Mikototo Privacy Policy — Member Personal Data Protection

1Introduction

Mikototo is an online entertainment platform operating in Malaysia, offering a wide range of games including video slots, Live Casino, fish shooting and sports betting. We care about the privacy of every member who entrusts their personal information to us.

This Privacy Policy describes our practices regarding the collection, processing, storage, and protection of your personal data. This document is drawn up in accordance with the requirements of the Malaysian Personal Data Protection Act (PDPA) 2010, and is updated from time to time to reflect changes in law or our platform practices.

The terms "we", "mikototo" and "Platform" in this document refer to the website operating company mikototo.vin and all services provided through it, including Android and iOS mobile apps. The terms "you", "member", and "user" refer to individuals who register for or use the Mikototo platform's services.

We emphasise that data protection is more than legal compliance — it is a core value of mikototo in building long-term trust with our member community across Malaysia.

2Data We Collect

Mikototo collects your personal data through several channels — primarily during the registration process, daily platform usage and interactions with our customer support team. Below is a summary of the types of data we collect and the purposes for collection:

We only collect data that is strictly necessary for the stated purposes. mikototo does not collect sensitive information such as medical records, religious beliefs or political views unless required by law under very specific circumstances.

3How We Use Your Data

Every piece of data we collect is used for lawful, specific, and transparent purposes. Mikototo does not use your data for purposes unrelated to platform services without obtaining your consent first.

• Identity verification & KYC: Verifying that you are an individual eligible to use the platform in accordance with the defined eligibility criteria.
• Transaction processing: Processing deposits, withdrawals and any financial transactions you carry out through the platform.
• Service provision: Ensuring you can access all games, promotions and platform features that you are eligible for.
• Customer support: Enabling our team to provide accurate and effective assistance whenever you need help.
• Account security: Detecting and preventing unauthorised access, fraud, money laundering and other illegal activities.
• Legal compliance: Fulfilling our obligations under the PDPA, the Anti-Money Laundering Act (AMLA) and other Malaysian financial regulations.
• Platform improvements: Analysing usage patterns in aggregate (not individually) to improve platform performance, interface and overall experience.
• Marketing communications: Sending information about promotions, bonuses and new offers — subject to your subscription preferences.

Mikototo will not make automated decisions that significantly affect you based solely on personal data, without appropriate human involvement.

4Disclosure to Third Parties

Mikototo does not sell or transfer your personal data to third parties for unrelated marketing or commercial purposes. However, there are specific situations where we need to share your data with other parties to enable us to deliver complete services and meet our legal obligations.

• Payment providers: DuitNow, FPX, Touch 'n Go eWallet, Boost, and GrabPay — to securely process your financial transactions. These providers maintain their own privacy policies and security standards, which we ensure are on par with our own.
• Technology service provider: Companies providing server infrastructure, authentication systems, security monitoring software, and platform analytics tools — all bound by strict confidentiality agreements.
• Third-party game providers: Companies such as Pragmatic Play, Evolution Gaming, and other game providers whose software is used on the Mikototo platform.
• Authorities & law enforcement: When required by Malaysian law, court order, or official request from a competent enforcement agency.

5Data Security

Mikototo employs a multi-layered security framework designed to protect your personal data from unauthorised access, loss, damage or disclosure. The key security measures we implement include:

• 256-bit SSL Encryption: All data in transit is protected using the latest TLS/SSL protocols, ensuring no third party can intercept communications between you and our servers.
• Two-factor authentication (2FA): An additional security layer requiring verification via SMS or an authenticator app each time you log in from a new device.
• 24/7 Monitoring: A continuous security monitoring system capable of detecting and responding to cyber threats in real time.
• Internal access controls: Only specifically authorised staff may access member personal data, and every access is recorded in a tamper-proof audit log.
• Regular security testing: Our platform undergoes penetration testing and security audits by independent third parties at least twice a year.
• PCI DSS Standards: All card and payment data processing complies with the strictest Payment Card Industry Data Security Standards (PCI DSS).

