Privacy Policy
Kimtoto is committed to protecting the personal data of every player on our platform. This Privacy Policy explains exactly what we collect, why we collect it, and how you stay in control.
Our Privacy Commitments
Six pillars that define how Kimtoto handles your personal data — before you read the full policy below.
No Third-Party Marketing Sales
Kimtoto does not sell, rent, or share your personal information with any third party for their own marketing or commercial purposes. Your data is used exclusively to operate and improve your account experience.
256-Bit SSL Encryption
Every data transmission between your device and the Kimtoto platform is protected by industry-standard 256-bit SSL encryption — the same standard applied by major Malaysian banking institutions such as Maybank and CIMB.
You Control Your Data
Registered players have the right to access, correct, and request deletion of their personal data. These rights can be exercised by contacting our support team — no complex processes, no unexplained delays.
Minimal Data Collection
We collect only the personal data that is strictly necessary for account operation, identity verification, fraud prevention, and legal compliance. We do not collect data for speculative or undefined future uses.
Transparent Cookie Use
Kimtoto uses cookies and similar tracking technologies solely to improve platform performance and personalise your session. Our cookie practices are described in full in the Cookie Policy section below.
Compliance-Driven Processing
All data processing at Kimtoto is grounded in a lawful basis — typically contractual necessity, legal obligation, or your explicit consent. We do not process personal data without a defined, documented purpose.
Introduction
This Privacy Policy ("Policy") issued by Kimtoto ("Kimtoto", "we", "us", "our"), the operator of the online gaming platform accessible athttps://kimtoto.cam (the "Platform"). It describes how Kimtoto collects, uses, stores, discloses, and otherwise processes the personal data of individuals ("you", "User", "Player") who access or use the Platform.
Kimtoto is committed to responsible data stewardship. We recognise that players across Malaysia — from Kuala Lumpur and Petaling Jaya to Penang, Johor Bahru, and Shah Alam — place real trust in us when they share their personal information. This Policy exists to make that trust transparent and well-founded.
By registering an Account on the Platform or by continuing to use the Platform after this Policy has been updated and notified to you, you acknowledge that you have read and understood this Privacy Policy and agree to the processing of your personal data as described herein.
Definitions
The following defined terms apply throughout this Privacy Policy:
- "Personal Data" means any information that identifies or can reasonably be used to identify a natural person, directly or indirectly, including name, identification number, contact details, financial data, and online identifiers.
- "Processing" means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, and deletion.
- "Data Controller" means the entity that determines the purposes and means of processing Personal Data — in this context, Kimtoto.
- "Data Processor" means any third party that processes Personal Data on behalf of Kimtoto under a contractual arrangement and in accordance with Kimtoto's instructions.
- "Consent" means a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your Personal Data for a stated purpose.
- "KYC" means Know Your Customer — the identity and document verification process required for account activation and transaction processing.
- "Cookie" means a small data file stored on your device by a website for purposes of session management, analytics, or personalisation.
Data We Collect
Kimtoto collects Personal Data in the following categories, depending on the nature of your interaction with the Platform:
| Category | Examples | When Collected |
|---|---|---|
| Identity Data | Full legal name, date of birth, nationality, government ID number (MyKad / passport) | Registration & KYC verification |
| Contact Data | Email address, mobile phone number, residential address | Registration & account updates |
| Financial Data | Payment method details (e-wallet IDs, bank account references for FPX/DuitNow), transaction history, deposit and withdrawal records | Deposit, withdrawal, KYC |
| Technical Data | IP address, device type, browser type and version, operating system, session identifiers, login timestamps | Automatically on Platform access |
| Usage Data | Games played, wagers placed, betting history, session duration, feature interactions, bonus claims | During active Platform use |
| Communication Data | Live chat transcripts, support emails, feedback submissions | When you contact support |
| Marketing Preferences | Opt-in/opt-out status for promotional communications, language and notification preferences | Account settings & registration |
We do not collect sensitive personal data (such as racial or ethnic origin, religious beliefs, health data, or biometric data) as part of standard account operations. If such data is ever requested for a specific regulatory purpose, we will seek your explicit consent and explain the reason clearly.
How We Collect Data
4.1 Directly From You
The majority of Personal Data we hold is provided directly by you during account registration, KYC verification, deposit and withdrawal requests, support interactions, and when updating your account settings.
4.2 Automatically
When you access or use the Platform, certain Technical Data and Usage Data is collected automatically through server logs, session tracking, and cookies. This data is used to maintain platform security, diagnose technical issues, and improve service quality. See Section 10 for full details on our cookie practices.
4.3 From Third Parties
Kimtoto may receive data about you from the following third-party sources in limited circumstances:
- Payment processors (e.g., FPX gateway operators, DuitNow, Touch'n Go eWallet, Boost, GrabPay) — transaction confirmation data only;
- Identity verification service providers — for KYC document validation;
- Fraud prevention and AML screening services — to fulfil legal compliance obligations;
- Analytics providers — aggregated, non-identifiable behavioural analytics to improve Platform features.
