Privacy Policy

This Privacy Policy ("Policy") sets out how Ungutoto ("we", "us", "our", "the Platform", "ungutoto") collects, processes, stores, and protects the personal data of individuals ("Player", "User", "you") who access or use the ungutoto website at ungutoto.cam, including all associated services, features, and functionality offered through the Platform.

Ungutoto is an online entertainment platform providing casino games, sports betting, live dealer services, and related gambling products, primarily serving players across Malaysia — including Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and other regions across the country.

By registering an account on ungutoto, making a deposit, or otherwise using the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein.

Ungutoto collects the minimum amount of personal data necessary to provide the Platform's services. The categories of data we may collect are set out in the table below:

We do not intentionally collect sensitive categories of personal data (e.g., health data, racial or ethnic origin, religious beliefs) except where strictly required for responsible gambling assessments, in which case such data is handled with heightened security controls and collected only with your explicit consent.

Ungutoto collects personal data through the following channels:

4.1 Direct Submissions

Data you provide directly when you register an account, complete KYC verification, make a deposit or withdrawal, contact our support team, or respond to a survey or promotion. This includes all information entered via the Platform's registration, account settings, and deposit/withdrawal interfaces.

4.2 Automated Technical Collection

Technical data collected automatically when you access ungutoto, including your IP address, browser type, device identifiers, pages viewed, referral URLs, and timestamps. This data is collected via server logs, cookies, and similar tracking technologies as described in Section 9.

4.3 Third-Party Sources

Ungutoto may receive data about you from third-party sources in limited circumstances, including:

• Payment Service Providers: Transaction confirmation data from FPX, Maybank, CIMB, Public Bank, Hong Leong Bank, Touch 'n Go, Boost, GrabPay, DuitNow, and cryptocurrency networks.
• KYC / Identity Verification Partners: Identity verification status and document authentication results from accredited verification service providers.
• Fraud Prevention Services: Risk scoring and fraud flags from third-party anti-fraud databases, used to protect your account and the integrity of the Platform.

Ungutoto processes your personal data on the following legal bases:

• Contractual Necessity: Processing required to perform the contract with you — including account creation, deposit and withdrawal processing, identity verification, and delivery of gaming services.
• Legal Obligation: Processing required to comply with applicable legal requirements, including anti-money laundering (AML) obligations, Know Your Customer (KYC) regulations, fraud prevention duties, and record-keeping requirements under applicable law.
• Legitimate Interests: Processing that is necessary for ungutoto's legitimate business interests, where these interests are not overridden by your rights — including Platform security monitoring, fraud detection, product analytics, and responsible gambling safeguards.
• Consent: Where you have given specific, informed, and freely provided consent — for example, for marketing communications or for certain cookie placements. You may withdraw consent at any time by contacting us or adjusting your account settings.

Ungutoto uses your personal data for the following specific purposes:

• Account Management: Creating, maintaining, and managing your ungutoto account, including authentication, password resets, and account settings.
• Transaction Processing: Processing deposits and withdrawals via your chosen payment method (e.g., Touch 'n Go eWallet, Maybank, FPX, BTC/USDT).
• Identity Verification (KYC): Verifying your identity and age (21+) prior to withdrawal processing, as required by applicable regulations and responsible gambling obligations.
• Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent activity, money laundering, account takeovers, and other illegal or prohibited conduct.
• Customer Support: Responding to your enquiries, resolving complaints, and managing support tickets through live chat and email at support@ungutoto.cam.
• Regulatory Compliance: Meeting our legal and regulatory obligations, including record-keeping, reporting to relevant authorities where required by law, and cooperating with law enforcement.
• Responsible Gambling: Monitoring play patterns to identify potential problem gambling behaviours, administering self-exclusion requests, and enforcing deposit and session limits.
• Platform Improvement: Analysing anonymised usage data to improve game offerings, user experience, payment flow efficiency, and overall Platform performance.
• Communications: Sending transactional notifications (e.g., deposit confirmations, withdrawal status updates) and, where you have consented, promotional communications about bonuses and seasonal offers relevant to Malaysian players.

We will not use your personal data for purposes materially different from those stated above without providing prior notice and, where required, obtaining your renewed consent.

Ungutoto does not sell, rent, or trade your personal data. We may share your data with the following categories of recipients only where necessary and under appropriate safeguards:

7.1 Payment Service Providers

We share necessary financial and identity data with payment processors — including FPX gateway operators, Malaysian banks (Maybank, CIMB, Public Bank, Hong Leong), and e-wallet providers (Touch 'n Go, Boost, GrabPay, DuitNow) — for the sole purpose of processing your deposits and withdrawals.

7.2 KYC and Compliance Partners

Accredited identity verification and AML compliance service providers may receive copies of your identity documents and related data strictly for the purpose of completing mandatory KYC checks. These partners are contractually bound to process your data only as instructed by ungutoto.

7.3 Technology and Infrastructure Providers

Hosting providers, cloud infrastructure operators, and IT security vendors may have access to technical data in the course of providing their services to ungutoto. All such providers are engaged under data processing agreements requiring appropriate security and confidentiality measures.

7.4 Legal and Regulatory Authorities

Ungutoto may disclose personal data to law enforcement agencies, regulatory bodies, or courts where legally required to do so — for example, pursuant to a court order, subpoena, or statutory reporting obligation. We will notify you of such disclosures where legally permitted to do so.

