Privacy Policy

This Privacy Policy ("Policy") is issued by PPTOTO ("the Company", "we", "us", or "our") and applies to all personal data collected from individuals ("you", "the User", "the Player") who access or use the PPTOTO online gaming and sports betting platform available at pptoto.asia ("the Platform") and all associated services.

PPTOTO is committed to protecting the privacy and personal data of its players in accordance with applicable data protection legislation and internationally recognised privacy standards. This Policy explains in transparent terms what personal information we collect, the purposes for which it is used, how it is stored and protected, and what rights you hold in relation to your personal data.

By registering an account on PPTOTO, depositing funds, placing a wager, or otherwise using any component of the Platform, you acknowledge that you have read, understood, and consented to the collection and processing of your personal data as described in this Policy. If you do not consent to these terms, you must cease using the Platform immediately.

The following terms carry the meanings set out below throughout this Privacy Policy:

• "Personal Data" — Any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial data, device identifiers, and behavioural data.
• "Processing" — Any operation performed on personal data, including collection, recording, storage, use, disclosure, transmission, or deletion.
• "Data Controller" — PPTOTO, as the entity that determines the purposes and means by which personal data is processed.
• "Data Processor" — A third party engaged by PPTOTO to process personal data on its behalf, such as payment providers, KYC verification services, or cloud hosting providers.
• "Consent" — A freely given, specific, informed, and unambiguous indication of agreement to the processing of personal data for a stated purpose.
• "KYC" — Know Your Customer identity verification procedures required by applicable anti-money laundering regulations before processing withdrawals.
• "Cookies" — Small text files placed on your device by the Platform to enable functionality, remember preferences, and gather anonymised usage analytics.

PPTOTO collects personal data across several categories, depending on the nature of your interaction with the Platform. The table below sets out the primary categories of data we collect and examples of the specific data points within each category:

PPTOTO collects personal data through the following channels and mechanisms:

• Account Registration: Data you provide directly when creating your PPTOTO account, including your name, contact details, and date of birth.
• KYC Verification: Identity documentation and biometric selfie data submitted during the mandatory identity verification process before your first withdrawal.
• Deposit and Withdrawal Transactions: Financial identifiers generated when you deposit or withdraw funds via DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, or cryptocurrency channels.
• Platform Usage: Automated collection of technical and behavioural data as you navigate and interact with the Platform, including pages visited, games played, and session patterns.
• Cookies and Tracking Technologies: As detailed in Section 8 of this Policy, cookies and similar technologies collect device-level and anonymised usage data to enable functionality and improve the Platform.
• Customer Support Interactions: Data provided voluntarily when you contact our support team via live chat, email at [email protected], or other support channels.
• Third-Party Verification Services: Identity and fraud check data received from our KYC and AML compliance service providers, in accordance with their respective privacy terms.

PPTOTO processes personal data only where a recognised lawful basis exists for doing so. The primary lawful bases upon which we rely are as follows:

• Contractual Necessity: Processing required to fulfil our obligations under the Terms and Conditions you accepted at registration — including account management, payment processing, and gameplay facilitation.
• Legal Obligation: Processing required to comply with applicable laws, including anti-money laundering (AML) regulations, Know Your Customer (KYC) requirements, and record-keeping obligations imposed by our operating licence.
• Legitimate Interests: Processing carried out for purposes of fraud prevention, platform security, responsible gambling monitoring, and improvement of our services — where those interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for direct marketing communications (promotional emails, bonus notifications) conducted only where you have expressly opted in. You may withdraw consent at any time by updating your communication preferences in Account Settings.

Personal data collected by PPTOTO is used for the following specific purposes:

• Account Creation and Management: Setting up, maintaining, and administering your PPTOTO account, including authentication, account security, and tier-level management.
• Payment Processing: Facilitating deposits and withdrawals in MYR via your selected Malaysian payment methods, and maintaining transaction records for reconciliation and dispute resolution purposes.
• Identity Verification (KYC/AML): Verifying your identity and age (21+ requirement) in compliance with our operating licence conditions and anti-money laundering regulatory obligations.
• Responsible Gambling: Monitoring gaming behaviour to identify patterns associated with problem gambling; implementing and enforcing player-selected deposit limits, session reminders, cooling-off periods, and self-exclusion.
• Fraud Prevention and Security: Detecting, investigating, and preventing fraudulent activity, unauthorised account access, money laundering, and other prohibited conduct.
• Customer Support: Responding to enquiries, resolving disputes, and providing multilingual support in English, Bahasa Melayu, and Mandarin.
• Platform Improvement: Analysing aggregated and anonymised usage data to improve the functionality, performance, and design of the Platform for all Malaysian users.
• Marketing Communications: Sending promotional offers, bonus notifications, and relevant updates — only where you have provided consent. You may opt out at any time.

PPTOTO does not sell, rent, or trade your personal data to third parties. We share personal data only in the limited circumstances described below, and only to the extent necessary for the stated purpose:

• Payment Service Providers: Malaysian e-wallet operators (Touch 'n Go eWallet, Boost, GrabPay), FPX-member banks (Maybank, CIMB, Public Bank, Hong Leong Bank), DuitNow, and cryptocurrency processors receive the minimum financial data required to execute transactions on your behalf.
• KYC and AML Compliance Providers: Third-party identity verification and fraud screening services receive identity documents and biometric data exclusively for the purpose of satisfying our regulatory verification obligations.
• Cloud Infrastructure Providers: Hosting and database infrastructure partners who store encrypted data on our behalf under strict data processing agreements that prohibit independent use of your data.
• Game Software Providers: Third-party game studios and live casino providers may receive anonymised session identifiers necessary to deliver gameplay. These providers do not receive your personally identifiable information.
• Regulatory and Law Enforcement Authorities: Where required by law, court order, or legitimate regulatory directive, PPTOTO will disclose the minimum necessary personal data to the requesting authority.
• Corporate Transactions: In the event of a merger, acquisition, or sale of substantially all assets, your personal data may be transferred to the successor entity, subject to equivalent privacy protections.

