Privacy Policy

This Privacy Policy ("Policy") is issued by royaltoto ("the Company", "we", "our", or "us"), the operator of the online betting and gaming platform accessible at royaltoto.cam. This Policy describes how we collect, use, store, disclose, and otherwise process personal data relating to individuals ("you", "the Player", "the User") who access or use our Platform, including our website, mobile site, and all associated products and services.

royaltoto is committed to protecting the privacy and personal data of all players, particularly those accessing our Platform from Malaysia. We process personal data in accordance with the requirements of Malaysia's Personal Data Protection Act 2010 (PDPA) and any other applicable data protection legislation.

By registering an account on royaltoto, using our Platform, or otherwise providing us with your personal data, you acknowledge that you have read and understood this Policy and you consent to the collection and processing of your personal data as described herein. If you do not agree with any aspect of this Policy, you should not use the royaltoto Platform.

For the purposes of this Policy, the following definitions apply:

• "Personal Data" means any information that directly or indirectly identifies a living individual, as defined under the PDPA 2010.
• "Processing" means any operation or set of operations performed on personal data, including collection, recording, storage, use, disclosure, or deletion.
• "Data Controller" means royaltoto, the entity that determines the purposes and means of processing personal data.
• "Data Processor" means any third party that processes personal data on behalf of royaltoto, such as payment service providers or KYC verification partners.
• "KYC" means Know Your Customer — identity verification procedures carried out to confirm a player's identity, age, and where applicable, source of funds.
• "Platform" means the royaltoto website, mobile interface, and all associated services and products available at royaltoto.cam.
• "Cookies" means small text files stored on your device by a web browser, used to identify your browser and capture certain information about your activity on the Platform.
• "PDPA" means the Personal Data Protection Act 2010 of Malaysia.

royaltoto collects the following categories of personal data, depending on how you interact with our Platform:

We collect only the personal data that is necessary for the stated purposes. We do not collect sensitive personal data (such as racial origin, health data, or political opinions) unless specifically required by a legal obligation.

royaltoto collects personal data through the following means:

• Direct Interactions: Data you provide directly when registering an account, completing KYC verification, making deposits or withdrawals, contacting our support team, or participating in promotions.
• Automated Technologies: Technical and usage data collected automatically when you access and interact with our Platform, including through cookies, web beacons, server logs, and similar tracking technologies.
• Third-Party Sources: Data received from payment processors (such as DuitNow, FPX, Touch 'n Go eWallet, Boost, and GrabPay), KYC verification service providers, fraud detection partners, and where applicable, credit reference agencies — where such sharing is permitted by applicable law.
• Publicly Available Sources: In limited circumstances and where legally permissible, data from public registers or other publicly available sources to verify the accuracy of information you have provided.

royaltoto processes your personal data for the following purposes:

1. Account Management: To create, administer, and maintain your royaltoto account, including processing registrations, verifying identity, and managing account preferences.
2. Service Delivery: To operate and deliver the products and services available on the Platform, including accepting bets, processing game results, and crediting winnings.
3. Financial Transactions: To process deposits, withdrawals, and bonus payments, and to maintain accurate financial records for audit and reconciliation purposes.
4. KYC and Age Verification: To verify that you are aged 21 or above, to confirm your identity, and to comply with anti-money laundering (AML) obligations.
5. Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, account abuse, money laundering, and other illegal or prohibited conduct on the Platform.
6. Responsible Gambling: To monitor gaming activity for signs of problem gambling, to implement player protection measures such as deposit limits and self-exclusion, and to fulfil our responsible gambling obligations.
7. Legal Compliance: To comply with applicable laws, regulations, court orders, and the lawful requests of regulatory or law enforcement authorities.
8. Customer Support: To respond to your enquiries, complaints, and support requests efficiently and accurately.
9. Platform Improvement: To analyse usage data and improve the functionality, performance, and user experience of the royaltoto Platform.
10. Marketing Communications: To send you promotional offers, bonuses, and updates relating to royaltoto — only where you have consented to receive such communications. You may opt out at any time.

royaltoto processes your personal data on the following legal grounds under the PDPA 2010 and applicable data protection principles:

• Contractual Necessity: Processing required to perform our contractual obligations to you as a registered player, including account management, transaction processing, and service delivery.
• Legal Obligation: Processing necessary to comply with applicable laws and regulations, including AML requirements, KYC obligations, and the requirements of regulatory or law enforcement authorities.
• Legitimate Interests: Processing carried out in pursuit of royaltoto's legitimate business interests — including fraud prevention, security monitoring, and Platform improvement — where these interests are not overridden by your fundamental rights.
• Consent: Processing carried out on the basis of your specific, informed consent — principally in relation to direct marketing communications. You may withdraw consent at any time by contacting our support team or updating your account communication preferences.

royaltoto does not sell, rent, or trade your personal data. We may share your data with the following categories of recipients, strictly on a need-to-know basis and only to the extent necessary:

• Payment Processors: Service providers facilitating deposits and withdrawals, including operators of Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and participating banks (Maybank, CIMB, Public Bank, RHB, Hong Leong). These parties receive only the transaction data necessary to process your payment.
• KYC and Identity Verification Partners: Third-party service providers engaged to verify the identity and age of players in compliance with our regulatory obligations.
• Fraud Detection and AML Partners: Service providers that assist royaltoto in detecting and preventing fraudulent activity, money laundering, and other prohibited conduct.
• IT and Platform Service Providers: Cloud hosting, infrastructure, and software providers that support the operation of the royaltoto Platform, subject to appropriate data processing agreements.
• Regulatory and Law Enforcement Authorities: Where required by applicable law, court order, or the lawful request of a competent regulatory or law enforcement authority.
• Professional Advisors: Legal counsel, auditors, and other professional advisors engaged in connection with the operation of our business, subject to professional confidentiality obligations.

