Privacy Policy

Introduction

This Privacy Policy ("Policy") is issued by pulautoto ("we", "us", "our", "the Company", "the Platform") and describes how we collect, use, process, store, disclose, and protect personal data relating to users ("you", "your", "User") of the pulautoto website located at https://pulautoto.cam and all associated services (collectively, the "Services").

pulautoto is committed to protecting the privacy and personal data of all individuals who interact with our Platform. This Policy has been prepared with reference to applicable personal data protection principles and reflects our commitment to responsible data management as an online betting and live casino operator serving Malaysian players.

This Policy should be read alongside our Terms & Conditions, which govern your use of the Services. By accessing the Platform, creating an account, or otherwise using our Services, you confirm that you have read, understood, and agreed to the terms of this Policy. If you do not agree, please discontinue your use of the Platform immediately.

Definitions

For the purposes of this Policy, the following terms carry the meanings set out below:

Data Controller

pulautoto is the Data Controller responsible for the personal data of Users collected through and in connection with the Platform. As Data Controller, we determine the purposes for which personal data is processed and bear primary responsibility for ensuring that processing is conducted lawfully, fairly, and transparently.

Where we engage third-party Data Processors — including payment service providers such as DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank2u, CIMB Clicks, Public Bank, and Hong Leong Connect, as well as KYC verification providers and analytical tools — we ensure that appropriate data processing agreements are in place that bind those processors to confidentiality and security obligations consistent with this Policy.

For all data protection enquiries, to exercise your rights, or to raise a concern, you may contact our Data Protection team using the details set out in Section 17 of this Policy.

Data We Collect

pulautoto collects the following categories of personal data in the course of providing the Services:

4.1 Identity & Registration Data

• Full legal name as it appears on official identification documents.
• Date of birth (collected for mandatory age verification — all users must be 21 years of age or older).
• Nationality and country of residence.
• Government-issued identification documents, including Malaysian Identity Card (MyKad) number, passport number, or equivalent.
• Profile username and account credentials (passwords are stored in hashed form and are never accessible in plain text).

4.2 Contact Data

• Email address (used for account communications, verification, and marketing where consented).
• Mobile phone number (used for account security, 2FA, and customer support).
• Residential address in Malaysia, including city (e.g., Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam).

4.3 Financial Data

• Payment method details used for deposits and withdrawals, including bank account references, e-wallet identifiers (e.g., Touch 'n Go eWallet, Boost, GrabPay), and FPX/DuitNow transaction references.
• Transaction history, including deposit amounts, withdrawal requests, and net gaming activity, denominated in Malaysian Ringgit (MYR / RM).
• Cryptocurrency wallet addresses where applicable (BTC/USDT users).

4.4 Gaming & Behavioural Data

• Betting history, game participation records, wagering patterns, win/loss records, and session data.
• Responsible gambling tool settings including deposit limits, loss limits, and self-exclusion status.
• Customer support interactions, including live chat transcripts and email correspondence.

4.5 Technical & Device Data

• IP address, device type, operating system, browser type and version.
• Geolocation data derived from IP address for access control and fraud prevention purposes.
• Session logs, login timestamps, and access records.
• Cookie data and similar tracking technologies as described in Section 12.

How We Collect Data

We collect personal data through the following means:

• Directly from you — when you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, respond to a survey, or interact with any feature of the Platform.
• Automatically — through cookies, web beacons, server logs, and analytics tools as you browse and use the Platform. This data is collected passively and does not require any active input from you.
• From third-party sources — including identity verification providers, fraud detection services, and payment processors who may supply additional data to verify your identity, confirm payment method ownership, or identify suspicious activity.
• From publicly available sources — where necessary for compliance, fraud prevention, or due diligence purposes, we may supplement our records with publicly available information.

Data Processing & Purpose

We process your personal data only for specific, documented purposes. The table below summarises the primary processing activities conducted by pulautoto:

Legal Basis for Processing

pulautoto processes personal data on the following legal bases, depending on the nature and purpose of each processing activity:

• Contractual Necessity: Processing required to perform our obligations under the Terms & Conditions, including account management, payment processing, and the provision of gaming services.
• Legal Obligation: Processing necessary to comply with applicable laws and regulatory requirements, including KYC verification, AML obligations, and age restriction enforcement.
• Legitimate Interests: Processing conducted in pursuit of pulautoto's legitimate business interests — including fraud prevention, platform security, and service improvement — where those interests are not overridden by your fundamental rights.
• Consent: For marketing communications and non-essential cookies, we rely on your explicit consent. You may withdraw consent at any time as described in Sections 12 and 15.

Data Sharing & Disclosure

pulautoto does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We share personal data only in the following defined circumstances:

8.1 Service Providers and Data Processors

We engage third-party processors who provide services essential to operating the Platform. These include payment processors (DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank2u, CIMB Clicks, Public Bank, Hong Leong Connect, and cryptocurrency custodians), KYC and identity verification providers, fraud detection and AML screening services, cloud infrastructure and hosting providers, and customer support tools. All processors are bound by data processing agreements that restrict their use of your data to the purpose for which it was provided.

8.2 Legal and Regulatory Disclosure

We may disclose your personal data to regulatory bodies, law enforcement agencies, or courts of competent jurisdiction where we are required to do so by applicable law, court order, or governmental request. Where legally permissible, we will endeavour to notify you of such disclosure.

8.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of pulautoto's business assets, your personal data may be transferred to the acquiring entity as part of that transaction, subject to equivalent data protection commitments.

