Megatoto Privacy Policy

Introduction

This Privacy Policy ("Policy") is issued by Megatoto ("the Company", "we", "us", or "our") and applies to all personal data collected from individuals who visit, register on, or otherwise interact with the Megatoto online gaming platform accessible at megatoto.cam (the "Platform").

Megatoto is committed to protecting the personal data of all Members and visitors, whether they are located in Kuala Lumpur, Penang, Johor Bahru, Shah Alam, Petaling Jaya, or elsewhere in Malaysia. We handle all personal data in accordance with applicable data protection legislation and our own high internal standards of data governance.

By registering an Account on the Platform or by continuing to use the Platform after this Policy has been made available, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein.

Definitions

For the purposes of this Policy, the following terms have the meanings set out below:

• "Controller" — Megatoto, acting as the entity that determines the purposes and means of processing personal data collected through the Platform.
• "Cookie" — a small text file placed on your device by the Platform for the purposes of session management, analytics, and functionality.
• "Data Subject" — the identified or identifiable natural person to whom personal data relates; in practice, any Member or visitor to the Platform.
• "Member" — a natural person who has completed registration and holds an active Account on the Platform.
• "Personal Data" — any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial data, and online identifiers.
• "Processing" — any operation performed on personal data, including collection, storage, use, disclosure, and deletion.
• "Processor" — a third party that processes personal data on behalf of Megatoto under a written data processing agreement.
• "Sensitive Data" — a subset of personal data attracting additional protection, including data relating to health, biometrics, financial status, or government-issued identification numbers.

Data We Collect

Megatoto collects personal data in several categories. The specific data collected depends on your interaction with the Platform — whether as a visitor, a registered Member, or in the context of a particular transaction or support request.

Megatoto does not intentionally collect sensitive personal data beyond what is strictly necessary for identity and age verification. Where government-issued identification numbers (such as MyKad IC numbers) are collected, they are processed exclusively for KYC purposes and are stored in encrypted form.

How We Collect Your Data

Megatoto collects personal data through the following channels:

• Direct submission: Data provided voluntarily by you when registering an Account, submitting KYC documents, making deposit or withdrawal requests, contacting customer support, or completing profile settings.
• Automated collection: Technical and usage data collected automatically as you interact with the Platform, including through cookies, server logs, and session tracking technologies.
• Payment processors: Transaction confirmation data returned by third-party payment providers (such as FPX, DuitNow, or eWallet operators) following successful payment processing. Megatoto does not store complete payment credentials — only confirmation references and account-matching identifiers.
• Identity verification providers: Where Megatoto engages third-party KYC verification services, data may be cross-referenced with government identity registries or document verification systems for age and identity confirmation.
• Publicly available sources: In limited circumstances related to fraud prevention or AML compliance, Megatoto may verify information against publicly available records or sanctions databases.

Legal Basis for Processing

Megatoto processes your personal data on one or more of the following lawful bases, depending on the specific processing activity:

1. Contractual necessity: Processing required to perform the contract between you and Megatoto — including operating your Account, processing deposits and withdrawals in MYR, settling bets, and providing customer support.
2. Legal obligation: Processing required to comply with applicable laws and regulations, including anti-money laundering (AML) obligations, Know Your Customer (KYC) requirements, and age verification mandates.
3. Legitimate interests: Processing carried out in pursuit of Megatoto's legitimate business interests, including fraud detection, platform security, product improvement, and responsible gambling monitoring, provided such interests are not overridden by your own rights and interests.
4. Consent: Processing based on your freely given, specific, and informed consent — primarily in the context of direct marketing communications. You may withdraw consent at any time by contacting our support team or updating your Account preferences.

