Privacy Policy —Balontoto

1 Introduction

Balontoto (hereinafter referred to as "Balontoto", "we", "us", or "our") operates the online gaming and sports betting platform accessible at balontoto.cam "Platform"). We are committed to safeguarding the privacy and personal data of every individual who registers on, visits, or interacts with our Platform.

This Privacy Policy (the "Policy") describes how Balontoto collects, processes, stores, shares, and protects personal information relating to our registered players, prospective users, and visitors to the Platform. It also sets out the rights available to individuals whose data we process and the means by which those rights may be exercised.

This Policy forms part of our broader legal framework and should be read in conjunction with our Terms & Conditions and Responsible Gambling Policy. By creating an account or using the Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

2 Definitions

For the purposes of this Policy, the following terms shall carry the meanings defined below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, location data, and online identifiers.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, alteration, retrieval, and deletion.
• "Data Subject" means the individual to whom Personal Data relates — in most cases, a registered player or visitor to the Platform.
• "Data Controller" means Balontoto, the entity that determines the purposes and means of processing Personal Data.
• "Third Party" means any natural or legal person other than the Data Subject and Balontoto, including payment processors, game providers, and analytics services.
• "Cookie" means a small text file stored on a user's device by a web browser for the purpose of recording information about that user's browsing activity.
• "KYC" means Know Your Customer — the identity and age verification process required before withdrawal privileges are activated.

3 Personal Data We Collect

Balontoto collects the following categories of personal data in connection with your registration and use of the Platform:

3.1 Identity & Contact Information

• Full legal name as it appears on your Malaysian IC (MyKad) or passport;
• Date of birth and national identification number;
• Residential address (including city — for example, Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, or Shah Alam);
• Email address and mobile telephone number.

3.2 Financial & Payment Information

• Bank account numbers associated with Malaysian payment methods (Maybank, CIMB, Public Bank, Hong Leong Bank, RHB);
• E-wallet account identifiers (Touch 'n Go eWallet, Boost, GrabPay, DuitNow);
• Transaction records including deposits, withdrawals, and bonus activity;
• Cryptocurrency wallet addresses where applicable (BTC, ETH, USDT).

3.3 Identity Verification Documents (KYC)

• Scanned copies or photographs of Malaysian IC (MyKad), passport, or other government-issued identification;
• Proof of address documents (utility bills, bank statements);
• Selfie or biometric verification images where required.

3.4 Technical & Usage Data

• IP address, device identifier, browser type, and operating system;
• Login timestamps, session duration, and navigation patterns on the Platform;
• Game play history, betting activity, and wagering records;
• Geolocation data (country and region level) for compliance and fraud prevention purposes.

3.5 Communications Data

• Records of interactions with our customer support team, including live chat transcripts, email correspondence, and support ticket records;
• Survey responses, feedback submissions, and promotional correspondence.

4 How We Collect Personal Data

We collect personal data through the following channels:

• Directly from you — when you register an account, complete KYC verification, make a deposit or withdrawal, contact support, or respond to a promotion;
• Automatically — through cookies, web beacons, and similar tracking technologies as you interact with the Platform;
• From third parties — including identity verification service providers, payment processors (FPX, DuitNow, Touch 'n Go), and fraud prevention partners, where necessary to verify your identity or process your transactions; and
• From public sources — where permitted by applicable law, including publicly available registers or fraud prevention databases.

5 Data Processing & Use

Balontoto processes personal data for the following purposes:

6 Legal Basis for Processing

Balontoto processes your personal data on the following legal bases:

• Contractual necessity — processing required to fulfil our obligations to you under the Terms & Conditions, including account management and payment processing;
• Legal obligation — processing required to comply with applicable laws, including KYC verification, anti-money laundering requirements, and responsible gambling regulations;
• Legitimate interests — processing carried out in pursuit of Balontoto's legitimate interests, including fraud prevention, security monitoring, and Platform improvement, provided such interests are not overridden by your rights and interests; and
• Consent — processing based on your freely given, specific, informed, and unambiguous consent, including for marketing communications. Where consent is the basis for processing, you retain the right to withdraw it at any time without detriment.

