kartutoto takes the privacy of every member seriously. This Policy explains what personal data we collect, why we collect it, how it is used and protected, and the rights you hold as a Malaysian user of our platform.
kartutoto ("we", "us", "our", "Platform") is committed to protecting the privacy and personal data of every individual who visits, registers with, or transacts on our online gaming platform accessible at kartutoto.cam. This Privacy Policy ("Policy") is provided in accordance with internationally recognised data protection standards and is designed to be clear, transparent, and accessible to our members across Malaysia and beyond.
This Policy describes the categories of personal information we collect from you ("Member", "User", "you"), the purposes for which that information is processed, the circumstances under which it may be shared with third parties, the measures we take to keep it secure, and the rights you may exercise with respect to your personal data.
This Policy should be read alongside our Terms & Conditions and Responsible Gambling Policy, each of which is incorporated by reference into the overall agreement between you and kartutoto. By registering an Account on the Platform, you acknowledge that you have read and understood this Policy.
The following defined terms are used throughout this Policy:
| Term | Meaning |
|---|---|
| "Personal Data" | Any information relating to an identified or identifiable natural person — including name, email address, device identifiers, and transactional records. |
| "Processing" | Any operation performed on Personal Data — including collection, storage, use, transmission, alteration, and deletion. |
| "Data Controller" | kartutoto, in its capacity as the entity that determines the purposes and means of processing Personal Data collected through the Platform. |
| "Data Processor" | A third party that processes Personal Data on behalf of kartutoto, under a contractual data processing agreement. |
| "Consent" | A freely given, specific, informed, and unambiguous indication of a Member's agreement to the processing of their Personal Data for a stated purpose. |
| "KYC Data" | Identity and age verification documentation, including government-issued IC, passport, and proof of address submitted during the Know Your Customer process. |
| "Cookies" | Small text files placed on a Member's device by the Platform for the purposes of session management, analytics, and functionality improvement. |
kartutoto collects Personal Data across several categories depending on the nature of your interaction with the Platform. The categories of data we collect include:
3.1 Account Registration Data
3.2 Know Your Customer (KYC) Data
3.3 Financial & Transaction Data
3.4 Technical & Device Data
3.5 Communications Data
kartutoto collects Personal Data through the following channels:
kartutoto processes Personal Data on one or more of the following legal bases, depending on the nature and purpose of the processing:
| Legal Basis | When Applied |
|---|---|
| Contractual necessity | Processing required to perform the membership agreement — including account creation, payment processing, game operation, and withdrawal fulfilment. |
| Legal obligation | Processing required to comply with anti-money laundering (AML) obligations, age verification requirements, and regulatory directions from kartutoto's licensing authority. |
| Legitimate interests | Processing for fraud detection, platform security, business analytics, and service improvement — where kartutoto's interests do not override your fundamental privacy rights. |
| Consent | Processing for optional marketing communications, promotional emails, and non-essential cookies — where you have expressly opted in and may withdraw consent at any time. |
kartutoto uses Personal Data for the following specific purposes:
6.1 Account Management and Service Delivery
To create and maintain your Account, verify your identity and age, process your deposits and withdrawals in MYR and supported cryptocurrencies, administer your wagering activity, and deliver the gaming and sports betting services you have contracted to receive.
6.2 Know Your Customer and Anti-Money Laundering Compliance
To verify your identity, confirm that you meet the 21+ age requirement, screen your Account against sanctions and PEP (politically exposed persons) databases, and monitor transactional patterns for indicators of money laundering or fraud. This processing is required by kartutoto's licensing obligations and cannot be opted out of.
6.3 Customer Support
To respond to your enquiries, resolve complaints, process withdrawal disputes, and maintain records of support interactions for quality assurance and training purposes. kartutoto's support team serves members across Malaysia — including Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru, and Shah Alam.
6.4 Fraud Prevention and Platform Security
To detect and prevent multi-accounting, bonus abuse, payment fraud, account takeovers, and other activities prohibited under kartutoto's Terms and Conditions. Automated risk-scoring systems may flag Accounts for manual review where anomalous patterns are detected.
6.5 Responsible Gambling
To monitor player behaviour for indicators of problem gambling, enforce deposit limits and self-exclusion requests, and provide responsible gambling tools to Members who request them. Visit our Responsible Gambling page for full details.
6.6 Marketing and Promotions (Consent-Based)
Where you have explicitly opted in to receive marketing communications, kartutoto may contact you by email with information about promotions, bonuses, VIP programme updates, and platform news. You may withdraw marketing consent at any time by contacting support or updating your Account notification preferences.
6.7 Analytics and Platform Improvement
To analyse how Members interact with the Platform — including which games are played, which features are used, and where navigation friction occurs — in order to improve user experience and platform performance.
kartutoto does not sell, rent, or trade your Personal Data to third parties for their own commercial purposes. We may share your data only in the following circumstances:
kartutoto uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files stored on your device when you visit a website. We use the following categories of cookies:
| Cookie Type | Purpose | Opt-Out |
|---|---|---|
| Strictly Necessary | Required for session authentication, security token management, and core Platform functionality. Without these, the Platform cannot operate. | Not available — these are essential. |
| Functional | Remembers your language preference, currency selection (MYR), and display settings between sessions. | Can be disabled; may affect functionality. |
| Analytics | Collects pseudonymised data on page views, session duration, and navigation paths to help kartutoto improve the user experience. | Opt-out available via Account settings. |
| Marketing | Used only where you have consented to receive personalised promotional communications or to measure the effectiveness of marketing campaigns. | Consent can be withdrawn at any time. |
You can manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair your ability to log in and use the Platform effectively.
kartutoto retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and licensing obligations. The following retention periods apply as general guidance:
Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in a manner that prevents reconstruction of the original data.
kartutoto implements technical and organisational security measures appropriate to the sensitivity of the Personal Data it processes. These measures include:
Despite these measures, no internet-based service can guarantee absolute security. Members are encouraged to use strong, unique passwords, enable 2FA, and contact kartutoto immediately if they suspect unauthorised access to their Account.
kartutoto operates as an international platform and may transfer Personal Data to servers, affiliates, or service providers located outside of Malaysia. Where such transfers occur, kartutoto takes steps to ensure that your data is afforded an adequate level of protection consistent with the standards applied within the Platform's licensing jurisdiction.
