Kangtoto Privacy Policy —
Your Data, Our Responsibility

This Privacy Policy ("Policy") is issued by Kangtoto ("the Platform", "we", "us", "our") and applies to all personal data collected from individuals who access, register, or use the Kangtoto website at kangtoto.buzz and its associated mobile-optimised interface ("the Site").

Kangtoto operates as an online gaming platform offering casino games, live dealer tables, slot machines, and sports betting services, primarily serving players based in Malaysia. As part of our operations, we process personal data in connection with account management, identity verification (KYC), payment processing, responsible gambling compliance, and the delivery of a secure gaming experience.

We take our obligations as a data handler seriously. This Policy is designed to be transparent, accessible, and written in plain English — because we believe you have the right to understand exactly how your personal information is used when you interact with Kangtoto.

The following terms carry the meanings set out below throughout this Privacy Policy:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to names, identification numbers, location data, online identifiers, and financial information.
• "Data Subject" means any individual whose Personal Data is processed by Kangtoto, including registered Players and prospective users.
• "Data Controller" means Kangtoto, the entity that determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Processor" means any third party that processes Personal Data on behalf of Kangtoto under a written data processing agreement, such as payment processors and cloud infrastructure providers.
• "Processing" means any operation performed on Personal Data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "KYC" means Know Your Customer — the identity verification and due diligence process conducted by Kangtoto to comply with its licensing and anti-money-laundering obligations.
• "Cookies" means small text files placed on a user's device by a website to store session information, preferences, and analytical data.
• "AML" means Anti-Money Laundering, referring to the legal and regulatory framework designed to prevent the use of financial services for money laundering or terrorist financing.

Kangtoto collects the following categories of Personal Data, depending on the nature of your interaction with the Platform:

3.1 Registration & Identity Data

• Full legal name as it appears on your government-issued identification document.
• Date of birth (to verify the 21+ age requirement).
• Residential address, including city and postcode (relevant for Malaysian players across Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and elsewhere).
• Email address and mobile phone number.
• Nationality and country of residence.

3.2 Identity Verification (KYC) Documents

• Scanned copy or photograph of a valid government-issued photo ID (Malaysian MyKad, Passport, or Driver's License).
• Proof of residential address document (utility bill, bank statement, or official correspondence dated within three months).
• Selfie photograph holding the identity document.
• Where applicable, documentation confirming ownership of the payment method used (e.g., e-wallet account screenshot or bank statement showing account holder name).

3.3 Financial & Transaction Data

• Details of deposits and withdrawals, including amounts, timestamps, and payment method used (Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank, USDT TRC20, and other supported methods).
• Account balance history and wagering records.
• Transaction reference numbers provided by payment processors.

3.4 Gaming Activity Data

• Game history including game titles played, bet amounts, session durations, and outcomes.
• Sports betting selections, odds, stakes, and settlement results.
• Bonus redemption and wagering requirement completion records.

3.5 Technical & Device Data

• IP address and approximate geolocation derived from IP.
• Device type, operating system, browser version, and screen resolution.
• Session logs including login and logout timestamps.
• Cookie identifiers and similar tracking technologies (see Section 8).

3.6 Communication Data

• Records of live chat conversations, email correspondence, and support tickets submitted to Kangtoto.
• Feedback, complaints, and dispute records.
• Preferences for marketing communications, where consent has been given.

Kangtoto collects Personal Data through the following means:

• Directly from you: When you register an Account, complete KYC verification, make a deposit or withdrawal, contact our support team, or respond to a promotional communication.
• Automatically: Through the use of cookies, web beacons, server logs, and session-tracking technologies when you access or interact with the Site.
• From third-party payment processors: When you initiate a payment transaction via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, or cryptocurrency networks, the payment provider may share transaction confirmation data with us to reconcile your Account balance.
• From KYC and identity verification service providers: Where we engage third-party providers to assist with identity document verification or fraud screening, those providers may return verification outcome data and risk scoring to us.
• From publicly available sources: In limited circumstances required by our AML obligations, we may cross-reference information against publicly available databases, sanctions lists, or politically exposed persons (PEP) registries.

