Privacy Policy — familytoto

This Privacy Policy ("Policy") is issued by familytoto ("familytoto", "we", "us", "our"), the operator of the online gaming and sports betting platform accessible at familytoto.cam (the "Platform"). This Policy governs how we collect, use, store, share, and protect the personal data of all individuals ("Users", "Players", "you") who access or interact with the familytoto Platform.

familytoto is committed to handling your personal data with transparency, integrity, and strict security practices. We recognise that trust is foundational to the relationship between an online gaming platform and its players — particularly for our Malaysian player community, whose data is subject to the same protections we apply globally.

This Policy is drafted in compliance with applicable data protection legislation and is intended to satisfy the transparency requirements placed on data controllers under such legislation. By registering an account on familytoto, or by continuing to use the Platform having been notified of this Policy, you acknowledge that you have read and understood our data practices as described herein.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

familytoto collects the following categories of personal data in connection with the operation of the Platform:

familytoto collects personal data through the following channels and mechanisms:

• Direct Provision: Data you actively provide when you register an account, complete KYC verification, make deposits or withdrawal requests, contact our support team, or update your Account settings.
• Automated Collection: Technical data collected automatically when you access the Platform, including via browser cookies, server logs, device fingerprinting for fraud prevention, and session analytics tools.
• Third-Party Sources: Data received from payment service providers (DuitNow, FPX operators, Touch 'n Go, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, and cryptocurrency network confirmations) in the course of processing your transactions; and from KYC verification partners who conduct identity checks against government-issued document databases.
• Referral Data: Where you arrive at familytoto via a referral link, we may collect limited referral attribution data to credit the referring party under our Refer A Friend programme, subject to the programme's terms.

familytoto processes your personal data only where we have a lawful basis to do so. The lawful bases we rely upon, and the specific purposes for which we process personal data under each basis, are as follows:

5.1 Contractual Necessity
We process your identity data, contact data, and financial data to fulfil our contractual obligations to you as a registered familytoto account holder — including creating and maintaining your account, processing deposits and withdrawals in MYR, applying bonuses and VIP benefits, and providing access to the gaming and betting platform.

5.2 Legal Obligation
We process your KYC document data, transaction data, and identity data to comply with applicable anti-money laundering (AML) regulations, counter-terrorist financing (CTF) requirements, age verification obligations (21+ minimum age policy), and reporting obligations to relevant regulatory and law enforcement authorities where required.

5.3 Legitimate Interests
We process technical data and gaming data to detect and prevent fraud, account takeovers, bonus abuse, and other prohibited activities that would cause harm to familytoto or to other players. We also process data to maintain and improve platform security, stability, and performance — activities that are in the legitimate interest of all platform users.

5.4 Consent
Where we send you direct marketing communications — such as promotional emails about new games, upcoming Liga Super Malaysia or EPL betting markets, or special bonus campaigns — we do so based on your consent, which you may withdraw at any time. Withdrawal of marketing consent does not affect the lawfulness of processing carried out prior to withdrawal.

familytoto does not sell, rent, or trade your personal data to third parties for their independent commercial purposes. We share personal data only in the following defined circumstances:

• Payment Service Providers: We share financial data with processors including DuitNow, FPX gateway operators, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, and cryptocurrency network operators, solely for the purpose of processing your deposits and withdrawals. These providers process data under their own privacy policies and applicable financial regulations.
• KYC / Identity Verification Partners: We engage accredited third-party KYC service providers to verify your identity documents and confirm compliance with age verification and AML obligations. These partners process data under strict contractual data processing agreements with familytoto.
• Cloud Infrastructure and IT Service Providers: We use reputable cloud hosting and database providers to store and manage Platform data. All infrastructure partners are bound by contractual data processing obligations equivalent to those set out in this Policy.
• Regulatory and Law Enforcement Authorities: We may disclose personal data to government agencies, regulators, courts, or law enforcement bodies where required to do so by applicable law, court order, or regulatory direction.
• Fraud Prevention and Security Services: We may share technical and identity data with industry fraud prevention databases where necessary to protect the Platform and its users from financial crime.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of familytoto's business, personal data may be transferred to the successor entity, subject to equivalent privacy protections and advance notification to affected users where practicable.

familytoto uses cookies and similar tracking technologies (including session storage and device fingerprinting) to operate the Platform effectively and to improve your user experience. The categories of cookies we deploy are as follows:

You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent you from logging into and using the familytoto Platform. Disabling analytics cookies will not affect your access to gameplay features.

familytoto retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligation. The following retention periods apply as a general guide:

