Ometoto Privacy Policy

Ometoto ("the Company", "we", "us", or "our") is committed to protecting and respecting the privacy of every individual who interacts with the ometoto platform. This Privacy Policy (the "Policy") sets out the basis on which any personal data we collect from you — or that you provide to us — will be processed by us.

This Policy applies to the ometoto website accessible at ometoto.cam, all associated mobile-optimised pages, live chat tools, and related services collectively referred to as the "Platform". It governs personal data relating to users regardless of their location, with particular regard to the data rights of persons accessing the Platform from Malaysia.

Ometoto processes personal data in accordance with applicable data protection laws, including the Personal Data Protection Act 2010 of Malaysia ("PDPA") and other internationally recognised principles of data privacy where applicable. We act as a data controller in respect of personal data collected directly from you via the Platform.

The following definitions apply throughout this Privacy Policy:

Ometoto collects Personal Data through various means — directly from you during registration and Account use, automatically via technical systems when you access the Platform, and in limited cases from third parties such as payment providers and identity verification services.

We do not intentionally collect special categories of Personal Data (such as racial or ethnic origin, religious beliefs, or health data) unless required by law or provided voluntarily in a support context (e.g., a responsible gambling hardship declaration). Where such data is provided, it will be handled with additional security measures.

Ometoto processes your Personal Data only where we have a lawful basis to do so. The following table summarises the primary purposes of processing and the applicable lawful basis under the Personal Data Protection Act 2010 (Malaysia) and internationally recognised data protection standards:

• Contract Performance. To register and maintain your Account, process deposits and withdrawals through Malaysian payment providers (Maybank2u, CIMB Clicks, FPX, DuitNow, Touch 'n Go eWallet, Boost, GrabPay), process wagers, and deliver customer support — all of which are necessary for us to fulfil our contractual obligations to you.
• Legal Obligation. To conduct identity verification (KYC), comply with anti-money laundering (AML) obligations, respond to regulatory enquiries, satisfy age verification requirements (21+ for casino-style gambling), and fulfil any mandatory reporting obligations under applicable law.
• Legitimate Interests. To detect and prevent fraud, abuse, or money laundering; to maintain Platform security; to conduct analytics that improve the user experience; and to enforce our Terms and Conditions where necessary. We have assessed that these interests are not overridden by your privacy rights.
• Consent. To send you promotional communications, bonus notifications, or personalised offers — but only where you have actively opted in. You may withdraw this consent at any time by updating your Account notification preferences or by contacting support.
• Vital Interests. In exceptional circumstances, to act in the vital interests of a user or a third party, including in cases involving safeguarding concerns reported through our responsible gambling processes.

We will not use your Personal Data for purposes incompatible with those disclosed above without notifying you and, where required, obtaining your explicit consent.

Ometoto uses cookies and similar tracking technologies to enhance the functionality of the Platform, remember your session state, and gather aggregate usage data to improve our services. The following categories of cookies may be active when you access the Platform:

• Strictly Necessary Cookies. These are essential for the Platform to operate correctly. They manage your login session, maintain Account security tokens, and ensure navigation functions as expected. These cookies cannot be disabled without disrupting core Platform functionality.
• Functional Cookies. These remember your preferences such as language, currency display (MYR), and notification settings to provide a more personalised experience across visits.
• Analytics Cookies. These collect aggregated, anonymised data about how users interact with the Platform — which pages are most visited, how long sessions last, and where technical errors occur. This data is used to improve the Platform's quality and usability.
• Security Cookies. Used to detect and prevent fraudulent activity, identify anomalous login patterns, and protect user sessions from session hijacking or cross-site request forgery.

Ometoto does not sell, rent, or trade your Personal Data to third parties for commercial purposes. We share Personal Data only in the limited circumstances described below:

• Payment Service Providers. Your financial data is shared with payment processors and banking partners necessary to execute deposit and withdrawal transactions (e.g., FPX network participants, e-wallet operators). These parties act as Data Processors under contract and may only use your data for the purpose of processing your transaction.
• Identity Verification Partners. Where KYC verification is conducted via a third-party verification service, your identity documents and associated data are transmitted to that service provider under a data processing agreement. Document data is not retained beyond the verification period unless required by law.
• Regulatory and Law Enforcement Authorities. We may disclose Personal Data to competent authorities — including Malaysian financial intelligence units, law enforcement agencies, or regulatory bodies — where required by applicable law or where disclosure is necessary to prevent, detect, or respond to suspected criminal activity.
• Professional Advisers. We may share Personal Data with our legal, audit, compliance, or financial advisers in connection with legitimate professional engagements, subject to appropriate confidentiality obligations.
• Business Transfers. In the event of a merger, acquisition, or sale of business assets, Personal Data held by ometoto may be transferred to a successor entity. We will notify affected users in advance of any such transfer and advise them of their rights.

All third parties with whom we share Personal Data are contractually required to maintain appropriate security standards and to process data only in accordance with our instructions and applicable law.

Ometoto's primary services are targeted at users in Malaysia. However, due to the global nature of internet infrastructure and cloud services, your Personal Data may be processed, stored, or accessed in jurisdictions outside Malaysia by our vetted service providers.