How We Use Your Personal Data

Megatoto uses the personal data it collects for the following purposes:

• To create, maintain, and manage your Megatoto Account;
• To process deposits and withdrawals in Malaysian Ringgit (MYR) via your chosen payment method;
• To verify your identity and age (minimum 21 years) in accordance with our KYC obligations;
• To settle sports bets, casino game outcomes, and any other wagering activities conducted through the Platform;
• To administer bonuses, promotions, loyalty rewards, and the Megatoto Brand Migration Programme;
• To monitor gaming activity for responsible gambling purposes and to apply deposit limits, session reminders, or self-exclusion tools where appropriate;
• To detect, investigate, and prevent fraud, money laundering, and any other unlawful conduct;
• To comply with our regulatory and legal reporting obligations;
• To communicate with you regarding Account status, security alerts, transaction confirmations, and support responses;
• To send you promotional communications where you have provided consent to receive them;
• To analyse Platform usage patterns and improve the performance, functionality, and user experience of the Platform;
• To resolve disputes, enforce our Terms and Conditions, and exercise or defend legal claims.

Data Sharing & Disclosure

Megatoto does not sell, rent, or trade your personal data. We share personal data only in the circumstances set out below, and always subject to appropriate data protection safeguards.

• Payment processors and banking partners: We share necessary financial data with payment service providers (including FPX operators, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, and partner banks such as Maybank, CIMB, Public Bank, and Hong Leong) to process your deposits and withdrawals. These parties act as data processors under written agreements and are prohibited from using your data for any other purpose.
• KYC and identity verification providers: Identity documents and personal data may be shared with third-party verification services to fulfil our age and identity verification obligations.
• Game providers and platform technology partners: Limited technical and session data is shared with our certified game content providers for the purpose of delivering game content and resolving technical disputes.
• Regulatory and law enforcement authorities: Megatoto may disclose personal data to competent authorities where required by applicable law, court order, or regulatory direction — including for AML reporting purposes. We will not notify you of such disclosures where doing so would be unlawful or would prejudice an investigation.
• Professional advisers: Personal data may be shared with legal advisers, auditors, or insurers where strictly necessary and subject to appropriate confidentiality obligations.
• Corporate transactions: In the event of a merger, acquisition, or sale of all or part of Megatoto's business, personal data may be transferred to the relevant successor entity, subject to notice to affected Members.

Cookies & Tracking Technologies

Megatoto uses cookies and similar tracking technologies to enhance your experience on the Platform, maintain session security, and collect analytics data to improve our services. The following categories of cookies are used:

• Strictly necessary cookies: Required for the Platform to function correctly, including session management, login authentication, and security features. These cookies cannot be disabled without impairing Platform functionality.
• Functional cookies: Used to remember your preferences, such as language settings and Account display options, to deliver a more personalised experience.
• Analytics cookies: Used to collect anonymised data on how visitors interact with the Platform — including pages visited, time on site, and navigation paths — to help us improve usability and performance.
• Security cookies: Used to detect and prevent fraudulent activity, including detecting multiple Account creation attempts or suspicious login patterns.

You may manage cookie preferences through your browser settings. Please note that disabling certain categories of cookies may affect the functionality of the Platform. Megatoto does not use third-party advertising or retargeting cookies.

Data Security

Megatoto implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. Our security programme includes, but is not limited to:

• 256-bit TLS/SSL encryption for all data in transit between your device and Megatoto's servers;
• Encryption at rest for all sensitive data stored in our databases, including identity documents and financial account references;
• Multi-factor authentication options available to Members for Account access;
• Access controls ensuring that personal data is accessible only to authorised personnel with a documented need to process it;
• Regular penetration testing and vulnerability assessments conducted by independent security specialists;
• Incident response procedures governing detection, containment, and notification in the event of a suspected data breach.

While Megatoto takes all reasonable steps to protect your personal data, no method of transmission over the internet is completely secure. We encourage all Members to use strong, unique passwords for their Accounts and to enable two-factor authentication where available.

Data Retention

Megatoto retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention principles apply:

• Active Account data: Retained for the duration of the Member relationship and for a period thereafter as required for legal, regulatory, or audit purposes.
• Financial transaction records: Retained for a minimum of seven (7) years from the date of the transaction, in accordance with applicable AML and financial record-keeping requirements.
• KYC and identity verification documents: Retained for a minimum of five (5) years following Account closure, or longer where required by applicable law.
• Gaming activity records: Retained for a period sufficient to resolve any disputes regarding bet settlement and to comply with responsible gambling monitoring obligations.
• Support and communications records: Retained for a period of three (3) years from the date of the last interaction, unless a live dispute requires extended retention.
• Marketing consent records: Retained for as long as consent is active, and for a further period following withdrawal of consent to demonstrate compliance.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our data disposal procedures.

