Privacy Policy

This Privacy Policy (hereinafter "the Policy") is issued by Primatoto (hereinafter "primatoto", "we", "us", or "our"), operator of the online gaming platform accessible at primatoto.cam. This Policy applies to all personal data collected from or about individuals (hereinafter "Players", "Users", or "you") who access, register on, or interact with the primatoto platform in any capacity.

Primatoto is committed to protecting the privacy and personal data of all players, with particular consideration for the expectations and applicable data protection standards relevant to Malaysian users. This Policy explains in clear and transparent terms: what personal data we collect, the purposes for which it is processed, the legal bases upon which we rely, the parties with whom we may share data, your rights as a data subject, and how you may exercise those rights.

By registering an account or using the primatoto platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you must not create an account or use the platform. This Privacy Policy should be read in conjunction with our Terms and Conditions.

For the purposes of this Privacy Policy, the following definitions apply:

• "Controller" means primatoto, as the entity that determines the purposes and means of processing personal data collected through the platform.
• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, email address, phone number, date of birth, payment information, and device identifiers.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, transmission, alteration, or deletion.
• "Data Subject" means the individual to whom personal data relates — in this context, the registered primatoto player or platform visitor.
• "Third Party" means any natural or legal person other than primatoto and the data subject, including service providers, payment processors, and regulatory authorities.
• "Cookies" means small text files placed on a user's device by a website to store preferences, session data, and analytical information.
• "KYC" (Know Your Customer) means the identity and age verification process required by primatoto as a condition of account activation and withdrawal processing.
• "Sensitive Data" means a subset of personal data warranting heightened protection, including government-issued identification numbers, financial account details, and biometric or photographic identity verification data.

Primatoto collects personal data on a need-to-know basis. We do not collect personal data beyond what is reasonably necessary for the purposes outlined in this Policy. The categories of personal data we collect are as follows:

Where you provide us with personal data relating to a third party (for example, during a referral programme), you confirm that you have obtained that individual's consent to share their data with primatoto for the stated purpose.

Primatoto collects personal data through the following mechanisms:

• Direct Submission: Data you provide during account registration, the KYC verification process, deposit and withdrawal transactions, bonus claim forms, customer support interactions, and voluntary participation in surveys or promotions.
• Automated Collection: Technical and behavioural data collected automatically when you access the platform, including through cookies, web beacons, pixel tags, session recording tools, and server logs. This data collection occurs whether or not you are logged into your account.
• Payment Processors: Financial transaction data relayed to primatoto by our approved payment processing partners, including Malaysian payment service providers facilitating DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and Hong Leong transactions, and cryptocurrency exchange processors for BTC, ETH, USDT, and LTC deposits.
• Identity Verification Providers: Data returned by our third-party KYC and identity verification service providers, including the outcome of document authentication and liveness checks.
• Fraud Prevention Services: Risk signals and data from third-party fraud detection and anti-money laundering (AML) screening services used to assess the legitimacy of account activity and financial transactions.

Primatoto processes personal data for the following clearly defined purposes. We do not process data for purposes incompatible with those stated herein without obtaining fresh consent where required.

• Account Management: Creating, authenticating, and maintaining your primatoto account, including password management, session management, and account preference storage.
• Identity Verification: Conducting KYC verification to confirm your identity, age (21+ compliance), and residential address, as required by our operating licence conditions and applicable law.
• Payment Processing: Facilitating deposits from and withdrawals to your registered Malaysian payment accounts, reconciling transactions, and maintaining accurate financial records.
• Service Provision: Operating and improving the gaming platform, resolving technical issues, optimising game performance, and personalising your experience based on game history and preferences.
• Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent activity, money laundering, multi-accounting, bonus abuse, and other security threats to the platform and its players.
• Regulatory Compliance: Meeting obligations under applicable laws and our operating licence, including AML/CTF (Anti-Money Laundering / Counter-Terrorism Financing) reporting, record retention requirements, and responding to lawful requests from regulatory authorities.
• Responsible Gambling: Monitoring wagering patterns to identify indicators of problem gambling behaviour, administering self-exclusion and deposit limit tools, and communicating with players about responsible gambling resources where appropriate.
• Customer Support: Processing and resolving your support enquiries, complaints, and feedback, and maintaining records of communications for quality assurance and dispute resolution purposes.
• Marketing Communications (Opt-in only): Sending promotional emails, bonus notifications, and platform updates to players who have explicitly opted in to marketing communications. You may withdraw consent to marketing at any time through your account settings or by contacting support.
• Analytics and Platform Improvement: Analysing aggregated and anonymised usage data to understand player behaviour patterns and improve platform features, game selection, and user experience.

Primatoto relies on the following legal bases to process your personal data lawfully:

• Contractual Necessity: Processing required to perform the contract between primatoto and the Player — principally account operation, payment processing, and service delivery. Without this processing, primatoto cannot provide its services to you.
• Legal Obligation: Processing required to comply with applicable legal requirements, including KYC obligations under licensing conditions, AML/CTF reporting obligations, and records retention mandates.
• Legitimate Interests: Processing carried out on the basis of primatoto's legitimate business interests, including fraud prevention, platform security, responsible gambling monitoring, and analytical improvement of the platform — where these interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing carried out on the basis of your freely given, specific, and informed consent — principally in respect of marketing communications and the use of non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of processing undertaken prior to withdrawal.

Primatoto does not sell, rent, or trade your personal data to any third party for commercial purposes. We share personal data only in the limited circumstances described below, and only to the extent necessary for the stated purpose. All third-party recipients are required to process your data solely for specified purposes and in accordance with applicable data protection standards.

• Payment Service Providers: Malaysian banking and eWallet payment processors — including those facilitating DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and Hong Leong transactions — receive transaction data necessary to execute deposits and withdrawals on your behalf. Cryptocurrency processors receive relevant transaction data for BTC, ETH, USDT, and LTC operations.
• Identity Verification Providers: Third-party KYC service providers receive identity document data and selfie images solely to perform authentication and verification services on behalf of primatoto.
• Fraud and Risk Management Services: Anti-fraud and AML screening platforms receive transaction signals and account activity data for risk assessment and regulatory screening purposes.
• Gaming Software and Content Providers: Game studio and aggregator partners may receive pseudonymised player session data (e.g., player ID, session token, bet data) to operate their games and RNG systems on the platform.
• IT Infrastructure and Cloud Services: Hosting, database management, security, and analytics service providers who process data on our behalf under strict data processing agreements and security obligations.
• Regulatory and Law Enforcement Authorities: Primatoto will disclose personal data to regulators, law enforcement agencies, courts, or other authorities where legally required to do so by a valid legal process, court order, or regulatory demand. Where permitted by law, primatoto will notify the affected player of such a disclosure.
• Business Transfers: In the event of a merger, acquisition, restructuring, or sale of all or substantially all of primatoto's assets, player personal data may be transferred to the acquiring entity as part of the transaction, subject to equivalent data protection standards being maintained.

Primatoto uses cookies and similar tracking technologies to operate and improve the platform, maintain secure sessions, and analyse platform usage. The categories of cookies we use are as follows:

• Strictly Necessary Cookies: Essential for the operation of the platform. These cookies maintain your session, authenticate your login state, store your language preferences, and enable security features. They cannot be disabled without impairing platform functionality. No consent is required for strictly necessary cookies.
• Performance and Analytics Cookies: Used to collect anonymised information about how players interact with the platform — pages visited, time on page, navigation paths, and error occurrences. This data helps primatoto improve usability and performance. These cookies are deployed subject to your consent.
• Functional Cookies: Store your platform preferences — such as your preferred game category, notification settings, and responsible gambling tool configurations — to provide a personalised experience across sessions. Deployed subject to your consent.
• Fraud Prevention and Security Cookies: Used to detect unusual activity patterns, prevent CSRF attacks, and identify potential bot or scripted interaction. These may be classified as strictly necessary in the context of platform security.

You may manage your cookie preferences through your browser settings at any time. Please note that disabling certain categories of cookies may affect the functionality of the primatoto platform. Your consent to non-essential cookies is independent of your agreement to these Terms and may be withdrawn at any time.

Primatoto retains personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following retention periods apply as general guidelines:

• Active Account Data: Retained for the lifetime of the account and for a period of five (5) years following account closure, to meet regulatory record-keeping requirements applicable to licensed gaming operators.
• KYC and Identity Verification Documents: Retained for a minimum of five (5) years from the date of verification or account closure, consistent with AML record retention standards.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of the transaction, in compliance with applicable financial record-keeping obligations.
• Customer Support Communications: Retained for three (3) years from the date of the final communication in each support case.
• Marketing Preferences and Consent Records: Retained for the duration of the account and for two (2) years following account closure or withdrawal of consent, as evidence of lawful processing.
• Technical and Log Data: Retained for up to twelve (12) months, after which it is anonymised or deleted, except where retention is required for ongoing security investigations or legal proceedings.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that renders it incapable of re-identification. Data subject to ongoing legal proceedings or regulatory investigations will be retained until those proceedings are fully resolved.