Transfers to third-party processors (including KYC providers, payment processors, and game studios) are governed by contractual data processing agreements that incorporate data protection obligations equivalent to those described in this Policy. kartutoto will not transmit Personal Data to a third party located in a jurisdiction with demonstrably inadequate data protection standards without implementing appropriate safeguards.
Subject to applicable law and kartutoto's legal obligations (including AML and KYC record-keeping requirements), Members have the following rights with respect to their Personal Data:
Request a copy of the Personal Data kartutoto holds about you and information on how it is processed.
Request correction of inaccurate or incomplete Personal Data held on your Account.
Request deletion of your Personal Data where it is no longer necessary for the purposes collected, subject to legal retention requirements.
Request that kartutoto restrict the processing of your data in certain circumstances — for example, while the accuracy of data is disputed.
Request a structured, machine-readable copy of Personal Data you have provided to kartutoto, where technically feasible.
Object to processing based on legitimate interests or direct marketing purposes. kartutoto will cease such processing unless compelling legitimate grounds override your interests.
To exercise any of these rights, please contact kartutoto's support team via live chat or at [email protected] with the subject line "Data Rights Request — [Your Username]". kartutoto will respond within 30 days and may request identity verification before processing your request.
Please note that certain rights — particularly the right to erasure — may be limited or delayed where kartutoto is required to retain data to comply with AML record-keeping obligations or ongoing regulatory investigations.
kartutoto's Services are strictly intended for individuals aged 21 years and above. We do not knowingly collect, process, or retain Personal Data from persons below this age threshold. Age verification is a mandatory step in the Account registration and KYC process, and kartutoto reserves the right to request identity documentation confirming date of birth from any Member at any time.
If kartutoto becomes aware or has reasonable grounds to believe that a person under the age of 21 has registered an Account or submitted Personal Data, we will:
If you believe that a minor has registered an Account or provided Personal Data to kartutoto, please notify us immediately at [email protected].
The kartutoto platform may contain references or links to third-party services — including payment processing platforms, game studio interfaces, and responsible gambling resources. This Privacy Policy applies solely to Personal Data collected and processed by kartutoto. kartutoto is not responsible for the privacy practices of any third-party service and recommends that Members review the applicable privacy policies of any external service before providing their information.
Where kartutoto embeds third-party game content or integrates external payment interfaces, those third parties may independently collect technical data (such as IP address and session identifiers) as part of their own service delivery. kartutoto contractually requires all embedded third-party providers to handle such data in compliance with applicable data protection standards.
kartutoto reserves the right to update, revise, or replace any provision of this Privacy Policy at any time. Where changes are material — affecting the rights of Members or the manner in which Personal Data is processed — kartutoto will provide advance notice by email to the registered address on file and/or through a prominent on-platform notice, no fewer than seven (7) calendar days before the updated Policy takes effect.
For minor changes — including typographical corrections, clarifications that do not alter the substantive content, or updates required to reflect changes in applicable law — kartutoto may update the Policy with immediate effect. The "Effective Date" at the top of this document will reflect the most recent revision date.
Continued use of the Platform following the effective date of a revised Privacy Policy constitutes acceptance of the updated terms. Members who do not accept the revised Policy should cease using the Platform and request Account closure in accordance with kartutoto's Terms & Conditions.
If you have questions, concerns, or requests relating to this Privacy Policy or kartutoto's handling of your Personal Data, please contact us through the following channels:
kartutoto's support team provides assistance in English and is available to Members across Malaysia — whether you are based in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, or anywhere else in the country.
Six practical commitments that define kartutoto's approach to personal data — meaningful protection, not just policy language.
kartutoto never sells, rents, or trades your personal information to third parties for their own marketing purposes. Your data is used exclusively for the purposes described in this Policy — nothing more.
All data transmitted between your device and kartutoto's servers is protected by 256-bit SSL/TLS encryption. Sensitive fields including passwords and KYC documents are encrypted at rest using industry-standard algorithms.
Access to Member Personal Data is restricted to kartutoto staff and contractors with a genuine business need. All access is logged, role-based, and subject to regular access review audits.
kartutoto supports your right to access, correct, delete, or restrict your personal data — and responds to data rights requests within 30 days. All requests are handled by a dedicated data privacy team.
Data is retained only as long as legally required or operationally necessary. Transaction and KYC records are kept for five years in compliance with AML requirements, then securely deleted or anonymised.
In the event of a data security incident posing material risk to Members, kartutoto commits to notifying affected individuals without undue delay and taking immediate steps to contain and remediate the breach.
Our support team is available 24/7 to address any privacy questions, process data rights requests, or help you manage your Account preferences. kartutoto is committed to transparency — ask us anything. For players aged 21 and above only.