colitoto Privacy Policy

1. Introduction

colitoto ("we", "us", "our") is committed to protecting the privacy and personal data of every individual who visits, registers with or uses the colitoto platform accessible athttps://colitoto.cam. This Privacy Policy ("Policy") describes the nature of the personal data we collect, the purposes for which it is processed, the legal bases that apply, the parties with whom it may be shared, and the rights available to you under applicable data protection law.

This Policy applies to all personal data submitted or generated through the colitoto website, its games, betting markets, payment facilities, customer support channels and any related services. It applies equally to players based in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam and all other locations from which colitoto may lawfully be accessed.

This Policy should be read alongside the colitoto Terms and Conditions and the Responsible Gambling Policy. Where conflicts arise between this Policy and any other document, this Policy shall govern with respect to the processing of personal data.

2. Definitions

• Personal Data: any information that identifies or can reasonably identify a natural person, directly or indirectly, including name, identification number, contact details, financial information and online identifiers.
• Processing: any operation performed on personal data, including collection, recording, storage, retrieval, use, disclosure, erasure or destruction.
• Data Controller: the entity that determines the purposes and means of processing personal data — in this case, the colitoto platform operator.
• Data Processor: a third party that processes personal data on behalf of the Data Controller under binding contractual obligations.
• Consent: a freely given, specific, informed and unambiguous indication by which a data subject signifies agreement to the processing of their personal data.
• KYC: Know Your Customer — the identity and document verification process required to confirm player eligibility and comply with anti-money-laundering obligations.
• Cookies: small text files placed on a user's device by a website to store session information, preferences and usage data.
• MYR: Malaysian Ringgit — the primary currency in which colitoto processes transactions for Malaysian players.

3. Data Controller

The Data Controller responsible for your personal data in connection with the colitoto platform is the entity that operates the platform under its applicable licensing arrangements. Details of the operator, including registered address and licensing authority, are available within the colitoto platform account area and are provided to players on request through the support team.

All data-related enquiries, including requests to exercise data subject rights or to raise concerns about data handling, should be directed to the contact details provided in Clause 15 of this Policy.

4. Personal Data We Collect

colitoto collects personal data through several channels, including the account registration form, identity verification submissions, payment transactions, customer support interactions and automated technical systems. The categories of data we may collect are set out in the table below.

colitoto does not intentionally collect special categories of sensitive personal data (such as health, racial or biometric information) unless explicitly required by regulatory obligations.

5. Data Processing Purposes

Personal data collected by colitoto is used for the following purposes:

• Account creation and management: to register, maintain, verify and administer your colitoto account.
• Identity verification (KYC): to confirm your eligibility, age and identity in accordance with applicable regulatory requirements.
• Payment processing: to facilitate MYR deposits and withdrawals via DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong and other available methods.
• Service delivery: to provide access to sports betting markets, live casino games, slot games and associated platform features.
• Customer support: to respond to enquiries, process complaints and provide assistance with account or payment issues.
• Fraud and security: to detect, investigate and prevent fraudulent activity, money laundering, unauthorised account access and other prohibited conduct.
• Legal compliance: to meet obligations imposed by applicable anti-money-laundering legislation, licensing conditions and law enforcement requests.
• Platform improvement: to analyse usage patterns and improve the colitoto user experience using aggregated or anonymised data.
• Responsible gambling: to monitor account behaviour and apply protective measures where patterns indicate potential harm.
• Communications: to send account notifications, security alerts and, where you have opted in, promotional communications.

6. Legal Basis for Processing

6.1 Contractual necessity

Processing required to enter into and perform the colitoto Terms and Conditions — including account registration, payment processing and service delivery — is carried out on the basis of contractual necessity.

6.2 Legal obligation

Processing required to comply with anti-money-laundering regulations, licensing requirements, tax reporting obligations or law enforcement requests is carried out to fulfil a legal obligation.

6.3 Legitimate interests

Processing carried out for fraud detection, security monitoring and platform improvement is based on colitoto's legitimate interests, provided those interests are not overridden by your rights and freedoms.

6.4 Consent

Where processing is based on your consent — for example, the receipt of optional marketing communications — you may withdraw that consent at any time by contacting support or using the unsubscribe mechanism in any communication.

7. Data Sharing and Disclosure

colitoto does not sell your personal data. We may share your data with the following categories of recipient where necessary and proportionate:

• Payment service providers: banks, e-wallet operators (including Touch 'n Go eWallet, Boost, GrabPay) and FPX/DuitNow network participants required to process your MYR transactions.
• Identity verification providers: third-party KYC services that assist with document verification and age-confirmation checks.
• Platform technology providers: game studios, software infrastructure partners and analytics services that process data on our behalf under binding data-processing agreements.
• Regulatory and law enforcement authorities: where disclosure is required by applicable law, court order or regulatory direction.
• Professional advisers: lawyers, auditors and compliance consultants bound by confidentiality obligations.

All third-party Data Processors engaged by colitoto are required to maintain appropriate technical and organisational measures to protect your data and to process it only for the purposes specified in their contractual arrangements with us.

