Ulartoto Privacy Policy – Personal Data Protection for Malaysia Players

1Introduction & Scope of This Policy

Welcome to the Ulartoto Privacy Policy page. This document details how Ulartoto ("Platform", "We", "Company") collects, processes, stores, and protects your personal information ("Personal Data") as a registered member or visitor to our site at ulartoto.im.

This policy is drafted in compliance with the provisions of the Personal Data Protection Act 2010 (PDPA) Malaysia and forms part of Terms & Conditions use of our platform. By registering for or using the Ulartoto platform, you consent to the collection and processing of your personal data as described in this policy.

This privacy policy covers all Ulartoto platforms, including the website, mobile interface, and all related services. It does not cover third-party websites or services that you may access via external links.

2Personal Data We Collect

Ulartoto collects various types of information depending on how you interact with our platform. The following are the categories of data we collect:

We do not collect sensitive data such as medical records, religious beliefs, or political views. All financial data is processed through secure Malaysian local payment methods, including Touch 'n Go eWallet, DuitNow, GrabPay, Boost, ShopeePay, and FPX online banking via Maybank2u and CIMB Clicks.

3Purpose of Data Collection and Use

Ulartoto uses your personal data for the following purposes, all of which are lawful under Malaysia's PDPA:

• Account Management: Creating, verifying, and managing your member account, including the required KYC (Know Your Customer) process.
• Transaction Processing: Securely processing deposits and withdrawals via Touch 'n Go eWallet, DuitNow, GrabPay, and other accepted Malaysian payment methods.
• Service Provision: Enabling you to access all games and betting options available on Ulartoto, including slots, live casino, baccarat, roulette, sports, and e-sports.
• Security & Fraud Prevention: Detecting and preventing fraudulent activity, money laundering, and security breaches.
• Customer Support: Providing effective technical support and customer service when needed.
• Legal Compliance: Meeting applicable legal and regulatory obligations, including anti-money laundering (AML) requirements.
• Service Communications: Sending transaction notifications, security updates, and important service information.
• Marketing (with consent): Sending promotions, bonus offers, and new product information — only if you have given your explicit consent.

4Sharing Data with Third Parties

Ulartoto does not sell your personal data. However, we may share certain information with the following parties under limited and controlled circumstances:

• Payment Service Providers: Malaysian e-wallet and online banking providers (Touch 'n Go, DuitNow, GrabPay, Boost, ShopeePay, FPX) to process your financial transactions.
• Game Providers: Live casino game studios and third-party software providers required to deliver games on our platform.
• Security Services: Cybersecurity and fraud prevention companies that help us protect our platform and members.
• Regulatory Authorities: Law enforcement agencies or authorised regulatory bodies in Malaysia when required by law or court order.

All third parties who receive your data are required to sign strict data protection agreements and are only permitted to use that data for agreed purposes. They are not allowed to share your data further without Ulartoto's authorisation.

5Data Security Measures

Ulartoto continuously invests in the latest security technologies and procedures to safeguard your personal data. The protective measures we implement include:

• 256-bit SSL Encryption: All data transmitted between your device and our servers is encrypted using 256-bit TLS/SSL protocols.
• Static Data Encryption: Data stored in our databases is encrypted using AES-256 standards.
• Two-Factor Authentication (2FA): An additional security layer for account login that all members can enable.
• 24/7 Monitoring: Threat detection and security monitoring systems operate around the clock.
• Strict Access Controls: Only authorised personnel who have passed a strict verification process may access user data.
• Regular Security Audits: Independent security assessments are conducted periodically by third-party experts.
• Secure Data Backup: Data backups are performed automatically with full encryption to prevent data loss.

6Data Retention Period

Ulartoto retains your personal data only for as long as it is needed for the original purpose of collection or as required by law. Our data retention guidelines are as follows:

• Active Account Data: Retained for as long as your Ulartoto account remains active.
• Financial Transaction Data: Retained for a minimum of 7 years from the transaction date in accordance with Malaysian legal requirements on financial records and AML.
• KYC Data: Retained for 5 years following account closure or the end of the business relationship.
• Technical Logs: Typically retained for 12 months before being deleted or anonymised.
• Support Communication Data: Retained for 3 years for reference and service improvement purposes.

Once the retention period expires, your data will be securely deleted or fully anonymised so that it can no longer be identified as yours.

7Your Rights as a Data Subject

Under Malaysia's PDPA, you have the following rights regarding your personal data held by Ulartoto:

To exercise any of the rights above, please contact us at support@ulartoto.im with the subject line "Data Rights Request". We will respond within 14 working days. We may need to verify your identity before processing your request.

8Cookie & Tracking Technology Policy

Ulartoto uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device. The following are the types of cookies we use:

You can manage your cookie settings through the panel above or via your web browser settings. Please note that disabling essential cookies may affect the functionality of the Ulartoto platform.

9Cross-Border Data Transfers

In the course of our operations, your personal data may be processed or stored on servers located outside Malaysia. This occurs primarily when we utilise cloud infrastructure services or international game providers.

In all cases of cross-border data transfers, Ulartoto ensures that:

• The recipient country or entity maintains data protection standards equivalent to or stricter than Malaysia's PDPA requirements.
• Appropriate contractual agreements have been signed to ensure adequate data protection.
• Data transfers are carried out only for legitimate purposes necessary to deliver our services.
• All transferred data remains subject to this privacy policy and Ulartoto's security standards.

10Changes to This Privacy Policy

Ulartoto reserves the right to update or modify this privacy policy from time to time to reflect changes in our business practices, legal requirements, or other operational needs.

When we make material changes to this policy, we will:

• Updating the "Updated" date at the top of this document.
• Notifying all members via their registered email.
• Displaying a prominent notice on the Ulartoto platform for a minimum period of 30 days.

Your continued use of the Ulartoto platform after any changes take effect will be considered your acceptance of the updated policy. We encourage you to review this page periodically to stay informed about how we protect your data.

11Contact Our Data Protection Officer

If you have any questions, concerns, or complaints regarding how Ulartoto handles your personal data, or if you wish to exercise any of your rights as a data subject, please contact our Data Protection Officer (DPO) through the following channels: