — including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank, and RHB Bank — and reconciling financial records.
4. Gaming Service Delivery: Delivering casino games, sports betting markets (EPL, Liga Super Malaysia, UFC, and other events), live dealer tables, lottery products, and poker to your account.
5. Responsible Gambling: Monitoring gaming activity for indicators of problem gambling behaviour, administering self-exclusion requests, and maintaining records of responsible gambling tool usage.
6. Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent activity, bonus abuse, money laundering, and other prohibited conduct as defined in our Terms and Conditions.
7. Customer Support: Responding to your queries, resolving disputes, processing complaints, and providing account assistance via live chat and email.
8. Platform Analytics & Improvement: Analysing anonymised and aggregated usage data to improve platform performance, user interface, and game selection.
9. Legal Compliance: Complying with obligations under our international gaming licence, responding to lawful requests from regulatory or law enforcement authorities, and maintaining required records.
10. Promotional Communications (with consent): Sending you information about relevant promotions, bonus offers, and platform updates where you have provided consent to receive such communications.

Olxtoto does not sell, rent, or trade your personal data to third parties. We share personal data only in the circumstances described below, and only to the extent necessary for the stated purpose:

• Payment Service Providers: We share transaction data with our payment processing partners — including e-wallet operators, FPX network processors, and cryptocurrency exchange custodians — to the extent necessary to execute deposits and withdrawals.
• KYC & Identity Verification Partners: We use third-party identity verification services to conduct KYC checks. These providers process identity documents and biometric liveness data solely for verification purposes under strict data processing agreements.
• Cloud Infrastructure Providers: Our platform data is hosted on secure cloud infrastructure. Our hosting providers act as data processors under contractual arrangements that require them to maintain appropriate security standards.
• Regulatory & Licensing Authorities: We may be required to disclose player data to our international licensing authority or to regulatory bodies as part of our compliance obligations. We will always act in accordance with applicable legal requirements when making such disclosures.
• Law Enforcement: Where required by a valid legal order, court order, or applicable law, we may disclose personal data to law enforcement or government authorities. We will notify you of such requests unless legally prohibited from doing so.
• Fraud Prevention Networks: We may share data with industry fraud prevention databases to identify and prevent fraudulent activity, AML risks, and multi-account abuse.

Olxtoto uses cookies and similar tracking technologies on its platform. Cookies are small data files placed on your device that help us deliver a functional, secure, and personalised experience.

You can manage or disable cookies through your browser settings. Please note that disabling essential cookies will impair the functionality of the platform, including the ability to log in, place bets, and process payments. Olxtoto's analytical cookies, where used, do not contain personally identifiable information.

Olxtoto retains personal data for the minimum period necessary to fulfil the purposes for which it was collected, and to satisfy applicable legal and regulatory obligations. Our standard retention periods are set out below:

• Account and KYC Data: Retained for a minimum of 5 years from the date of account closure, in accordance with international gaming licence anti-money laundering record-keeping requirements.
• Transaction and Betting Records: Retained for a minimum of 5 years from the date of the transaction, for audit, dispute resolution, and regulatory compliance purposes.
• Communication Records (support tickets, live chat logs): Retained for 3 years from the date of the interaction, or longer where the communication is relevant to an ongoing investigation or dispute.
• Responsible Gambling Records: Retained for the duration of any active self-exclusion period, plus 5 years thereafter, to prevent circumvention of self-exclusion restrictions.
• Technical and Device Logs: Retained for 12 months from the date of collection, unless required for longer in connection with a fraud investigation or security incident.

At the end of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification. Requests for early deletion are handled under Section 10 (Your Data Rights), subject to our retention obligations.

