puncaktoto Privacy Policy — How We Handle Your Data

Introduction and Scope

This Privacy Policy describes how puncaktoto processes personal information relating to individuals who register an account, visit the platform, contact support, or otherwise interact with the service. It forms part of the overall agreement between puncaktoto and the player, alongside the Terms & Conditions and any applicable promotion rules.

puncaktoto is committed to handling personal information responsibly, using it only for the purposes described here, and applying appropriate safeguards to protect it. This policy should be read in full. If you do not accept its terms, you should discontinue use of the platform.

Definitions

For the purposes of this Privacy Policy, the following terms carry these meanings:

• Personal Data — any information relating to an identified or identifiable natural person, including name, email address, device identifiers, and transaction records.
• Processing — any operation performed on personal data, including collection, storage, use, transmission, and deletion.
• Data Controller — puncaktoto, the entity that determines the purposes and means of processing personal data collected through this platform.
• Player / User / You — any natural person who creates an account or accesses puncaktoto.
• Service Providers — third-party companies engaged by puncaktoto to perform technical or operational functions on its behalf.
• Cookies — small text files or similar technologies placed on a device to store session state, preferences, or analytical data.

Data We Collect

puncaktoto may collect the following categories of personal information during registration, verification, gameplay, transactions, and support interactions:

• Identity data: full name, date of birth, government-issued identification number or document details required for age and identity verification.
• Contact data: email address, phone number, and residential address used to administer and support your account.
• Financial data: deposit and withdrawal records, MYR transaction amounts, payment method identifiers, cryptocurrency wallet references for supported currencies such as BTC, ETH, and USDT, and details of Malaysian payment instruments including DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and Hong Leong.
• Technical data: IP address, device type, operating system, browser, session identifiers, and log files generated during platform access.
• Usage data: game history, betting activity, session duration, pages visited, search queries, and interaction patterns on the platform.
• Communications data: content of messages, support requests, complaints, and survey responses submitted to puncaktoto.
• Responsible gambling data: deposit limit settings, self-exclusion requests, session reminders, and cooling-off instructions where these are provided.

Purposes of Processing

Personal information collected by puncaktoto is used for the following purposes:

• Creating and managing player accounts, including authentication and ongoing access controls.
• Conducting age checks, identity verification, and Know Your Customer procedures before processing withdrawals or in response to security flags.
• Processing deposits and withdrawals in MYR and supported cryptocurrencies, and communicating transaction confirmations.
• Operating the gaming platform, including settlement of sports bets on events such as EPL, Liga Super Malaysia, UFC, and international football, as well as casino game results.
• Preventing and detecting fraud, money laundering, bonus abuse, account sharing, prohibited conduct, and other activities that may harm players or the platform.
• Providing customer support in English and other languages offered by puncaktoto to players across Malaysia, including Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and other locations.
• Administering responsible gambling controls requested or required for your account.
• Sending service communications such as verification emails, transaction notifications, security alerts, and updates to policies.
• Improving platform performance, user experience, payment processes, and game discovery based on aggregated and anonymised usage data.
• Meeting legal, regulatory, and compliance obligations applicable to puncaktoto and its operations.

Legal Bases for Processing

puncaktoto relies on the following legal bases when processing your personal information:

• Contractual necessity: processing required to establish and operate your account, execute payments, and provide the services described in the Terms & Conditions.
• Legitimate interests: fraud prevention, platform security, responsible gambling monitoring, analytics for service improvement, and protection of the business and other players — where those interests are not overridden by your fundamental rights.
• Legal obligation: complying with applicable obligations, record-keeping requirements, lawful disclosures, and responding to valid regulatory or law enforcement requests.
• Consent: where you have given explicit consent, such as opting in to marketing communications. Consent may be withdrawn at any time without affecting prior lawful processing.

Sharing and Disclosure

puncaktoto does not sell or rent your personal information to third parties. Sharing is limited to circumstances where it is necessary for operations or required by obligation:

• Payment processors and banking partners: Malaysian payment providers, banking institutions, e-wallet operators, and cryptocurrency network services that process your transactions.
• Identity and verification services: third-party identity verification providers engaged to confirm age, identity, and document authenticity during account checks.
• Technology and hosting providers: companies providing platform infrastructure, cloud services, security tools, and communications systems under appropriate data processing terms.
• Fraud prevention services: shared fraud intelligence networks that help identify and prevent financial crime, account abuse, and prohibited conduct.
• Legal and regulatory authorities: government bodies, law enforcement agencies, courts, or regulators where disclosure is required by a lawful order, obligation, or mandatory obligation.
• Business transactions: in the event of a merger, acquisition, restructuring, or transfer of assets, personal data may be disclosed to relevant parties under appropriate confidentiality arrangements.