Purposes of Processing
Kimtoto processes your Personal Data for the following clearly defined purposes:
- Account Administration: Creating, maintaining, and operating your Player account, including authentication, balance management, and transaction processing.
- Identity Verification (KYC): Verifying your identity and age eligibility in compliance with anti-money laundering obligations and our internal responsible gambling policies.
- Transaction Processing: Processing deposits and withdrawals via Malaysian payment channels including DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, and cryptocurrency.
- Customer Support: Responding to your queries, resolving account issues, and processing complaints through our 24/7 live chat and email support channels.
- Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent transactions, money laundering, bonus abuse, and other prohibited conduct as defined in our Terms & Conditions.
- Legal & Regulatory Compliance: Meeting obligations under applicable laws, including retention of transaction records and responding to lawful authority requests.
- Responsible Gambling: Monitoring account activity to identify patterns associated with problem gambling and facilitating access to responsible gambling tools including deposit limits, self-exclusion, and cooling-off periods.
- Platform Improvement: Analysing aggregated usage patterns to improve game performance, interface design, and service quality.
- Marketing Communications: Sending promotional offers, bonus notifications, and platform updates — only where you have opted in to receive such communications and in accordance with your stated preferences.
Legal Basis for Processing
Kimtoto processes Personal Data only where a valid legal basis exists. The primary legal bases applicable to our processing activities are:
- Contractual Necessity: Processing required to perform our obligations under the agreement formed when you register an Account — including account management, deposit processing, game operation, and withdrawal fulfilment.
- Legal Obligation: Processing required to comply with applicable laws, including KYC identity verification, AML transaction monitoring, and data retention requirements.
- Legitimate Interests: Processing that is necessary for Kimtoto's legitimate business interests, provided those interests are not overridden by your rights — including fraud detection, platform security, and service improvement analytics.
- Consent: Processing based on your explicit agreement, primarily for optional marketing communications. You may withdraw consent at any time by updating your account notification preferences or contacting our support team.
Data Sharing & Disclosure
Kimtoto does not sell, rent, or trade your Personal Data with third parties for their own marketing purposes. We may share your Personal Data with carefully selected third parties only in the following circumstances:
7.1 Service Providers (Data Processors)
We engage third-party service providers to assist in operating the Platform. These include payment gateway operators, KYC verification providers, cloud hosting and infrastructure providers, fraud screening services, and analytics platforms. All Data Processors are contractually bound to process your data only on Kimtoto's instructions and in compliance with applicable data protection standards.
7.2 Regulatory and Law Enforcement Authorities
Kimtoto may disclose Personal Data to regulatory bodies, law enforcement agencies, financial intelligence units, or courts when required to do so by applicable law, court order, or regulatory direction. We will only disclose the minimum data necessary to satisfy the lawful request.
7.3 Business Transfers
In the event of a merger, acquisition, restructuring, or sale of assets involving Kimtoto, Personal Data held by us may be transferred to the successor entity. In such circumstances, we will notify affected Players and ensure the successor entity is bound by privacy obligations consistent with this Policy.
7.4 With Your Consent
We may share your data with third parties in circumstances not described above where you have provided explicit prior consent for that specific disclosure.
Data Retention
Kimtoto retains Personal Data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The principal retention periods applied by Kimtoto are as follows:
- Active Account Data: Retained for the duration of your account and for a period of not less than 5 years following account closure, in accordance with standard AML and financial record-keeping requirements;
- Transaction Records: Retained for a minimum of 6 years following the date of the transaction, consistent with financial compliance obligations;
- KYC Documentation: Retained for the duration of the account and for a minimum of 5 years post-closure;
- Support Communication Records: Retained for 3 years from the date of the interaction, unless a longer period is required by an ongoing dispute or investigation;
- Marketing Opt-In Records: Retained for the duration of the opted-in period, plus 3 years as evidence of consent history.
Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised so that it can no longer be associated with any individual.
Data Security
Kimtoto implements technical and organisational security measures proportionate to the risk posed by the processing activities we conduct. These measures include, but are not limited to:
- 256-bit SSL/TLS encryption for all data in transit between your device and the Platform;
- Encryption of sensitive data at rest in our database infrastructure;
- Role-based access controls limiting employee access to Personal Data on a strict need-to-know basis;
- Multi-factor authentication for sensitive account actions, including password changes and withdrawal requests;
- Regular security assessments, vulnerability scanning, and penetration testing of Platform infrastructure;
- Automated anomaly detection systems monitoring for unusual login patterns, transaction irregularities, and potential account compromise.
In the event of a data security breach that is likely to result in a risk to your rights and freedoms, Kimtoto will notify affected individuals and relevant authorities in accordance with applicable notification timelines and requirements.
