Privacy Policy — Avtoto

This Privacy Policy ("Policy") issued by Avtoto ("the Company", "we", "us", "our"), the operator of the online gaming platform available at https://avtoto.asia (the "Platform"). It describes how we collect, use, store, disclose, and protect personal data provided by or generated about users ("Player", "you", "your") in the course of accessing and using our services.

Avtoto is committed to handling your personal data with care, transparency, and in accordance with internationally recognised data protection principles. The Platform is designed and operated primarily for players based in Malaysia, and all personal data processing activities referenced in this Policy are conducted with Malaysian players in mind. Where data is processed across borders, we apply appropriate safeguards as described in Section 13.

This Policy should be read together with our Terms & Conditions and Responsible Gambling Policy, which collectively govern your relationship with Avtoto.

For the purposes of this Policy, the following terms shall bear the meanings set out below:

Avtoto collects personal data from Players across several categories depending on the nature of the interaction with the Platform. The categories of data we may collect include:

3.1 Registration & Identity Data

• Full legal name as it appears on a government-issued identification document
• Date of birth (used for age verification —21+ requirement strictly enforced)
• Nationality and country of residence
• Email address and chosen username
• Malaysian MyKad number or passport number (for KYC verification)
• Residential address

3.2 Financial & Transaction Data

• Deposit and withdrawal transaction records, including amounts MYR, timestamps, and payment method identifiers
• Payment method details (e.g., e-wallet account reference for Touch'n Go eWallet, Boost, GrabPay; bank account reference for Maybank, CIMB, Public Bank, Hong Leong; FPX and DuitNow transaction references)
• Wallet balance history and bonus fund activity
• Wagering history, game session records, and win/loss summaries

3.3 Technical & Device Data

• IP address and geographic location data derived from IP
• Device type, operating system, browser type and version
• Session duration, page interaction data, and clickstream analytics
• Cookie identifiers and similar tracking technologies (see Section 8)

3.4 Communications Data

• Records of live chat conversations with our support team
• Email correspondence sent to and received from [email protected]
• Feedback, complaint records, and dispute logs

3.5 Responsible Gambling Data

• Deposit limit settings, self-exclusion requests, and cooling-off period records
• Responsible gambling assessment responses where voluntarily provided

Avtoto collects personal data through the following channels:

• Directly from you — when you register an account, complete KYC verification, make a deposit or withdrawal, contact our support team, respond to a survey, or submit a complaint.
• Automatically through the Platform — via cookies, server logs, and tracking technologies that record your device information, session activity, and browsing behaviour when you access the Platform.
• From third-party payment processors — transaction confirmation data and fraud-screening signals received from payment gateways (e.g., DuitNow, FPX operators, e-wallet platforms) in the course of processing deposits and withdrawals.
• From KYC verification providers — identity verification results and risk scoring data generated by our contracted KYC service partners in connection with the account verification process.
• From fraud prevention and AML screening services — data matching results and risk flags generated when processing transactions in compliance with anti-money laundering obligations.

Avtoto processes your personal data for the following specific, legitimate purposes:

Where Avtoto wishes to use your personal data for a purpose not listed above, we will notify you in advance and, where required, seek your explicit consent before commencing such processing.

Avtoto processes your personal data on the following legal grounds:

• Contractual necessity: Processing required to perform our obligations under the Terms & Conditions, including account management, payment processing, and delivery of gaming services.
• Legal obligation: Processing required to comply with applicable anti-money laundering (AML) regulations, age verification requirements, licensing obligations, and data retention laws.
• Legitimate interests: Processing undertaken in Avtoto's legitimate business interests, including fraud prevention, responsible gambling monitoring, platform security, and analytics — where those interests are not overridden by your privacy rights.
• Consent: Processing for which you have given specific, informed, and freely given consent — primarily for marketing communications. You may withdraw consent at any time by contacting our support team without affecting the lawfulness of prior processing.

Avtoto does not sell your personal data to third parties. We may share your data with the following categories of recipients only to the extent necessary for the purposes described in this Policy:

• Payment processors and financial institutions — including operators of Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, and Hong Leong Connect, solely for the purpose of processing your deposits and withdrawals.
• KYC and identity verification providers — contracted third-party services that assist in verifying the identity, age, and documentation of Players as required by our licensing obligations.
• Fraud prevention and AML screening services — providers that assist in detecting suspicious activity, screening transactions, and complying with financial crime prevention obligations.
• IT infrastructure and hosting providers — cloud and data hosting services that maintain the technical infrastructure supporting the Platform, operating under strict data processing agreements with Avtoto.
• Regulatory and licensing authorities — government agencies, financial regulators, or licensing bodies to whom we are legally required to report, upon receipt of a valid legal request or as required by our licence conditions.
• Law enforcement agencies — where Avtoto is required or authorised by law to disclose personal data in response to a valid court order, warrant, or official request.