Kangtoto processes your Personal Data for the following specific purposes:

Kangtoto processes your Personal Data on the following legal bases, depending on the specific purpose:

• Contractual necessity: Processing required to fulfil our obligations under the agreement formed when you register an Account and accept our Terms & Conditions — including account management, payment processing, and game delivery.
• Legal obligation: Processing required to comply with our regulatory and licensing obligations, including KYC identity verification, AML monitoring, and responsible gambling compliance requirements imposed by our gaming licence.
• Legitimate interests: Processing undertaken in furtherance of Kangtoto's legitimate business interests, including fraud detection, platform security, and service improvement — where such interests are not overridden by your rights and freedoms.
• Consent: Processing for purposes not strictly necessary for the delivery of the Platform's services, such as direct marketing communications. You may withdraw this consent at any time by updating your Account preferences or contacting support. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

Kangtoto does not sell, rent, or trade your Personal Data to third parties for their own commercial purposes. We may share your data in the following limited and controlled circumstances:

• Payment processors and e-wallet providers: Data necessary to process deposit and withdrawal transactions is shared with the relevant payment service provider — which may include Touch 'n Go, Boost, GrabPay, DuitNow operators, FPX-participating banks (Maybank, CIMB, Public Bank, Hong Leong, and others), or USDT TRC20 network intermediaries. These providers operate under their own data protection and security standards.
• KYC and identity verification providers: Where third-party verification services are engaged to assist with document authentication or fraud screening, relevant identity documents and verification request data may be shared with those providers under binding data processing agreements.
• Game content providers and platform technology partners: Aggregated or pseudonymised gaming session data may be shared with licensed game providers for technical support and compliance purposes. Individual player identity is not shared unless required for a specific dispute.
• Regulatory and licensing authorities: Kangtoto may be required to disclose player data to its licensing authority, gaming regulators, or financial intelligence units as part of its compliance obligations. Such disclosures are made only to the extent required by applicable law or regulation.
• Law enforcement and government bodies: Where required by a valid legal order, court order, or applicable law, Kangtoto may disclose Personal Data to law enforcement or government agencies in Malaysia or other relevant jurisdictions.
• Professional advisers: Legal counsel, auditors, and compliance consultants engaged by Kangtoto may access limited Personal Data in the course of providing professional services, subject to confidentiality obligations.

Kangtoto uses cookies and similar tracking technologies on the Site. Cookies are small text files stored on your device that allow the Platform to recognise your browser, maintain your session, and record certain preferences or behaviours.

We use the following categories of cookies:

• Strictly necessary cookies: Required for the basic operation of the Site, including maintaining your login session, securing your account, and ensuring transactions are processed correctly. These cannot be disabled without impairing the functionality of the Platform.
• Functional cookies: Store user preferences such as language settings, display options, and recently viewed games to improve your experience on return visits.
• Analytical cookies: Used to collect aggregated, anonymised data about how users interact with the Site — including page visits, session durations, and navigation paths — to help us improve the Platform's performance and usability.
• Session security cookies: Used to detect and prevent fraudulent login attempts, suspicious activity, and multi-account creation — part of our security and AML monitoring obligations.

You may configure your browser settings to block or delete cookies. Please note that disabling strictly necessary cookies may prevent you from logging into your Account or completing transactions. Blocking analytical cookies does not impair core Platform functionality. Your cookie preferences can also be managed through the cookie settings panel accessible from the Site's footer.

Kangtoto retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, and licensing obligations. The following indicative retention periods apply:

• Account and identity data: Retained for the duration of the Account relationship and for a minimum of five (5) years following Account closure, in accordance with AML regulatory requirements.
• KYC documents: Retained for a minimum of five (5) years from the date of the most recent KYC submission or from Account closure, whichever is later.
• Financial and transaction records: Retained for a minimum of five (5) years from the date of each transaction, as required by financial record-keeping and AML obligations.
• Gaming activity records: Retained for a minimum of two (2) years from the date of each gaming session for responsible gambling monitoring and dispute resolution purposes.
• Support and communication records: Retained for two (2) years from the date of last interaction, unless retention is required for an ongoing dispute or regulatory investigation.
• Marketing preference data: Retained until consent is withdrawn, after which marketing data is deleted or anonymised within thirty (30) days.

