Ulartoto Privacy Policy – Malaysian User Data Protection

1 Information We Collect

To provide a smooth, secure, and responsible service, ulartoto collects several categories of information from our users. This information is divided into three main categories:

Data Categories	Examples of Information	Primary Purpose
Identity Data	Full name, date of birth, ID card number, KYC selfie photo	Identity verification & legal compliance
Contact Data	Email address, phone number, residential address	Account communications & notification delivery
Financial Data	Bank account number, e-wallet details, transaction records	Deposit & withdrawal processing
Technical Data	IP address, device type, web browser, access logs	Account security & fraud detection
Usage Data	Wagering records, games played, session duration	Responsible gaming & personalized recommendations

We do not collect sensitive information such as biometric data, religious beliefs, or medical records, unless specifically required by applicable law.

2 How We Use Your Data

Collected data is used solely for legitimate purposes directly related to the delivery of ulartoto services. Specifically, we use your information to:

• Managing your account — registration, secure login, and profile management.
• Processing financial transactions — deposits, withdrawals, and financial transaction history.
• KYC and AML compliance — fulfilling Know Your Customer and anti-money laundering requirements in accordance with applicable regulations.
• Platform security — detecting suspicious activity, fraud attempts, and unauthorised access.
• Customer Support — enabling our team to assist you more effectively whenever an issue arises.
• Platform improvements — analysing aggregated usage patterns to improve the user experience.
• Responsible gaming — monitoring gameplay patterns to identify early signs of problem gambling.
• Marketing communications — sending relevant promotions and offers, only if you have given your consent.

3 Basis for Data Processing

All personal data processing by ulartoto is carried out based on at least one of the following legal bases:

• Contract fulfillment — processing required to deliver the services you requested through account registration.
• Legal obligations — data required to comply with KYC, AML, and applicable financial regulatory requirements.
• Legitimate interests — processing for platform security, fraud prevention, and service improvement purposes.
• Consent — marketing communications and personalised recommendations sent only when you have actively opted in to receive them.

4 Data Sharing with Third Parties

Ulartoto does not sell your personal data to any party. However, in certain circumstances, we may share your data with the following parties:

• Payment service providers — FPX gateways, e-wallet operators, and banks that process your transactions. They are bound by strict confidentiality agreements.
• Game software provider — third-party game content providers that require minimal session information to operate the games.
• Cloud infrastructure provider — cloud computing services that store data in a secure, encrypted environment.
• Competent authorities — data is disclosed to authorities only when required by a court order or applicable legislation.

5 Data Retention Period

We retain your personal data for as long as your account is active or as long as necessary to provide our services. Following account closure:

• Financial and transaction data retained for 7 years in accordance with financial and tax compliance requirements.
• KYC Documents retained for 5 years after account closure in accordance with AML regulations.
• Support communication logs retained for 2 years for dispute resolution purposes.
• Technical data and access logs retained for 12 months for security purposes.

Once the retention period ends, your data will be securely deleted or anonymized so it can no longer be linked to you.

6 Data Security Measures

Ulartoto invests seriously in security infrastructure to ensure your data is always protected. The measures we implement include:

• Data encryption during transmission using TLS 1.3 and a 256-bit SSL certificate.
• Data stored in the database is encrypted using AES-256.
• Two-factor authentication (2FA) for staff access to internal systems.
• Regular penetration testing by independent security auditors.
• 24/7 system monitoring to detect anomalies and security threats in real time.
• A comprehensive incident response plan to address any data breach promptly.

7 Your Rights as a Data Owner

As an ulartoto member, you have the following rights regarding your personal data. You may submit any requests relating to these rights through our customer support team:

8 Cookies & Tracking Technologies

Ulartoto uses cookies and similar tracking technologies to enhance the user experience and ensure platform security. The types of cookies we use are:

• Essential Cookies — required for core platform functions such as login, session management, and security. Cannot be disabled.
• Performance Cookies — collecting information on how you use the platform to help us improve our services. All data is aggregated and anonymised.
• Functional Cookies — saving your preferences such as language and display settings for a more convenient experience.
• Marketing Cookies — used to display relevant advertisements. You may opt out of these cookies through your browser settings.

You can manage cookie settings through your web browser at any time. However, disabling essential cookies may affect platform functionality.

9 Cross-Border Data Transfers

As an international platform, your data may be processed or stored on servers located outside Malaysia. When this occurs, we ensure:

• The destination country or region provides a level of data protection equivalent to Malaysia standards.
• Appropriate data processing agreements have been signed with all involved service providers.
• Data encryption is maintained throughout the transfer process to prevent unauthorized access.

10 Changes to This Privacy Policy

Ulartoto reserves the right to amend this privacy policy from time to time to reflect changes in our business practices, legal requirements, or the technologies we use. When material changes are made:

• We will display a clear notice on the platform's main page for at least 14 days before the changes take effect.
• Email notifications will be sent to all registered members regarding significant changes.
• The "Updated" date at the top of this document will be revised to reflect the latest version.

Continued use of the ulartoto platform after any change takes effect will be considered your acceptance of the amended privacy policy.

11 Contact Us Regarding Privacy

If you have any questions, concerns, or wish to submit a request regarding your personal data, please contact our Data Protection Officer (DPO) team through the following channels:

You can also reach us via the live chat available on the ulartoto platform, 24 hours a day, 7 days a week. We are committed to addressing every privacy-related enquiry seriously and within the stipulated timeframe.