7 Data Sharing & Disclosure

Balontoto does not sell, rent, or trade your personal data to third parties for marketing or commercial purposes. We may share your data with the following categories of recipient solely for the purposes described in this Policy:

• Payment Processors: Malaysian payment providers including Touch 'n Go eWallet, DuitNow, FPX, Maybank, CIMB, Public Bank, Boost, and GrabPay — for the sole purpose of processing your deposits and withdrawals;
• Identity Verification Providers: Third-party KYC and AML compliance service providers who assist in verifying the identity and age of account holders;
• Game Providers: Licensed game studios and content providers whose games are accessible via the Platform, where such sharing is necessary to deliver gameplay and ensure fair game operation;
• Fraud Prevention Partners: Specialist service providers who assist in the detection and prevention of fraudulent activity and multi-accounting;
• Regulatory Authorities: Competent regulatory or law enforcement bodies where disclosure is required by applicable law, court order, or regulatory direction; and
• Group Companies: Affiliated entities within the Balontoto corporate group, where necessary for internal operational, compliance, or administrative purposes.

All third-party recipients of your personal data are required to process it in accordance with applicable data protection standards and are prohibited from using your data for any purpose other than that for which it was disclosed to them.

8 Cookies & Tracking Technologies

Balontoto uses cookies and similar tracking technologies to operate the Platform effectively, personalise your experience, and analyse usage patterns. The following types of cookies are deployed on the Platform:

• Essential Cookies: Strictly necessary for the Platform to function. These include session authentication cookies and security tokens. These cannot be disabled without impairing Platform functionality.
• Functional Cookies: Enable personalisation features such as remembering your preferred language (English, Bahasa Melayu, or Mandarin), display preferences, and region settings.
• Analytical Cookies: Collect anonymised data on how users interact with the Platform — including pages visited, session duration, and navigation flows — to help us improve the user experience.
• Security Cookies: Used to authenticate users, prevent fraudulent use of credentials, and protect against cross-site request forgery and other security threats.

You may manage your cookie preferences through your browser settings. Disabling certain non-essential cookies may affect the functionality of the Platform. By continuing to use the Platform, you consent to our use of cookies as described in this Policy.

9 Data Retention

Balontoto retains personal data for as long as is necessary to fulfil the purposes for which it was collected, including to satisfy any legal, regulatory, accounting, or reporting requirements.

As a general guide, the following retention periods apply:

• Account Data: Retained for the duration of your active account and for a period of at least five (5) years following account closure, as required by anti-money laundering regulations.
• KYC & Identity Documents: Retained for a minimum of five (5) years from the date of submission or account closure, whichever is later.
• Transaction Records: Retained for a minimum of five (5) years from the date of each transaction.
• Support Communications: Retained for up to three (3) years from the date of the last interaction.
• Marketing Consent Records: Retained until consent is withdrawn, plus a reasonable administrative period thereafter.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in manner that prevents reconstruction.

10 Security Measures

Balontoto implements industry-standard technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• Transport Layer Security (TLS/SSL): All data transmitted between your device and the Platform is encrypted using256-bit SSL/TLS encryption.
• Access Controls: Access to personal data is restricted to authorised personnel on a strict need-to-know basis, with role-based access management.
• Secure Data Storage: Sensitive data — including KYC documents and payment information — is stored in encrypted form on secured servers with restricted physical and logical access.
• Real-Time Fraud Monitoring: Automated systems continuously monitor for unusual account activity, suspicious login patterns, and potential security incidents.
• Regular Security Audits: Our security infrastructure is subject to periodic internal and external review to identify and address vulnerabilities.

While we take all reasonable steps to protect your data, no system of data transmission over the internet is entirely secure. We encourage you to use a strong, unique password for your balontoto account and to notify us immediately at [email protected] if you suspect any unauthorised access.

11 Your Rights

Subject to applicable law, you hold the following rights with respect to your personal data processed by Balontoto. To exercise any of these rights, please contact our Data Protection team using the details provided in Section 15.