Where Personal Data is no longer required for any active purpose and the retention period has expired, Kangtoto will securely delete or anonymise the data in accordance with our internal data disposal procedures.

Kangtoto implements a range of technical and organisational measures to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and the Kangtoto servers.
• Encryption of sensitive data at rest, including KYC documents and financial records stored on our servers.
• Strict access controls ensuring that Personal Data is accessible only to authorised personnel who require it for legitimate operational purposes.
• Regular security assessments, penetration testing, and vulnerability scanning of Platform infrastructure.
• Optional two-factor authentication (2FA) for Player accounts to reduce the risk of unauthorised account access.
• Automated fraud detection and anomaly monitoring systems that flag unusual account activity for review.

While Kangtoto takes all reasonable precautions to protect your data, no internet transmission or electronic storage system can be guaranteed to be 100% secure. You are responsible for maintaining the confidentiality of your Account credentials. If you suspect that your account has been compromised, please contact our support team immediately at [email protected].

Subject to applicable law and any overriding regulatory obligations (such as AML retention requirements), you have the following rights in relation to your Personal Data held by Kangtoto:

To exercise any of the above rights, please contact us in writing at [email protected] with the subject line "Data Rights Request". We will acknowledge your request within five (5) business days and respond substantively within thirty (30) calendar days. We may need to verify your identity before processing a data rights request.

Kangtoto is strictly an adult gaming platform. The minimum age requirement is 21 years. We do not knowingly collect, store, or process Personal Data from any person under the age of 21. Age verification is a mandatory step in the KYC process for all registered Players.

If Kangtoto becomes aware that Personal Data has been collected from an individual under the age of 21 without appropriate age verification, the Account will be immediately suspended, all deposits will be returned to the depositor's payment method, and the associated Personal Data will be deleted or anonymised in accordance with our data retention procedures. Winnings accrued by an underage user will be forfeited in accordance with our Terms & Conditions.

In the course of providing the Kangtoto Platform to Malaysian players, your Personal Data may be transferred to and processed in countries outside Malaysia, including the jurisdiction in which our gaming licence is held and the locations of our cloud infrastructure and service providers. Kangtoto ensures that all cross-border transfers of Personal Data are conducted in accordance with applicable data protection principles and, where relevant, subject to appropriate safeguards such as data processing agreements incorporating standard contractual clauses or equivalent protections.

We select technology and service partners that maintain data security standards commensurate with our own. All third-party data processors engaged by Kangtoto are bound by contractual data processing agreements that restrict their use of your data to the specific purposes for which it was shared.

The Kangtoto Platform may integrate with or reference third-party services, including payment gateways (such as Touch 'n Go eWallet, Boost, GrabPay, DuitNow, and FPX), game content providers, and analytics platforms. Kangtoto is not responsible for the privacy practices of these third-party services.

When you interact with a third-party payment provider — for example, when redirected to Maybank's or CIMB's online banking portal to complete an FPX transaction — that provider's own privacy policy governs the handling of data within their environment. We recommend reviewing the privacy policies of any third-party service you interact with when using the Platform.

The Site does not contain links to external third-party websites outside the Kangtoto platform. Any external services engaged by Kangtoto operationally are subject to contractual data protection obligations as described in Section 7.

Kangtoto reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. Where changes are material, we will provide notice to registered Players via email to the registered account address or through an in-Platform notification, with a minimum of fourteen (14) days' advance notice where practicable.

The "Last Updated" date at the top of this Policy reflects the date of the most recent revision. We encourage you to review this Policy periodically. The current version will always be available at kangtoto.buzz/privacy-policy. Your continued use of the Platform following the effective date of any amendments constitutes your acceptance of the revised Policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the processing of your Personal Data by Kangtoto, please contact us using the details below:

We aim to acknowledge all privacy enquiries within five (5) business days and to provide a full substantive response within thirty (30) calendar days. For complex data rights requests, we may extend this period by a further thirty (30) days where necessary, and will notify you accordingly.