Privacy Policy birutoto – Personal Data Protection for Malaysian Users

1 Introduction and Scope of This Policy

Birutoto recognises that user privacy is a fundamental right that must be respected and protected. This Privacy Policy is prepared in accordance with Malaysia's Personal Data Protection Act 2010 and international data protection best practices.

This document applies to all users who register, browse, or use any birutoto service — whether through the official website, Android and iOS mobile app, or any other channel operated by birutoto. It explains:

• The types of personal information birutoto collects from you.
• The purpose for which such information is collected and used.
• How we protect your data from unauthorised access.
• Your rights regarding the personal data we hold about you.
• How you can reach us for privacy-related enquiries or requests.

If you have any concerns about this policy or how birutoto handles your data, we encourage you to contact our support team via live chat before continuing to use the platform.

2 Personal Information We Collect

Birutoto collects your personal information through several means – directly from you during registration and platform use, automatically through technologies used within the platform, and in some instances, from trusted third-party sources.

Birutoto does not collect information irrelevant to platform operations, including biometric data (except where biometric login is enabled by the user themselves on their own device), continuous real-time location data, or the content of private communications between users.

3 How We Use Your Information

Every piece of data that birutoto collects has a specific and legitimate purpose. We do not use your data for purposes not stated in this document without first obtaining fresh consent from you.

• Account management: Creating, verifying, and managing your birutoto account.
• Transaction processing: Processing deposits, withdrawals, and all financial transactions on the platform.
• Identity verification (KYC): Verifying your identity in accordance with legal compliance requirements and anti-money laundering regulations.
• Platform security: Detecting and preventing fraud, unauthorised use, and suspicious activity.
• Customer support: Providing technical assistance and resolving any issues you encounter.
• Service improvement: Analysing usage patterns to improve the overall platform experience.
• Marketing communications: Sending relevant promotions, bonuses, and special offer information (only if you have consented to receive them).
• Legal compliance: Complying with legal obligations imposed on birutoto by the relevant authorities.

4 Sharing Information with Third Parties

Birutoto does not sell your personal data to any third party. Your information is only shared in the following limited situations, and only to the extent necessary for the stated purposes:

• Payment service providers: To securely process your deposits and withdrawals through designated payment gateways.
• Identity verification service providers: Third parties who assist us in carrying out the KYC process in accordance with industry standards.
• Technology service providers: Companies supporting birutoto's technical infrastructure, such as cloud computing and cybersecurity services, which are bound by strict confidentiality agreements.
• Legal authority: When required by law, court order, or direction from a competent authority.
• Fraud prevention bodies: As part of a joint effort to prevent fraud and money laundering that affects the industry as a whole.

All third parties that receive data from birutoto are bound by strict data protection agreements and are prohibited from using that information for any purpose other than those specified by birutoto.

5 Data Security Measures We Take

Protecting your data is not merely a legal obligation for birutoto — it is a core commitment we take seriously at every level of our operations. We continuously invest in security infrastructure to ensure your data remains protected at all times.

• Data encryption at rest: Sensitive information such as passwords and payment details is stored in encrypted form and cannot be read even by birutoto staff.
• Multi-layered access controls: Only authorised birutoto staff with legitimate job requirements may access user data, and all such access is fully logged.
• 24/7 security monitoring: Automated monitoring systems continuously protect birutoto infrastructure against cyber threats and unauthorised access attempts.
• Regular security audits: birutoto conducts regular external security audits to identify and address any vulnerabilities before they can be exploited.
• Two-factor authentication: Login with two-factor authentication (2FA) is available and encouraged for all birutoto users.

6 Cookies and Tracking Technologies

Birutoto uses cookies and similar tracking technologies to enhance the user experience, enable core platform functionality, and understand how users interact with our platform.

• Essential Cookies: Required for core platform functions such as login authentication and session security. These cookies cannot be disabled as they are necessary for the platform to operate.
• Performance Cookies: Helping us understand how users interact with the platform so we can make improvements. Information collected is in aggregate form and does not directly identify individuals.
• Preference Cookies: Storing your settings and preferences such as your preferred language for a smoother experience.
• Analytics Cookies: Helping birutoto understand overall usage patterns for product improvement.

You can manage cookie usage through your web browser settings. However, disabling essential cookies may affect your ability to use certain features of the birutoto platform.

7 Data Retention and Deletion

Birutoto does not retain your personal data longer than necessary for the purpose it was collected, except where longer retention is required by Malaysian law or industry compliance requirements.

• Active account data: Retained for as long as your birutoto account remains active.
• Financial transaction data: Retained for a minimum of 7 years in accordance with accounting and compliance legal requirements.
• KYC and verification data: Retained for the period specified under applicable anti-money laundering laws.
• Security logs: Retained for 12 months for security incident investigation purposes if required.
• Marketing data: Deleted within 30 days after you withdraw consent for marketing communications.

Once the defined retention period has elapsed and there is no legal requirement to retain the data, birutoto will securely delete or anonymise your data.

8 KYC Process and Identity Verification

As a responsibly operated betting platform, birutoto is required to carry out a rigorous Know Your Customer (KYC) process. This not only fulfils legal requirements but also protects you as a user from identity misuse.

During the KYC process, you will be asked to submit a valid proof of identity (such as a national identity card or passport), proof of current address, and in some cases, additional information to verify the source of funds. All submitted documents:

• Transmitted and stored using strict end-to-end encryption.
• Accessible only by the birutoto compliance team, who have completed privacy training.
• Not shared with third parties except for verification purposes by recognised bodies.
• Retained for the period required by law, then securely deleted.

9 Your Rights as a birutoto User

Under applicable data protection laws, you have several important rights regarding your personal data held by birutoto. We respect these rights and have clear processes in place to help you exercise them.