7.5 Business Transfers

In the event of a merger, acquisition, asset sale, or corporate restructuring, your personal data may be transferred to the successor entity. You will be notified of any such change via the contact details registered on your account.

Ungutoto retains your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention periods apply:

• Active account data: Retained for the duration of your account registration plus a minimum of 5 years following account closure, to comply with AML record-keeping requirements.
• KYC and identity documents: Retained for a minimum of 5 years from the date of submission, or longer where required by applicable law.
• Transaction records: Retained for a minimum of 7 years to satisfy financial record-keeping obligations.
• Customer support communications: Retained for 3 years from the date of the last communication, unless extended for dispute resolution purposes.
• Marketing preferences and consent records: Retained for the period of consent plus 2 years for audit purposes.
• Technical and usage logs: Retained for up to 12 months for security analysis and performance monitoring.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be attributed to any identifiable individual.

Ungutoto uses cookies and similar technologies (including web beacons, pixel tags, and local storage) to enhance your experience on the Platform, maintain session security, and gather aggregated analytics data.

9.1 Types of Cookies We Use

9.2 Managing Cookies

You can control and manage cookies through your browser settings. Most modern browsers allow you to refuse new cookies, delete existing cookies, and receive alerts when a new cookie is set. Please note that disabling essential cookies will impair the functionality of the ungutoto Platform, including your ability to log in and place bets.

Instructions for managing cookies in common browsers can be found in the browser's help documentation. Ungutoto does not currently support a third-party cookie consent management platform; browser-level controls are the primary mechanism for managing cookie preferences on this Platform.

Ungutoto implements a comprehensive suite of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our security framework includes:

• Encryption in Transit: All data transmitted between your device and ungutoto's servers is protected by TLS 1.2 or higher encryption.
• Encryption at Rest: Sensitive personal data stored on our servers is encrypted using AES-256 standard encryption.
• Access Controls: Role-based access controls (RBAC) restrict staff access to personal data on a strict need-to-know basis. Administrative access is protected by multi-factor authentication (MFA).
• Regular Security Audits: Our Platform and infrastructure undergo regular penetration testing and vulnerability assessments conducted by independent third-party security specialists.
• Incident Response: Ungutoto maintains a documented data breach response procedure. In the event of a breach affecting your personal data, we will notify you within a reasonable timeframe as required by applicable obligations.

While ungutoto employs commercially reasonable security measures, no platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and should contact support@ungutoto.cam immediately upon suspecting any unauthorised account access.

Subject to applicable law and certain limited exceptions (for example, where compliance conflicts with legal obligations), you hold the following rights in relation to your personal data processed by ungutoto:

To exercise any of the above rights, submit a written request to support@ungutoto.cam with the subject line "Data Rights Request — [Your Registered Username]". We will acknowledge your request within 5 business days and fulfil it within 30 calendar days of receipt.

Please note that some rights are subject to exceptions — for example, we cannot erase data that we are legally required to retain under AML or financial record-keeping regulations. Where an exception applies, we will inform you of the reason.

The ungutoto Platform is strictly intended for adult players aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21.

During account registration, we collect date of birth information and require players to confirm their age. Where we have reason to believe that a registered player is under the minimum age, we will immediately suspend the account, freeze any pending withdrawals, and initiate KYC verification to confirm the player's age. Accounts confirmed to belong to under-age individuals will be permanently closed, and any deposited funds will be returned via the original payment method.

The ungutoto Platform may contain references or links to third-party websites or services (for example, payment processor portals accessed during the deposit or withdrawal flow). This Privacy Policy applies solely to data processing conducted by ungutoto on the ungutoto.cam domain.

Ungutoto is not responsible for the privacy practices, data handling, or security measures of any third-party website or service. We recommend that you review the privacy policy of any third-party service you access in connection with your ungutoto account before providing them with personal information.

In the course of providing its services, ungutoto may transfer your personal data to, or store it on, servers located outside of Malaysia. Where such transfers occur, ungutoto takes appropriate steps to ensure that your data receives an equivalent level of protection as it would under applicable Malaysian data protection standards.

Safeguards for international data transfers may include:

• Contractual data protection clauses with the receiving entity, requiring equivalent security and processing restrictions.
• Transfers to jurisdictions that have been assessed as providing an adequate level of data protection.
• Technical measures such as end-to-end encryption ensuring data cannot be read by intermediary parties.

You may request information about the safeguards governing any specific international transfer by contacting support@ungutoto.cam.

Ungutoto reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory guidance. The most recent version of this Policy will always be published at ungutoto.cam/privacy-policy, with the "Last Updated" date revised accordingly.

Where we make material changes to this Policy — changes that significantly affect your rights or how we use your data — we will notify registered players via email to their registered address and/or via a prominent notice on the Platform at least 14 calendar days before the revised Policy takes effect.

Your continued use of the Platform following the effective date of a revised Policy constitutes your acceptance of the updated terms. If you do not agree with material changes, you should cease using the Platform and may request account closure in accordance with our Terms & Conditions.

For any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact the ungutoto support team using the following details:

Ungutoto takes all privacy enquiries seriously and endeavours to respond to all data rights requests within the statutory timeframe. If you are dissatisfied with our response, you have the right to raise the matter with the relevant data protection authority in your jurisdiction.