8. Data Retention

colitoto retains personal data only for as long as is necessary to fulfil the purposes set out in this Policy or as required by applicable law. The following general retention periods apply:

• Active account data: retained for the duration of your active account relationship with colitoto.
• KYC and identity documents: typically retained for a minimum of five years following account closure, in line with standard anti-money-laundering record-keeping requirements.
• Transaction records: retained for a minimum of five years following the relevant transaction date.
• Support communications: retained for a period of up to three years following resolution of the relevant matter.
• Technical and usage logs: typically retained for up to twelve months unless a longer period is required for security or compliance investigation.

Upon expiry of the applicable retention period, data will be securely deleted or anonymised so that it can no longer identify you.

9. Cookies and Tracking Technologies

colitoto uses cookies and similar tracking technologies to operate, secure and improve the platform. Cookies may be session-based (deleted when you close your browser) or persistent (retained for a set period). The main categories of cookies used are as follows:

• Strictly necessary cookies: essential for the platform to function, including authentication, security tokens and session management. These cannot be disabled without preventing access to core features.
• Functional cookies: used to remember your preferences such as language settings and display options, improving the consistency of your experience.
• Analytical cookies: used to collect aggregated information about how visitors use the platform, helping colitoto identify areas for improvement. This data is processed in a manner that does not directly identify individual users.
• Security cookies: used to detect and prevent fraudulent activity, session hijacking and other security threats.

You may manage cookie preferences through your browser settings. Blocking strictly necessary cookies may prevent some platform features from functioning correctly.

10. Security Measures

colitoto implements a range of technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration or disclosure. These measures include, but are not limited to:

• Transport Layer Security (TLS) encryption for all data transmitted between your device and the colitoto platform.
• Access controls limiting employee access to personal data on a need-to-know basis.
• Regular security assessments and penetration testing of platform infrastructure.
• Multi-factor authentication options for player accounts.
• Documented incident response procedures for addressing potential data breaches.

While colitoto takes all reasonable precautions to secure your data, no internet transmission or electronic storage system can be guaranteed to be entirely secure. You are encouraged to maintain strong, unique account credentials and to notifyolitoto immediately if you suspect any unauthorised access to your account.

11. Your Rights as a Data Subject

Subject to the applicable data protection law of your jurisdiction, you may be entitled to exercise the following rights in relation to your personal data held by colitoto:

• Right of access: to request a copy of the personal data colitoto holds about you.
• Right to rectification: to request that inaccurate or incomplete personal data be corrected.
• Right to erasure: to request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to legal retention obligations.
• Right to restriction: to request that processing of your data be restricted pending the resolution of a query or dispute.
• Right to data portability: to receive a copy of your personal data in a structured, machine-readable format where processing is based on consent or contractual necessity.
• Right to object: to object to processing based on legitimate interests or carried out for direct marketing purposes.
• Right to withdraw consent: to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing.

To exercise any of the above rights, please submit a written request to the colitoto support team using the contact details in Clause 15. We will acknowledge your request within five business days and aim to resolve it within thirty calendar days of receipt, or within the timeframe required by applicable law.

12. Minors and Age Restriction

The colitoto platform is intended solely for use by adults aged twenty-one (21) and above. colitoto does not knowingly collect or process the personal data of persons under this age. If we become aware that we have inadvertently collected data from a minor, we will take immediate steps to delete that data and close the associated account.

If you have reason to believe that a minor has registered an account with colitoto or submitted personal data to the platform, please contact us immediately using the details in Clause 15 so that appropriate action can be taken.

13. International Data Transfers

colitoto's platform infrastructure and service providers may be located in jurisdictions outside Malaysia. Where your personal data is transferred to or processed in a country that does not provide an equivalent level of data protection, colitoto will implement appropriate safeguards — such as contractual clauses or equivalent mechanisms — to ensure that your data continues to be protected to a standard consistent with this Policy.

By using the colitoto platform, you acknowledge that your personal data may be transferred to and processed in such locations. colitoto will not transfer your data internationally in a manner that strips it of the protections described in this Policy.

14. Amendments to This Policy

colitoto reserves the right to update or amend this Privacy Policy at any time in response to changes in applicable law, platform functionality or data-processing practices. The updated Policy will be published on the colitoto website with a revised effective date noted at the top of the document. Where an amendment materially affects your rights, we will notify you by email or via an in-platform notification prior to the change taking effect.

Your continued use of the colitoto platform following publication of an amended Policy constitutes your acknowledgement of those amendments. If you do not accept the updated terms, you should cease using the platform and request account closure.

15. Contact Us

For any questions about this Privacy Policy, to exercise your data subject rights, or to raise a data-related concern, please contact the colitoto Data Protection team using the details below. All correspondence should be in English.

• Email: [email protected]
• Subject line (for data requests): Data Subject Request — [Your Registered Username]
• Support hours: 24 hours a day, 7 days a week
• Response timeframe: Acknowledgement within 5 business days; full resolution within 30 calendar days