Legitoto Privacy Policy

Legitoto ("we", "us", "our", or "the Platform") is an online betting and gaming platform operating under the domain legitoto.cam, serving players primarily in Malaysia including Kuala Lumpur, Petaling Jaya, Shah Alam, Penang, Johor Bahru, and surrounding areas.

This Privacy Policy ("Policy") describes in detail how Legitoto collects, receives, uses, stores, shares, transfers, and processes personal data relating to individuals who visit, register with, or otherwise interact with the Platform ("Users"). It applies to all personal data processed through the Platform, whether submitted by Users directly or collected automatically through their use of the service.

This Policy is issued in compliance with applicable data protection legislation, including the Personal Data Protection Act 2010 (PDPA) of Malaysia. Where Users access the Platform from other jurisdictions, additional or alternative data protection laws may apply, and Legitoto endeavours to comply with all applicable obligations accordingly.

By registering an Account with Legitoto or by continuing to use the Platform following the publication of this Policy, you acknowledge that you have read and understood its contents and that you consent to the processing of your personal data as described herein. If you do not agree with any part of this Policy, you should cease using the Platform and may request Account closure in accordance with our Terms and Conditions.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

Legitoto collects personal data from Users across several categories. The specific data collected depends on the nature of the User's interaction with the Platform. The categories of personal data we collect are set out in the table below:

We do not intentionally collect special categories of sensitive personal data (such as racial or ethnic origin, political opinions, religious beliefs, or health data) unless specifically required to fulfil a legal obligation, such as evidence of a self-exclusion on medical grounds. Where such data is collected, it will be handled with heightened protection measures.

Legitoto collects personal data through the following channels:

• Direct submission by the User: Information you enter during registration, identity verification, payment processes, support interactions, or promotional opt-ins.
• Automated technical collection: Data gathered automatically through cookies, web beacons, server logs, and similar technologies when you access or use the Platform. This includes IP addresses, device identifiers, and usage patterns.
• Third-party payment providers: When you deposit or withdraw via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX (Maybank, CIMB, Public Bank, Hong Leong Bank), or cryptocurrency networks, relevant transaction data is received from those providers to reconcile your Account balance.
• Identity verification service providers: During KYC processing, our authorised verification partners may cross-reference your submitted documents against reference databases and return a verification outcome to Legitoto. The underlying personal data remains subject to this Policy.
• Regulatory and law enforcement bodies: In limited circumstances, we may receive information about Users from regulatory authorities or law enforcement agencies in connection with an investigation or legal obligation.

Legitoto processes personal data only where there is a lawful basis for doing so. The primary purposes for which we process User data, and the corresponding legal bases under the PDPA 2010 and applicable data protection frameworks, are as follows:

Legitimate processing of your personal data by Legitoto is conducted by authorised personnel and, where applicable, by contracted third-party processors operating under strict data processing agreements. All processors engaged by Legitoto are required to:

• Process personal data solely on documented instructions from Legitoto;
• Implement appropriate technical and organisational security measures;
• Not engage any sub-processor without prior written authorisation from Legitoto;
• Assist Legitoto in fulfilling its obligations in response to User rights requests;
• Delete or return all personal data to Legitoto upon termination of the processing engagement.

Personal data is processed in a manner consistent with the principles of data minimisation — we collect only the data that is necessary for the stated purpose — and purpose limitation — data collected for one purpose is not used for an incompatible secondary purpose without obtaining fresh consent or establishing another lawful basis.

Legitoto does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may share personal data with the following categories of recipients in the circumstances described:

• Payment service providers: Transaction data is shared with Touch 'n Go, Boost, GrabPay, DuitNow, FPX-connected Malaysian banks (including Maybank, CIMB, Public Bank, and Hong Leong Bank), and cryptocurrency network operators solely to facilitate the processing of deposits and withdrawals.
• KYC and identity verification partners: Identity documents and biometric selfie data may be shared with our contracted verification service providers to complete the KYC process. These providers are bound by equivalent data protection obligations.
• Technology and infrastructure providers: Data may be processed by our cloud hosting, database management, and cybersecurity service providers who operate as data processors under contractual data processing agreements.
• Fraud prevention and AML compliance bodies: Where required by applicable anti-money laundering or counter-terrorism financing obligations, we may share data with relevant regulatory or compliance bodies.
• Law enforcement and regulatory authorities: Where required by a lawful legal order, court order, or regulatory directive, Legitoto will disclose personal data to the requesting authority. We will endeavour to notify the affected User of such disclosure where legally permitted to do so.
• Business successors: In the event of a merger, acquisition, or sale of all or part of Legitoto's business, personal data may be transferred to the acquiring entity, subject to equivalent data protection protections being maintained.

Legitoto retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Active Account holders: Personal data is retained for the full duration of the Account relationship plus a minimum period of 5 years following Account closure, in accordance with AML and gaming record-keeping obligations under Malaysian law.
• KYC and identity verification documents: Retained for a minimum of 5 years from the date of verification or from the date of Account closure, whichever is later.
• Financial transaction records: Retained for a minimum of 7 years to comply with financial record-keeping obligations.
• Support and communications data: Retained for 3 years from the date of the last communication, unless the subject matter of the communication gives rise to a legal obligation to retain for longer.
• Marketing consent records: Retained until consent is withdrawn and for a further 12 months thereafter as evidence of the consent status.
• Anonymised analytical data: May be retained indefinitely as it does not constitute personal data once properly anonymised in a manner that is not reversible.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in accordance with Legitoto's data destruction procedures.