Your Rights Regarding Personal Data

As a Data Subject, you have the following rights with respect to your personal data held by Megatoto. To exercise any of these rights, please contact our support team via live chat or by email:

• Right of access: You may request confirmation of whether Megatoto holds personal data about you and, if so, a copy of that data along with information about how it is processed.
• Right to rectification: You may request correction of any inaccurate or incomplete personal data we hold about you. You may also update certain Account details directly through your Account settings.
• Right to erasure ("right to be forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where you object to processing carried out on legitimate interests grounds — subject to any overriding legal retention obligations.
• Right to restriction of processing: You may request that Megatoto limits the processing of your personal data in certain circumstances, such as where the accuracy of the data is contested or where you have objected to processing.
• Right to data portability: Where processing is carried out by automated means on the basis of contract or consent, you may request a copy of your personal data in a structured, machine-readable format.
• Right to object: You may object to processing carried out on the basis of legitimate interests at any time. You also have an unconditional right to object to processing for direct marketing purposes.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Megatoto will respond to all valid data rights requests within 30 calendar days of receipt. In complex cases, this period may be extended by a further 60 days with written notice to you. We do not charge a fee for processing data rights requests unless they are manifestly unfounded or excessive.

Children & Minors

The Megatoto Platform is strictly intended for adults aged 21 years and above. Megatoto does not knowingly collect personal data from individuals under the age of 21. Age verification is conducted as part of the Account registration and KYC process.

If Megatoto becomes aware that an Account has been registered by a person under the age of 21, the Account will be immediately suspended, all pending transactions will be cancelled, and any personal data associated with that Account will be securely deleted to the extent permitted by applicable law and our AML obligations.

If you believe that a minor has registered an Account on the Platform, please contact our support team immediately so that we can take appropriate action.

Cross-Border Data Transfers

Megatoto's Platform is operated by a team that may include personnel and infrastructure located in jurisdictions outside Malaysia. As a result, your personal data may be transferred to, stored in, or processed in countries other than Malaysia.

Where personal data is transferred outside of Malaysia, Megatoto takes steps to ensure that appropriate safeguards are in place to protect that data to a standard equivalent to that required under applicable Malaysian law. These safeguards may include standard contractual clauses, data processing agreements, or other recognised transfer mechanisms.

By registering an Account and using the Platform, you acknowledge and consent to the transfer of your personal data to jurisdictions that may not provide the same level of data protection as Malaysia, subject always to the safeguards described in this Policy.

Third-Party Links

The Megatoto Platform does not contain links to third-party websites other than those expressly integrated for payment processing purposes. Megatoto accepts no responsibility for the privacy practices or data handling of any third-party website or service. We recommend that you review the privacy policy of any third-party service you use in connection with your Megatoto Account, including your chosen banking or eWallet provider.

Updates to This Privacy Policy

Megatoto reserves the right to update or amend this Privacy Policy at any time. Where changes are material, we will notify affected Members by email or via a prominent notice on the Platform prior to the changes taking effect. Non-material updates may take effect immediately upon posting of the revised Policy.

The version of this Policy currently in effect is dated 1 January 2026. We encourage you to review this Policy periodically to stay informed about how we handle your personal data. Your continued use of the Platform following notification of any change constitutes your acceptance of the updated Policy.

Contact Us & Data Requests

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or need to report a privacy concern, please contact the Megatoto Data Protection team through any of the following channels:

• Live Chat: Available 24 hours a day, 7 days a week via the Platform. This is the fastest route for urgent privacy matters.
• Email: [email protected] — include "Privacy Request" in your subject line and allow up to 30 days for a full response.

When submitting a data rights request, please provide your full registered name, Account email address, and a description of your request. To protect against fraudulent data requests, we may ask you to verify your identity before processing any request that involves access to, or deletion of, personal data.

Our support team operates in English and in Malaysian Standard Time (MYT, UTC+8), serving Members from Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and across Malaysia.