Rajatoto Privacy Policy — Our Commitment to Protecting Your Personal Data

Rajatoto collects your personal information in several ways — directly when you register an account or interact with our platform, and automatically through tracking technologies as you browse our website. The following are the categories of information we collect:

Information you provide directly:

• Registration information: Full name, Malaysian phone number, email address, date of birth, and the password you set yourself.
• Financial information: Malaysian bank account details, e-wallet account numbers (Touch 'n Go, GrabPay, DuitNow, Boost, ShopeePay), and records of all deposit and withdrawal transactions made via FPX, Maybank2u, or CIMB Clicks.
• Identity verification documents: A copy of your Malaysian identity card (MyKad) submitted during the KYC (Know Your Customer) process prior to your first withdrawal being processed.
• Communications information: The content of messages you send to the Rajatoto support team via live chat, email, or WhatsApp.

Automatically collected information:

• Technical data: IP address, device type, operating system, web browser version, and screen resolution.
• Usage data: Pages visited within the Rajatoto platform, games played, session duration, and actions taken while using the platform.
• Location data: Approximate location information based on your IP address to ensure licensing compliance and fraud detection.
• Cookie data: Information collected through cookies and similar tracking technologies as described in Section 5.

The personal data we collect is used exclusively for legitimate purposes necessary to operate the Rajatoto platform safely and efficiently. Below is a detailed breakdown of how your data is used:

• Account management: Creating, verifying, and maintaining your Rajatoto account — including login monitoring, password recovery, and profile information updates.
• Transaction processing: Deposits via Touch 'n Go, GrabPay, DuitNow, Boost, ShopeePay, FPX (Maybank2u, CIMB Clicks) and withdrawals to your Malaysian bank account are processed securely and accurately.
• Identity verification (KYC): Fulfilling legal obligations related to anti-money laundering (AML) compliance and member identity verification as required by the relevant authorities.
• Delivery of gaming services: Provides access to over 1,200 games including slots, Live Casino, table games, Virtual Sports, and progressive jackpots, subject to your VIP tier and account eligibility.
• Promotion and bonus management: Calculating eligibility, crediting, and monitoring the usage of welcome bonuses, weekly cashback, free spins, and all Rajatoto promotions you claim.
• Customer support: Responding to enquiries, resolving complaints, and providing technical support across our various communication channels.
• Security and fraud prevention: Monitoring account activity to detect and prevent fraud, money laundering, bot usage, and other violations that could compromise the security of the platform and other members.
• Legal compliance: Meeting the reporting and documentation obligations required under applicable Malaysian law.
• Product improvement: Analysing aggregated, non-personally identifiable usage patterns to improve the user experience, introduce new games, and enhance platform performance.

Rajatoto does not use your personal data for third-party marketing, off-platform advertising, or any purpose not stated in this Privacy Policy without first obtaining your explicit consent.

Rajatoto does not sell, rent, or trade your personal data to any third party for marketing or commercial purposes. This is a core commitment that has remained unchanged since Rajatoto began operations.

However, there are limited situations where Rajatoto needs to share certain information with third parties necessary for platform operations:

• Payment service providers: Required transaction data is shared with payment gateway providers (such as FPX operators, Touch 'n Go, and GrabPay) solely for the purpose of processing your deposits and withdrawals. These providers are bound by strict confidentiality agreements.
• Game providers: Game session data required to ensure proper game functionality is shared with providers such as Pragmatic Play, Evolution Gaming, and others. No financial or personal identity information is shared for this purpose.
• Technology service providers: Companies that assist us in running our technical infrastructure, such as cloud service and cybersecurity providers, operating under strict confidentiality terms and accessing only the minimum data necessary.
• Legal authorities: Rajatoto will disclose the necessary information where required by Malaysian law, a valid court order, or a lawful request from a law enforcement agency. In such circumstances, we will notify you where we are legally permitted to do so.

Every third party that Rajatoto works with is required to uphold data protection standards that are equally as stringent as our own internal standards. A data protection agreement (DPA) is signed with all service providers that process personal data belonging to Rajatoto members.

Protecting the personal and financial data of our members is Rajatoto's foremost technical and operational priority. We continuously invest in the latest security infrastructure to ensure your data remains safe at all times.

