Privacy Policy

1 Introduction

This Privacy Policy ("Policy") is issued by Fultoto ("the Company", "we", "us", "our") and governs the collection, use, storage, disclosure, and protection of personal data provided by or collected from individuals ("User", "you", "your") who access or use the online gaming platform operated atfultoto.cam ("Platform").

Fultoto provides online casino games, sports betting services, and related promotional features to eligible users in Malaysia and other permitted territories. In operating the Platform, the Company collects and processes personal data as described in this Policy. We are committed to handling that data with transparency, integrity, and in full compliance with applicable data protection principles.

This Policy should be read in conjunction with our Terms & Conditions and Responsible Gambling Policy. By accessing or using the Platform, you acknowledge that you have read and understood this Policy. If you do not agree with any part of this Policy, please cease using the Platform and contact us to arrange closure of your account.

2 Data Controller

For the purposes of applicable data protection law, Fultoto is the data controller in respect of personal data collected through the Platform. As the data controller, the Company determines the purposes for which and the means by which personal data is processed.

Where the Company engages third-party service providers (such as payment processors, KYC verification vendors, and cloud infrastructure providers) to process personal data on its behalf, those parties act as data processors and are bound by contractual obligations to process data only in accordance with the Company's documented instructions and applicable data protection requirements.

The Company's designated data protection contact can be reached via the contact details set out in Section 15 of this Policy.

3 Personal Data We Collect

The Company collects the following categories of personal data in connection with the operation of the Platform:

The Company does not collect special categories of personal data (such as racial or ethnic origin, health data, or biometric data for identification purposes) unless explicitly required by regulatory mandate and with appropriate safeguards in place.

4 How We Collect Personal Data

Fultoto collects personal data through the following channels:

• Direct Submission: Data you provide voluntarily during account registration, KYC verification, deposit and withdrawal requests, responsible gambling tool configuration, and communications with our support team;
• Automated Collection: Technical and behavioural data collected automatically through cookies, web beacons, server logs, and similar tracking technologies when you access and interact with the Platform;
• Third-Party Sources: Identity and address verification data from licensed KYC verification service providers; fraud and sanctions-screening data from compliance databases; payment confirmation data from certified Malaysian payment processors (Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX); and
• Publicly Available Sources: In limited circumstances, publicly available directories or records may be referenced to verify information provided by Users during the account verification process.

5 How We Use Your Personal Data

The Company processes personal data for the following purposes:

A Account Administration

To create, maintain, and operate your fultoto account; to verify your identity and age (21+ requirement); to process deposits and withdrawals via your chosen payment method (Touch 'n Go eWallet, FPX, Maybank, CIMB, etc.); to communicate account-related notices; and to enforce our Terms & Conditions.

B Gaming Services

To provide access to casino games, live dealer tables, and sports betting markets; to calculate and credit winings; to apply and track bonus offers and loyalty programme rewards; and to maintain accurate transaction records in MYR.

C Regulatory Compliance and AML

To fulfil Know Your Customer (KYC) and Anti-Money Laundering (AML) obligations; to conduct sanctions and politically exposed person (PEP) screening; to maintain records as required by applicable financial regulation; and to report suspicious activity to relevant authorities where legally required.

D Responsible Gambling

To administer self-imposed limit and exclusion requests; to monitor gaming behaviour for indicators of problem gambling; and to provide personalised intervention messaging to Users who may be exhibiting at-risk patterns.

E Customer Support

To handle and resolve support queries, complaints, and disputes submitted by Users via live chat, email ([email protected]), or other communication channels.

F Platform Improvement and Analytics

To analyse aggregated usage and behavioural data for the purpose of improving Platform performance, user experience, game selection, and promotional relevance. Analytics processing uses anonymised or pseudonymised data wherever possible.

G Fraud Prevention and Security

To detect, investigate, and prevent fraudulent activity, account manipulation, bonus abuse, and unauthorised access to the Platform or to other Users' accounts.

H Direct Communications

To send transactional notifications (account activity, withdrawal confirmations, security alerts) and, where you have consented to receive them, promotional communications regarding bonuses, new games, and Platform updates. You may withdraw marketing consent at any time by contacting our support team.

6 Legal Basis for Processing

The Company relies on the following legal bases for the processing of personal data:

• Contractual Necessity: Processing required to perform the contract between Company and the User — including account operation, payment processing, and KYC verification;
• Legal Obligation: Processing required to comply with applicable AML, KYC, and financial reporting obligations under relevant law;
• Legitimate Interests: Processing conducted for the Company's legitimate business interests — including fraud prevention, Platform security, responsible gambling monitoring, and Platform analytics — where those interests are not overridden by the User's privacy rights; and
• Consent: Processing for purposes such as promotional communications, where your prior consent has been obtained and may be withdrawn at any time without affecting the lawfulness of prior processing.

7 Data Sharing and Disclosure

Fultoto does not sell, rent, or trade personal data to third parties for commercial or marketing purposes. The Company may share personal data with the following categories of recipient, strictly on a need-to-know basis and subject to appropriate data-protection safeguards:

• Payment Processors: Certified Malaysian and international payment service providers (including operators of Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and cryptocurrency payment channels) to facilitate deposit and withdrawal transactions;
• KYC and Compliance Vendors: Licensed identity verification and AML screening service providers engaged to fulfil regulatory obligations;
• Game Studio Technology Partners: Licensed game content providers who require limited session and account-level data to deliver their games and calculate game outcomes;
• Cloud Infrastructure Providers: Certified data centre and cloud service operators who host Platform infrastructure, subject to contractual data-processing agreements;
• Regulatory and Law Enforcement Authorities: Government bodies, financial intelligence units, or law enforcement agencies where disclosure is required by law, court order, or regulatory direction; and
• Professional Advisers: Lawyers, auditors, and insurers who require access to data in the course of providing professional services to the Company, subject to binding confidentiality obligations.

8 Data Retention

The Company retains personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention guidelines apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with the Company's data disposal procedures, unless a longer period is required by a specific legal or regulatory obligation that has arisen during the retention period.

9 Cookies & Tracking Technologies

Fultoto uses cookies and similar tracking technologies (including web beacons and local storage) on the Platform to provide a functioning, secure, and improved experience. The following cookie categories are used:

• Strictly Necessary Cookies: Required for the Platform to function correctly. They enable login session management, security token validation, and payment flow continuity. These cannot be disabled without impacting Platform functionality.
• Functional Cookies: Store user preferences such as language settings, preferred currency (MYR), and game display options to personalise your Platform experience.
• Analytical Cookies: Used to collect aggregated, anonymised information about how users interact with the Platform — pages visited, session duration, feature usage — to help us improve the Platform over time.
• Security Cookies: Support fraud detection, bot filtering, and account security functions by identifying unusual access patterns.

Fultoto does not use third-party behavioural advertising cookies or cross-site tracking technologies that build individual advertising profiles. You may manage or restrict cookies through your browser settings; however, disabling strictly necessary cookies may prevent you from accessing some or all Platform features.

10 Your Rights

Subject to applicable law and any overiding legal obligations (such as AML and KYC retention requirements), you have the following rights in relation to your personal data held by the Company:

To exercise any of the above rights, please contact us via the details in Section 15. The Company will respond to all verified data rights requests within 14 business days of receipt. Identity verification may be required before a request is processed to protect against unauthorised access to your data.

11 Data Security

Fultoto implements a multi-layered approach to data security, combining technical controls, organisational policies, and contractual obligations to protect personal data from unauthorised access, disclosure, alteration, or destruction.

Key security measures in place include:

• Encryption in Transit: All data transmitted between the User's device and our servers is encrypted using 256-bit TLS/SSL protocols;
• Encryption at Rest: Sensitive data stored in our databases is encrypted at rest using AES-256 encryption;
• Access Controls: Employee access to personal data is restricted on a strict need-to-know basis, enforced through role-based access control and multi-factor authentication;
• Two-Factor Authentication: Offered to all Users as an additional layer of account-level protection;
• Intrusion Detection: Real-time monitoring and automated alerting systems detect and respond to suspicious access patterns or security incidents;
• Regular Security Audits: The Platform undergoes periodic penetration testing and security assessments by independent security professionals; and
• Data Breach Response: The Company maintains a documented incident response procedure and will notify affected Users and relevant authorities of any significant data breach in a timely manner.

While the Company takes all reasonable steps to protect your data, no digital system is completely immune to risk. You are encouraged to use strong, unique passwords for your fultoto account and to enable two-factor authentication through your account security settings.

12 International Data Transfers

In operating a global digital platform, the Company may transfer personal data to service providers and infrastructure partners located outside of Malaysia. Such transfers may occur in connection with cloud hosting, KYC verification, or game technology services.

Where personal data is transferred internationally, the Company takes appropriate steps to ensure an adequate level of protection is maintained, including through the use of contractual data-processing agreements that incorporate standard data protection clauses, and by restricting transfers to jurisdictions with recognised data protection standards.

Users who wish to obtain further information about the specific safeguards applied to international data transfers may contact using the details in Section 15.

13 Protection of Minors

Fultoto employs age-verification controls during registration and KYC verification to enforce this restriction. Where the Company discovers that personal data has been collected from an individual under 21 years of age, it will take the following steps:

• Immediately suspend and close the associated Account;
• Return any deposited funds (excluding bonus-derived winings) to the payment method of origin;
• Delete all personal data associated with the Account as promptly as practicable, subject to any mandatory regulatory retention obligation; and
• Where there is reason to suspect deliberate misrepresentation of age, preserve relevant records and refer the matter to appropriate authorities.

If you are a parent or guardian who believes that a minor in your care has registered an account on the Platform, please contact us immediately via the details in Section 15.

14 Changes to This Policy

The Company reserves the right to amend or update this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or the Company's data processing practices.

When material changes are made to this Policy, the Company will notify registered Users by email or by displaying a prominent notice on the Platform at least seven (7) calendar days before the revised Policy takes effect. The revised Policy will also display an updated "Last Reviewed" date at the top of this page.

Continued use of the Platform following the effective date of a revised Policy constitutes your acceptance of the updated terms. If you do not accept the changes, you may close your Account by contacting support, at which point your data will be handled in accordance with the retention periods set out in Section 8.

The current version of this Policy is always accessible on this page. Users are encouraged to review it periodically.

15 Contact Us

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or wish to raise a privacy concern, please contact the Company's data protection team through the following channels:

• Live Chat: Available24/7 on the fultoto Platform — the fastest channel for data rights requests.
• Email: [email protected] (plain text address — not a clickable link; please copy this into your email client). Please mark the subject line as "Privacy / Data Request" to ensure prompt routing to the correct team.
• FAQ: Many common privacy questions are addressed on our FAQ page.

We serve players across Malaysia — including Kuala Lumpur, Petaling Jaya, Shah Alam, Penang, Johor Bahru, and other regions — and aim to respond to all privacy-related enquiries within 14 business days of verification of the requester's identity.