Privacy Policy

Gardatoto ("we", "us", "our", or "the Platform") is committed to safeguarding the privacy and personal data of all users of the gardatoto online casino and sports betting platform, accessible at https://gardatoto.cam. This Privacy Policy ("Policy") describes how we collect, use, store, share, and protect personal data in connection with your use of the Platform and all associated services.

This Policy applies to all individuals who access the Platform, register an Account, place bets, participate in promotions, or otherwise interact with gardatoto's services — including visitors to our website who have not registered. It should be read alongside our Terms & Conditions and Responsible Gambling Policy, both of which are incorporated herein by reference.

By using the gardatoto Platform, you acknowledge that you have read and understood this Privacy Policy and that your personal data will be handled as described herein. If you do not agree with how your data is processed, you must discontinue use of the Platform and may request closure of your Account as described in our Terms & Conditions.

For the purposes of this Policy, the following terms carry the meanings set out below:

• "Account" means a registered member account on the gardatoto Platform.
• "Controller" means the entity that determines the purposes and means of processing personal data — in this case, gardatoto.
• "Data Subject" means any identified or identifiable natural person whose personal data is processed by gardatoto — principally, registered Users and Platform visitors.
• "Personal Data" means any information relating to an identified or identifiable natural person, including name, email address, identification document details, financial information, IP address, and device identifiers.
• "Processing" means any operation performed on personal data, including collection, storage, retrieval, use, disclosure, and deletion.
• "Processor" means any third-party entity that processes personal data on behalf of and under the instruction of gardatoto.
• "Sensitive Data" means categories of personal data that attract heightened protection, including financial records, government-issued identification data, and information relating to problem gambling or self-exclusion.
• "User" means any individual who accesses or uses the gardatoto Platform, whether registered or not.

Gardatoto collects personal data through multiple channels, including directly from you during registration and account use, automatically through your interaction with the Platform, and from third-party verification and payment service providers. The categories of personal data we collect are as follows:

3.1 Identity & Registration Data

When you create an Account, we collect: full legal name, date of birth, nationality, government-issued identification document number (such as Malaysian MyKad number or passport number), and a copy of your identification document where required for KYC verification.

3.2 Contact Data

We collect your email address, mobile telephone number, and residential address, including city and postcode. For Malaysian users, this may include your address within Kuala Lumpur, Petaling Jaya, Shah Alam, Penang, Johor Bahru, or other localities.

3.3 Financial Data

We collect details necessary to process deposits and withdrawals, including bank account details, e-wallet account identifiers (such as Touch 'n Go eWallet, Boost, GrabPay), FPX transaction references, DuitNow identifiers, and USDT wallet addresses where applicable. We do not store full card numbers or banking credentials on our systems.

3.4 Transaction Data

We maintain records of all deposits, withdrawals, bets placed, games played, bonuses credited and claimed, and all other financial transactions conducted through your Account. This data is retained for regulatory compliance, audit, and dispute resolution purposes.

3.5 Technical & Usage Data

Gardatoto automatically collects technical information when you access the Platform, including your IP address, browser type, operating system, device model, language preference, time zone, login history, session duration, referring page, and interactions with casino games, live football markets, and account features. This information supports security monitoring, service optimisation, and fraud prevention.

3.6 Communications Data

We retain records of communications between you and gardatoto, including live chat transcripts, customer support emails, complaint records, responsible gambling requests, and responses to surveys. Telephone numbers and email addresses are displayed or processed only where required for account administration and support.

3.7 Responsible Gambling Data

Where you set deposit limits, request a cooling-off period, activate self-exclusion, or contact gardatoto about gambling-related concerns, we process the relevant information to apply your chosen safeguards. This data is treated as confidential and is accessible only to authorised personnel who require it for player protection, compliance, or support purposes.

