Privacy Policy
Wifitoto is committed to protecting your personal data with the same rigour as Malaysia's leading banking platforms. This Privacy Policy explains what we collect, how we use it, and the rights you hold over your information.
How Wifitoto Protects Your Data
These cards summarise the key pillars of our privacy framework. The full legal text below provides complete detail on each point.
Minimal Data Collection
We collect only the personal information strictly necessary to operate your account, process payments via FPX and DuitNow, and fulfil our regulatory obligations. We do not collect data speculatively.
Secure Payment Processing
All financial transactions — including deposits via Maybank, CIMB, Touch 'n Go eWallet, and Boost — are processed through encrypted payment gateways. We do not store full card or bank account numbers on our servers.
No Third-Party Marketing Sales
Your personal data is never sold, rented, or shared with external marketing companies. Data sharing is limited to service providers essential to Platform operation and regulatory bodies as required by law.
Your Data Rights
You have the right to access, correct, and request deletion of your personal data at any time. Requests are processed within 30 business days. Contact our support team to exercise your rights.
Data Retention Policy
Account data is retained for a minimum of 7 years following account closure to meet anti-money laundering and regulatory record-keeping requirements. Data not subject to retention obligations is deleted upon request.
Cookies & Tracking
Wifitoto uses essential and analytical cookies to maintain session security and improve platform performance. We do not use third-party advertising trackers. You can manage cookie preferences through your browser settings.
Introduction
This Privacy Policy ("Policy") is published by Wifitoto ("we", "us", "our"), the operator of the online sports betting and live casino platform accessible at wifitoto.cam. This Policy describes how we collect, use, store, protect, and disclose personal data in connection with your use of the Wifitoto platform and any related services.
We are committed to safeguarding the privacy of our registered players and website visitors. This commitment is reflected in our data handling practices, which are designed to align with the principles of Malaysia's Personal Data Protection Act 2010 (PDPA) and applicable international data protection standards.
Consent: By registering an account, making a deposit, or continuing to use the Wifitoto platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and use of your personal data as described herein.
This Policy should be read together with our Terms & Conditions, which govern the overall contractual relationship between you and Wifitoto.
Definitions
For the purposes of this Privacy Policy, the following terms shall have the meanings ascribed to them below:
- "Personal Data" means any information that relates to an identified or identifiable natural person, including name, identification number, contact details, financial information, and digital identifiers.
- "Processing" means any operation or set of operations performed on personal data, including collection, recording, storage, use, disclosure, and deletion.
- "Data Subject" means the individual to whom the personal data relates — in most cases, a registered Wifitoto player or website visitor.
- "Controller" means Wifitoto, the entity that determines the purposes and means of processing personal data.
- "Processor" means a third-party entity that processes personal data on behalf of Wifitoto under a data processing agreement.
- "KYC Data" means identity verification documentation submitted during the Know Your Customer process, including government-issued identification documents.
- "PDPA" means the Personal Data Protection Act 2010 of Malaysia, which governs the processing of personal data in commercial transactions.
- "Cookies" means small text files placed on your device by the Platform to maintain session state, analyse usage, and improve user experience.
Data We Collect
Wifitoto collects personal data across three primary categories: data you provide directly, data generated automatically through your use of the Platform, and data received from third-party sources in connection with payment processing and identity verification.
| Data Category | Examples | Purpose |
|---|---|---|
| Identity Data | Full legal name, date of birth, MyKad or passport number, nationality | Account registration, KYC verification, age verification |
| Contact Data | Email address, mobile phone number, residential address | Account communications, support, transaction notifications |
| Financial Data | Bank account name, FPX transaction references, DuitNow transfer details, e-wallet identifiers | Deposit processing, withdrawal verification, AML compliance |
| Betting Activity | Bets placed, markets selected, wagering history, winnings and losses | Account management, bonus eligibility, responsible gambling monitoring |
| Technical Data | IP address, device type, browser, operating system, session timestamps | Security monitoring, fraud prevention, platform analytics |
| Communications Data | Live chat transcripts, email correspondence, support ticket content | Customer support, dispute resolution, service improvement |
| KYC Documents | Scanned MyKad, passport, utility bill, bank statement | Identity verification, regulatory compliance, AML/KYC obligations |
How We Collect Your Data
Wifitoto collects personal data through the following channels:
4.1 Direct Collection
Data you provide directly when you register an account, complete the KYC verification process, submit a deposit or withdrawal request, contact customer support, or participate in a promotion. This includes all information entered into registration forms, identity verification uploads, and live chat sessions.
