Privacy Policy Joitoto – Personal Data Protection for Malaysia Members

Joitoto ("we", "Platform") takes member privacy very seriously. We understand that your trust in us begins with the confidence that your personal data is handled with full responsibility and transparency.

This Privacy Policy explains in detail how Joitoto collects, processes, stores, and protects your personal information when you use our platform — whether via the website, mobile app, or other communication channels we provide.

We fully comply with Malaysia's Personal Data Protection Act 2010 (PDPA) and ensure all our data handling practices meet applicable legal requirements. The information in this document is written in plain language so you know exactly what happens with your personal data.

Joitoto collects various categories of information depending on how you interact with our platform. Below are details of the types of data we collect:

2.1 Information You Provide Directly

• Registration Information — Full name, date of birth, email address, phone number, and password upon account registration.
• KYC Information — Copies of your identity card, passport, or other identification documents; proof of address such as a utility bill or recent bank statement.
• Financial Information — Bank account details, payment card numbers (in secure token format), and deposit and withdrawal transaction history.
• Communications — Records of conversations with the customer support team via live chat or email.

2.2 Information Collected Automatically

• Your IP address, web browser type, and device operating system.
• Game session data including login times, games played, and session duration.
• Platform usage data such as pages visited and features used.
• General location data based on IP address (not precise GPS location).

Joitoto uses your personal data only for legitimate and necessary purposes. We do not use your data for purposes unrelated to the services you use. The following are the purposes for which we use your data:

• Account Management — Creates and manages your member account, processes registration, and verifies identity through the KYC process.
• Transaction Processing — Processes deposits, withdrawals, and all financial transactions in your account securely and accurately.
• Platform Security — Identifies and prevents fraud, money laundering, and unauthorised access to your account.
• Legal Compliance — Fulfils legal and regulatory obligations including PDPA requirements, anti-money laundering (AML), and other regulatory body requirements.
• Customer Support — Helps you resolve issues, answer inquiries, and provide technical assistance.
• Service Improvements — Analyses usage patterns to improve the user experience and develop useful new features.
• Marketing Communications — Sends promotional information and relevant offers (with the option to unsubscribe at any time).
• Responsible Gaming — Monitors gameplay patterns to identify signs of problem gambling and supports the use of responsible gaming tools.

Joitoto does not sell your personal data. However, in certain limited situations, we may share information with the following parties:

• Technology Service Providers — Companies that help us operate the platform, including payment processors, cloud infrastructure providers, and identity verification service providers. They are bound by strict data protection agreements.
• Game Providers — Third-party game providers whose games are available on the joitoto platform receive the minimum technical data required to ensure games function correctly.
• Regulatory Bodies & Law Enforcement — We comply with lawful requests from regulatory bodies or legal authorities when required by law.
• Corporate Partners — In the event of a merger, acquisition, or asset sale, member data may be transferred as part of that business transaction, with equivalent privacy protections maintained.

Joitoto uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device when you visit our website.

Types of Cookies We Use

• Essential Cookies — Required for core platform functions such as login session management and security. These cookies cannot be disabled without affecting platform functionality.
• Performance Cookies — Helps us understand how users interact with the platform through anonymised analytics data for improvement purposes.
• Functional Cookies — Saves your preferences such as language, display settings, and login information to streamline repeat use.
• Marketing Cookies — Used to display relevant content based on your interests. You can opt out of these cookies at any time.

You can manage cookie settings through your web browser. However, disabling certain cookies may affect the functionality of the Joitoto platform.

Joitoto implements comprehensive technical and organisational security measures to protect your personal data from unauthorised access, disclosure, alteration, or destruction.

Key Security Measures

• 256-bit SSL/TLS encryption for all data in transit.
• Encryption of sensitive data at rest using AES-256 standards.
• Role-based access control — staff can only access the data they need to perform their duties.
• Continuous 24/7 security monitoring with intrusion detection systems.
• Regular security audits by accredited independent parties.
• Regular data backups stored at secure locations.

Data Retention Period

Joitoto retains your personal data for as long as your account is active or as long as necessary to fulfil the purposes stated in this Privacy Policy. Once an account is closed, your data will be retained for the minimum period required by Malaysian law (typically 7 years for financial records) before being securely deleted.

As a data subject under Malaysia's PDPA, you have important rights regarding your personal data held by joitoto. We respect and facilitate the exercise of these rights:

The joitoto platform is exclusively for adults aged 18 and above. We do not knowingly collect, process, or store any personal information from individuals under the age of 18.

If we discover that a child's personal data has been collected without our knowledge, we will take immediate action to delete that information and close the relevant account. Parents or guardians who suspect their child has registered on our platform should contact us immediately through the provided support channels.

The joitoto platform may contain links to third-party services such as game providers or payment gateways. When you access these third-party services, their own privacy policies apply and not joitoto's Privacy Policy.

Joitoto is not responsible for the privacy practices of such third parties. We encourage you to read the privacy policy of any third-party service you access through our platform before providing them with any personal information.

Nonetheless, joitoto ensures that all third-party providers integrated with our platform comply with equivalent data protection standards and sign binding data processing agreements before integration is permitted.

In operating our platform, your personal data may be processed or stored on servers located outside Malaysia. This occurs primarily when we use international cloud infrastructure services or interact with game providers based overseas.

Joitoto ensures that all cross-border data transfers are carried out with adequate safeguards, including:

• Using service providers that comply with data protection standards equivalent to or stricter than Malaysia's PDPA.
• Executing legally binding data transfer agreements with all overseas data recipients.
• Ensuring your data receives a consistent level of protection regardless of its physical location.

Joitoto reserves the right to update or modify this Privacy Policy from time to time in line with changes in law, industry practices, or how we handle your data. Any material changes will be communicated to you via:

• In-account notification upon your next login.
• An email to your registered email address for significant changes.
• Updates the "Last updated" date at the top of this document.

We encourage you to review this Privacy Policy periodically. Your continued use of the joitoto platform after changes are published will be considered your acceptance of the updated terms.

If you have any questions, concerns, or complaints regarding this Privacy Policy or how we handle your personal data, our team is ready to help. You can reach us through the following channels:

• Live Chat — Available 24/7 directly from the joitoto platform for immediate responses.
• Support Email — [email protected] for more detailed written inquiries.
• FAQ Section — Visit FAQ page for answers to frequently asked questions about privacy.

We are committed to responding to all privacy-related enquiries within 7 business days and resolving more complex complaints within 30 business days in accordance with Malaysia's PDPA requirements.