Olxtoto implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, and destruction. Our security measures include:

• Encryption in Transit: All data transmitted between your device and our servers is protected using 256-bit SSL/TLS encryption.
• Encryption at Rest: Sensitive personal data stored in our databases is encrypted at rest using AES-256 or equivalent standards.
• Password Security: Account passwords are stored as salted cryptographic hashes — they cannot be recovered or read by olxtoto staff.
• Two-Factor Authentication (2FA): Players are encouraged to enable 2FA on their accounts for an additional layer of login security.
• Access Controls: Internal access to player data is restricted on a strict need-to-know basis. All staff with data access undergo background checks and data privacy training.
• Intrusion Detection: Our infrastructure is monitored 24/7 for anomalous activity, potential intrusions, and security incidents.
• Penetration Testing: Regular third-party security assessments are conducted to identify and remediate vulnerabilities in our platform.
• Data Breach Procedures: In the event of a data breach that poses a risk to your rights and interests, we will notify affected players and relevant authorities within the timeframe required by applicable law.

While we take all reasonable precautions to protect your data, no internet-based transmission or storage system can be guaranteed to be 100% secure. You are responsible for maintaining the confidentiality of your account credentials and for promptly reporting any suspected unauthorised access to [email protected].

Subject to applicable law and our legitimate processing grounds, you have the following rights in respect of your personal data held by olxtoto. To exercise any of these rights, please contact us at [email protected] with the subject line "Data Rights Request":

The olxtoto platform is strictly intended for use by persons aged 21 years and above. We do not knowingly collect personal data from anyone under 21. Mandatory KYC age verification is required for all registered accounts before withdrawal privileges are activated.

If we become aware that personal data has been collected from a person under the age of 21, we will immediately suspend the relevant account, initiate an investigation, and permanently close the account upon confirmation. Any funds held in the account will be reviewed in accordance with our Terms and Conditions.

If you are a parent or guardian and believe that a person under 21 in your care has registered an account on olxtoto, please contact us immediately at [email protected] so that we can take appropriate action.

The olxtoto platform integrates with third-party services to deliver certain functionality — including payment processing, identity verification, live dealer game streaming, and customer communication tools. These third parties operate as data processors under contractual data processing agreements.

Olxtoto does not embed third-party advertising networks, social media trackers, or external analytics platforms that would share your browsing behaviour with unrelated third parties. Our analytical tools are configured to operate in a privacy-protective manner, using anonymisation and aggregation where possible.

Where you access the olxtoto platform via links to or from third-party websites, those websites are governed by their own privacy policies and olxtoto accepts no responsibility for the data practices of third parties outside our platform.

Olxtoto operates under an international gaming licence and uses cloud infrastructure and service providers located in multiple jurisdictions. As a result, your personal data may be transferred to and processed in countries outside Malaysia. This includes data processed by our payment partners, KYC verification providers, and cloud hosting infrastructure.

Where personal data is transferred internationally, we implement appropriate safeguards to protect it in transit and at the destination, including contractual data protection clauses with all data processors and hosting providers. These arrangements ensure that your data receives a level of protection consistent with the standards applicable under our licensing framework.

By using the olxtoto platform, you acknowledge and consent to the international transfer of your personal data as described in this section.

Olxtoto reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or licensing requirements. Material changes — those that significantly affect your rights or the way your data is used — will be communicated to registered players via email and/or a prominent notice on the platform at least 7 days before the amendment takes effect.

Minor or administrative amendments (such as corrections to typographical errors or updates to contact details) may be made at any time without specific advance notice. The "Last Updated" date at the top of this page will always reflect the most recent revision.

Your continued use of the olxtoto platform following the effective date of any amended Policy constitutes your acceptance of the revised terms. If you do not agree with the amended Policy, you should stop using the platform and contact us to request account closure.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way in which olxtoto processes your personal data, please contact our Privacy team using the details below. We aim to respond to all data-related inquiries within 30 calendar days.

If you are not satisfied with our response to a privacy-related complaint, you may escalate the matter to the independent complaints body designated by our international licensing authority. Details of the appropriate escalation route will be provided upon request.