Okitoto Privacy Policy

Introduction

This Privacy Policy ("Policy") describes how Okitoto ("we", "us", "our") collects, processes, stores, shares and protects personal information provided by individuals ("you", "your", "player") who visit or register an account at okitoto.cam.

By creating an account, making a deposit or otherwise using Okitoto, you acknowledge that you have read this Policy and accept the practices described herein. If you do not accept this Policy, you must not access or use Okitoto.

Okitoto may update this Policy to reflect changes in legal requirements, technological practices, the scope of services offered or security standards. We will publish material updates on the platform before they take effect. Continued use of Okitoto after the effective date of a revision constitutes acceptance of the updated Policy.

Definitions

• Personal Data — any information relating to an identified or identifiable natural person, including name, contact details, payment references and device identifiers.
• Processing — any operation performed on personal data, including collection, storage, use, disclosure, transfer and deletion.
• Controller — Okitoto, as the entity determining the purposes and means by which personal data is processed.
• Processor — a third party that processes personal data on Okitoto's behalf and under documented instructions.
• KYC — Know Your Customer procedures designed to verify identity, confirm age and detect fraud or financial crime.
• Consent — a freely given, specific, informed and unambiguous indication of a player's agreement to processing of their personal data for a stated purpose.

Categories of Personal Data Collected

Okitoto may collect and process the following categories of personal data, depending on the services accessed:

Okitoto does not intentionally collect special categories of personal data (such as health information, biometric data or data about criminal convictions) unless provided voluntarily as part of a support, responsible gambling or legal inquiry.

How Personal Data Is Collected

Okitoto collects personal data through the following means:

• Direct provision — information you supply when registering, completing identity verification, making a deposit, requesting a withdrawal or contacting support.
• Automated technologies — session data, IP addresses and device identifiers collected automatically as you interact with the Okitoto platform.
• Payment processors — transaction confirmation data received from DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong and other payment partners when a transaction is processed.
• Identity verification services — confirmation results and risk indicators received from contracted third-party verification providers during KYC checks.

Purposes and Legal Bases for Processing

Okitoto processes personal data only where a lawful basis exists. The primary purposes and corresponding legal grounds are set out below:

Contract Performance

Processing is necessary to manage your Okitoto account, verify identity, process MYR deposits and withdrawals, settle wagers, apply bonuses and provide customer support.

Legal and Regulatory Obligation

Okitoto must process certain data to comply with anti-money laundering obligations, age verification requirements, fraud prevention standards and applicable regulatory duties. This includes retaining transaction records and identity documents for required periods.

Legitimate Interests

Okitoto has legitimate interests in maintaining platform security, detecting and preventing fraud, protecting other players, monitoring for policy breaches and improving the quality of services offered. Processing carried out on this basis is proportionate and does not override your fundamental rights.

Consent

Where Okitoto processes data for optional communications, marketing preferences or non-essential analytical purposes, we will seek your consent. You may withdraw consent at any time by contacting Okitoto support, though withdrawal does not affect the lawfulness of processing that occurred before withdrawal.

Disclosure to Third Parties

Okitoto may share personal data with third parties only in defined circumstances:

• Payment service providers — transaction data is shared with DuitNow, FPX, e-wallet providers and Malaysian banking institutions to process deposits and withdrawals.
• Identity verification processors — name, document images and date of birth are shared with contracted KYC providers to confirm identity and age eligibility.
• Security and fraud prevention services — device, session and transaction data may be shared with contracted services to detect patterns associated with fraud, account compromise or financial crime.
• Legal authorities — Okitoto may disclose data to law enforcement agencies, regulators or courts where required by law, a valid legal order or to protect against imminent harm.
• Group and operational entities — where Okitoto shares infrastructure or compliance functions with related entities, data is shared under binding internal agreements.

All third parties acting as processors are contractually required to handle personal data only for specified purposes, under documented instructions and subject to appropriate security measures. Okitoto does not authorise processors to sell or use player data for their own independent commercial purposes.