Technical security measures we have in place:

• 256-bit SSL/TLS Encryption: All data transmitted between your browser and Rajatoto's servers is encrypted using 256-bit SSL standards — the same technology used by Malaysia's leading banking institutions and major financial organisations worldwide.
• Data encryption at rest: All sensitive personal data stored in Rajatoto's databases is encrypted using strong encryption algorithms. Passwords are never stored in plain text.
• Two-factor authentication (2FA): 2FA is available on all accounts, and we strongly encourage every member to enable it for a significant additional layer of security.
• 24/7 security monitoring: Rajatoto's cybersecurity team continuously monitors system activity to detect and respond to any security threats in real time.
• Regular security audits: Independent security audits are conducted on a regular basis by qualified third-party cybersecurity firms to identify and address any system vulnerabilities.
• Internal access controls: Access to members' personal data within the Rajatoto organisation is restricted to staff with a legitimate operational need, and all access is logged and monitored.

In the event of any security incident involving your personal data, Rajatoto is committed to notifying you in a timely manner and taking all necessary steps to mitigate the impact of that incident.

Rajatoto uses cookies and similar tracking technologies to enhance the user experience, maintain session security, and understand how members use our platform. The following are the types of cookies we use:

You can manage cookie settings through your web browser. However, disabling essential cookies may affect the functionality of the Rajatoto platform, including your ability to log in and use our services smoothly. Analytics cookies can be disabled without affecting core platform functionality.

Rajatoto retains your personal data for as long as your account remains active and for the period required following account closure to fulfil legal obligations, resolve any outstanding disputes, and enforce our agreements.

Our data retention policy is as follows:

• Active account data: Retained for as long as the account remains active and for 7 years after account closure to meet Malaysia's Anti-Money Laundering (AMLA) compliance requirements.
• Financial transaction records: Retained for a minimum of 7 years in accordance with Malaysian legal requirements relating to financial and tax records.
• KYC Documents: Retained for 7 years after account closure, or longer if required by the relevant authorities.
• Customer support communication logs: Retained for 2 years from the date of your last interaction for reference and dispute resolution purposes.
• Log and security data: Retained for 1 year for security monitoring and incident investigation purposes.

Once the applicable retention period has ended, your data will be securely deleted or anonymised in a way that can no longer be linked back to your identity.

Under Malaysia's Personal Data Protection Act 2010 (PDPA) and international data protection best practices, you as a Rajatoto member have the following rights regarding your personal data:

• Right to access: You have the right to request a copy of the personal data we hold about you. Such requests will be processed within 21 business days.
• Right to rectification: If the personal data we hold is inaccurate or out of date, you have the right to request a correction. Basic profile information can be updated directly through your account settings.
• Right to erasure: In certain circumstances, you have the right to request the deletion of your personal data. This right is subject to Rajatoto's legal obligations to retain specific records as outlined in Section 6.
• Right to withdraw consent: Where processing of your data is based on consent, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the validity of any processing carried out prior to withdrawal.
• Right to object: You have the right to object to the processing of your personal data for specific purposes, including direct marketing.
• Right to data portability: You have the right to request your personal data in a machine-readable format for transfer to another service provider.

To submit any request relating to the rights above, please contact the Rajatoto data protection team by email at support@rajatoto.onl with the subject line "Data Rights Request", along with your account number and the details of your request. We are committed to responding within 21 working days from the date a complete request is received.

Rajatoto is an adult entertainment platform strictly intended for individuals aged 18 and above. We do not knowingly collect, store, or process any personal data relating to children or minors.

Should we discover that we have inadvertently collected personal data from an individual under the age of 18, we will immediately take the following steps:

• Immediately closing the account in question
• Deleting all collected personal data
• Refunding any deposits made by that account
• Reporting the incident to the relevant authorities where necessary

If you become aware or suspect that a minor is using the Rajatoto platform, please contact us immediately at support@rajatoto.onl or via 24/7 live chat so that appropriate action can be taken without delay.

Rajatoto reserves the right to update or amend this Privacy Policy from time to time in line with changes in law, technology, or business operations. Any amendments will be published on this page with an updated revision date.

For significant amendments that affect how we use your personal data, Rajatoto will endeavour to notify you via in-platform notifications or by email to your registered address at least seven days before the amendment takes effect.

Your continued use of the Rajatoto platform after any Privacy Policy amendment is published will be considered acceptance of the revised terms. We encourage you to review this page periodically to stay informed of how we protect your data.

If you have any questions, concerns, or complaints regarding how Rajatoto handles your personal data, our team is ready to assist through the following channels:

• Email: support@rajatoto.onl — please include "Privacy Inquiry" in the subject line of your message
• Live Chat: Available 24/7 directly within the Rajatoto platform
• Target response time: All privacy enquiries will be responded to within 48 working hours

We value the trust you place in Rajatoto when handling your personal information. Our commitment to data protection goes beyond legal obligation — it is a core value of ours as a platform that respects and prioritises the interests of every Malaysian member who trusts us.