Cookies and Similar Technologies

puncaktoto uses cookies, local storage, and similar technologies on its platform. These serve a number of functional and analytical purposes:

• Session cookies: maintain your authenticated session while you are logged into puncaktoto, preventing the need to re-enter credentials on every page.
• Preference cookies: store settings such as display preferences to personalise your experience during and between visits.
• Analytical cookies: collect aggregated and anonymised data about how players navigate the platform, which pages are most visited, and where errors occur, in order to improve performance.
• Security cookies: support fraud detection, unusual login detection, and general account protection measures.

You may configure your browser to block, delete, or restrict cookies. Disabling certain cookies may affect the functionality of puncaktoto, including your ability to remain logged in or complete transactions. Continuing to use the platform after reviewing this notice indicates acceptance of cookies as described.

Data Retention

Personal information is retained for the period necessary to fulfil the purposes set out in this policy. Key retention considerations include:

• Active account data is retained for the duration of the account relationship and for a reasonable period after account closure, to address disputes and support requests.
• Financial transaction records, verification documents, and activity logs may be retained for periods required by applicable obligations or internal risk management practices.
• Support communications and complaint records are retained to assist with ongoing inquiries and service improvements.
• Where data is no longer required, puncaktoto applies secure deletion or anonymisation procedures so that the information can no longer be attributed to an individual.

Security Measures

puncaktoto implements technical and organisational measures proportionate to the sensitivity of the personal data processed. These include encrypted data transmission and storage, access controls limiting staff access to personal data on a need-to-know basis, routine monitoring for security vulnerabilities and unusual activity, and procedures for responding to data incidents. No online platform can guarantee absolute security. Players are responsible for maintaining the confidentiality of their account credentials and notifying puncaktoto promptly if they suspect unauthorised access to their account or payment methods.

International Data Transfers

puncaktoto operates systems that may involve storage or processing of data in locations outside Malaysia. Where personal information is transferred internationally, puncaktoto takes steps to ensure that such transfers are covered by appropriate safeguards — including contractual protections — consistent with the principles described in this policy. Players who have questions about international transfer safeguards may contact puncaktoto using the details in the Contact section.

Your Rights

Subject to applicable rules and the conditions of your account relationship, you hold the following rights in relation to your personal information:

• Access: you may request a copy of the personal information puncaktoto holds about you.
• Correction: you may request correction of inaccurate or incomplete personal information held about your account.
• Erasure: in certain circumstances, you may request deletion of your personal data, subject to overriding retention obligations.
• Restriction: you may request that processing of your personal information be limited in specific circumstances while a request is under review.
• Withdrawal of consent: where processing is based on consent, you may withdraw that consent at any time, without affecting the lawfulness of prior processing.
• Marketing opt-out: you may request removal from promotional communications at any time through available account controls or by contacting support.

Requests will be addressed within a reasonable timeframe. puncaktoto may ask you to verify your identity before processing a request to protect against unauthorised access to account information.

Minors and Age Requirement

puncaktoto is strictly a service for adults aged 21 and above. puncaktoto does not knowingly collect personal information from persons under 21, and does not permit minors to create accounts or place wagers. Where puncaktoto becomes aware that a person under 21 has submitted personal information or accessed the service, relevant data will be removed and the account closed. Adults should ensure their account credentials and connected payment devices are kept secure and out of reach of minors and other unauthorised persons.

Updates to This Policy

puncaktoto may revise this Privacy Policy to reflect changes to our services, operational practices, technology infrastructure, payment systems, or applicable requirements. The revised version will be published on the platform with an updated effective date. Continued use of puncaktoto after the revised policy has been published constitutes acceptance of the updated terms. Players who do not accept a material change should stop using the service and may contact puncaktoto to close their account and request appropriate handling of their data.

Contact

For questions, correction requests, erasure requests, or concerns relating to your personal information and how puncaktoto handles it, contact our support team using the email address displayed in plain text in the footer of this page. Please include your registered account identifier, the nature of your inquiry, and relevant context so that your request can be handled efficiently. puncaktoto will respond within a reasonable period and may request identity verification before actioning sensitive requests.