Cookies & Tracking Technologies
The Kimtoto Platform uses cookies and similar technologies (including local storage and session tokens) to operate core platform functionality, maintain your session, and improve your experience. The categories of cookies we use are as follows:
10.1 Strictly Necessary Cookies
These cookies are essential for the Platform to function. They include session management cookies that keep you logged in during your visit and security tokens that protect against cross-site request forgery. These cannot be disabled without significantly impairing Platform functionality.
10.2 Performance & Analytics Cookies
These cookies collect aggregated, anonymised information about how Players use the Platform — for example, which pages are visited most frequently and whether any technical errors are encountered. This data is used solely to improve Platform performance and user experience. No individually identifiable data is shared with third-party analytics providers through these cookies.
10.3 Functional Cookies
These cookies remember your preferences — such as display language, preferred game lobby view, and notification settings — so that you do not need to re-configure your experience each time you visit.
10.4 Managing Cookies
You can manage or disable non-essential cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of some Platform features. Full instructions for managing cookies are available in the help documentation of your browser.
Your Rights
Subject to applicable law and certain limited exceptions, you have the following rights in relation to the Personal Data we hold about you:
Right of Access
Request a copy of the Personal Data we hold about you and information about how it is processed.
Right to Rectification
Request correction of any inaccurate or incomplete Personal Data held your account record.
Right to Erasure
Request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to legal retention obligations.
Right to Restriction
Request that we restrict the processing of your data in certain circumstances — for example, while a data accuracy dispute is being resolved.
Right to Portability
Receive a structured, machine-readable copy of the Personal Data you provided to us for portability to another service provider.
Right to Object
Object to processing based on legitimate interests or to direct marketing communications at any time.
To exercise any of these rights, please contact the Kimtoto data privacy team via live chat or by emailing [email protected] with the subject line "Privacy Request". We will acknowledge your request within 5 business days and aim to resolve it within 30 days. Where a request is complex or involves a large volume of data, we may extend this period by a further 60 days, in which case we will notify you of the extension and the reason for it.
Kimtoto will not charge a fee for exercising your rights in the vast majority of circumstances. If a request is manifestly unfounded or excessive — for example, repetitive requests for the same data within a short period — we reserve the right to charge a reasonable administrative fee or decline the request, with a written explanation provided.
Children & Minors
The Kimtoto Platform is strictly for individuals aged 21 and above. We do not knowingly collect, process, or retain Personal Data from any person under the age of 21. If we become aware that Personal Data has been collected from a minor, we will take immediate steps to delete that data and close the associated account.
If you are a parent or guardian and believe that a person under 21 has provided Personal Data to Kimtoto or accessed the Platform, please contact us immediately at [email protected]. We take underage access extremely seriously and will act promptly to investigate and resolve any such report.
Kimtoto's KYC verification process is designed to confirm age eligibility as a standard step before full account activation. No player can access real-money gaming services without passing the minimum age verification check.
International Data Transfers
Kimtoto operates an online platform that may involve the use of cloud infrastructure or Data Processors located outside of Malaysia. Where Personal Data is transferred outside of Malaysia, Kimtoto ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that applied within Malaysia.
These safeguards may include:
- Contractual data processing agreements with Data Processors containing standard data protection clauses;
- Transfer to jurisdictions that provide an adequate level of data protection as recognised by applicable law;
- Technical and organisational measures equivalent to those applied domestically.
You may request further information about the specific safeguards applicable to any international transfer of your Personal Data by contacting us at the details provided in Section 15.
Policy Amendments
Kimtoto reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or Platform functionality. We will notify registered Players of material changes via email or on-site notification at least 7 days before the updated Policy takes effect.
The "Last Updated" date at the top of this Policy indicates when the most recent revision was made. We encourage you to review this Policy periodically. Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the updated Policy.
The current version of this Privacy Policy is always accessible at https://kimtoto.cam/privacy-policy.
Contact Us
For any enquiries, requests, or complaints relating to this Privacy Policy or the processing of your Personal Data by Kimtoto, please contact our support team through the following channels:
- Live Chat: Available 24 hours a day, 7 days a week via the on-site chat widget. Use the subject "Privacy Enquiry" when initiating your chat.
- Email: [email protected] — please include "Privacy Request" in the subject line for data rights enquiries. Responses are typically provided within 5 business days.
Kimtoto is committed to resolving privacy complaints promptly and fairly. If you are not satisfied with our response, you retain the right to escalate your complaint to the relevant data protection authority or regulatory body with jurisdiction over your situation.
Your Data. Your Rights. Our Responsibility.
Kimtoto is built on transparency and player trust. If you have any questions about how we handle your personal data, our support team is available 24/7. Or visit our FAQ for quick answers to common privacy questions.
For players aged 21 and above only. Kimtoto is an entertainment platform. Play responsibly. Visit our Responsible Gambling page for player protection tools and resources.