International Data Transfers

The operation of an online platform necessarily involves the use of technology infrastructure, cloud services, and third-party processors that may be located outside Malaysia. Where personal data is transferred to jurisdictions outside Malaysia, pulautoto takes appropriate measures to ensure that such transfers are conducted in accordance with applicable data protection requirements and that the recipient entity offers an adequate level of protection for your personal data.

Safeguards we apply to international transfers may include contractual clauses binding the recipient to data protection standards, selection of processors operating in jurisdictions recognised as providing adequate data protection, and where appropriate, your explicit consent to the specific transfer.

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our general retention guidelines are as follows:

• Active account data: Retained for the duration of your account's existence on the Platform.
• KYC and identity documents: Retained for a minimum of five (5) years following account closure, or longer where required by applicable AML legislation.
• Transaction and payment records: Retained for a minimum of seven (7) years to comply with financial record-keeping obligations.
• Customer support interactions: Retained for up to three (3) years after the interaction, to support dispute resolution and service quality improvement.
• Marketing consent records: Retained until consent is withdrawn, plus a reasonable period thereafter for audit purposes.
• Self-exclusion records: Retained indefinitely for the purposes of preventing re-registration in breach of an active self-exclusion order.

Following the expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our data destruction procedures.

Security Measures

pulautoto implements comprehensive technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our security infrastructure includes:

• 256-bit SSL/TLS encryption on all data transmitted between your device and the Platform.
• Encrypted storage of sensitive personal data, including identity documents and payment details, at rest.
• Hashed password storage — account passwords are never stored in plain text and cannot be retrieved by pulautoto staff.
• Two-factor authentication (2FA) available and recommended for all Users.
• Role-based access controls ensuring that Platform staff can only access personal data necessary for their specific function.
• Automated fraud detection and anomaly monitoring to identify and respond to suspicious access patterns in real time.
• Regular security audits and penetration testing conducted by qualified information security professionals.

While we maintain rigorous security standards, no online platform can guarantee absolute protection against all threats. You are responsible for maintaining the security of your own Account credentials and for notifying us promptly at [email protected] if you suspect any unauthorised access to your Account.

Cookies & Tracking Technologies

pulautoto uses cookies and similar tracking technologies on the Platform for the purposes described below. A cookie is a small text file placed on your device when you access the Platform. Cookies do not contain executable code and do not give us access to the rest of your device.

12.1 Types of Cookies We Use

12.2 Managing Cookies

You may configure your browser to block or delete cookies at any time. Please note that disabling strictly necessary cookies will affect Platform functionality, and some features may not operate as intended. Instructions for managing cookies are available through your browser's settings or help documentation.

Your Rights

Subject to applicable data protection law, you hold the following rights in respect of your personal data held by pulautoto. You may exercise these rights at any time by contacting us as described in Section 17:

We will respond to all valid rights requests within 30 days of receipt. We may request verification of your identity before processing a request to ensure we are disclosing or modifying data only to the correct individual.

Minors & Age Restriction

pulautoto's Services are strictly restricted to individuals aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. If we become aware that personal data has been submitted by or on behalf of an individual under the age of 21, we will immediately suspend the associated Account, delete the collected data to the extent permitted by our legal obligations, and refund any deposited funds.

As part of our KYC verification process, all Users are required to submit proof of age before accessing full account functionality, including deposits, withdrawals, and gameplay. Providing false age information constitutes a breach of our Terms & Conditions and may result in permanent Account closure and forfeiture of associated balances.

If you are a parent or guardian and believe that a person under 21 in your care has accessed or registered on pulautoto, please contact us immediately at [email protected] so that we may take appropriate action without delay.

Marketing Communications

pulautoto may send you marketing communications relating to promotions, bonuses, new game launches, VIP programme updates, and other Platform news where you have provided your explicit consent to receive such communications at the time of registration or through your Account settings.

You may opt out of marketing communications at any time by:

• Clicking the "unsubscribe" link included in any marketing email we send to you.
• Updating your communication preferences within your Account settings.
• Contacting our support team via live chat or email to request removal from our marketing list.

Opting out of marketing communications will not affect your receipt of essential service communications relating to your Account, transactions, KYC requests, security alerts, or changes to our Terms or this Policy.

Policy Amendments

pulautoto reserves the right to update or revise this Privacy Policy at any time. Where we make material changes to how we process your personal data, we will notify you through one or more of the following means: a prominent notice on the Platform, an email notification to your registered address, or a prompt upon your next login to the Platform.

The "Last Updated" date at the top of this document reflects the date of the most recent revision. We encourage you to review this Policy periodically to remain informed of how we handle your personal data. Your continued use of the Platform following any update constitutes your acceptance of the revised Policy.

Where changes to this Policy require a new legal basis for processing (for example, introducing a new category of processing based on consent), we will obtain that consent separately before commencing such processing.

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by pulautoto, please contact us through the following channels:

• Live Chat: Available 24/7 directly through the Platform in English, Bahasa Melayu, and Mandarin. This is the fastest channel for urgent data queries.
• Email: [email protected] — please include "Privacy Request" in the subject line for data-related enquiries. (Plain text — not a clickable link.)
• Response Times: Live chat responses within 3–5 minutes. Email responses within 5 business days for standard enquiries; within 30 days for formal rights requests.

When submitting a rights request, please provide sufficient information to allow us to identify your Account and verify your identity. We may request a copy of your identification document before processing sensitive requests such as data access or erasure.