Privacy Policy

This Privacy Policy ("Policy") is issued by Lakutoto ("we", "us", "our"), the operator of the online gaming platform accessible at https://lakutoto.cam. It describes how Lakutoto collects, uses, discloses, stores, and protects the personal data of individuals ("Player", "User", "you") who access or use our platform, whether as registered account holders or as visitors browsing our website.

This Policy applies to all personal data processed by Lakutoto in connection with the provision of our online casino and sports betting services to players in Malaysia and elsewhere. It should be read together with our Terms & Conditions and Responsible Gambling Policy, which are incorporated by reference.

By registering an Account with Lakutoto or by continuing to use our platform following the date of this Policy, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with any aspect of this Policy, you should discontinue use of the platform and request closure of your Account.

The following terms have the meanings ascribed to them throughout this Policy:

Lakutoto collects the following categories of personal data from Players and website visitors:

3.1 Registration Data

Information you provide when creating an Account, including your full legal name, date of birth, email address, mobile phone number, residential address (including postcode, city, and state within Malaysia — e.g., Kuala Lumpur, Petaling Jaya, Shah Alam, Penang, Johor Bahru), chosen username, and self-declared nationality.

3.2 Identity Verification (KYC) Data

Copies of government-issued identity documents submitted during the KYC process, including your Malaysian MyKad, Driver's Licence, or Passport; proof of address documents such as utility bills or bank statements; and selfie photographs taken alongside your identity document for liveness verification purposes.

3.3 Financial Data

Details relating to your financial transactions on the Platform, including deposit and withdrawal amounts, payment method details (masked account numbers, e-wallet identifiers for Touch 'n Go eWallet, Boost, GrabPay; FPX/DuitNow transaction references; cryptocurrency wallet addresses for BTC, ETH, USDT, and LTC), transaction timestamps, and associated bank details for Malaysian bank transfers via Maybank, CIMB, Public Bank, Hong Leong, and other participating institutions.

3.4 Gaming & Behavioural Data

Records of your gaming activity on the Platform, including game sessions played, betting history, wagering amounts, win/loss records, sports markets accessed (including Liga Super Malaysia and EPL markets), bonus claims, and session duration data. This data is used for account management, responsible gambling monitoring, and fraud prevention.

3.5 Technical & Device Data

Automatically collected technical data including your IP address, browser type and version, operating system, device type (desktop, mobile, tablet), screen resolution, referring URL, pages visited on our website, session duration, and approximate geolocation derived from your IP address.

3.6 Communications Data

Records of your communications with Lakutoto's customer support team via live chat, email, or any other channel, including the content of messages, timestamps, and resolution outcomes. These records are retained for quality assurance, dispute resolution, and compliance purposes.

3.7 Responsible Gambling Data

If you engage with our responsible gambling tools — such as setting deposit limits, session time limits, or requesting self-exclusion — we record the parameters of those tools, the dates they were set or modified, and any documentation provided in connection with a self-exclusion request.

Lakutoto collects personal data through the following means:

• Directly from you: When you register an Account, complete KYC verification, make deposits or withdrawals, contact customer support, complete surveys, or participate in promotions;
• Automatically: Through cookies, web beacons, and server logs as you navigate and interact with the Platform (see Section 10 for details);
• From third-party service providers: Including identity verification providers (who may cross-reference your submitted documents against government databases), payment processors (who confirm transaction outcomes), and fraud prevention services;
• From publicly available sources: In limited circumstances, and only where legally permissible, we may cross-reference information against publicly available databases for fraud detection and AML compliance purposes.

We process your personal data for the following clearly defined purposes:

Lakutoto processes your personal data on the following legal bases, in accordance with applicable data protection law:

• Contractual necessity: Processing that is necessary for the performance of your Account agreement with us — including account creation, payment processing, game access, and withdrawal management;
• Legal obligation: Processing required to fulfil our obligations under applicable law, including KYC, AML, and counter-terrorism financing obligations under our international gaming licence;
• Legitimate interests: Processing necessary for our legitimate interests — including fraud prevention, platform security, responsible gambling monitoring, and service improvement — where those interests are not overridden by your rights and freedoms;
• Consent: For certain processing activities — such as marketing communications or the use of non-essential cookies — we rely on your explicit consent, which you may withdraw at any time without affecting the lawfulness of prior processing.

Lakutoto does not sell, rent, or exchange your personal data with third parties for commercial purposes. We share personal data only in the following limited circumstances and only to the minimum extent necessary:

As an internationally operated platform, some of your personal data may be transferred to and processed in countries outside Malaysia. In particular, our cloud hosting infrastructure and certain third-party service providers operate in jurisdictions that may have different data protection standards from those applicable in Malaysia.

