Privacy Policy — Rupiahtoto

01 Introduction

Rupiahtoto is an online casino and sports betting platform serving registered adult Members across Malaysia, including players in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and other regions. As part of operating this platform, we necessarily collect and process certain personal data from our Members and visitors.

We recognise that personal data is sensitive and that our Members place trust in us when they share their information. This Privacy Policy has been drafted to be transparent, clear, and comprehensive — setting out in plain, professional English exactly how Rupiahtoto handles your data at every stage of your membership.

This Policy applies to all personal data collected through the Rupiahtoto website (rupiahtoto.buzz), our mobile platform interface, live chat system, email communications, and any related digital services. It applies to registered Members, visitors, and individuals who contact us through any channel.

This Privacy Policy should be read alongside our Terms & Conditions. In the event of any conflict between these documents, the Terms & Conditions shall prevail with respect to matters of account conduct, and this Privacy Policy shall prevail with respect to matters of data handling.

02 Definitions

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

• "Personal Data" — Any information that identifies or could reasonably be used to identify a natural person, either on its own or in combination with other data.
• "Processing" — Any operation or set of operations performed on Personal Data, including collection, recording, storage, use, disclosure, and deletion.
• "Data Controller" — Rupiahtoto, which determines the purposes and means of processing Personal Data.
• "Data Processor" — Any third party that processes Personal Data on behalf of Rupiahtoto under a contractual arrangement.
• "Member" / "User" — A natural person who has registered a verified account on the Rupiahtoto platform.
• "Cookies" — Small text files placed on a User's device by the platform to support functionality, analytics, and session management.
• "KYC" — Know Your Customer — the identity and document verification process required for regulatory compliance and account security.

03 Data We Collect

Rupiahtoto collects personal data in the following categories, depending on how you interact with the platform:

When you access the Rupiahtoto platform, certain technical and behavioural data is collected automatically through our systems, including:

• IP address, device type, operating system, and browser version;
• Login timestamps, session duration, and pages visited;
• Betting activity, game history, wagering patterns, and in-play bet placement data;
• Deposit and withdrawal timestamps and method preferences;
• Cookie identifiers and similar tracking technology identifiers (see Section 8).

04 How We Use Your Data

Rupiahtoto uses the personal data we collect for the following purposes:

• Account Management: To register, verify, and manage your Member Account, process your KYC documentation, and maintain accurate account records;
• Payment Processing: To process deposits and withdrawals via DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, and cryptocurrency channels — and to verify that transactions originate from accounts registered in your name;
• Platform Delivery: To provide access to sports betting markets, live casino games, slots, crash games, and all other Platform services;
• Customer Support: To respond to queries, resolve disputes, and maintain support records via live chat and email;
• Security & Fraud Prevention: To detect, investigate, and prevent fraudulent activity, money laundering, account takeovers, and other unlawful or prohibited conduct;
• Regulatory Compliance: To meet our obligations under applicable anti-money laundering (AML), identity verification, and financial services regulations;
• Responsible Gambling: To monitor betting patterns for indicators of problem gambling behaviour, enforce deposit limits and self-exclusion requests, and fulfil our duty of care obligations;
• VIP Programme Administration: To calculate tier status, cashback, and loyalty rewards under the Rupiahtoto VIP Programme;
• Platform Improvement: To analyse aggregated, anonymised usage data to improve the platform's functionality, performance, and user experience.

05 Legal Basis for Processing

Rupiahtoto processes your personal data on the following legal bases:

• Contractual Necessity: Processing is necessary to perform the contract between you and Rupiahtoto — specifically, to operate your Account, process transactions, and deliver platform services;
• Legal Obligation: Processing is required to comply with applicable legal obligations, including KYC/AML regulations and financial services compliance requirements;
• Legitimate Interests: Processing is carried out in pursuit of Rupiahtoto's legitimate interests in platform security, fraud prevention, and service quality improvement, where those interests are not overridden by your data protection rights;
• Consent: Where processing is not covered by the above bases, we will request your explicit consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

06 Data Sharing & Disclosure

Rupiahtoto does not sell, rent, or transfer your personal data to third parties for commercial purposes. We may share your data in the following limited and controlled circumstances:

We engage third-party service providers who process data on our behalf under binding data processing agreements. These include payment gateway operators (e.g., DuitNow, FPX, and e-wallet processing partners), cloud infrastructure providers, KYC and identity verification services, fraud detection and AML screening tools, and customer support technology providers. All such processors are contractually obligated to handle data in accordance with this Policy and applicable data protection law.

We may disclose your personal data to law enforcement agencies, financial intelligence units, regulatory bodies, or courts where required by law, court order, or other legal process — or where disclosure is necessary to protect the rights, property, or safety of Rupiahtoto, our Members, or the public.

In the event of a merger, acquisition, corporate restructuring, or asset sale involving Rupiahtoto, personal data held by us may be transferred to the acquiring entity as part of that transaction, subject to equivalent data protection commitments.

