Privacy Policy

Introduction

This Privacy Policy ("Policy") is published by bociltoto ("bociltoto", "we", "us", or "our"), the operator of the online casino and sports betting platform available at bociltoto.cam. This Policy sets out the basis on which we collect, use, store, share, and otherwise process personal data relating to registered users, visitors, and prospective users of the Platform ("you" or "the User").

Bociltoto is committed to handling your personal data with transparency, integrity, and respect. We collect only the data that is necessary to provide our services to you, and we do not use it for any purpose beyond what is described in this Policy.

By registering an account, accessing the Platform, or continuing to use our services after any update to this Policy, you acknowledge that you have read and understood its contents. If you do not agree with any part of this Policy, you should discontinue use of the Platform and request account closure.

Definitions

The following definitions apply throughout this Privacy Policy:

Personal Data We Collect

3.1 Registration Data

When you create an account on bociltoto, we collect the following information:

• Full legal name;
• Date of birth (to verify that you are aged 21 or above);
• Email address;
• Residential address, including city, state, and postcode;
• Username and encrypted password (passwords are never stored in plain text);
• Mobile phone number (used for two-factor authentication and account security).

3.2 KYC Verification Data

To comply with our licensing obligations and to verify your identity prior to processing withdrawals, we may collect:

• Scanned copy or photograph of your Malaysian National Identity Card (MyKad), passport, or other government-issued photo identification;
• Proof of residential address (utility bill, bank statement, or official correspondence dated within 90 days);
• Selfie photograph or live facial verification image for identity matching purposes;
• Documentation confirming ownership of payment methods registered on the account.

3.3 Financial and Transaction Data

We collect and process transaction data associated with your use of the Platform, including:

• Deposit and withdrawal amounts, dates, and methods used (e.g., Touch 'n Go eWallet, Maybank, CIMB, DuitNow, FPX, BTC, USDT);
• Account balance history;
• Bonus credits claimed and wagering activity associated with promotional offers;
• Partial payment method identifiers (e.g., last four digits of a bank account number) — we do not store full bank account numbers.

3.4 Gameplay and Betting Data

We maintain records of your gaming and betting activity on the Platform, including: game sessions played, bet amounts, outcomes, RTP history, sports betting selections across Liga Super Malaysia, EPL, UFC and other markets, and session duration. This data is used to personalise your experience, calculate VIP tier eligibility, and identify indicators of problem gambling behaviour.

3.5 Technical and Device Data

When you access the Platform, we automatically collect:

• IP address and geolocation data (city/region level);
• Device type, operating system, and browser version;
• Session timestamps and duration;
• Referring URL and on-Platform navigation path;
• Crash reports and error logs for technical support and platform stability purposes.

3.6 Communications Data

If you contact our support team via live chat or email, we retain records of those communications — including the content of messages exchanged — for a period of up to five years for quality assurance, dispute resolution, and regulatory compliance purposes.

How We Collect Your Data

Bociltoto collects Personal Data through the following means:

• Directly from you: Information you provide when registering, completing KYC, making deposits or withdrawals, contacting support, or participating in promotions;
• Automatically: Technical and device data collected through cookies, server logs, and analytics tools as you interact with the Platform;
• From third-party service providers: Identity verification results from KYC technology partners; fraud-screening outcomes from payment processors; and AML risk assessments from compliance service providers;
• From payment processors: Transaction confirmation and payment status data from Malaysian payment gateways including DuitNow, FPX, and e-wallet operators.

Purposes of Data Processing

Bociltoto processes your Personal Data for the following purposes:

Legal Basis for Processing

Bociltoto processes your Personal Data on one or more of the following legal bases, depending on the specific purpose of processing:

• Performance of a contract: Processing necessary to provide the gaming and betting services described in our Terms & Conditions, including account management, deposit and withdrawal processing, and delivery of promotional offers you have opted into;
• Legal obligation: Processing required to comply with our international licensing conditions, including KYC verification, AML screening, responsible gambling monitoring, and regulatory reporting;
• Legitimate interests: Processing necessary for fraud prevention, platform security, and abuse detection, where such interests are not overridden by your fundamental privacy rights;
• Consent: Processing for marketing and promotional communications, which is conducted only where you have provided clear, affirmative consent and which may be withdrawn at any time.

Data Sharing and Disclosure

Bociltoto does not sell your Personal Data. We share your data only in the following circumstances, and only to the extent strictly necessary:

• Payment processors and banking partners: Transaction data is shared with payment service providers — including Touch 'n Go eWallet, Boost, GrabPay, FPX operators, Maybank, CIMB, Public Bank, Hong Leong, DuitNow, and cryptocurrency network operators — solely to process your deposits and withdrawals;
• Identity verification providers: KYC documents and biometric verification data are shared with third-party identity verification technology providers for the sole purpose of conducting mandatory age and identity checks;
• Fraud prevention and AML service providers: Transaction and behavioural data may be processed by specialist compliance service providers to detect and prevent financial crime, in accordance with our licensing obligations;
• Game technology providers: Session and wager data is transmitted to game studios and live dealer platform operators solely to enable delivery of gaming services;
• Regulatory and law enforcement authorities: Where required by applicable law, licensing conditions, or a valid legal process (such as a court order), bociltoto may disclose Personal Data to relevant regulatory or law enforcement bodies;
• Business successors: In the event of a merger, acquisition, or asset transfer, your Personal Data may be transferred to a successor entity, subject to equivalent data protection obligations.