Where such transfers occur, Lakutoto ensures that appropriate safeguards are in place to protect your data, including:

• Standard contractual clauses or data transfer agreements with the receiving party;
• Transfer only to service providers located in jurisdictions determined to provide an adequate level of data protection for the purposes of the transfer;
• Implementation of additional technical safeguards — such as end-to-end encryption — where the destination jurisdiction's protections are deemed insufficient without supplementary measures.

Lakutoto retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal or regulatory obligations. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or permanently anonymised. Where data must be retained beyond these periods due to an ongoing legal dispute, regulatory investigation, or court order, it will be retained only for the duration of that proceeding.

The Lakutoto platform uses cookies and similar tracking technologies to ensure proper platform functionality, enhance your user experience, maintain session security, and gather anonymised analytics data. The following categories of cookies are used:

10.1 Strictly Necessary Cookies

These cookies are essential for the platform to function. They enable core operations such as user authentication, session management, security token validation, and fraud detection. These cookies cannot be disabled without impairing your ability to use the platform. No consent is required for these cookies as they are technically necessary.

10.2 Functional Cookies

These cookies remember your preferences and settings — such as your chosen language, display options, and saved form data — to provide a more personalised experience on the platform. They are not used for tracking across third-party websites.

10.3 Analytics Cookies

We use anonymised analytics cookies to understand how Players navigate and interact with the platform. This data helps us identify areas for improvement and optimise the user experience. Data collected through analytics cookies is aggregated and cannot be used to identify individual users.

Lakutoto implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Transport Layer Security (TLS/SSL): All data in transit between your device and our servers is encrypted using industry-standard TLS 1.2 or higher;
• Encryption at rest: Sensitive personal data — including KYC documents and financial records — is encrypted at the storage level using AES-256 encryption;
• Access controls: Role-based access control (RBAC) ensures that employee access to personal data is limited to what is strictly required for their function;
• Multi-factor authentication: Internal system access by Lakutoto personnel requires multi-factor authentication. Players are strongly encouraged to enable 2FA on their own Accounts;
• Intrusion detection: Automated monitoring systems are in place to detect and respond to suspicious access patterns and potential security incidents;
• Penetration testing: We commission periodic third-party security assessments to identify and remediate vulnerabilities in our platform infrastructure.

Subject to applicable law and certain limitations arising from our legal obligations (such as AML record-keeping requirements), you hold the following rights in respect of your personal data held by Lakutoto:

12.1 How to Exercise Your Rights

To exercise any of the rights listed above, please contact our Data Privacy team via email at [email protected] with the subject line "Data Subject Request". Please include your full name, registered email address, and a description of the right you wish to exercise. We will respond within 30 calendar days of receiving your request. For complex or multiple requests, we may extend this period by a further 60 days, in which case we will notify you accordingly.

The Lakutoto platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. If we become aware that personal data has been collected from a person under this age — whether through a misrepresentation during registration or otherwise — we will take immediate steps to delete that data and close the associated Account.

If you believe that we may have inadvertently collected personal data from a person under the age of 21, please contact us immediately at [email protected]. We treat such notifications as a priority and will act promptly.

The Lakutoto platform does not contain links to third-party websites. Game content is delivered within the Lakutoto platform environment by integrated studio software. Payment processing is handled via embedded integrations with payment partners.

To the extent that any third-party services are integrated within the platform — such as payment processor interfaces — those providers operate under their own independent privacy policies. Lakutoto is not responsible for the data practices of third-party services operating under their own terms. We recommend reviewing the privacy policies of any payment service you use in connection with your Lakutoto Account.

Lakutoto reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory requirements. The "Last Updated" date at the top of this Policy will reflect the date of the most recent revision.

Where amendments are material — meaning they substantively affect your rights or the way your data is processed — we will notify you by email to your registered address at least 14 days before the changes take effect. For minor amendments (such as typographical corrections or clarifications that do not alter substantive rights), changes may take effect immediately.

Your continued use of the Lakutoto platform following the effective date of any amendment constitutes your acceptance of the revised Policy. If you do not accept the amended Policy, you should discontinue use of the platform and close your Account before the changes take effect.

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way Lakutoto processes your personal data, please contact us through the following channels:

16.1 Complaints Process

If you are dissatisfied with our response to a privacy concern or data subject request, you may escalate the matter as follows:

1. Internal Escalation: Request that your complaint be reviewed at a senior level within our compliance team. We will provide a written response within 10 business days;
2. External Escalation: Where the matter remains unresolved, you may refer your complaint to the independent data protection supervisory authority or ombudsman body associated with the jurisdiction under which our platform is licensed.