Privacy Policy Kangtoto — Personal Data Protection for Malaysia Members

This Privacy Policy is published and maintained by Kangtoto ("we", "the platform", or "Kangtoto") and applies to all users who access the website, mobile app, or any digital service provided by Kangtoto — including Sports Betting (Malaysia Super League football, EPL, BWF badminton, MPL esports), Live Casino, slots, and all other game categories available on the platform.

At Kangtoto, we understand that privacy is more than a word in a legal document. It is the foundation of the trust you place in us every time you register an account, make a deposit via Touch 'n Go or DuitNow, or place a bet on your favourite badminton match. That trust is something we guard with the utmost care.

This Policy is drawn up in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA) and international best practices in personal data management. It is binding on all Kangtoto staff, contractors and business partners who handle user data in any capacity.

Kangtoto collects personal data through several means — directly from you during registration and platform use, and automatically via tracking technologies when you browse the website or use our app. Below are the categories of data we collect and their respective purposes:

Kangtoto not collect sensitive data such as health information, religious beliefs, political views or biometric information except in very specific circumstances and with your explicit consent. Full financial data such as complete credit card numbers is not stored on our servers — transactions are processed entirely by licensed payment processors such as FPX and e-wallet providers that comply with PCI-DSS security standards.

The data we collect is used solely for legitimate purposes directly related to the provision of our services Kangtoto to you. We do not use your data for purposes you would not expect. The following are the legitimate purposes for which your data is used:

• Account Management: Creating, verifying, and maintaining your member account, including the KYC process and age verification
• Transaction Processing: Processing MYR deposits via Touch 'n Go, GrabPay, DuitNow, FPX and other methods, as well as managing withdrawals
• Service Provision: Grants access to Sports Betting, Live Casino, slots, and all games available on the Kangtoto platform
• Security & Fraud Prevention: Detecting and preventing fraud, money laundering, multi-account abuse, and other unlawful activities
• Customer Support: Providing technical support and resolving issues reported by members in Bahasa Melayu
• Responsible Gaming: Monitoring gameplay patterns to identify signs of problem gambling and to apply self-management tools
• Legal Compliance: Fulfils obligations under Malaysian law, including the PDPA 2010 and financial reporting requirements
• Marketing Communications (with consent): Sending information about promotions, bonuses and platform updates to members who have opted in to receive them

Kangtoto will not use your data for purposes other than those stated above without notifying you in advance and obtaining fresh consent where required. If you have questions about how specific data is being used, please reach out to our team at support@kangtoto.fun.

Kangtoto does not sell, rent or commercialize your personal data to any third party. That said, in the course of operating the platform, we may need to share certain data with carefully selected partners in the following limited situations:

• Payment Processors: Service providers such as FPX, Touch 'n Go eWallet, GrabPay, Boost and DuitNow require minimum transaction details to securely process your MYR deposits and withdrawals
• Game Software Providers: Live casino and slots game providers receive the session data required to run the games — they do not receive any personally identifiable information about you
• KYC Services: In cases where additional identity verification is required, the minimum necessary identity information is shared with a licensed KYC service provider that complies with stringent security standards
• Legal Authorities: Kangtoto is required to disclose data to Malaysian authorities (such as PDRM or BNM) upon receiving a valid and lawful official request
• Cloud Computing Services: Data is stored on cloud servers that comply with international security standards, backed by strict data protection agreements

All third parties that receive Kangtoto member data are bound by strict confidentiality and data protection agreements. They are permitted to use that data only for the specific purposes defined in those agreements and may not use it for any other purpose. Kangtoto remains accountable for how those third parties handle the data they receive from us.