4.2 Automated Collection
Data collected automatically when you access or use the Platform, including your IP address, browser type, device identifiers, session duration, pages visited, bet placement events, and login timestamps. This data is collected through server logs, cookies, and similar tracking technologies.
4.3 Third-Party Sources
Data received from payment processors (including FPX, DuitNow, and e-wallet providers such as Touch 'n Go eWallet and Boost) in connection with the processing of deposits and withdrawals. We may also receive identity verification data from KYC service providers where we engage them to assist with the verification process.
We do not purchase personal data lists from data brokers or marketing companies. All personal data held by Wifitoto is either provided by you directly or collected in the course of your use of the Platform.
Legal Basis for Processing
Wifitoto processes personal data on the following legal bases:
- Contractual Necessity: Processing required to perform our obligations under the Terms & Conditions, including account maintenance, bet settlement, deposit processing, and withdrawal execution.
- Legal Obligation: Processing required to comply with applicable law, including anti-money laundering (AML) regulations, KYC requirements, and regulatory reporting obligations.
- Legitimate Interests: Processing in furtherance of Wifitoto's legitimate business interests, including fraud prevention, platform security, and improving service quality, where such interests are not overridden by your data protection rights.
- Consent: Processing based on your explicit consent, including the use of non-essential cookies and the sending of promotional communications. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.
How We Use Your Data
Your personal data is used for the following purposes:
- Creating and managing your Wifitoto account.
- Verifying your identity and age in accordance with our KYC obligations.
- Processing deposits via FPX, DuitNow, Maybank, CIMB, and supported e-wallets.
- Processing withdrawal requests to your verified bank account or e-wallet.
- Calculating and crediting bonuses, cashback, birthday rewards, and referral earnings.
- Detecting and preventing fraud, money laundering, and prohibited conduct.
- Monitoring betting activity for responsible gambling compliance, including identifying potential problem gambling patterns.
- Providing customer support via live chat and email.
- Sending transactional notifications relevant to your account (deposits confirmed, withdrawals processed, security alerts).
- Sending promotional communications where you have consented to receive them.
- Conducting platform analytics to improve service quality and user experience.
- Complying with our legal and regulatory obligations.
Data Sharing
Wifitoto does not sell, rent, or trade your personal data to third parties for commercial or marketing purposes. We share personal data only in the following circumstances:
7.1 Service Providers
We engage third-party service providers to assist with specific operational functions, including payment processing, identity verification (KYC), IT infrastructure, and customer support technology. These providers are contractually bound to process your data only for the specific purpose for which it was shared and in accordance with this Policy.
7.2 Payment Processors
Transaction data is shared with payment processors (including FPX gateway operators, DuitNow via PayNet, and e-wallet providers such as Touch 'n Go eWallet, Boost, and GrabPay) to the extent necessary to execute the requested transaction. These processors operate under their own privacy policies and are subject to applicable financial regulatory requirements in Malaysia.
7.3 Regulatory and Legal Disclosure
Wifitoto may disclose personal data to government authorities, regulatory bodies, law enforcement agencies, or courts where we are legally obligated to do so, including under anti-money laundering legislation, court orders, or lawful requests from competent authorities. We will notify you of such disclosures where permitted by law.
7.4 Business Transfers
In the event of a merger, acquisition, or sale of all or substantially all of Wifitoto's assets, personal data held by us may be transferred to the acquiring entity. You will be notified via the email address registered to your account prior to any such transfer, and your rights under this Policy will be maintained.
International Data Transfers
Some of Wifitoto's service providers may operate servers or facilities located outside of Malaysia. Where personal data is transferred to a jurisdiction outside Malaysia, we implement appropriate safeguards to ensure that such data continues to receive an adequate level of protection, including the use of contractual data transfer agreements incorporating standard data protection clauses.
Where international data transfers occur, they are limited to jurisdictions with adequate data protection frameworks or are subject to binding contractual protections. We do not transfer personal data to jurisdictions without appropriate safeguards in place.
Data Retention
Wifitoto retains personal data for as long as is necessary to fulfil the purposes described in this Policy and to comply with applicable legal and regulatory obligations. The following retention periods apply:
- Account and Identity Data: Retained for a minimum of 7 years following permanent account closure, in accordance with anti-money laundering record-keeping requirements.
- Financial Transaction Data: Retained for a minimum of 7 years following the relevant transaction, as required by financial regulatory obligations.
- Betting History: Retained for 3 years following account closure, after which it is anonymised or deleted.
- Customer Support Records: Retained for 2 years following resolution of the relevant support case.
- Technical and Log Data: Retained for 12 months from the date of collection, unless required longer for security investigation purposes.
- Marketing Consent Records: Retained for as long as you remain a registered player, or until you withdraw consent.
