Privacy Policy

This Privacy Policy (hereinafter "the Policy" or "this Policy") is issued by Lektoto (hereinafter "Lektoto," "the Company," "we," "us," or "our") and applies to all users (hereinafter "User," "you," or "your") who access, register on, or otherwise interact with the Lektoto online betting and gaming platform accessible at lektoto.cam, including any associated mobile applications or services (collectively, "the Platform").

Lektoto respects your privacy and is committed to protecting your personal data. This Policy sets out, in plain and accessible language, what personal information we collect about you, the purposes for which we process it, the legal bases on which we rely, how long we retain it, and the rights you hold in relation to your personal data.

By registering an account, depositing funds, or otherwise using the Lektoto Platform, you acknowledge that you have read and understood this Policy. This Policy should be read alongside our Terms & Conditions and our Responsible Gambling Policy.

For the purposes of this Privacy Policy, the following terms have the meanings set out below:

• Personal Data — Any information that identifies or can reasonably identify a living individual, directly or indirectly. Examples include your name, email address, date of birth, Malaysian identity card number, IP address, and device identifiers.
• Processing — Any operation performed on personal data, including collection, recording, storage, use, disclosure, transmission, erasure, or destruction.
• Data Controller — The entity that determines the purposes and means of processing personal data. For the purposes of this Policy, Lektoto is the Data Controller in respect of personal data collected from Platform users.
• Data Processor — A third party that processes personal data on behalf of the Data Controller under a contractual obligation, such as a payment processing partner or cloud hosting provider.
• Consent — A freely given, specific, informed, and unambiguous indication of agreement by which you signify acceptance of personal data processing for one or more specific purposes.
• KYC — Know Your Customer. Identity and address verification required by our licensing and anti-money-laundering compliance obligations.
• Cookies — Small text files placed on your device when you access the Platform, used for authentication, preferences, analytics, and security purposes.

Lektoto collects the categories of personal data described below. The specific data collected varies depending on how you interact with the Platform and the services you use.

4.1 Directly From You

The majority of personal data we hold about you is collected directly from you through: your account registration form; KYC document submission; deposits, withdrawal requests, and payment method registrations; live chat, email, and other support interactions; responses to surveys or promotional communications; and your voluntary use of responsible gambling tools such as deposit limits or self-exclusion requests.

4.2 Automatically

When you access the Platform, we automatically collect technical and usage data through server logs, cookies, web beacons, and similar tracking technologies. This data is collected regardless of whether you are logged into your account. See Section 8 for more detail on our use of cookies.

4.3 From Third Parties

We may receive personal data about you from third parties in the following circumstances:

• Payment processors: Transaction reference data from payment services including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, and Hong Leong, as well as cryptocurrency network confirmations;
• Identity verification providers: Results of identity and document checks conducted by our KYC compliance partners;
• Fraud prevention agencies: Risk signals and fraud indicators from third-party anti-fraud services;
• Regulatory or law enforcement bodies: Where we receive legal requests or are subject to regulatory inquiries.

Lektoto processes your personal data on one or more of the following legal bases, depending on the purpose:

• Contractual Necessity: Processing required to perform our contract with you — for example, operating your account, processing deposits and withdrawals, and providing access to betting and gaming services;
• Legal Obligation: Processing required to comply with legal requirements, including anti-money laundering (AML) regulations, KYC obligations, responsible gambling mandates under our operating licence, and responses to lawful authority requests;
• Legitimate Interests: Processing necessary for purposes of fraud prevention, platform security, network and information security, improving our services, and direct marketing of similar products and services where you have not opted out;
• Consent: Where we have obtained your specific, informed consent for a processing activity — for example, sending you promotional communications by email or SMS. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Lektoto uses the personal data we collect for the following purposes:

• Account management: Creating, maintaining, and managing your registered Lektoto account, including processing deposits, withdrawals, and wagers;
• Identity verification: Conducting KYC checks to verify your identity, age (21+ requirement), and the legitimacy of your payment methods, as required by our operating licence;
• Fraud prevention and security: Detecting, preventing, and investigating fraudulent activity, money laundering, account takeovers, and other prohibited conduct on the Platform;
• Regulatory compliance: Meeting our anti-money laundering, responsible gambling, and licensing obligations, including filing mandatory reports with regulatory authorities where required;
• Customer support: Responding to your enquiries, resolving disputes, and managing your support interactions across English, Bahasa Melayu, and Mandarin channels;
• Service improvement: Analysing Platform usage patterns to improve features, fix bugs, personalise your experience, and develop new products;
• Marketing communications: Sending you relevant promotional offers, bonus notifications, and updates about new features, subject to your marketing preferences and applicable opt-out rights;
• Responsible gambling: Monitoring betting patterns for signs of problem gambling behaviour and facilitating the use of responsible gambling tools including deposit limits and self-exclusion.