All third-party Data Processors engaged by PPTOTO are bound by contractual data processing agreements that require them to process your personal data only on PPTOTO's documented instructions and to maintain appropriate security standards.

The PPTOTO Platform uses cookies and similar tracking technologies to enable core functionality, remember your preferences, maintain session security, and gather anonymised analytics data. Cookies do not personally identify you unless combined with your account data.

• Strictly Necessary Cookies: Essential for the Platform to function — managing your login session, maintaining your account security state, and remembering language preferences. These cannot be disabled without impairing functionality.
• Functional Cookies: Remember your game preferences, UI settings, and selected payment methods to personalise your experience between sessions.
• Analytics Cookies: Collect anonymised data on how players navigate the Platform, which pages are visited most frequently, and where technical errors occur — used exclusively for Platform improvement purposes.
• Security Cookies: Used to detect and prevent fraudulent account access, bot activity, and suspicious session behaviour.

You may manage your cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will impair your ability to use the Platform. Disabling analytics or functional cookies will not prevent access but may reduce the quality of your experience.

PPTOTO implements a layered security architecture to protect your personal data against unauthorised access, accidental loss, unlawful destruction, and misuse. Our security measures include:

• AES-256 Encryption at Rest: All personally identifiable data stored on PPTOTO servers is encrypted using AES-256 symmetric encryption, the same standard used by financial institutions globally.
• 256-bit SSL/TLS in Transit: All data transmitted between your device and the PPTOTO Platform is protected by 256-bit SSL/TLS encryption, ensuring data cannot be intercepted during transmission.
• Access Controls: Internal access to personal data is restricted on a strict need-to-know basis. Staff are granted the minimum permissions required for their operational role.
• Two-Factor Authentication: Players are encouraged to enable 2FA on their accounts. Internal staff systems require 2FA as a mandatory security control.
• Penetration Testing: PPTOTO engages independent security professionals to conduct regular penetration testing of the Platform and supporting infrastructure.
• Incident Response: In the event of a confirmed data breach that is likely to result in risk to affected individuals, PPTOTO will notify impacted players and relevant authorities within the timeframes required by applicable law.

PPTOTO retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law, regulatory obligation, or legitimate dispute resolution needs. Our general retention principles are as follows:

• Active Account Data: Retained for the duration of your account's active status and for a minimum period of five (5) years following account closure, in compliance with AML record-keeping requirements.
• KYC and Identity Documents: Retained for a minimum of five (5) years post-account closure or as required by the jurisdiction governing our operating licence, whichever is longer.
• Transaction Records: Financial transaction records are retained for a minimum of seven (7) years for audit and regulatory compliance purposes.
• Responsible Gambling Records: Self-exclusion status and limit settings are retained for the duration of the exclusion or restriction period, plus an additional five (5) years.
• Marketing Consent Records: Retained for the duration of the consent and for two (2) years following withdrawal, to demonstrate compliance with consent obligations.
• Anonymised Analytics Data: Aggregated, anonymised usage statistics — which cannot be linked back to any individual — may be retained indefinitely for long-term platform improvement analysis.

Upon expiry of the applicable retention period, personal data is securely deleted, anonymised, or rendered irrecoverable through industry-standard data destruction procedures.

Subject to applicable law and the limitations inherent in our regulatory obligations, you hold the following rights in respect of your personal data held by PPTOTO. To exercise any of these rights, please contact our Data Privacy team at [email protected] with the subject line "Data Subject Request".

PPTOTO will respond to all verified data subject requests within thirty (30) calendar days. Where a request is complex or voluminous, we may extend this period by a further thirty (30) days and will notify you of the extension with reasons. We do not charge a fee for reasonable data subject requests.

The PPTOTO Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory step in our account registration and KYC process.

If PPTOTO becomes aware that personal data has been collected from a person under the age of 21 without verified parental or guardian consent, we will take immediate steps to delete that data and close the associated account. If you believe a minor has registered on our platform, please notify us immediately at [email protected].

The PPTOTO Platform may, from time to time, reference or integrate with third-party services — including payment processors, game software providers, and identity verification services — that operate under their own independent privacy policies.

PPTOTO is not responsible for the privacy practices, content, or data security measures of third-party services. We encourage you to review the privacy policies of any third-party service providers you interact with in connection with your PPTOTO account, particularly your chosen Malaysian payment method provider (e.g., Touch 'n Go eWallet, Boost, GrabPay, or your bank's FPX service).

PPTOTO reserves the right to amend, update, or replace this Privacy Policy at any time. Changes may be made in response to regulatory developments, operational changes, new data processing activities, or improvements to our privacy practices. The revised Policy will be published on this page with an updated "Last Updated" date.

Where amendments are material — meaning they significantly alter the way we collect or use your personal data — we will provide notice through your registered email address or via an in-platform notification. Your continued use of the Platform following notification of material changes constitutes your acceptance of the revised Policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data by PPTOTO, please contact our Data Privacy team through any of the following channels:

We endeavour to respond to all privacy-related enquiries within 30 calendar days. For requests that require identity verification prior to processing (e.g., access or erasure requests), we may ask you to confirm your identity before we proceed.