6Data Retention Period

Mikototo retains your personal data for as long as necessary to fulfil the original purpose of collection or as required by applicable Malaysian law. The following are our data retention guidelines:

• Active account data: Retained for the duration that your account is active and in use on the mikototo platform.
• Data after account closure: After account closure, core data such as name, identification number, and transaction history is retained for a minimum of seven (7) years to meet Malaysia's financial legislation and AMLA requirements.
• KYC Data: Identity verification documents are retained for the period stipulated by regulatory authorities, typically no less than five (5) years after the business relationship ends.
• Communication logs: Customer support interaction records are retained for three (3) years for reference and dispute resolution purposes.
• Marketing data: Communication preference data is retained until you withdraw consent or request deletion, whichever comes first.

Once the retention period expires, your data will be securely deleted using methods that ensure it cannot be recovered or accessed again by any party.

7Your Rights Under the PDPA

As a Mikototo member in Malaysia, you have certain rights under the Personal Data Protection Act 2010 regarding your personal data. Mikototo respects and facilitates the exercise of all these rights.

To exercise any of the above rights, contact our data protection team via live chat or our support email. We will respond within the timeframe stipulated under the PDPA.

8Cookies & Tracking Technologies

Mikototo uses cookies and similar tracking technologies to enhance the user experience, maintain login session security and understand overall platform usage patterns. The following are the types of cookies we use:

• Essential cookies: Required for core platform functions such as maintaining login sessions, processing transactions, and ensuring security. These cookies cannot be disabled.
• Performance cookies: Collecting information on how you use the platform — most frequently visited pages, time spent and buttons clicked — to help us improve the user experience.
• Functional cookies: Remembering your preferences and settings such as language, preferred betting denomination and interface layout so you do not need to reset them each time you log in.
• Analytics cookies: Using anonymised aggregate data to understand overall usage trends and periodically improve platform performance.

You can manage your cookie settings through your web browser. However, disabling essential cookies may affect the functionality of the mikototo platform. Note: the mikototo mobile app uses local storage technology that functions similarly to cookies in a web browser.

9International Data Transfers

In certain circumstances, your personal data may be processed or stored outside Malaysia — for example, through cloud server infrastructure or international game provider systems we use. When such data transfers occur, mikototo ensures that:

• The recipient country or organisation maintains a level of data protection equivalent to or higher than Malaysia's standards.
• A legally binding data transfer agreement has been signed between Mikototo and the data recipient.
• All data transfers are conducted in accordance with Section 129 of Malaysia's PDPA, which governs the transfer of personal data abroad.
• Transferred data remains protected by encryption both in transit and at rest at the new destination.

We do not transfer sensitive data such as copies of MyKad or KYC documents to overseas servers without clear legal or operational justification. If you wish to learn more about the countries or organisations that receive your data, you may submit a written request to our team.

10Privacy Policy Changes

Mikototo reserves the right to update or amend this Privacy Policy at any time to reflect changes in platform practices, new legal requirements or feedback from our member community. Any significant changes will be communicated to you via:

• In-app notification on the mikototo mobile app at least seven (7) days before the changes take effect.
• Email to the address registered in your account for changes that materially affect your rights.
• A banner or notice displayed during login to ensure you are aware of and have the opportunity to review any changes.

The latest version of this Privacy Policy is always available on this page. The "Last Updated" date at the top of the page reflects the version of the document you are currently reading. Continued use of the Mikototo platform after any amendments take effect constitutes your acceptance of the latest version of this policy.

11Contact Us

If you have any questions, concerns, or complaints regarding this Privacy Policy or the processing of your personal data by Mikototo, we encourage you to contact our team through the following channels:

• Live Chat: Available directly on the Mikototo website platform and mobile app — average response time under three minutes, 24 hours a day, 7 days a week.
• Email: [email protected] — response within 24 hours for all privacy-related inquiries.

For formal complaints related to data protection that cannot be resolved through regular support channels, you may submit a written complaint via the email above with the subject "Privacy Policy Complaints". We are committed to resolving every complaint within 30 calendar days from the date of receipt.

You also have the right to refer personal data protection complaints to Malaysia's Personal Data Protection Department (PDPD) if you believe your rights under the PDPA have been violated.