Primatoto implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. Our security infrastructure includes, but is not limited to:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the primatoto platform is encrypted in transit using industry-standard Secure Socket Layer (SSL) / Transport Layer Security (TLS) protocols.
• Encryption at Rest: Sensitive personal data stored in our databases — including identity documents, financial data, and KYC materials — is encrypted at rest using strong cryptographic standards.
• Password Security: Account passwords are stored exclusively in irreversibly hashed form using modern cryptographic hashing algorithms. Primatoto staff cannot retrieve your plaintext password at any time.
• Two-Factor Authentication (2FA): Two-factor authentication is available and strongly encouraged for all player accounts to provide an additional layer of access security.
• Access Controls: Internal access to personal data is restricted on a strict need-to-know basis. Staff who handle player data are subject to confidentiality obligations and regular data security training.
• Regular Security Audits: The platform undergoes periodic independent security assessments, penetration testing, and vulnerability scanning to identify and remediate potential weaknesses.
• Incident Response: Primatoto maintains a documented data breach response procedure. In the event of a breach affecting your personal data, we will notify affected players and relevant authorities in accordance with applicable requirements.

Notwithstanding these measures, no data transmission over the internet or electronic storage system can be guaranteed as completely secure. While primatoto takes all reasonable steps to protect your data, we cannot provide an absolute guarantee of security. Players are responsible for maintaining the confidentiality of their own account credentials and should report any suspected unauthorised access immediately.

As a data subject whose personal data is processed by primatoto, you hold the following rights. Primatoto will respond to substantiated data subject requests within a reasonable period and in compliance with applicable data protection standards.

• Right of Access: You have the right to request confirmation of whether primatoto processes personal data about you, and if so, to receive a copy of that data together with information about the purposes, categories, and recipients of processing.
• Right to Rectification: You have the right to request correction of inaccurate or incomplete personal data held about you. You may update most account information directly through your account settings; contact support for corrections to KYC or financial records.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (and no other legal basis applies), or where processing is unlawful. This right is subject to our legal retention obligations — we cannot delete data we are legally required to retain.
• Right to Restriction of Processing: You may request that we restrict processing of your data in specified circumstances, such as while the accuracy of data is contested or where processing is unlawful but you prefer restriction over deletion.
• Right to Data Portability: Where processing is based on consent or contract, you may request a copy of personal data you have provided to us in a structured, commonly used, and machine-readable format.
• Right to Object: You have the right to object to processing of your personal data where that processing is based on legitimate interests. Primatoto will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing undertaken prior to withdrawal.

To exercise any of the above rights, contact our data team at [email protected] with the subject line "Data Subject Request", including your full name, registered email address, and a description of the right you wish to exercise. We may request additional verification to confirm your identity before processing the request.

Primatoto's platform and services are strictly intended for individuals aged 21 years and above. The platform does not knowingly collect, process, or retain personal data from any person under the age of 21. We enforce age verification through our mandatory KYC process on every account.

If primatoto becomes aware that personal data has been collected from a person under the age of 21 — whether through registration misrepresentation or any other means — we will immediately suspend the relevant account, delete all associated personal data to the extent permitted by legal retention obligations, and void any associated transactions including deposits, wagers, and withdrawals.

Parents or guardians who have reason to believe that a minor has accessed or registered on the primatoto platform should contact us immediately at [email protected] so that we may take prompt action.

The primatoto platform may, from time to time, contain references to or links to third-party websites, game content providers, or payment partner information pages. This Privacy Policy applies exclusively to personal data collected and processed by primatoto. It does not govern the data practices of any third-party website or service provider, even where access to that third party is facilitated through the primatoto platform.

Primatoto accepts no responsibility for the privacy practices, data security standards, or content of any third-party website. We encourage you to review the privacy policy of any third-party platform you visit independently of the primatoto platform.

Primatoto reserves the right to amend, update, or replace this Privacy Policy at any time to reflect changes in our data processing practices, applicable legal requirements, or platform operations. All amendments will be reflected in an updated "Last Updated" date at the top of this page.

Where amendments are material — meaning they significantly affect your rights or the way we process your personal data — we will provide advance notice via email to your registered address and/or via a prominent notification on the platform, with a minimum of fourteen (14) days' notice before the changes take effect. Your continued use of the platform following the effective date of any amendment constitutes your acknowledgement of the updated Policy.

We recommend reviewing this page periodically to remain informed of our current privacy practices. If you have any questions about a specific amendment, please contact our support team before the effective date.

For all questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by primatoto, please contact us using the following details:

When submitting a data-related enquiry, please include your registered username and account email to enable prompt identification of your account. For data subject rights requests, we may require additional identity verification before processing the request. All privacy enquiries are handled in strict confidence by a designated member of our data team.