Gardatoto processes personal data only for specified and legitimate purposes. Depending on how you use the Platform, your data may be processed to:

• Create, administer, secure, and maintain your gardatoto Account;
• Confirm that you are aged 21 or above and complete identity, address, and source-of-funds verification;
• Process MYR deposits and withdrawals through Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, or other supported methods;
• Record and settle casino gameplay, sports bets, bonus activity, cashback, and Black Diamond VIP rewards;
• Detect and prevent fraud, account takeover, collusion, bonus abuse, money laundering, and other prohibited activity;
• Provide customer support, investigate complaints, and resolve payment or betting disputes;
• Apply deposit limits, cooling-off periods, self-exclusion instructions, and other responsible gambling controls;
• Personalise account content, subject to your communication choices and applicable law;
• Monitor Platform performance, correct technical faults, and improve accessibility and mobile usability;
• Comply with legal, regulatory, licensing, accounting, and record-keeping obligations;
• Establish, exercise, or defend legal claims and protect the rights of gardatoto, its Users, and relevant third parties.

Gardatoto does not use automated processing to make decisions that produce legal or similarly significant effects without appropriate safeguards. Automated risk indicators may assist our security and compliance teams, but material account restrictions are subject to review by authorised personnel where required.

Gardatoto relies on one or more lawful grounds when processing personal data. The applicable ground depends on the nature of the information and the purpose for which it is used.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing undertaken before consent was withdrawn, and it does not prevent processing that gardatoto must continue under another lawful basis.

Gardatoto does not sell personal data. We disclose information only where necessary for the purposes described in this Policy and subject to appropriate contractual, technical, and organisational safeguards.

Personal data may be shared with the following categories of recipient:

• Payment service providers and financial institutions that process deposits, withdrawals, refunds, and transaction verification;
• Identity and compliance providers that support age checks, KYC screening, AML monitoring, sanctions screening, and fraud prevention;
• Technology and hosting providers that supply secure infrastructure, data storage, analytics, customer support, and cybersecurity services;
• Game and sportsbook suppliers where limited identifiers and transaction data are necessary to deliver, settle, or investigate a game or wager;
• Professional advisers, including auditors and legal advisers, where access is reasonably necessary and subject to confidentiality duties;
• Regulators, licensing authorities, courts, or law enforcement agencies where disclosure is required by law or a valid official request;
• Successors to the business in connection with a lawful merger, reorganisation, financing, or transfer, provided that equivalent privacy safeguards remain in place.

All service providers acting on behalf of gardatoto are permitted to process personal data only under documented instructions and may not use it for unrelated purposes. Access is limited to the minimum information necessary for the relevant service.

Gardatoto uses cookies and similar technologies to operate the Platform, maintain secure sessions, remember preferences, measure performance, and understand how Users navigate our services. A cookie is a small text file stored on your device by your browser.

7.1 Essential Cookies

Essential cookies support login sessions, account security, fraud prevention, load balancing, and other functions required for the Platform to work. Because these cookies are necessary to provide requested services, they cannot generally be disabled through Platform settings.

7.2 Preference and Performance Cookies

Preference cookies remember settings such as language, display choices, and selected sports markets. Performance cookies help gardatoto understand page speed, errors, and aggregated usage patterns so that we can improve the experience for Malaysian players.

7.3 Cookie Controls

You may adjust cookie settings through your browser. Blocking certain cookies may affect Account login, payment flows, saved preferences, live betting updates, or other Platform functions. Where applicable law requires consent for non-essential cookies, gardatoto will request that consent before placing them.

Gardatoto retains personal data only for as long as reasonably necessary to fulfil the purposes described in this Policy, satisfy legal and regulatory requirements, resolve disputes, prevent fraud, and enforce agreements. Retention periods vary according to the category and sensitivity of the information.

• Account and identity records are retained while your Account remains active and for the period required by applicable KYC, AML, licensing, and limitation rules after closure;
• Financial and wagering records are retained for audit, taxation, dispute resolution, and regulatory compliance purposes;
• Support communications and complaint files are retained for as long as needed to address the matter and demonstrate a fair resolution process;
• Self-exclusion and responsible gambling records may be retained after Account closure to ensure that restrictions remain effective and are not circumvented;
• Technical security logs are retained for a limited period based on operational need, risk, and applicable legal requirements.