07 Data Retention

Rupiahtoto retains your personal data only for as long as is necessary to fulfil the purposes described in this Policy, or as required by applicable legal and regulatory obligations. The following general retention periods apply:

• Account and identity data: retained for the duration of active membership plus a minimum of five (5) years following account closure, in compliance with AML and financial services record-keeping requirements;
• Transaction records: retained for a minimum of seven (7) years from the date of each transaction;
• KYC documents: retained for the duration of active membership plus five (5) years, or longer if required by applicable regulation;
• Support communications: retained for three (3) years from the date of the last communication;
• Technical log data: retained for up to twelve (12) months, after which it is anonymised or deleted;
• Cookie and session data: retained for the period specified in our Cookie settings (see Section 8).

At the end of the applicable retention period, data is securely deleted or anonymised so that it can no longer be linked to an identifiable individual. Requests for earlier deletion may be submitted as described in Section 10(Your Rights), subject to legal retention obligations that may prevent immediate erasure.

08 Cookies & Tracking Technologies

Rupiahtoto uses cookies and similar tracking technologies to support the operation, security, and improvement of our platform. Cookies are small text files stored on your device when you visit our website.

• Strictly Necessary Cookies: Required for the platform to function — including session management, login authentication, and security functions. These cannot be disabled without impairing platform functionality;
• Functional Cookies: Remember your preferences, language settings, and account customisations to improve your experience;
• Analytics Cookies: Collect aggregated, anonymised data about how visitors use the platform to help us identify improvements. No personally identifying data is shared with analytics providers;
• Security Cookies: Assist in fraud detection, bot prevention, and account security monitoring.

You may control or disable non-essential cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the Rupiahtoto platform. We do not use cookies for third-party advertising targeting purposes.

09 Data Security

Rupiahtoto implements industry-standard technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Our security practices include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and our servers;
• Encrypted storage of sensitive personal data and financial information at rest;
• Two-factor authentication (2FA) available for all Member Accounts;
• Role-based access controls limiting internal access to personal data on a strict need-to-know basis;
• Real-time fraud monitoring and anomaly detection systems;
• Regular security audits and penetration testing conducted by independent specialists;
• Staff training on data protection and information security obligations.

Notwithstanding these measures, no data transmission or storage system is completely secure. We cannot guarantee absolute security. In the event of a data breach that poses a risk to Member rights, we will notify affected Members and relevant authorities in accordance with applicable legal requirements.

10 Your Rights

As a Rupiahtoto Member, you have the following rights with respect to your personal data. To exercise any of these rights, please contact our support team via live chat or email as described in Section 14.

We will respond to all rights requests within thirty (30) days of receipt and identity verification. In complex cases, we may extend this period by up to an additional thirty (30) days, in which case we will notify you of the extension and the reason.

11 Children's Privacy

Rupiahtoto is strictly for individuals aged21 years and above. We do not knowingly collect personal data from individuals under the age of 21. Registration requires submission of age-verifying identity documentation as part of the mandatory KYC process.

If we become aware that personal data has been submitted by a person under the age of 21, we will immediately suspend the relevant Account, delete or securely retain the data as required by applicable law, and report the matter to relevant authorities where appropriate. If you believe a minor has submitted data through our platform, please contact us immediately via the channels listed in Section 14.

12 Third-Party Links & Services

The Rupiahtoto platform may reference or link to third-party services such as payment processors (e.g., DuitNow, FPX operators e-wallet services), responsible gambling support organisations, or game content providers. These third-party services operate under their own privacy policies and terms, which are independent of Rupiahtoto.

Rupiahtoto is not responsible for the privacy practices or data handling of any third-party service provider. We recommend that you review the privacy policies of any third-party services you interact with in connection with your Rupiahtoto account.

13 Policy Amendments

Rupiahtoto reserves the right to update or amend this Privacy Policy at any time. All changes will be published on this page with a revised "Last Updated" date. Where changes are material — meaning they significantly affect how we process your personal data or rights — we will provide notice via the platform interface or your registered email address where practicable.

Your continued use of the Rupiahtoto platform following publication of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree to the revised Policy, you must discontinue use of the platform and may request Account closure as described in our Terms & Conditions.

14 Contact Us

For any questions, concerns, or requests relating to this Privacy Policy, or to exercise any of the data rights described in Section 10, please contact the Rupiahtoto data support team through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week via the platform dashboard — the fastest channel for data requests and account queries;
• Email: [email protected] — please allow up to 24 hours for a response. For data subject access requests, mark your subject line "Data Subject Request — Privacy";
• Responsible Gambling Queries: If your data request relates to a self-exclusion, deposit limit, or responsible gambling matter, please visit our Responsible Gambling page for dedicated tools and resources.

We take all privacy and data protection enquiries seriously and will respond within thirty (30) days. For matters requiring urgent attention, including suspected unauthorised account access, please contact us immediately via live chat.