Duatoto Privacy Policy

Introduction

Duatoto ("we", "us", "our", "the Platform") operates the online gaming platform accessible at duatoto.cam. As a platform serving Malaysian players, we take the protection and responsible handling of your personal data very seriously. This Privacy Policy ("Policy") describes in detail how we collect, use, disclose, store, and protect information about you when you visit or use the duatoto platform.

This Policy applies to all visitors and registered players who access duatoto through any device or interface, including desktop browsers and mobile web. By registering an account with duatoto or continuing to use the platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

This Privacy Policy should be read alongside our Terms & Conditions and our Responsible Gambling Policy. Together, these documents govern your relationship with duatoto.

Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings assigned below:

Personal Data We Collect

Duatoto collects the following categories of personal data in connection with the operation of its platform:

3.1 Account Registration Data

• Full legal name as it appears on your government-issued identity document
• Date of birth (used to verify that you meet the 21+ age requirement)
• Email address and contact phone number
• Username and encrypted password hash
• Residential address

3.2 Identity Verification (KYC) Data

• Scanned or photographed copies of your Malaysian MyKad (NRIC), Passport, or Driver's Licence
• Proof of address documents (utility bill, bank statement, or equivalent) dated within the preceding three months
• Selfie photograph holding the primary identity document
• Payment method verification documentation where required

3.3 Financial & Transaction Data

• Deposit and withdrawal transaction records, including amounts and timestamps
• Payment method references (e.g., masked e-wallet identifiers, bank account references for Touch 'n Go, Boost, GrabPay, DuitNow, FPX, and supported Malaysian banks)
• Cryptocurrency wallet addresses where USDT TRC20 transactions are involved
• Account balance history and bonus utilisation records

3.4 Gameplay & Betting Data

• Records of all wagers placed, games played, and betting history
• Session duration, frequency of play, and win/loss records
• Responsible gambling tool usage, including deposit limits and self-exclusion requests

3.5 Technical & Device Data

• IP address and approximate geographic location
• Device type, operating system, and browser version
• Session identifiers and authentication tokens
• Log files recording platform access and activity timestamps

3.6 Communications Data

• Records of live chat interactions with duatoto's support team
• Email correspondence with duatoto regarding your account
• Feedback, complaints, and dispute records

How We Collect Your Data

Duatoto collects personal data through the following means:

• Direct submission: Data you provide voluntarily during account registration, KYC submission, deposit or withdrawal requests, and when contacting support.
• Automated collection: Technical data collected automatically when you access the platform, including IP addresses, device identifiers, and session logs via cookies and server-side logging.
• Third-party payment processors: Transaction confirmation data received from payment providers such as Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and bank partners (Maybank, CIMB, Public Bank, Hong Leong Bank) upon processing your deposits or withdrawals.
• KYC and identity verification partners: Verification status and document authenticity outcomes provided by authorised third-party verification services engaged by duatoto for compliance purposes.
• Anti-fraud and security systems: Risk scoring data generated by duatoto's internal fraud detection and monitoring systems.

Purposes of Data Processing

Duatoto processes your personal data for the following specific, legitimate purposes:

Duatoto does not use your personal data for automated profiling that produces legal effects on you or similarly significantly affects you without your explicit consent.

Legal Basis for Processing

Duatoto processes your personal data on the following legal grounds:

• Contractual necessity: Processing required to perform the contract between you and duatoto — i.e., to operate your gaming account, process transactions, and deliver platform services.
• Compliance with legal obligations: Processing required for KYC/AML (anti-money laundering) compliance, age verification, responsible gambling obligations, and any other applicable regulatory requirements.
• Legitimate interests: Processing for fraud prevention, platform security, system integrity, and the protection of duatoto's business interests, where such interests do not override your rights and freedoms.
• Consent: Where duatoto processes data for optional purposes — such as sending promotional emails about bonuses or new games — we will obtain your explicit consent before doing so. You may withdraw consent at any time without affecting the lawfulness of processing conducted prior to withdrawal.

Data Sharing & Disclosure

Duatoto does not sell, rent, or commercially disclose your personal data to third parties for their own marketing purposes. Your data may be shared only in the following circumstances and only to the extent strictly necessary:

• Payment processors: Transaction data is shared with payment service providers (such as Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and partner banks) solely for the purpose of processing your deposits and withdrawals.
• KYC verification partners: Identity documents and verification data are shared with authorised third-party KYC service providers for the purpose of identity verification and AML compliance screening.
• Cloud infrastructure providers: Encrypted data is stored on secure cloud servers operated by contracted infrastructure providers. These providers act as data processors under binding data processing agreements.
• Fraud prevention and security services: Anonymised or pseudonymised data may be shared with fraud detection services to identify and prevent suspicious activity.
• Legal and regulatory authorities: Duatoto may disclose personal data to law enforcement agencies, regulatory bodies, or courts where required to do so by applicable law, court order, or in response to a lawful request.
• Business transfers: In the event of a merger, acquisition, or sale of business assets, your data may be transferred to the relevant successor entity, subject to equivalent privacy protections.

Data Retention

Duatoto retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law, whichever is longer. The following retention guidelines apply:

• Active account data: Retained for the duration of your account relationship with duatoto, plus a minimum period of five (5) years following account closure, to satisfy anti-money laundering and regulatory record-keeping obligations.
• KYC documentation: Retained for a minimum of five (5) years following the completion of the business relationship, in accordance with standard AML compliance requirements.
• Transaction records: Retained for a minimum of five (5) years, consistent with financial record-keeping standards.
• Support communications: Retained for a minimum of three (3) years to facilitate dispute resolution and quality assurance.
• Promotional consent records: Retained until consent is withdrawn, plus a reasonable period thereafter to evidence compliance.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in accordance with duatoto's data destruction protocols. Anonymised data (from which no individual can be identified) may be retained indefinitely for statistical and analytics purposes.