royaltoto retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Account and Identity Data: Retained for the duration of the player's account and for a minimum of seven (7) years following account closure, in compliance with AML record-keeping obligations.
• Financial Transaction Records: Retained for a minimum of seven (7) years following the date of the transaction, in compliance with applicable financial regulations.
• Gaming Activity Data: Retained for the duration of the account and for a period thereafter in accordance with regulatory requirements and responsible gambling monitoring obligations.
• Communications Data: Customer support records retained for a period of three (3) years following the last interaction, unless a longer period is required for dispute resolution or legal proceedings.
• Technical and Usage Data: Typically retained for a rolling period of thirteen (13) months for analytical and security purposes.

Following the applicable retention period, personal data is securely deleted or anonymised in accordance with our data disposal procedures.

royaltoto uses cookies and similar tracking technologies (including web beacons and pixel tags) on the Platform. Cookies are small data files stored on your device that help us operate the Platform effectively and improve your experience.

We use the following categories of cookies:

• Strictly Necessary Cookies: Essential for the Platform to function correctly. These include session cookies that maintain your login state and security tokens. These cannot be disabled.
• Functional Cookies: Used to remember your preferences and personalise your experience — for example, remembering your preferred language or currency display.
• Analytics Cookies: Used to collect aggregated, anonymised data about how visitors use the Platform, helping us identify areas for improvement. Data collected is not associated with individual players for analytical purposes.
• Security Cookies: Used to support fraud detection and prevention functions, including monitoring for automated or suspicious access patterns.

You may manage or disable non-essential cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the royaltoto Platform. royaltoto does not use third-party advertising or cross-site tracking cookies.

royaltoto implements and maintains appropriate technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and our servers.
• Encryption of personal data and sensitive financial information stored in our systems.
• Role-based access controls limiting employee access to personal data on a strict need-to-know basis.
• Regular security assessments, penetration testing, and vulnerability scanning.
• Two-factor authentication options for player accounts.
• Incident response procedures for detecting, reporting, and responding to personal data breaches.

While royaltoto takes all reasonable steps to protect your personal data, no method of internet transmission or electronic storage is entirely secure. We cannot guarantee the absolute security of data transmitted to our Platform over the internet. Players are encouraged to use strong, unique passwords and to enable two-factor authentication on their accounts.

Under the Personal Data Protection Act 2010 (PDPA) and applicable data protection principles, you have the following rights in relation to your personal data held by royaltoto:

• Right of Access: You may request a copy of the personal data we hold about you. We will respond to verified access requests within 21 days.
• Right to Correction: You may request the correction of any personal data that is inaccurate, incomplete, or out of date. Many details can be updated directly in your account settings.
• Right to Withdraw Consent: Where processing is based on your consent (for example, for marketing communications), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.
• Right to Restrict Processing: In certain circumstances, you may request that we restrict the processing of your personal data while a dispute or correction request is pending.
• Right to Object: You may object to the processing of your personal data for direct marketing purposes at any time. You may also object to processing carried out on the basis of legitimate interests, subject to overriding legal grounds.

To exercise any of the above rights, please contact our customer support team in writing at [email protected]. We may need to verify your identity before processing your request. We will respond within the timeframe required by applicable law.

The royaltoto Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect, use, or store personal data relating to individuals under the age of 21. Persons under 21 are prohibited from registering an account or using any feature of the Platform.

If royaltoto becomes aware that personal data has been collected from an individual under the age of 21, we will take immediate steps to delete that data, close the associated account, and refund any deposits made, in accordance with our Terms & Conditions. If you believe that a person under 21 may have registered on our Platform, please contact us immediately at [email protected].

The royaltoto Platform may, from time to time, contain references to third-party services such as payment gateways (including Maybank, CIMB, Touch 'n Go eWallet, and other Malaysian financial institutions). When you interact with a third-party service provider's interface — for example, completing a payment through your bank's FPX portal — you are subject to that party's own privacy policy and terms of use.

royaltoto is not responsible for the privacy practices or content of third-party websites or services. We encourage you to review the privacy policies of any third-party service providers you interact with in connection with your use of the royaltoto Platform.

royaltoto reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform operations. Where a material change is made, we will provide reasonable notice to registered players via the email address on record or by way of a prominent notice on the Platform.

The date of the most recent revision is indicated at the top of this Policy. Your continued use of the royaltoto Platform following notification of any amendment constitutes your acceptance of the revised Policy. If you do not agree with the revised Policy, you should cease using the Platform and may request account closure in accordance with our Terms & Conditions.

If you have any questions, concerns, or requests relating to this Privacy Policy or royaltoto's handling of your personal data, please contact our Data Protection team using the details below. We are available 24 hours a day, 7 days a week, with support in English, Bahasa Melayu, and Mandarin.

• Email: [email protected]
• Live Chat: Available directly on the royaltoto Platform. Average response time: 3–5 minutes.
• Written Requests: Data access and correction requests must be submitted in writing to the email address above, clearly stating your full name, account username, and the nature of your request.

For enquiries specifically related to responsible gambling, self-exclusion, or account restrictions, please visit our Responsible Gambling page.