Upon expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be associated with an identified individual.
Data Security
Wifitoto implements industry-standard technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Our security infrastructure includes:
- Transport Layer Security (TLS): All data transmitted between your browser and our servers is encrypted using 256-bit TLS encryption.
- Data Encryption at Rest: Sensitive personal data stored on our servers is encrypted at rest using AES-256 encryption.
- Access Controls: Access to personal data is restricted to authorised personnel on a strict need-to-know basis, enforced through role-based access controls and multi-factor authentication.
- Security Monitoring: Our systems are continuously monitored for anomalous activity, intrusion attempts, and security incidents.
- Penetration Testing: Regular independent security assessments and penetration tests are conducted to identify and remediate potential vulnerabilities.
- Incident Response: We maintain a documented incident response plan and will notify affected users and relevant authorities of material data security incidents in accordance with applicable law.
Your Responsibility: While we take extensive measures to protect your data, you are responsible for maintaining the security of your account credentials. Please use a strong, unique password, enable two-factor authentication, and never share your login details with any third party.
Your Data Rights
Subject to applicable law and certain statutory exceptions, you have the following rights in relation to your personal data held by Wifitoto. To exercise any of these rights, please contact our support team with your request and sufficient information to verify your identity.
Right of Access
Request a copy of the personal data we hold about you, including the purposes for which it is processed.
Right to Rectification
Request correction of inaccurate or incomplete personal data held in your account.
Right to Erasure
Request deletion of your personal data, subject to our legal retention obligations and ongoing regulatory requirements.
Right to Restriction
Request that we restrict the processing of your data in specific circumstances, such as while we investigate a dispute.
Right to Portability
Request a copy of your personal data in a structured, machine-readable format where processing is based on consent or contract.
Right to Object
Object to processing of your personal data based on legitimate interests, including for direct marketing purposes.
Rights requests will be acknowledged within 5 business days and processed within 30 business days of receipt. We may request additional identity verification before processing a request to ensure the security of your data. Please note that certain rights are subject to limitations where data must be retained to comply with legal obligations.
Cookies & Tracking Technologies
Wifitoto uses cookies and similar tracking technologies to maintain session security, analyse Platform usage, and improve the user experience. The following categories of cookies are used:
- Strictly Necessary Cookies: Essential for the operation of the Platform, including maintaining your logged-in session, processing transactions, and preventing cross-site request forgery. These cookies cannot be disabled without impairing core Platform functionality.
- Analytical Cookies: Used to collect aggregated, anonymised information about how visitors use the Platform, including pages visited, session duration, and navigation paths. This data helps us identify areas for improvement.
- Functional Cookies: Store preferences such as your language settings and display preferences to provide a more personalised experience across sessions.
- Security Cookies: Used to authenticate users, prevent fraudulent use of login credentials, and protect the Platform against automated attacks.
Wifitoto does not use third-party advertising cookies or permit external advertising networks to place tracking cookies on the Platform. You may manage cookie preferences through your browser settings; however, disabling strictly necessary cookies will affect your ability to use the Platform.
Minors
Wifitoto is strictly an adults-only platform. We do not knowingly collect personal data from individuals under the age of 21. Account registration requires affirmative confirmation that you are aged 21 or above, and we verify age as part of our KYC process.
If we become aware that personal data has been inadvertently collected from an individual under the minimum age, we will promptly delete that data and close the relevant account. If you have reason to believe that a minor has registered an account with Wifitoto, please contact us immediately at [email protected].
Amendments to This Policy
Wifitoto reserves the right to amend this Privacy Policy at any time. Material changes will be communicated to registered players via email to the address on file or via an in-platform notification, at least 14 days before the changes take effect. The current version number and effective date are displayed at the top of this page.
Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Policy. If you do not agree to the amended Policy, you may close your account and request deletion of your personal data, subject to our legal retention obligations.
Contact Us
If you wish to exercise your data rights, raise a privacy concern, request a copy of this Policy in an accessible format, or make an inquiry about any aspect of our data handling practices, please contact us using the details below:
- Data Privacy Email: [email protected]
- Subject Line: Please include "Privacy Request" in the subject line of your email
- Live Chat: Available 24 hours, 7 days a week via the Platform interface
- Response Time: Privacy requests acknowledged within 5 business days; resolved within 30 business days
For the security of your data, we will ask you to verify your identity before processing any rights request. Please be prepared to provide the email address associated with your account and, where necessary, a copy of your identity document.
Questions About Your Privacy?
Our support team is available around the clock to address any privacy concerns, data access requests, or account queries. We take your data rights seriously.