Data Security

Duatoto implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• Transport Layer Security (TLS 1.2+) encryption for all data transmitted between your device and the duatoto platform.
• AES-256 encryption for personal data stored at rest on duatoto's servers and cloud infrastructure.
• Role-based access controls ensuring that only authorised personnel can access sensitive personal data, limited strictly to what is necessary for their specific job function.
• Continuous security monitoring, intrusion detection systems, and regular penetration testing of the platform infrastructure.
• Strict internal data handling policies covering employee training, clean desk protocols, and device security requirements.
• Multi-factor authentication requirements for internal systems that store or process personal data.

Notwithstanding the above measures, no data transmission over the internet or electronic storage system can be guaranteed to be 100% secure. Duatoto will notify affected players and relevant authorities in the event of a data breach that presents a material risk to their rights and freedoms, in accordance with applicable breach notification requirements.

Cookies & Tracking Technologies

Duatoto uses cookies and similar tracking technologies on its platform for the following purposes:

• Strictly necessary cookies: Required for the platform to function correctly, including session management, authentication state, and security token handling. These cookies cannot be disabled without disrupting platform functionality.
• Functional cookies: Used to remember your preferences, language settings, and display configurations to improve your experience on return visits.
• Analytics cookies: Used to collect anonymised data about how players navigate the platform — including page visit frequency, session duration, and feature usage — to inform platform improvements. Analytics data is aggregated and does not identify individual users.
• Security cookies: Used to detect and prevent fraudulent activity, unauthorised access attempts, and bot traffic.

Duatoto does not deploy third-party advertising or cross-site tracking cookies. By continuing to use the duatoto platform, you consent to the use of cookies as described in this section. You may configure your browser to reject or delete cookies; however, doing so may impair certain platform features, including the ability to maintain a logged-in session.

KYC & Identity Document Handling

Identity documents submitted for KYC verification are handled under strict access control protocols. The following safeguards apply specifically to KYC documentation:

• Documents are uploaded exclusively via the secure in-platform document upload facility. Duatoto will never request identity documents via unsecured messaging applications, social media, or unencrypted email.
• Access to KYC documents is restricted to authorised compliance personnel and, where applicable, our contracted KYC verification partners operating under binding data processing agreements.
• Documents are not retained beyond the applicable regulatory retention period and are destroyed in accordance with duatoto's secure data disposal procedures upon expiry of that period.
• Players are advised to partially obscure sensitive identification numbers on uploaded documents where feasible, as duatoto's review process requires only sufficient information to confirm identity, not full document replication.

Children's Privacy

The duatoto platform is strictly intended for persons aged 21 years and above. Duatoto does not knowingly collect, process, or store personal data from individuals under the age of 21. Age verification is a mandatory step in the account registration and KYC process.

If duatoto becomes aware that personal data has been collected from an individual under the age of 21 without the requisite parental or guardian consent, that account will be immediately suspended, all associated personal data will be deleted, and any funds deposited will be returned via the original payment method following verification.

If you believe a minor may have registered on the duatoto platform, please contact our support team immediately so that appropriate action can be taken without delay.

Your Data Rights

Subject to applicable law and certain exceptions, you have the following rights in relation to the personal data duatoto holds about you. To exercise any of these rights, please contact duatoto via live chat or at [email protected]. We will respond to valid requests within a reasonable timeframe.

Please note that certain rights may be limited where duatoto is required to retain or process data to comply with legal obligations, to defend legal claims, or to maintain the integrity of the platform. We will explain any such limitations clearly when responding to your request.

International Data Transfers

Duatoto's primary player base is located in Malaysia and its platform is designed for Malaysian users. However, certain technical operations — including cloud infrastructure hosting and third-party KYC verification services — may involve the processing of personal data by service providers located outside Malaysia.

Where personal data is transferred to third parties outside of Malaysia, duatoto ensures that appropriate safeguards are in place to protect the security and confidentiality of that data. Such safeguards include the use of contractual data protection clauses that impose equivalent standards of protection to those described in this Policy.

Duatoto does not transfer personal data to jurisdictions that do not offer adequate data protection standards without implementing additional protective measures. By using the duatoto platform, you consent to such transfers being made in accordance with this Policy.

Amendments to This Policy

Duatoto reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, platform operations, or data processing practices. Material changes will be communicated to registered players via their registered email address and/or by a prominent notice on the platform prior to the change taking effect.

The "Last Updated" date at the top of this Policy indicates when the most recent revision was made. Your continued use of the duatoto platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not accept any amendment, you must cease using the platform and may request voluntary account closure in accordance with the process described in our Terms & Conditions.

We encourage you to review this Policy periodically to stay informed about how duatoto protects your personal data.

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact duatoto through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week via the in-platform support widget. This is the fastest route for most enquiries.
• Email: [email protected] — for formal data rights requests, privacy complaints, or detailed written enquiries. Responses will be provided within a reasonable timeframe, typically within 5 business days for data rights requests.

When submitting a data rights request, please include your registered email address, account username, and a clear description of the right you wish to exercise. We may need to verify your identity before processing your request to ensure we do not inadvertently disclose data to an unauthorised party.

For matters relating to platform rules and wagering, please refer to our Terms & Conditions. For responsible gambling tools and support, please visit our Responsible Gambling page.