Legitoto uses cookies and similar tracking technologies to operate the Platform, enhance User experience, and analyse usage patterns. A cookie is a small text file stored on your device by the browser when you visit the Platform. We use the following categories of cookies:

• Strictly necessary cookies: Essential for the Platform to function. These include session management cookies that keep you logged in, security tokens, and fraud prevention identifiers. These cannot be disabled without impairing Platform functionality.
• Functional cookies: Used to remember your preferences, such as language settings, preferred payment method, and customised interface options, so you do not need to reconfigure them on each visit.
• Analytics cookies: Used to collect aggregate information about how Users navigate and use the Platform, including which pages are visited most frequently and where users exit the site. This data helps us improve the Platform experience for Malaysian players.
• Security cookies: Used to detect and mitigate suspicious activity, including bot access, credential stuffing attempts, and abnormal login patterns.

You may manage cookie settings through your browser's privacy controls. Please note that disabling non-essential cookies may affect the performance and personalisation features of the Platform. Strictly necessary cookies cannot be disabled while continuing to use the Platform.

Legitoto implements a multi-layered security architecture to protect personal data against unauthorised access, disclosure, alteration, or destruction. Our security measures include, but are not limited to:

• Encryption in transit: All data transmitted between your device and the Legitoto Platform is protected using TLS 1.2 or higher (256-bit SSL encryption), preventing interception during transmission.
• Encryption at rest: Sensitive personal and financial data stored in our databases is encrypted using industry-standard encryption algorithms.
• Access controls: Access to personal data by Legitoto personnel is granted on a strict need-to-know basis, enforced through role-based access control systems and multi-factor authentication for administrative access.
• Intrusion detection: Real-time monitoring systems flag anomalous activity, unusual login patterns, and potential security incidents for immediate investigation.
• Regular security assessments: We conduct periodic vulnerability assessments and security reviews of our platform infrastructure.
• Data breach response: Legitoto maintains a documented data breach response procedure. In the event of a breach involving personal data that carries a risk to User rights, affected Users and, where required, the relevant regulatory authority will be notified within the timeframe prescribed by applicable law.

Under the Personal Data Protection Act 2010 (Malaysia) and applicable data protection principles, Users whose personal data is processed by Legitoto have the following rights. You may exercise any of these rights at any time by contacting us at the address set out in Section 16.

To exercise any of the above rights, please submit your request to [email protected] with the subject line "Data Rights Request" and include your registered Account username and a description of your request. We will acknowledge receipt of your request within 48 hours and will process it within the applicable statutory timeframe.

We may need to verify your identity before fulfilling a data rights request to ensure that we do not disclose or alter personal data belonging to another person. You will not ordinarily be charged a fee for exercising your rights unless your request is manifestly unfounded, repetitive, or excessive.

The Legitoto Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. Our registration process includes an age declaration, and our KYC verification procedures are designed to detect and prevent underage registration.

If Legitoto becomes aware that personal data has been collected from a person under the age of 21 without appropriate parental or guardian consent, we will take immediate steps to delete that data and close the associated Account.

If you are a parent or guardian and have reason to believe that a minor has registered with Legitoto using falsified age information, please contact us immediately at [email protected].

As an online platform, Legitoto may process or store certain personal data on servers and infrastructure located outside of Malaysia. Where personal data is transferred to a jurisdiction that does not provide a level of data protection equivalent to that afforded under Malaysian law, Legitoto will implement appropriate safeguards to ensure that the data remains protected to an equivalent standard.

Such safeguards may include the use of standard contractual clauses approved by the relevant data protection authority, binding corporate rules, or other legally recognised transfer mechanisms. By using the Platform, you acknowledge that your personal data may be transferred to and processed in countries outside Malaysia in the circumstances described above.

The Legitoto Platform may contain references to third-party services, including payment providers such as Touch 'n Go, Boost, GrabPay, Maybank, CIMB, and Public Bank, as well as game studio integrations. When you navigate away from the Legitoto Platform to a third-party service, this Privacy Policy no longer applies to data collected on that third-party service.

Legitoto is not responsible for the privacy practices of any third-party provider, and we encourage Users to review the privacy policies of any third-party service they interact with in connection with their use of the Platform. This includes the privacy policies of e-wallet providers and banking applications used to fund your Legitoto Account.

Legitoto reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law, or improvements to the Platform. The date of the most recent revision is displayed at the top of this page.

Where amendments are material — meaning they involve a significant change to how we collect, use, or share personal data — we will notify registered Users by email to their registered address and by displaying a prominent notice on the Platform homepage for a period of at least 14 days prior to the changes taking effect.

Your continued use of the Platform following the effective date of any amendment constitutes your acknowledgement and acceptance of the updated Policy. If you do not agree with the amended Policy, you should cease using the Platform and contact us to request Account closure.

We recommend that Users review this Policy periodically, particularly following any amendments, to stay informed about how their personal data is being protected and used.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the processing of your personal data by Legitoto, please contact our Data Protection team using the details below: