At Edatoto, your privacy is not an afterthought — it is a foundational part of how we build and operate our platform. This Privacy Policy explains, in clear and formal terms, what personal data we collect from Malaysian users and visitors, why we collect it, how we process and protect it, who we may share it with, and what rights you hold over your own information. Please read this document carefully. It forms part of your agreement with Edatoto alongside our Terms & Conditions.
These six principles summarise the approach Edatoto takes to every piece of personal data we hold. The full legal detail is in the policy sections below.
We collect only the personal data that is strictly necessary to provide our services, fulfil legal obligations, and maintain platform security. We do not collect data for speculative or undeclared purposes.
All data transmitted between your device and our servers is protected by 256-bit SSL/TLS encryption. Stored data is encrypted at rest and access is restricted to authorised personnel on a need-to-know basis.
Edatoto does not sell, rent, or trade your personal data to third parties for marketing or commercial purposes. Your data is used only as described in this Privacy Policy.
You have the right to access, correct, restrict, or request deletion of your personal data at any time. Requests are processed within 30 days of receipt and require identity verification.
We do not retain personal data indefinitely. Specific retention periods apply to each data category, balancing our legal obligations with your right to have data removed when it is no longer needed.
This Privacy Policy is written in plain, accessible English. We do not hide important data practices in fine print. If you have a question about how your data is used, our support team will answer it directly.
Every piece of data we hold about you follows a defined, auditable lifecycle. Here is how it works at Edatoto.
Registration, KYC documents, deposits, gameplay, and support interactions — data entered directly by you.
256-bit TLS encryption protects all data during transmission between your device and our servers.
Data is encrypted at rest in access-controlled data centres. Only authorised Edatoto personnel may access personal records.
Once the retention period expires and no legal hold applies, data is securely deleted or anonymised beyond recovery.
This Privacy Policy ("Policy") is issued by Edatoto ("the Company", "we", "us", "our") and applies to all personal data collected through the website located at https://edatoto.cam ("the Platform"), including through account registration, gameplay activity, financial transactions, customer support interactions, and any other engagement with our services.
Edatoto is committed to handling your personal data responsibly, lawfully, and in accordance with internationally recognised data protection principles. We respect the privacy of every user — whether you are a registered player from Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, or any other location — and we operate our data practices with full transparency.
This Policy should be read alongside our Terms & Conditions and our Responsible Gambling Policy. By accessing the Platform or creating an account, you acknowledge that you have read and understood this Policy and consent to the data processing activities described herein. If you do not agree to this Policy, you should not use the Platform.
Malaysian Users: Malaysia's Personal Data Protection Act 2010 (PDPA) governs the processing of personal data in commercial transactions within Malaysia. Edatoto's processing practices are designed to align with internationally recognised data protection standards. Where the PDPA applies to your personal data, we endeavour to comply with its relevant principles, including lawful collection, purpose limitation, and data subject rights.
The following terms carry the meanings set out below throughout this Policy:
Edatoto collects personal data through multiple channels in the course of providing our services. The categories of data we collect, and the circumstances in which they arise, are set out in the table below:
| Data Category | Specific Data Points | Collection Method |
|---|---|---|
| Identity Data | Full legal name, date of birth, nationality, government-issued ID number (e.g., MyKad / passport number) | Account registration; KYC verification process |
| Contact Data | Email address, mobile phone number, residential address | Account registration; account settings updates |
| Financial Data | Payment method details (bank name, account reference, e-wallet identifier), deposit and withdrawal history, transaction amounts in MYR | Deposit/withdrawal transactions via FPX, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, Maybank2u, CIMB, and other supported methods |
| Gaming Data | Game play history, bet amounts, win/loss records, session duration, bonus usage, wagering activity | Automated system logging during Platform use |
| KYC Documents | Copies of national identity card, passport, utility bills, bank statements, source-of-funds documentation | Identity and address verification requests |
| Technical Data | IP address, device type and model, operating system, browser type and version, screen resolution, session timestamps | Automated collection via server logs and cookies |
| Communications Data | Records of live chat conversations, email correspondence, WhatsApp support messages, complaint submissions | Customer support interactions |
| Responsible Gambling Data | Self-exclusion requests, deposit limit settings, cooling-off activations, problem gambling disclosures | Account settings; responsible gambling tool usage; support interactions |
Edatoto does not knowingly collect Sensitive Personal Data beyond what is strictly necessary for identity verification, fraud prevention, and responsible gambling compliance. We do not collect health, racial, religious, or political data unless directly relevant to a responsible gambling assessment and provided voluntarily by the User.
Edatoto processes personal data only where a valid legal basis exists for doing so. The legal bases upon which we rely are as follows:
Edatoto uses the personal data collected for the following defined purposes:
No Automated Decision-Making with Legal Effect: Edatoto does not make decisions that produce legal or similarly significant effects on Users through solely automated means, without any human oversight. Where automated screening generates a flag (e.g., a KYC discrepancy or fraud alert), a qualified member of our compliance team reviews the matter before any account action is taken.
Edatoto does not sell personal data to any third party. We share personal data only where necessary for the purposes described in Section 5, and only with parties who are subject to appropriate contractual data protection obligations. The categories of recipients with whom we may share your data are:
No Third-Party Marketing: Your personal data is never shared with advertisers, data brokers, or third-party marketing companies. If you opt into Edatoto's own promotional communications, that preference is managed exclusively within our own systems.