Kangtoto continuously invests in security infrastructure to ensure that the personal and financial data of our Malaysian members is always protected to the highest standard we can guarantee. The technical and organisational security measures we employ include:

• Transit Encryption: All communications between your device and Kangtoto's servers are protected with 256-bit SSL/TLS — no data travels in an unencrypted state
• Storage Encryption: Sensitive data stored in our databases — including passwords and identity information — is encrypted using robust encryption algorithms
• Two-Factor Authentication (2FA): Available for all accounts and strongly recommended — adds an extra layer of protection even if your password is compromised
• Internal Access Controls: Only Kangtoto staff who require access to specific data within the scope of their duties are permitted to do so — the "least privilege" principle is strictly enforced
• 24/7 Monitoring: An intrusion detection system (IDS) monitors network traffic in real time and triggers immediate alerts upon detecting any suspicious activity
• Regular Security Audits: Independent penetration testing and security audits are conducted regularly to identify and patch vulnerabilities before they can be exploited
• Fund Segregation: Member deposit funds are kept entirely separate from the company's operational funds to safeguard your financial security

While Kangtoto takes every reasonable step to protect your data, no security system in the world can be guaranteed 100% foolproof. We encourage you to take personal protective measures as well — such as using a strong password, enabling 2FA and never sharing your login credentials with anyone.

In the event of a data security breach involving your personal data, Kangtoto committed to notifying you within a reasonable time and taking immediate remedial action in accordance with Malaysia's PDPA 2010 requirements.

Platform Kangtoto uses cookies and similar tracking technologies to enhance user experience, maintain session security and gather analytics that help us improve our services. Cookies are small text files stored on your device by your web browser when you visit the Kangtoto website.

You can manage or delete cookies through your web browser settings at any time. Please note, however, that disabling essential cookies may affect the functionality of the Kangtoto platform — you may be unable to log in or complete transactions properly. Analytical and functional cookies are entirely optional and will not affect your betting experience if you choose to disable them.

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you as a member Kangtoto have rights that we are obliged to respect and uphold. Below are your rights and how to exercise them:

To exercise any of the above rights, send your request by email to support@kangtoto.fun with a clear subject line ("Data Access Request", "Data Deletion Request" and so on), along with your account number and sufficient identity verification. Kangtoto is committed to processing all data rights requests within the timeframes stipulated by PDPA 2010.

Platform Kangtoto is a service intended exclusively for adults aged 18 and above. We do not knowingly collect, store, or process the personal data of individuals under the age of 18 in any capacity.

Kangtoto enforces strict age verification procedures during the registration process. Should we discover that personal data belonging to anyone under the age of 18 has been collected inadvertently, we will take immediate steps to delete that data and close the account in question. Parents or guardians who suspect their child has registered a Kangtoto account are encouraged to contact us promptly at support@kangtoto.fun for immediate action.

Kangtoto reserves the right to update or modify this Privacy Policy from time to time to reflect changes in our data practices, new legal requirements or technological developments that affect how we process personal data.

When material changes are made to this Privacy Policy — for example, changes to the types of data collected, new purposes for use, or changes to how data is shared — Kangtoto will notify you via:

• In-platform notifications when you log in to your account
• Notification emails sent to your registered email address
• Update the "Last Updated" date at the top of this page

Changes take effect 14 days after the publication date, unless immediate changes are required for security or urgent legal reasons. Continued use of the Kangtoto platform after changes take effect constitutes your acceptance of the updated policy. If you do not agree with any changes, you have the right to close your account before they take effect.

If you have any questions, concerns or complaints regarding this Privacy Policy or the way Kangtoto handle your personal data, we strongly encourage you to reach out to us directly. Our Bahasa Malaysia-speaking team is available to assist you 24 hours a day, 7 days a week.

• Privacy Email: support@kangtoto.fun — use the subject line "Privacy Enquiry" for priority handling
• Live Chat: Available on the Kangtoto platform — response within minutes
• Frequently Asked Questions: Visit our FAQ page for answers to common enquiries

For formal privacy-related complaints, please email support@kangtoto.fun with the subject line "Formal Privacy Complaint", along with the full details of your complaint and your Kangtoto account number. We are committed to providing an initial response within 5 business days and resolving complaints within 14 business days. If you are not satisfied with our proposed resolution, you have the right to escalate the matter to Malaysia's Department of Personal Data Protection under the Ministry of Communications & Digital.