• Account and Identity Data: Retained for the duration of your active account plus a minimum of 5 years following account closure, to satisfy AML regulatory record-keeping requirements.
• Transaction and Financial Data: Retained for a minimum of 7 years from the date of the transaction, in accordance with financial record-keeping obligations applicable to licensed gaming operators.
• KYC Document Data: Retained for a minimum of 5 years from the date of verification or from the date of account closure, whichever is later.
• Gaming and Betting Records: Retained for a minimum of 3 years from the date of each gaming session or wager.
• Customer Support Communications: Retained for 2 years from the date of the interaction, unless the communication is relevant to an ongoing dispute or investigation.
• Technical / Log Data: Retained for up to 12 months from collection, after which data is aggregated and anonymised for analytical purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Data subject to an ongoing regulatory investigation, court order, or legal hold may be retained beyond these standard periods as required.

As a data subject whose personal data is processed by familytoto, you hold the following rights. To exercise any of these rights, please contact our Data Protection contact via the details in Section 14.

familytoto implements a comprehensive suite of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Transport Encryption: All data transmitted between your device and familytoto's servers is encrypted using TLS 1.2 or higher (256-bit SSL).
• Data at Rest Encryption: Personal data stored in our databases is encrypted using AES-256 encryption at the storage layer.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. All staff and contractor access is logged, monitored, and subject to regular review.
• Two-Factor Authentication: Internal systems handling personal data require multi-factor authentication for all administrative access.
• Intrusion Detection: We operate continuous intrusion detection and security monitoring systems across all Platform infrastructure.
• Penetration Testing: The Platform undergoes periodic third-party security penetration testing to identify and remediate vulnerabilities.
• Incident Response: In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, familytoto will notify affected users within 72 hours of becoming aware of the breach, in accordance with applicable notification obligations.

While familytoto employs industry-standard security practices, no digital platform can guarantee absolute security. We encourage all Players to use strong, unique passwords for their familytoto accounts and to enable two-factor authentication where offered.

In the course of operating the familytoto Platform, your personal data may be transferred to and processed in countries outside Malaysia, including countries where our cloud infrastructure providers, KYC partners, and game technology providers are based.

Where personal data is transferred internationally, familytoto ensures that appropriate safeguards are in place to protect your data, including:

• Contractual clauses with Data Processors that impose data protection obligations equivalent to those applicable under this Policy.
• Transfers only to jurisdictions or processors that provide an adequate level of data protection, as assessed by familytoto or recognised by applicable regulatory guidance.
• Operational and technical controls to minimise the volume and sensitivity of data transferred internationally.

You may request information about the safeguards applied to any specific international transfer of your data by contacting us at the details provided in Section 14.

The familytoto Platform is strictly for adults aged 21 (twenty-one) years and above. We do not knowingly collect personal data from individuals under the age of 21, and we do not permit minors to register accounts or use any aspect of the Platform.

familytoto employs both automated and manual age verification checks as part of the registration and KYC process to confirm that all Players meet the minimum age requirement. Where we discover that personal data has been collected from a minor — whether through error, deception, or circumvention of our controls — we will:

• Immediately suspend or close the relevant account.
• Permanently delete all personal data associated with the minor from our active systems as soon as practicable.
• Refund any real-money deposits made, where the source can be established and verified.
• Report the matter to relevant authorities where legally required.

familytoto reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, our data processing activities, or our Platform's features and functionality.

When material changes are made to this Policy — particularly changes that affect your rights or how we use your data — we will notify you by email to the address registered on your Account, and by a prominent notice on the familytoto Platform, at least 14 days before the changes take effect.

The "Last Updated" date at the top of this Policy reflects the date of the most recent revision. We recommend reviewing this Policy periodically. The current version of this Policy is always accessible at familytoto.cam/privacy-policy.

Your continued use of the familytoto Platform after the effective date of any amendment constitutes your acknowledgement of the revised Policy. If you do not accept the amended Policy, you must cease using the Platform and may close your account by contacting our support team.

If you have any questions, concerns, or complaints about this Privacy Policy, about how familytoto handles your personal data, or if you wish to exercise any of your data rights as described in Section 9, please contact our Data Protection team through the following channels:

• Email: [email protected] — please mark your subject line "Privacy / Data Request" for fastest routing to our Data Protection team.
• Live Chat: Available 24/7 on the familytoto Platform. For formal data rights requests, please follow up in writing by email to create a traceable record.

familytoto will acknowledge all privacy-related enquiries within 5 business days and provide a substantive response within 30 calendar days.

If you are dissatisfied with familytoto's response to a privacy complaint, you have the right to escalate your complaint to the relevant data protection supervisory authority in your jurisdiction. We encourage you to contact us first so that we have the opportunity to address your concerns directly.