The Avtoto Platform uses cookies and similar tracking technologies to enhance your experience, maintain session state, and gather analytics data. The categories of cookies we use are:

• Strictly necessary cookies: Essential for the Platform to function correctly. They enable core services such as account login, session management, security token validation, and payment flow continuity. These cookies cannot be disabled without preventing use of the Platform.
• Functional cookies: Store your preferences such as language settings, display preferences, and saved login details to improve your experience on return visits.
• Analytics cookies: Used to collect anonymised or pseudonymised data about how users interact with the Platform, including page visit frequency, navigation paths, and feature usage. This data helps us improve the Platform's performance and usability.
• Security and fraud prevention cookies: Help identify and prevent fraudulent access attempts, bot activity, and unusual session patterns that may indicate Account compromise.

Upon your first visit to the Platform, you will be presented with a cookie consent notice. You may manage your cookie preferences at any time through your browser settings or the Platform's cookie management tool. Please note that disabling strictly necessary cookies may impair the functionality of the Platform and prevent you from accessing certain features, including your gaming account and payment services.

Avtoto retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law, regulatory obligations, and our licensing conditions. The following indicative retention periods apply:

• Account and identity data: Retained for the duration of your active Account plus a minimum of five (5) years following Account closure, to satisfy AML record-keeping obligations and potential dispute resolution requirements.
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction, in accordance with financial record-keeping regulations applicable to online gaming operators.
• KYC documentation: Retained for the period of the Account relationship and for at least five (5) years after Account termination, or longer if required by a specific legal or regulatory obligation.
• Support and communications records: Retained for two (2) years from the date of the last interaction, unless the records relate to an unresolved dispute, in which case they are retained until resolution.
• Analytics and technical log data: Typically retained in aggregated or anonymised form for up to twelve (12) months.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be attributed to any identifiable individual. Requests for early deletion are handled in accordance with the User Rights described in Section 11.

Avtoto implements a comprehensive suite of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security infrastructure includes:

• 256-bit SSL/TLS encryption applied to all data transmissions between your device and the Platform, ensuring that your personal and financial information cannot be intercepted in transit.
• Encrypted data storage — sensitive personal data including identity documents and payment references are stored in encrypted form at rest using industry-standard encryption algorithms.
• Access controls — personal data is accessible only to authorised Avtoto personnel whose roles require such access, governed by strict role-based access control policies.
• Multi-factor authentication — available for Player accounts and mandatory for all internal staff systems that involve access to personal data.
• Regular security audits and penetration testing — conducted periodically by independent security professionals to identify and remediate vulnerabilities in the Platform.
• Incident response procedures — in the event of a data security incident that poses a risk to Player data, Avtoto will take immediate containment steps and notify affected individuals and relevant authorities in accordance with applicable legal requirements.

Whilst Avtoto takes all reasonable steps to protect your personal data, no method of electronic transmission or storage is 100% secure. You are responsible for maintaining the confidentiality of your Account login credentials and for notifying us immediately if you suspect any unauthorised access to your Account.

As a Player whose personal data is processed by Avtoto, you have the following rights with respect to your personal information. To exercise any of these rights, please contact us using the details in Section 15:

Avtoto will respond to all valid data subject requests within 30 days of receipt. In complex cases, we may extend this period by a further30 days, in which case we will notify you of the extension and the reason for it. We may require proof of identity before processing a request to protect against unauthorised access to another person's data.

The Avtoto Platform is strictly intended for individuals aged21 years and above. We do not knowingly collect personal data from, or provide services to, anyone under the age of 21. Age verification is conducted as part of the mandatory KYC process for every registered Account.

If Avtoto discovers or reasonably suspects that personal data has been collected from an individual under 21, we will immediately suspend the relevant Account, initiate a full investigation, delete the data in question, and return any real-money wallet balance to the deposit source. The account will be permanently closed.

In order to deliver the Avtoto Platform and comply with our licensing, payment processing, and KYC obligations, some of your personal data may be transferred to, stored in, or processed in countries outside of Malaysia. This includes data transfers to our payment gateway partners, KYC verification providers, cloud infrastructure operators, and our licensing authority's jurisdiction.

Where such transfers occur, Avtoto ensures that appropriate safeguards are in place to protect your personal data to a standard equivalent to that applied within Malaysia. These safeguards may include contractual clauses with data recipients that impose equivalent data protection obligations, or transfers to jurisdictions that have been assessed as providing an adequate level of data protection.

Players who require further information about the specific safeguards applied to cross-border transfers of their personal data may request details by contacting us via the channels listed in Section 15.

Avtoto reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, regulatory guidance, or Platform functionality. Material changes to this Policy will be communicated to registered Players via a notification displayed on the Platform or sent to the registered email address associated with the Account, where practicable.

The "Last Updated" date at the top of this page indicates when the Policy was most recently revised. Continued use of the Platform following the effective date of an updated Policy constitutes your acceptance of the revised terms. If you do not agree to the updated Policy, you should cease using the Platform and may request voluntary Account closure in accordance with our Terms & Conditions.

Players are encouraged to review this Policy periodically. The version published on the Platform at any given time is the version currently in effect.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by Avtoto, please contact our Data Support team using the following channels:

When submitting a data subject request, please provide sufficient identifying information to enable us to locate your Account and verify your identity. This protects you against the risk of another person accessing your personal data.

For concerns relating to responsible gambling, self-exclusion, or Player protection, please also visit our Responsible Gambling page.