Data Retention

Okitoto retains personal data for as long as your account remains active and for such additional periods as are required to meet legal, regulatory, security and operational obligations. Retention periods vary by data category:

• Identity and verification documents — retained for the duration of the account relationship and for a minimum of five years following account closure, in compliance with anti-money laundering record-keeping requirements.
• Transaction records — retained in line with applicable financial record-keeping obligations, generally a minimum of five to seven years.
• Account data and correspondence — retained while the account is open and for a reasonable period following closure to address pending inquiries or disputes.
• Technical and usage data — typically retained for periods sufficient to address security investigations and platform improvement, then deleted or anonymised.

Where no legitimate purpose remains for continued retention, Okitoto will securely delete or anonymise personal data in a manner that prevents reconstruction.

Security Measures

Okitoto applies technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction or disclosure. These measures include:

• Encryption of data in transit via HTTPS and TLS protocols across the Okitoto platform.
• Encryption of sensitive stored data including verification documents and payment references.
• Role-based access controls that restrict data access to personnel with a legitimate operational need.
• System monitoring, logging and intrusion detection to identify and respond to security events.
• Periodic review of security practices in line with evolving standards.

Players are also responsible for maintaining the security of their Okitoto account, including choosing a strong password, not sharing login credentials and reporting any suspected unauthorised access promptly. Okitoto staff will never request your password, banking password or one-time access code.

Cookies and Technical Identifiers

Okitoto may use cookies, session tokens and similar identifiers to enable platform functionality, maintain login sessions, detect fraud and analyse general usage patterns.

Functional Identifiers

Used to maintain your session, remember language and display preferences and provide core platform features. These identifiers are necessary for Okitoto to function and cannot be disabled without affecting availability.

Security Identifiers

Used to detect unusual access patterns, protect account sessions and reduce the risk of unauthorised login. These serve a legitimate security interest and are not used for marketing.

Analytical Identifiers

Where used, analytical tools collect aggregated data about how players interact with Okitoto. This data is used to identify areas for improvement and is not linked to individual player profiles for marketing purposes.

Your Rights

Subject to applicable law, you may exercise the following rights regarding personal data held by Okitoto:

• Access — obtain confirmation that Okitoto processes your data and request a copy of that data.
• Correction — request correction of inaccurate or incomplete personal data held on your account.
• Erasure — request deletion of personal data where no ongoing legal or contractual retention obligation applies.
• Restriction — request that processing be limited while a dispute about accuracy or lawfulness is under review.
• Objection — object to processing based on legitimate interests where your individual circumstances justify a different outcome.
• Portability — receive personal data you have provided in a structured, commonly used format where technically feasible.

To exercise any right, contact Okitoto support with sufficient information to identify your account and the specific request. Okitoto may require identity confirmation before fulfilling a request. Responses will be provided within a reasonable period. Some requests may be declined where compliance would conflict with legal retention requirements or ongoing security investigations.

Persons Below Minimum Age

Okitoto does not knowingly collect personal data from persons below the age of 21. Casino-style online gambling is restricted to adults, and Okitoto uses age verification procedures during registration and KYC review to enforce this requirement.

If Okitoto becomes aware that personal data has been collected from a person below the minimum age, that data will be deleted as soon as reasonably practicable and the account will be closed. A parent or guardian who believes their child has submitted data to Okitoto may contact support to request removal.

Responsible Gambling and Data

Where a player requests self-exclusion, sets deposit limits or contacts Okitoto regarding gambling-related concerns, the resulting records are treated with additional sensitivity. This information is used solely to honour the player's stated preference, prevent re-registration during an exclusion period and facilitate appropriate referrals to support resources where needed.

Responsible gambling records are retained for the duration necessary to enforce a player's chosen restriction and to comply with applicable obligations. They are not used for commercial profiling or shared beyond the scope of the player's protection.

Changes to This Policy

Okitoto may revise this Privacy Policy from time to time to reflect changes in applicable law, operational practices, security standards or the scope of services provided. The effective date at the head of this document indicates when the current version took effect.

Where a revision is material — meaning it affects how your data is used in a way that may be relevant to your decision to continue using Okitoto — we will provide notice through the platform. Continued use of Okitoto following the effective date of a revised Policy constitutes acceptance of that revision.

Contact Us

For questions about this Privacy Policy, to exercise a data subject right or to raise a privacy concern, contact the Okitoto support team. Please include your registered account details and a clear description of your inquiry. Do not include your password, banking password or one-time access code in any communication.