Privacy Policy

This Privacy Policy (hereinafter "Policy") is issued by Briototo (hereinafter "Briototo", "we", "us", or "our"), the operator of the online gaming and sports betting platform accessible at briototo.cam (the "Platform"). This Policy describes how Briototo collects, processes, stores, shares, and protects the personal data of individuals (hereinafter "Players", "Users", or "you") who register for or use our Platform.

Briototo is committed to handling personal data responsibly, transparently, and in compliance with applicable data protection legislation. This Policy applies to all personal data collected in connection with your use of the briototo Platform, including data provided during account registration, KYC verification, payment processing, customer support interactions, and general platform usage.

This Policy should be read alongside our Terms & Conditions and Responsible Gambling Policy, both of which are incorporated by reference. By registering an account on the briototo Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein.

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" — any information that identifies or can reasonably be used to identify a natural person, directly or indirectly, including but not limited to name, identification number, contact details, location data, or online identifiers.
• "Processing" — any operation performed on personal data, including collection, recording, storage, alteration, retrieval, use, disclosure, or deletion.
• "Data Controller" — the entity that determines the purposes and means of processing personal data. For the purposes of this Policy, the Data Controller is Briototo.
• "Data Processor" — any third party that processes personal data on behalf of Briototo, such as payment processors, KYC verification providers, and cloud hosting services.
• "Consent" — a freely given, specific, informed, and unambiguous indication of a Player's agreement to the processing of their personal data for one or more specified purposes.
• "KYC" — Know Your Customer; the identity and age verification process conducted by Briototo to comply with applicable legal and regulatory obligations.
• "Platform" — the briototo online gaming and sports betting services accessible via briototo.cam and any associated mobile applications.

Briototo is the Data Controller in respect of the personal data collected and processed in connection with your use of the Platform. As Data Controller, Briototo determines the purposes and means of processing personal data and is responsible for ensuring that such processing is carried out in accordance with this Privacy Policy and applicable data protection law.

Where Briototo engages third-party service providers to process personal data on its behalf (e.g., payment gateway operators including providers of Touch 'n Go eWallet, DuitNow, FPX, and major Malaysian banks; KYC verification providers; fraud prevention services; and cloud infrastructure providers), such third parties are engaged as Data Processors under written data processing agreements that impose appropriate obligations in relation to the security and confidentiality of personal data.

Briototo collects personal data that is necessary and proportionate to the purposes described in this Policy. The categories of personal data we collect include:

Briototo does not collect or process special categories of personal data (such as health data, racial or ethnic origin, religious beliefs, or biometric data) unless specifically required to fulfil a legal obligation and with your explicit consent where applicable.

Briototo collects personal data through the following means:

• Direct provision: Data you provide directly when registering an account, completing KYC verification, making deposits or withdrawals, contacting customer support, or participating in promotions.
• Automated collection: Technical and usage data collected automatically when you access or use the Platform, including through cookies, log files, and device fingerprinting technologies.
• Third-party sources: Identity and fraud-risk data received from third-party KYC verification providers, payment processors (including operators of Touch 'n Go eWallet, DuitNow, and FPX), and fraud prevention databases.
• Publicly available sources: Information available in public records, such as electoral rolls or public court databases, where relevant to our legal compliance obligations.

Briototo processes personal data on the following lawful bases:

• Contractual necessity: Processing required to perform the contract between you and Briototo, including operating your Account, processing deposits and withdrawals, and delivering gaming services.
• Legal obligation: Processing required to comply with applicable laws, including anti-money laundering legislation, Know Your Customer obligations, and age verification requirements.
• Legitimate interests: Processing carried out in pursuit of Briototo's legitimate business interests, including fraud prevention, platform security, network integrity, and customer service improvement, where those interests are not overridden by your data protection rights.
• Consent: Processing carried out on the basis of your freely given, informed consent, including the sending of direct marketing communications and the use of non-essential cookies. You may withdraw consent at any time without detriment to your Account.

