Privacy Policy

Introduction

This Privacy Policy ("Policy") is issued by Ocatoto ("we", "us", "our", "the Platform"), the operator of the online gaming platform accessible at https://ocatoto.cam and all associated subdomains, mobile-optimised web applications, and digital channels.

This Policy describes how Ocatoto collects, uses, stores, discloses, and otherwise processes personal data relating to registered players, prospective players, and visitors to the Platform ("you", "the User", "the Player"). It applies to all personal data provided to us through account registration, identity verification, payment processing, customer support interactions, and your ongoing use of Ocatoto's services.

This Policy should be read in conjunction with our Terms & Conditions and our Responsible Gambling Policy. By using the Platform, you confirm that you have read and understood this Policy and consent to the processing of your personal data as described herein.

Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person — including name, identification number, contact details, financial information, and online identifiers such as IP address or device ID.
• "Processing" means any operation performed on personal data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" means Ocatoto, as the entity that determines the purposes and means of processing your personal data.
• "Data Processor" means any third party that processes personal data on behalf of Ocatoto, pursuant to a data processing agreement.
• "Consent" means a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your personal data for a stated purpose.
• "KYC" means Know Your Customer — the identity and age verification process required before withdrawal or as required under applicable compliance obligations.
• "Cookie" means a small text file placed on your device by the Platform to facilitate session management, preference storage, and analytics.
• "MYR" means Malaysian Ringgit, the primary transaction currency of the Platform.

Data We Collect

3.1 Data You Provide Directly

We collect personal data that you provide to us when you interact with the Platform. This includes:

• Registration data: full legal name, date of birth, residential address, email address, and phone number.
• Identity verification documents: Malaysian MyKad, passport, or other government-issued photo identification submitted during KYC.
• Payment information: bank account details, e-wallet identifiers (Touch 'n Go, Boost, GrabPay), FPX/DuitNow references, and cryptocurrency wallet addresses used for deposits and withdrawals.
• Communication records: messages, emails, and live chat transcripts exchanged with our customer support team.
• Responsible gambling data: self-exclusion requests, deposit limits, session time preferences, and cooling-off periods you set within your account.

3.2 Data Collected Automatically

When you access or use the Platform, we automatically collect certain technical data, including:

• IP address and approximate geographic location derived from it.
• Device type, operating system, browser version, and screen resolution.
• Session data: pages visited, features accessed, time spent on Platform, and navigation path.
• Game activity logs: games played, wager amounts, game outcomes, and session timestamps.
• Transaction logs: deposit and withdrawal history, payment method used, and processing timestamps.
• Cookie and tracking technology data (see Section 9 for full details).

3.3 Data from Third Parties

We may receive personal data about you from third-party sources, including:

• Identity verification providers and fraud prevention agencies used during KYC processing.
• Payment service providers processing your MYR transactions (e.g., Maybank, CIMB, Public Bank, Hong Leong Bank, DuitNow, FPX networks).
• Affiliates and referral partners who referred you to the Platform, in accordance with their own privacy notices.
• Regulatory and law enforcement bodies where we are required or permitted to receive information for compliance purposes.

How We Use Your Data

Ocatoto processes your personal data for the following purposes:

• Account management: Creating, maintaining, and securing your player account on the Platform.
• Identity verification (KYC): Confirming that you meet the minimum age requirement of 21 years and verifying your identity as required by our licensing obligations.
• Payment processing: Facilitating deposits and withdrawals in MYR through your chosen payment method, including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank, and USDT TRC20.
• Fraud prevention and security: Detecting, investigating, and preventing fraudulent activity, money laundering, collusion, and other prohibited conduct on the Platform.
• Customer support: Responding to your enquiries, resolving disputes, and providing assistance in connection with your account.
• Responsible gambling: Monitoring gameplay patterns to identify signs of problem gambling and administering self-exclusion, deposit limits, and cooling-off requests.
• Legal and regulatory compliance: Meeting obligations under applicable law, licensing requirements, anti-money laundering (AML) regulations, and responding to lawful requests from authorities.
• Platform improvement: Analysing usage data in aggregated, anonymised form to improve Platform performance, game selection, and user experience.
• Marketing communications: Sending you promotional offers and updates relevant to your account, where you have consented to receive such communications. You may withdraw consent at any time.

Legal Basis for Processing

Ocatoto processes your personal data on one or more of the following legal bases:

• Contractual necessity: Processing required to perform the contract between you and Ocatoto — including account creation, game access, payment processing, and withdrawal facilitation.
• Legal obligation: Processing required to comply with applicable laws and regulations, including AML/KYC obligations under our licensing framework.
• Legitimate interests: Processing carried out in pursuit of our legitimate business interests, including fraud prevention, platform security, and service improvement — where those interests are not overridden by your privacy rights.
• Consent: Processing based on your explicit consent, including direct marketing communications. You retain the right to withdraw consent at any time without affecting the lawfulness of prior processing.

Data Sharing & Disclosure

Ocatoto does not sell your personal data. We may share your data with the following categories of recipients, only to the extent necessary for the stated purpose:

• Payment service providers: Malaysian banks (Maybank, CIMB, Public Bank, RHB, Hong Leong Bank), e-wallet operators (Touch 'n Go, Boost, GrabPay), DuitNow, FPX network operators, and cryptocurrency infrastructure providers — to process your deposit and withdrawal requests.
• Identity verification providers: Third-party KYC and age verification services used to confirm your identity and eligibility, as required by our licensing obligations.
• Fraud prevention and compliance agencies: Services used to identify and prevent fraudulent activity, money laundering, and other prohibited conduct.
• Technology and hosting providers: Cloud infrastructure, database, and software providers that host and operate the Platform on our behalf, bound by strict data processing agreements.
• Legal and regulatory authorities: Law enforcement agencies, regulatory bodies, and courts of competent jurisdiction, where we are required by law or legal process to disclose personal data.
• Corporate transactions: In the event of a merger, acquisition, or sale of all or part of our business, your personal data may be transferred to the acquiring entity, subject to the same protections described in this Policy.

