Your privacy is more than a legal obligation to us — it is a core value at koitoto. This document transparently explains how we collect, use, store, and protect your personal information as a member of our platform.
We invest seriously in technology and processes to ensure your personal data is always protected to the highest standard.
All data transmitted between your device and koitoto's servers is protected by 256-bit SSL encryption — the same standard used by leading financial institutions and banks worldwide.
Your personal data is stored on servers protected by strict access controls. Only authorised personnel with a legitimate need may access such information.
Koitoto has never and will never sell, rent, or disclose your personal data to any third party for marketing purposes without your explicit consent.
KYC documents you submit are processed in a secure environment and stored with full encryption. They are used solely for identity verification and regulatory compliance purposes.
Koitoto's security system monitors suspicious activity in real time, 24 hours a day. Any unauthorised access attempts are automatically detected and blocked.
You have the full right to access, correct, or request the deletion of your personal data at any time through your account settings or by contacting our support team.
Koitoto ("we", "our platform") takes the privacy of every member who uses our online entertainment platform seriously. This Privacy Policy has been established to ensure you fully understand how your personal information is managed — from the moment you register until you close your account.
We comply with Malaysia's Personal Data Protection Act 2010 (PDPA) and applicable international data protection standards. Our goal is simple: you have the right to know what happens with your data, and we are committed to being transparent every step of the way.
This Privacy Policy applies to all users of the Koitoto platform, including website visitors, registered members, and anyone who interacts with any of our services or applications.
We only collect information necessary to provide a safe, fair, and legally compliant service. The following are the categories of information we collect:
| Data Category | Purpose of Collection | Retention Period |
|---|---|---|
| Registration Data | Account management and identity verification | Throughout active account + 5 years |
| KYC Documents | Legal compliance and anti-fraud | 5 years after account closure |
| Financial Data | Transaction processing and auditing | 7 years (tax requirements) |
| Usage Data | Platform security and improvement | 2 years on a rolling basis |
Every piece of data we collect has a clear and legitimate purpose. We do not use your data for purposes beyond the scope stated here without obtaining your consent first.
Koitoto does not sell or rent your personal data to any third party. However, there are limited situations where data sharing is necessary for platform operations:
We share only the minimum necessary data with service providers that help us operate the platform, including payment processors, KYC verification providers, and cloud infrastructure providers. All such providers are bound by strict confidentiality agreements and are not permitted to use your data for their own purposes.
We may disclose your information to the relevant authorities if required by law, court order, or in the context of a legitimate financial crime investigation. In such cases, we will notify you where permitted to do so.
Should koitoto be involved in any form of merger, acquisition, or asset transfer, user data may be transferred as part of those assets. You will be notified in advance and given the option to delete your account if you do not agree.
Koitoto uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device when you visit our website.
You can control or disable cookies through your browser settings. Please note that disabling essential cookies may affect the functionality of the Koitoto platform.
We implement comprehensive technical and organisational security measures to protect your personal data from unauthorised access, loss, destruction, or accidental disclosure.
In the event of any data breach that may affect your rights, we will notify you within 72 hours of becoming aware of the incident, in line with industry best practices.
Koitoto retains your personal data only for as long as necessary to fulfil the purpose for which it was collected or to comply with applicable legal obligations.
In general, your data is retained according to the following schedule:
Once the retention period expires, your data will be securely deleted or anonymised so it can no longer be associated with you.
As a data subject under Malaysia's Personal Data Protection Act 2010, you have the following rights, which you may exercise at any time:
You have the right to obtain a copy of the personal data we hold about you.
You may request the correction of any inaccurate or incomplete data.
You may request the deletion of your data, subject to our legal obligations.
You may object to the processing of your data for direct marketing purposes.
You may request your data in a machine-readable format for transfer.
You may request that we restrict the processing of your data under certain circumstances.
To exercise any of the above rights, please contact our privacy team via email or live chat. We will process your request within 30 business days. In complex cases, this period may be extended with prior notice to you.
In the course of platform operations, your data may be stored or processed at data centres located outside Malaysia. Koitoto ensures that any international data transfers are carried out with adequate safeguards in place, including:
All data transfers are carried out with controls that ensure an equivalent level of protection to that provided in Malaysia.
The koitoto platform is intended solely for individuals aged 18 and above. We do not knowingly collect, store, or process any personal information from minors.
If we find that we have inadvertently collected data from someone under the age of 18, we will promptly delete that information and close the account in question. If you are aware that a minor has registered on our platform, please notify us immediately.
The koitoto platform may contain links to third-party websites for informational convenience. However, koitoto is not responsible for the privacy practices or content of those websites. This Privacy Policy applies exclusively to the koitoto platform.
We encourage you to read the privacy policy of every website you visit. The presence of links to other sites does not mean that Koitoto endorses or is responsible for the content or privacy practices of those sites.
Koitoto reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other legitimate reasons.
When significant changes occur, we will:
Your continued use of the koitoto platform after such changes take effect will be considered your acceptance of the updated Privacy Policy. If you do not agree with the changes, you have the right to close your account and request deletion of your data.
If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, do not hesitate to contact us through the following channels:
Our privacy team is ready to provide clear and easy-to-understand explanations of how your data is managed. We take every enquiry and concern raised seriously.