Kikototo Privacy Policy – Malaysia User Data Protection

1Introduction

This Privacy Policy ("Policy") is issued by kikototo ("we", "Platform") and describes how we collect, use, disclose and protect your personal information when you use the kikototo.fun website, our mobile app and all related services ("Services").

We understand that privacy is a serious matter for our users in Malaysia. The trust you place in us by sharing your personal information is never taken lightly. Every decision we make about your data is guided by your best interests as a user.

By registering or using the kikototo platform, you confirm that you have read and understood this Privacy Policy and agree to the data collection and usage practices described herein. If you do not agree, please stop using our platform.

This Policy should be read together with Terms and Conditions which together form the entire agreement between you and kikototo.

2Personal Data We Collect

Kikototo collects various types of personal information depending on how you interact with our platform. Below is a comprehensive overview of the data categories we collect:

2.1 Data You Provide Directly

• Account Information: Full name, email address, phone number, password (stored in hashed form), date of birth, and gender.
• KYC Information: A copy of your MyKad or passport, an identity verification selfie, and proof of current address such as a utility bill or bank statement.
• Financial Information: Bank account number, account holder name, and information required to process deposits and withdrawals.
• Communications: Messages you send to our customer support team via live chat, email, or any other communication channel.

2.2 Data Collected Automatically

• Technical Data: IP address, browser type and version, operating system, screen resolution and device information.
• Usage Data: Pages visited, time spent on the platform, games played, bets placed and navigation patterns.
• Location Data: General geographic location based on your IP address for geographic eligibility verification purposes.
• Log Data: Login records, session history, and account activity logs for security and audit purposes.

3How We Use Your Data

Every piece of data we collect has a clear purpose. We do not use your data for any purpose other than those stated below:

• Account Management: Creating and managing your account, processing registration, and verifying your identity through the required KYC process.
• Transaction Processing: Handling deposits, withdrawals, and any financial transactions you make on the kikototo platform safely and efficiently.
• Platform Security: Detecting and preventing fraud, money laundering, unauthorized access, and other suspicious activities that could compromise the security of the platform and other users.
• Legal Compliance: Fulfilling applicable legal and regulatory obligations, including anti-money laundering (AML) requirements and mandatory reporting obligations.
• Responsible Gaming: Monitoring gameplay patterns to identify signs of problem gambling and provide appropriate assistance when needed.
• Service Improvements: Analyzing usage patterns in aggregate to improve user experience, platform performance, and the range of games offered.
• Service Communications: Sending important notifications related to your account, such as transaction confirmations, security alerts, and terms updates.
• Marketing (with consent): Sending information about promotions and new offers if you have given consent to receive marketing communications.

4Legal Basis for Data Processing

Every instance of personal data processing we carry out has a solid legal basis. Depending on the type of data and purpose of processing, we rely on one or more of the following bases:

• Contract Fulfillment: Processing required to manage your account and deliver the services you have requested — including registration, deposits, and withdrawals.
• Legal Obligation: Processing required to comply with applicable laws, such as KYC and AML requirements under Malaysia's financial regulations.
• Legitimate Interests: Processing for platform security, fraud prevention, and service improvement purposes — where our interests do not override your fundamental rights.
• Consent: For marketing communications and the use of non-essential cookies — where you have given explicit consent and may withdraw it at any time.

5Data Sharing and Disclosure

Kikototo does not sell your personal data. We only share your data in the limited situations described below, and only with parties that have a legitimate need to access it:

5.1 Third-Party Service Providers

We work with carefully selected service providers to handle specific platform functions — such as payment providers (DuitNow, FPX, Touch 'n Go), game providers and analytics services. All providers are bound by strict data protection agreements and are only permitted to use your data for the specific purposes defined.

5.2 Legal Requirements and Authorities

We may disclose your data to government authorities, law enforcement, or other parties with valid legal authority — when required to do so by law, court order, or applicable legal process.

5.3 Business Transfers

In the event of a merger, acquisition, or sale of kikototo business assets, users' personal data may be transferred as part of that transaction. Users will be notified in advance and have the right to opt out if they do not agree.

6Data Security

We continuously invest in security infrastructure to ensure your personal data is protected against unauthorised access, loss, misuse or disclosure. Key security measures we maintain include:

• SSL/TLS Encryption: All communications between your device and kikototo's servers are protected with 256-bit encryption that is not easily compromised.
• Secure Password Storage: User passwords are never stored in plain text — they are stored using a strong one-way hashing algorithm.
• Access Control: Only staff with a legitimate business need are permitted to access user data, and all access is logged and monitored.
• 24/7 Security Monitoring: Our automated monitoring system runs around the clock to detect and contain any security threats immediately.
• Regular Security Testing: We conduct regular security audits and penetration testing to identify and address vulnerabilities.
• Two-Factor Authentication: We provide and encourage the use of 2FA for all user accounts as an additional layer of protection.

7Data Retention Period

Kikototo retains your personal data only for as long as necessary to fulfil the purposes stated in this Policy, or as required by applicable law. The following are our general data retention guidelines:

Once the retention period expires, your data will be securely deleted or permanently anonymised so it can no longer be linked back to you.

8Your Rights Regarding Personal Data

As a kikototo user in Malaysia, you have the following rights regarding your personal data held by us. We are committed to making it easy for you to exercise these rights:

To exercise any of the above rights, please contact our support team via the 24/7 live chat available on the kikototo platform. We will process your request within 30 business days. For complex cases, this period may be extended by up to 60 days, with prior notification to you.

9Cookies & Tracking Technologies

Kikototo uses cookies and similar tracking technologies to enhance your experience on our platform. The following are the types of cookies we use:

9.1 Essential Cookies

These cookies are required for the platform's core functions — such as maintaining your login session, remembering your preferences, and securing transactions. They cannot be disabled as they are essential for the platform to operate correctly.

9.2 Performance and Analytics Cookies

We use analytics cookies to understand how users interact with the platform — which pages are visited most, where users encounter issues, and how the platform performs overall. This information is collected in aggregate and cannot be linked to any specific individual.

9.3 Cookie Controls

You can manage your cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of some parts of the platform. For non-essential cookies, you may withdraw consent at any time via your account settings.

10Children's Privacy

The kikototo platform is strictly for individuals aged 18 and above. We do not knowingly collect or store any personal information from children or minors. If we discover that we have inadvertently collected data from anyone under 18, we will promptly delete that information and close the account in question.

If you believe a child has registered an account on our platform, please contact our support team immediately so we can take appropriate action.

11Amendments to the Privacy Policy

Kikototo reserves the right to modify this Privacy Policy at any time to reflect changes in our practices, legal requirements, or the way we operate our services. When significant amendments are made, we will:

• Sending a notification to your registered email at least 14 days before amendments take effect.
• Displaying clear notices on the kikototo platform regarding upcoming changes.
• Updating the "Last Updated" date at the top of this page.

Continued use of the platform after the effective date of any amendment is considered your acceptance of the revised Policy. If you disagree with the changes, you have the right to close your account and request deletion of your data before the amendment takes effect.

12Contact Us About Privacy

If you have any questions, concerns or requests regarding this Privacy Policy or how we handle your personal data, our team is ready to help:

• Live Chat: Available 24/7 via the chat icon at the bottom corner of the kikototo platform — the fastest way to get an immediate response.
• Privacy Email: [email protected] — for written enquiries that require an ongoing reference trail.
• Response Time: All privacy enquiries will be responded to within 5 business days; data rights requests within 30 business days.