• We take all reasonable steps to ensure that any international transfer of Personal Data is conducted in accordance with the requirements of the Malaysian PDPA and equivalent data protection standards in the recipient jurisdiction.
• Where Personal Data is transferred to a jurisdiction without an adequate level of data protection by local law, we implement contractual safeguards such as standard contractual clauses, data processing agreements, or equivalent protective mechanisms.
• You may contact us at the address in Section 13 to request further information about international transfer safeguards applicable to your Personal Data.

Ometoto retains Personal Data only for as long as necessary to fulfil the purposes set out in this Policy, or as required by applicable law and regulatory obligations. The following general retention principles apply:

• Active Account Data. While your Account remains open and active, we retain all Account-related Personal Data necessary to provide the Platform's services, maintain accurate transaction records, and fulfil our legal obligations.
• Closed Account Data. Following Account closure, we retain identity, financial, and transaction records for a minimum of five (5) years in accordance with AML recordkeeping requirements under applicable Malaysian and international standards. After this period, data is securely deleted or anonymised.
• KYC Documents. Identity verification documents are retained for the period required by applicable financial regulations, typically five (5) years from the date of last transaction or Account closure, whichever is later.
• Marketing Data. Where your consent for promotional communications is withdrawn, we will cease marketing activities within a reasonable period and delete the associated preference data, subject to retaining a record of the withdrawal of consent.
• Technical Logs. Server access logs and security event logs are retained for up to twelve (12) months for fraud detection and system security purposes, after which they are purged from active systems.

Ometoto implements appropriate technical and organisational measures to protect your Personal Data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security framework includes the following:

• Encryption in Transit. All data transmitted between your browser or device and the ometoto Platform is encrypted using 256-bit SSL/TLS protocols. This applies to every page, login session, cashier transaction, and support interaction.
• Encryption at Rest. Sensitive Personal Data stored on our servers — including identity documents and financial records — is encrypted at rest using industry-standard encryption algorithms.
• Access Controls. Access to Personal Data within our systems is restricted on a strict need-to-know basis. Internal access is controlled by role-based permissions and monitored through access logs reviewed regularly.
• Vulnerability Management. We conduct periodic security assessments, including vulnerability scanning and penetration testing, to identify and remediate potential weaknesses in our Platform infrastructure.
• Incident Response. We maintain a data breach response procedure. In the event of a Personal Data breach that is likely to result in a risk to your rights and freedoms, we will notify affected users and, where legally required, relevant authorities within the timeframe prescribed by applicable law.

Subject to applicable law and certain exceptions, you have the following rights with respect to your Personal Data held by ometoto. These rights may be exercised by submitting a written request to the contact details in Section 13.

• Right of Access. You have the right to request a copy of the Personal Data we hold about you, along with information about how it is processed. We will respond to verified access requests within thirty (30) calendar days.
• Right to Rectification. If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request correction. Minor corrections (e.g., contact details) may be made directly through Account settings. Material corrections (e.g., name, date of birth) require identity verification and written request.
• Right to Erasure. You may request the deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, or where you have withdrawn consent and no overriding legal basis exists. Please note that we are required by law to retain certain financial and identity records even following Account closure and are unable to delete data subject to those obligations.
• Right to Restriction. You may request that we restrict processing of your Personal Data in certain circumstances — for example, while the accuracy of the data is contested, or where processing is unlawful but you prefer restriction over deletion.
• Right to Data Portability. Where processing is based on consent or contract performance, you may request a machine-readable copy of your Personal Data in a structured, commonly used format so that it may be transferred to another data controller.
• Right to Object. You have the right to object to processing based on legitimate interests, including profiling, where your particular circumstances warrant it. You may also object to direct marketing communications at any time by updating your Account notification settings.
• Right to Withdraw Consent. Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

The ometoto Platform is strictly intended for eligible adults aged 21 years and above. We do not knowingly collect Personal Data from any person under the age of 18, and the Platform is not directed at children or minors under any circumstances.

• Age verification measures are applied during the registration process and at the point of any significant withdrawal or account change. We use KYC documentation to confirm that all users meet the minimum age requirement of 21 years.
• If we become aware that Personal Data has been collected from a person under the age of 18, that data will be deleted immediately and the associated Account will be suspended pending investigation.
• If you are a parent or guardian and believe that a minor under your care may have accessed the Platform or provided Personal Data to ometoto, please contact us immediately at [email protected].

Ometoto reserves the right to amend this Privacy Policy from time to time to reflect changes in legal requirements, operational practices, or Platform functionality. The effective date of the current version is displayed at the top of this page and in the table of contents sidebar.

• Material changes to this Policy — those that significantly affect how we process your Personal Data or alter your rights — will be communicated to registered users via email or a prominent Platform notification at least fourteen (14) days before the amendment takes effect.
• Minor changes, such as typographical corrections, clarifications that do not affect the substance of the Policy, or changes required by law with immediate effect, may be published without prior notification.
• Continued use of the Platform following notification of any material amendment constitutes your acceptance of the revised Policy. If you do not accept the revised Policy, you must cease using the Platform and may request Account closure in accordance with our Terms and Conditions.

If you have any questions, concerns, or formal requests relating to this Privacy Policy or the processing of your Personal Data by ometoto, please contact us using the details below:

Ometoto values the trust that players from across Malaysia — including Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and beyond — place in our platform. Maintaining clear, honest data practices is one of the most important ways we honour that trust. This Privacy Policy reflects our genuine commitment to treating your Personal Data with the care and transparency it deserves.