At the end of the applicable retention period, gardatoto securely deletes or irreversibly anonymises personal data unless continued retention is required by law. Anonymised information that can no longer identify a User may be retained for statistical and service improvement purposes.

Gardatoto maintains proportionate technical and organisational measures designed to protect personal data against accidental loss, unlawful destruction, alteration, unauthorised disclosure, and unauthorised access. These measures include encryption in transit, controlled administrative access, network monitoring, secure development practices, account authentication safeguards, and periodic security reviews.

Access to personal data is restricted according to role and operational need. Personnel with authorised access are subject to confidentiality requirements and receive appropriate data protection and security guidance.

No internet-based system can be guaranteed completely secure. You are responsible for choosing a strong, unique password, protecting your login credentials, signing out on shared devices, and notifying gardatoto promptly if you suspect unauthorised Account activity.

Subject to applicable law and any lawful exemptions, you may exercise the following rights in relation to personal data held by gardatoto:

• Right of access: request confirmation that your data is being processed and obtain a copy of relevant personal data;
• Right to correction: request correction of inaccurate or incomplete personal data;
• Right to erasure: request deletion of personal data where there is no lawful reason for continued retention;
• Right to restriction: request that processing be limited while accuracy, lawfulness, or another concern is reviewed;
• Right to object: object to processing based on legitimate interests in circumstances recognised by applicable law;
• Right to data portability: request eligible data in a structured, commonly used, machine-readable format;
• Right to withdraw consent: withdraw consent for optional processing at any time;
• Right to opt out of marketing: stop receiving promotional communications without affecting essential Account notices.

To exercise a right, contact gardatoto using the details in section 14. We may request reasonable proof of identity to protect your information from unauthorised disclosure. We aim to respond within the period required by applicable law and will explain any lawful restriction that prevents us from fulfilling a request in full.

Certain rights are not absolute. For example, gardatoto may need to retain transaction, KYC, self-exclusion, or fraud-prevention records despite an erasure request where legal, regulatory, or protective obligations apply.

The gardatoto Platform is intended solely for individuals aged 21 years and above. We do not knowingly permit minors to register, deposit funds, place bets, or participate in casino-style gambling.

Gardatoto uses age and identity verification measures during registration and Account review. If we discover that personal data has been submitted by a person under 21, we will suspend the Account, prevent further gambling activity, and take appropriate steps to delete or restrict the data, subject to any legal requirement to retain evidence of the incident.

A parent or guardian who believes that a person under 21 has provided personal data to gardatoto should contact customer support immediately using the details below. Adults should also keep account credentials and payment methods secure and should not allow minors to access gambling services on shared devices.

Because gardatoto operates an online platform supported by international technology, payment, verification, and gaming providers, personal data may be processed outside Malaysia or outside the jurisdiction in which it was originally collected.

Where personal data is transferred internationally, gardatoto applies safeguards appropriate to the destination, recipient, and sensitivity of the data. These may include contractual data protection clauses, security assessments, access restrictions, encryption, and verification that the recipient is subject to an adequate legal or regulatory framework.

International transfers are limited to what is necessary for Platform operation, payment processing, security, compliance, and the delivery of requested services. Gardatoto does not transfer data internationally for sale to unrelated advertisers.

Gardatoto may update this Privacy Policy to reflect changes in law, regulatory expectations, Platform features, security practices, or data processing activities. The revised version will be published on this page with an updated effective date.

Where a change materially affects how personal data is used or the rights available to Users, gardatoto will provide a prominent Platform notice or other appropriate notification before the change takes effect, where reasonably practicable. We encourage Users to review this Policy periodically.

If you have a question about this Privacy Policy, wish to exercise a data protection right, or want to report a privacy concern, contact the gardatoto privacy team using the details below. Please do not send copies of MyKad, bank statements, passwords, or other sensitive documents unless an authorised support representative has provided secure instructions.

Gardatoto will acknowledge privacy requests promptly and may ask for information needed to verify your identity and locate the relevant records. Complaints are reviewed fairly, confidentially, and in accordance with applicable data protection requirements.