Cookies & Tracking Technologies

The bociltoto Platform uses cookies and similar tracking technologies to operate core platform functions, improve user experience, and gather anonymised analytics data. The following categories of cookies are used:

• Strictly necessary cookies: Required for the Platform to function correctly, including maintaining your login session, remembering your language and currency settings, and enabling the gaming lobby to load. These cannot be disabled without impacting core functionality;
• Analytics cookies: Used to collect anonymised information about how users interact with the Platform — such as which games are most popular, how long sessions last, and how users navigate between pages. This helps us improve the Platform over time;
• Functional cookies: Remember your preferences (such as preferred payment method or display settings) to personalise your experience on return visits;
• Security cookies: Support fraud detection and account security functions, including identifying unusual access patterns.

You may adjust your browser settings to refuse or delete cookies. Please note that disabling strictly necessary cookies may affect your ability to use certain features of the Platform, including account login and gameplay.

Data Retention

Bociltoto retains your Personal Data for as long as necessary to fulfil the purposes described in this Policy, subject to the following retention parameters:

• Active accounts: Personal and transaction data is retained for the full duration of your account's active status plus a period of five (5) years following account closure, to meet regulatory record-keeping obligations;
• KYC documentation: Identity documents are retained for a minimum of five (5) years from the date of verification or account closure (whichever is later) in accordance with AML regulatory requirements;
• Support communications: Records of customer support interactions are retained for five (5) years for dispute resolution and quality assurance purposes;
• Marketing preferences: Marketing consent records are retained until you withdraw consent and for a period thereafter sufficient to demonstrate compliance with consent obligations;
• Technical logs: Server logs and session data are retained for up to twelve (12) months for security monitoring and platform performance analysis.

Upon expiry of the applicable retention period, data is securely deleted or anonymised so that it can no longer be associated with an individual user.

Data Security

Bociltoto employs a comprehensive set of technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure:

• Transport Layer Security (TLS): All data in transit between your device and our servers is encrypted using current TLS protocols;
• Data encryption at rest: Sensitive stored data, including KYC documents and payment identifiers, is encrypted using AES-256 encryption;
• Access controls: Access to Personal Data is restricted to authorised personnel on a strict need-to-know basis, enforced through role-based access controls and multi-factor authentication;
• Network security: Our infrastructure is protected by firewalls, intrusion detection systems, and regular security assessments;
• Password security: User passwords are hashed using industry-standard cryptographic algorithms. We do not store passwords in retrievable plain text;
• Incident response: Bociltoto maintains a documented data breach response procedure. In the event of a material breach affecting your data, we will notify you in accordance with our regulatory obligations.

Your Data Rights

As a user of the bociltoto Platform, you have the following rights with respect to your Personal Data. To exercise any of these rights, contact our support team at the details listed in Section 15:

Bociltoto will respond to valid data rights requests within 30 days of receipt. In complex cases, this period may be extended by a further 60 days, in which case we will notify you of the extension and the reason for it. We may be required to verify your identity before processing a rights request.

Please note that certain rights are subject to limitations where processing is required by law — for example, KYC and AML records cannot be deleted while applicable retention obligations remain in force.

Children and Minors

The bociltoto Platform is strictly for users aged 21 years and above. We do not knowingly collect, process, or store Personal Data relating to individuals under this age. If we discover that an account has been registered by a person under 21, we will immediately suspend the account, delete the associated personal data (except where retention is required by regulation), and forfeit any associated funds in accordance with our Terms & Conditions.

Parents and guardians who believe their child may have registered an account on bociltoto should contact our support team immediately at the contact details provided in Section 15 so that prompt action can be taken.

International Data Transfers

Bociltoto operates as an internationally licensed platform. As a result, your Personal Data may be processed by third-party service providers whose operations are located outside Malaysia — including in Europe, Singapore, or other jurisdictions where game studio operators, KYC technology providers, and payment infrastructure partners are based.

Where such transfers take place, bociltoto takes steps to ensure that appropriate safeguards are in place to protect your data to a standard equivalent to that described in this Policy. These safeguards may include contractual data processing agreements with third parties that impose equivalent obligations to those applicable under recognised international data protection frameworks.

Updates to This Privacy Policy

Bociltoto reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal requirements, or platform services. When material changes are made, we will provide notice to registered users via email notification or a prominent notice on the Platform, at least 14 days prior to the changes taking effect.

The date of the most recent update is displayed at the top of this document. Your continued use of the Platform following the effective date of any amendment constitutes your acknowledgement of the updated Policy. If you disagree with any changes, you should cease using the Platform and request account closure.

Contact Us

For any queries, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data by bociltoto, please contact our Data Support team using the following details:

• Email: [email protected] — plain text, do not click
• Live Chat: Available 24/7 via the Platform — average response under 90 seconds
• Subject line for data requests: Please use "Data Rights Request — [Your Account ID]" to ensure your request is routed directly to the appropriate team.

We aim to acknowledge all Privacy Policy queries within 48 hours of receipt, and to resolve data rights requests within 30 days as described in Section 11. Our support team is available around the clock, including Malaysian public holidays.

For concerns relating to responsible gambling and how bociltoto processes behavioural data to support player welfare, please also visit our Responsible Gambling page.