Briototo uses your personal data for the following purposes:

• Creating, maintaining, and managing your briototo Account.
• Verifying your identity and age in compliance with our KYC obligations (minimum age: 21 years).
• Processing deposits via Malaysian payment methods (Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank) and processing withdrawal requests.
• Detecting, investigating, and preventing fraudulent activity, money laundering, and other prohibited conduct as defined in our Terms & Conditions.
• Providing customer support, handling queries, and resolving disputes.
• Administering bonuses, promotions, and loyalty programme rewards.
• Monitoring gaming and betting activity to identify patterns consistent with problem gambling and, where appropriate, proactively offering responsible gambling support tools.
• Sending transactional communications (e.g., deposit confirmations, withdrawal notifications, security alerts) that are necessary for the operation of your Account.
• Sending marketing communications (e.g., promotional offers, product updates) where you have provided consent, and ceasing such communications promptly upon withdrawal of consent.
• Improving the briototo Platform through analytics, A/B testing, and performance monitoring.
• Complying with applicable legal and regulatory requirements, including responding to lawful requests from law enforcement and regulatory authorities.

Briototo does not sell, rent, or otherwise transfer your personal data to third parties for their independent commercial purposes. We may share your personal data with third parties only in the following circumstances:

• Payment service providers: Financial institutions and e-wallet operators involved in processing your deposits and withdrawals, including but not limited to providers of Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and major Malaysian banks (Maybank, CIMB, Public Bank, RHB, Hong Leong Bank).
• KYC and identity verification providers: Third-party services engaged to verify your identity documents and age in fulfilment of our regulatory obligations.
• Fraud prevention and security services: External providers who assist Briototo in detecting and preventing fraudulent transactions and account misuse.
• Cloud infrastructure and technology providers: Service providers who host or support the technical infrastructure of the briototo Platform, operating under strict data processing agreements.
• Legal and regulatory authorities: Where Briototo is required by applicable law, court order, or regulatory requirement to disclose personal data to law enforcement agencies, regulators, or other competent public authorities.
• Professional advisers: Lawyers, auditors, and other professional advisers who are subject to confidentiality obligations.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of Briototo's business, personal data may be transferred to the relevant acquiring entity, subject to equivalent privacy protections.

In the course of operating the briototo Platform and engaging third-party service providers, your personal data may be transferred to and processed in countries outside Malaysia. Where such transfers occur, Briototo takes appropriate steps to ensure that your personal data receives an adequate level of protection, including through the implementation of standard contractual clauses or other recognised data transfer mechanisms.

By using the briototo Platform and accepting this Privacy Policy, you acknowledge that your personal data may be transferred to and processed in jurisdictions outside your country of residence, including jurisdictions that may not provide the same level of data protection as Malaysia.

Briototo retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following indicative retention periods apply:

• Account and identity data: Retained for the duration of your active Account, plus a minimum of five (5) years following Account closure, in compliance with anti-money laundering and record-keeping obligations.
• Financial and transaction data: Retained for a minimum of seven (7) years following the date of each transaction, in line with financial record-keeping requirements.
• KYC documents: Retained for the duration of your active Account plus five (5) years following closure, unless a longer period is required by applicable law.
• Customer support communications: Retained for a maximum of three (3) years from the date of the final communication, unless the communication relates to an ongoing dispute.
• Technical and usage data: Retained for up to two (2) years, after which it is anonymised or deleted.
• Marketing consent records: Retained for the duration of active consent and for three (3) years following withdrawal of consent.

Upon expiry of the relevant retention period, personal data is securely deleted or anonymised in a manner that ensures it can no longer be used to identify you.