Data Retention

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including satisfying any legal, regulatory, accounting, or reporting obligations. The primary retention periods applicable to Ocatoto player data are:

• Active account data: Retained for the duration of your account and for a minimum of five (5) years following account closure, to meet AML and licensing compliance obligations.
• Transaction and financial records: Retained for a minimum of seven (7) years following each transaction, in accordance with applicable financial record-keeping requirements.
• KYC documents: Retained for a minimum of five (5) years following the conclusion of the business relationship, or longer where required by applicable law.
• Customer support records: Retained for three (3) years following the closure of each support case, unless the record is relevant to an ongoing legal matter.
• Marketing consent records: Retained for as long as you remain opted into marketing communications, and for two (2) years following withdrawal of consent.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our data destruction procedures.

Data Security

Ocatoto implements appropriate technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and our servers.
• Encryption of sensitive data at rest within our database infrastructure.
• Two-factor authentication (2FA) available for all player accounts and mandatory for all internal staff accounts with data access.
• Role-based access controls ensuring that staff members access only the data necessary for their job function.
• Regular penetration testing and vulnerability assessments conducted by independent security specialists.
• Intrusion detection systems and real-time security monitoring.
• Staff data protection training conducted on an annual basis.

While we employ industry-standard security measures, no data transmission over the internet can be guaranteed to be completely secure. You are responsible for maintaining the security of your account credentials. If you suspect unauthorised access to your account, contact us immediately at [email protected].

Cookies & Tracking Technologies

9.1 What Are Cookies?

Cookies are small text files stored on your device when you visit the Platform. They serve a range of functions — from keeping you logged in during a session to helping us understand how players navigate the Platform so we can improve it.

9.2 Types of Cookies We Use

• Strictly necessary cookies: Essential for the Platform to function. These include session cookies that keep you logged in and security cookies that protect against CSRF attacks. These cannot be disabled without breaking core Platform functionality.
• Functional cookies: Remember your preferences, such as language settings, deposit method selection, and display options, to personalise your experience.
• Analytical cookies: Used in aggregated, anonymised form to understand how players interact with the Platform — which pages are visited most, where sessions start and end, and how features are used. This data informs product improvements.
• Security and fraud prevention cookies: Used to identify suspicious behavioural patterns and prevent fraudulent activity on the Platform.

9.3 Managing Cookies

You may configure your browser settings to refuse or delete cookies. Please note that disabling strictly necessary cookies will prevent the Platform from functioning correctly and may prevent you from accessing your account. Instructions for managing cookies are available in your browser's help documentation.

International Data Transfers

Ocatoto operates under international licensing and may process or store your personal data in jurisdictions outside Malaysia. Where personal data is transferred internationally, we ensure that adequate safeguards are in place — including contractual protections binding the receiving entity to data protection standards equivalent to those described in this Policy.

Payment data processed via Malaysian payment networks (DuitNow, FPX, Maybank, CIMB, and others) is handled in accordance with the data processing standards of those networks and their respective privacy frameworks.

Your Rights

Subject to applicable law and our legitimate processing interests, you have the following rights with respect to your personal data held by Ocatoto:

To exercise any of these rights, contact our Data Protection team at [email protected] with the subject line "Data Rights Request". We will acknowledge your request within 5 business days and provide a substantive response within 30 calendar days. Complex requests may require up to 90 days, in which case we will notify you of the extension.

Minors & Age Restrictions

The Ocatoto Platform is strictly for players aged 21 years and above. We do not knowingly collect or process personal data from individuals under the age of 21. Age verification is a mandatory component of our KYC process for all players before any withdrawal is permitted.

If we become aware that personal data has been collected from a person under the age of 21 without verified parental consent, we will take immediate steps to delete that data and close the associated account.

Third-Party Services & Links

The Platform may contain references to game providers, payment processors, and technology partners. Where Ocatoto integrates third-party services directly into the Platform (such as live dealer game providers or payment gateway interfaces), those services are governed by separate privacy notices issued by the respective third parties.

Ocatoto is not responsible for the privacy practices of third-party service providers operating within the Platform's ecosystem. We recommend reviewing the privacy notices of any third-party service that requests your personal data. The provisions of this Policy apply only to data processing undertaken by Ocatoto directly or by processors acting on our express instructions.

Amendments to This Policy

Ocatoto reserves the right to update this Privacy Policy at any time. Material changes — those that substantially affect how we use your personal data or your rights under this Policy — will be communicated to you via email notification to your registered address and/or a prominent notice displayed on the Platform prior to the change taking effect.

Non-material amendments (such as formatting changes, typographical corrections, or clarifications that do not alter the substance of any provision) may be made without prior notice. The "Last Updated" date at the top of this page will always reflect the most recent revision.

Your continued use of the Platform following the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not accept the revised Policy, you should cease using the Platform and may request account closure as described in our Terms & Conditions.

Contact Us

If you have any questions, concerns, or complaints about this Privacy Policy, or about how Ocatoto processes your personal data, please contact us using the details below. We take all privacy enquiries seriously and will respond promptly and in good faith.

• Data Protection Enquiries — Email: [email protected] (Subject: "Privacy Policy Enquiry" or "Data Rights Request")
• Live Chat: Available 24 hours a day, 7 days a week, via the chat widget on the Platform. Suitable for urgent queries.

We aim to acknowledge all data-related correspondence within 5 business days and to resolve queries fully within 30 calendar days. Where a query requires extended investigation, we will inform you of the expected timeline.