Edatoto uses cookies and similar tracking technologies on the Platform to support core site functionality, improve user experience, and collect analytics data. A cookie is a small text file placed on your device by our web server when you visit the Platform.
The categories of cookies we use are as follows:
You may manage your cookie preferences through your browser settings. Please note that disabling certain cookies may affect your ability to use some features of the Platform. For strictly necessary cookies, no opt-out is available, as they are required for the Platform to function.
Edatoto retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by our legal and regulatory obligations. Specific retention periods applicable to key data categories are as follows:
Following the expiry of the applicable retention period, personal data will be securely and permanently deleted or irreversibly anonymised, provided no legal hold, regulatory requirement, or active dispute requires its continued preservation.
Edatoto operates internationally, and your personal data may be transferred to, stored in, or processed by our service providers in countries outside of Malaysia. These transfers may occur in the context of payment processing, identity verification, cloud infrastructure hosting, or game content delivery.
Where personal data is transferred outside Malaysia or the jurisdiction of Edatoto's primary data hosting infrastructure, we take appropriate steps to ensure that the transfer is subject to adequate protections, including:
By using the Platform, you acknowledge that your personal data may be processed outside of Malaysia, and you consent to such transfers where they are conducted in accordance with the safeguards described in this Section.
Subject to applicable law and verification of your identity, you have the following rights in relation to the personal data that Edatoto holds about you:
Request a copy of the personal data we hold about you and information about how it is used.
Request correction of inaccurate or incomplete personal data held in your account.
Request deletion of your personal data where it is no longer necessary, subject to legal retention obligations.
Request that we restrict processing of your personal data in certain defined circumstances.
Receive a structured, machine-readable copy of data you have provided to us, where technically feasible.
Object to processing based on legitimate interests or direct marketing, where applicable grounds exist.
To exercise any of the above rights, please contact our Data Privacy Team via the contact details in Section 15. We will respond to all valid requests within 30 calendar days. Where a request is complex or involves a large volume of data, we may extend this period by a further 30 days, with notification to you of the extension and reason. Identity verification is required before any data access or deletion request is processed.
Limitations: Certain data rights are subject to limitations where retention is required by law — for example, AML regulations require us to retain KYC and transaction data for minimum periods. In such cases, we will inform you of the legal basis for continuing to hold your data.
The Platform is strictly intended for individuals aged 21 years and above. Edatoto does not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory component of the account registration and KYC process.
If Edatoto becomes aware that personal data has been collected from an individual below the minimum age, the relevant account will be immediately closed, all associated balances will be returned to the source payment method, and all personal data relating to that account will be deleted from our systems without undue delay.
If you believe a minor has registered on this Platform: Please notify us immediately via our 24/7 live chat support or by email to [email protected]. We take underage gambling prevention with the utmost seriousness and will act on all credible reports without delay.
Edatoto implements a range of technical and organisational security measures designed to protect your personal data from unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:
Whilst Edatoto takes all reasonable steps to protect your personal data, no transmission over the internet or electronic storage system is completely secure. You play an important role in protecting your own account by maintaining strong, unique passwords, activating two-factor authentication, and notifying us immediately of any suspected unauthorised access.
The Platform may contain references to third-party services — for example, payment method providers such as Maybank2u, Touch 'n Go eWallet, or DuitNow — whose operations are governed by their own independent privacy policies and terms. Edatoto is not responsible for the privacy practices of these third parties, and this Policy does not apply to any data collected by them.
When you interact with a third-party payment gateway, e-wallet provider, or other external service in connection with your Edatoto account, your personal data is subject to that third party's own privacy policy from the point of handoff. We encourage you to review the privacy policies of any third-party services you use in connection with your Edatoto account.
Edatoto reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory guidance, or operational requirements. The "Last Updated" date displayed at the top of this page indicates when the most recent version came into effect.
Where amendments to this Policy are material — for example, where we introduce a new category of data collection or a new purpose for processing — we will notify registered users by email and/or by a prominent notice within the Platform interface prior to the changes taking effect. Minor updates (such as clarifications of existing practices or corrections of typographical errors) may be made without individual notification.
Your continued use of the Platform following the publication of an updated Policy constitutes your acceptance of the amended terms. If you do not accept any amendment, your sole remedy is to cease using the Platform and request account closure.
If you have any questions, concerns, or requests relating to this Privacy Policy or the way Edatoto handles your personal data, please contact us using the following channels:
If you are dissatisfied with our response to a privacy concern, you have the right to escalate your complaint to the relevant data protection supervisory authority in the jurisdiction applicable to your matter. For Malaysian users, the relevant authority is the Department of Personal Data Protection (JPDP), the body responsible for administering the Personal Data Protection Act 2010 in Malaysia.
Response Times: We aim to respond to all substantive privacy requests within 30 calendar days. If your request is particularly complex or involves a large volume of data, we may extend this to 60 days. We will notify you in writing of any extension, together with the reason, before the initial 30-day period expires.
Now that you understand how Edatoto handles your personal data, you can play knowing your information is protected, your rights are respected, and your privacy is taken seriously. Join thousands of Malaysian players who trust Edatoto for a secure, transparent gaming experience.