The briototo Platform uses cookies and similar tracking technologies to operate core Platform functions, analyse usage patterns, and enhance your experience. The categories of cookies we use are as follows:

• Strictly necessary cookies: Essential for the operation of the Platform, including maintaining your session when logged in, remembering your language and currency preferences, and enabling secure transactions. These cookies cannot be disabled without adversely affecting Platform functionality.
• Analytical / performance cookies: Used to collect aggregated, anonymised information about how Players use the Platform, enabling us to improve performance, identify errors, and optimise user journeys. We will only deploy analytical cookies where you have provided consent.
• Functional cookies: Enable enhanced functionality such as remembering your bet history preferences or notification settings across sessions.
• Marketing cookies: Used to deliver relevant promotional content based on your interests and Platform activity. These are only activated where you have provided explicit consent and may be withdrawn at any time.

You may manage or withdraw your consent to non-essential cookies at any time through your browser settings or through the cookie preference centre on the Platform. Please note that disabling certain cookies may affect the functionality of some features.

Briototo implements a comprehensive range of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, disclosure, alteration, or destruction. These measures include, but are not limited to:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the briototo Platform.
• Encrypted storage of sensitive personal data, including KYC documents and financial information, on secure servers with restricted access controls.
• Two-factor authentication (2FA) available to all registered Players and mandatory for internal administrative access.
• Continuous monitoring of systems for anomalous activity, intrusion attempts, and data security incidents.
• Regular security audits and vulnerability assessments conducted by qualified security professionals.
• Strict access controls ensuring that personal data is accessible only to authorised Briototo personnel and Data Processors with a legitimate need to access it.
• Staff training on data protection obligations and secure data handling practices.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, Briototo will notify affected Players as soon as reasonably practicable and will take all appropriate steps to contain the breach and mitigate its impact.

Subject to applicable data protection law, you have the following rights in respect of your personal data held by Briototo:

To exercise any of the above rights, please contact our customer support team via live chat on the Platform. We will acknowledge your request within 48 hours and respond substantively within 30 days. Where a request is particularly complex or where we receive a large number of requests simultaneously, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reasons for it.

We reserve the right to request proof of identity before processing any request relating to personal data, to ensure that we do not disclose or delete data in response to fraudulent or unauthorised requests.

The briototo Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect, process, or retain personal data from any person under the age of 21. Our registration process includes mandatory age declaration and KYC age verification to enforce this requirement.

If Briototo becomes aware that personal data has been collected from a person under the age of 21, we will immediately close the relevant Account, delete all associated personal data (subject to any overriding legal retention obligations), and refuse any withdrawal of funds pending investigation.

If you have reason to believe that a minor is using the briototo Platform, please contact our support team immediately via live chat so that we may investigate and take appropriate action.

Where you have provided your consent during registration or subsequently via your Account communication preferences, Briototo may send you marketing communications relating to our services, promotions, bonuses, and Platform updates via email, SMS, or push notification.

You may withdraw your consent to receive marketing communications at any time by:

• Updating your communication preferences within your Account settings;
• Clicking the "unsubscribe" link included in any marketing email; or
• Contacting our customer support team via live chat and requesting removal from our marketing list.

Withdrawal of marketing consent will be actioned within five (5) business days. Please note that withdrawal of marketing consent will not affect your receipt of transactional communications that are necessary for the operation of your Account (e.g., deposit confirmations, security alerts, and withdrawal notifications).

Briototo reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform functionality. Where we make material changes to this Policy, we will notify registered Players by email and/or by displaying a prominent notice on the Platform for a minimum of seven (7) days prior to the changes taking effect.

Your continued use of the briototo Platform following the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. We encourage you to review this Policy periodically to stay informed of any updates.

The most current version of this Privacy Policy will always be accessible at briototo.cam/privacy-policy. The "Last Updated" date at the top of this page reflects the date on which the most recent revision was made.

If you have any questions, concerns, or complaints regarding this Privacy Policy or the manner in which Briototo processes your personal data, please contact our customer support team using the details below:

Briototo is committed to resolving all privacy-related complaints promptly and fairly. If you are not satisfied with our response to a complaint, you may have the right to lodge a complaint with the relevant data protection authority in your jurisdiction.