We may share your personal data with the following categories of third parties, strictly for the purposes described in this Policy:

• Payment service providers: Including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, and cryptocurrency network processors, for the purpose of processing your deposits and withdrawals;
• KYC and identity verification partners: Third-party providers engaged to verify your identity and documents as part of our compliance programme;
• Cloud hosting and infrastructure providers: Secure server and cloud infrastructure providers who process data on our behalf under strict data processing agreements;
• Fraud prevention services: Anti-fraud and risk management service providers who help us detect and prevent fraudulent activity;
• Regulatory and law enforcement authorities: Where we are legally required to disclose data in response to a court order, regulatory request, or law enforcement demand;
• Professional advisers: Including lawyers, auditors, and compliance consultants, subject to obligations of confidentiality.

All third parties with whom we share personal data are required to process it in accordance with applicable data protection principles and under contractual obligations that provide equivalent protections to those set out in this Policy.

8.1 What Cookies We Use

The Lektoto Platform uses the following categories of cookies and similar tracking technologies:

• Strictly Necessary Cookies: Essential for the Platform to function — including session authentication, security tokens, and fraud detection. These cannot be disabled without impairing basic Platform functionality;
• Performance & Analytics Cookies: Used to collect anonymised data about how users navigate the Platform, which pages are most visited, and where users encounter errors. This data helps us improve Platform performance;
• Functionality Cookies: Store your preferences such as language selection, currency display, and responsible gambling tool settings to improve your experience on return visits;
• Marketing Cookies: Where you have provided consent, used to track your engagement with promotional communications and to present relevant bonus offers based on your usage patterns.

8.2 Managing Cookies

You can manage and delete cookies through your browser settings at any time. Please note that disabling certain categories of cookies may affect the functionality or security features of the Platform. Strictly necessary cookies cannot be disabled without preventing Platform use.

Lektoto retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Account and identity data: Retained for the duration of your active account relationship with Lektoto, and for a minimum of five (5) years following account closure, in accordance with anti-money laundering regulatory requirements;
• Financial and transaction data: Retained for a minimum of seven (7) years from the date of each transaction, in line with financial record-keeping obligations;
• KYC verification documents: Retained for the period required by our operating licence and applicable AML regulations, typically five (5) years from account closure;
• Customer support communications: Retained for two (2) years from the date of each interaction, unless longer retention is required in connection with an open dispute;
• Marketing preferences and consent records: Retained for the duration of any active consent and for a reasonable period thereafter as evidence of consent status.

At the end of each applicable retention period, personal data is securely deleted or anonymised in accordance with our data destruction procedures.

Lektoto implements a multi-layered technical and organisational security framework to protect your personal data against unauthorised access, accidental loss, disclosure, alteration, or destruction. Our security measures include:

• Transport Layer Security (TLS): All data transmitted between your device and Lektoto servers is encrypted using 256-bit TLS encryption (HTTPS). The presence of a valid SSL certificate can be verified via the padlock icon in your browser's address bar when accessing lektoto.cam;
• At-rest encryption: Sensitive personal data stored on our servers is encrypted at rest using industry-standard encryption algorithms;
• Access controls: Access to personal data is strictly limited to authorised Lektoto personnel and third-party processors on a need-to-know basis. All access is logged and audited;
• Two-factor authentication: Lektoto offers and strongly recommends 2FA for all user accounts to protect against unauthorised access;
• Regular security audits: Lektoto commissions periodic third-party penetration testing and security audits to identify and remediate vulnerabilities;
• Payment tokenisation: Payment data is processed via tokenised flows, meaning Lektoto does not store full payment credentials on its own servers.

Subject to applicable law, you have the following rights in relation to the personal data that Lektoto holds about you. To exercise any of these rights, please contact our Data Protection team via the contact details in Section 15.

We will not charge a fee to process data rights requests in ordinary circumstances. Where requests are manifestly unfounded or excessive, we reserve the right to charge a reasonable administrative fee or decline the request, with reasons provided.

Lektoto is an internationally operating platform. As a result, your personal data may be transferred to and processed in countries outside of Malaysia, including the jurisdiction in which Lektoto's licensing authority is based and the locations of our cloud infrastructure and third-party service providers.

Where personal data is transferred to countries that do not provide an equivalent level of data protection to the jurisdiction in which you reside, Lektoto takes appropriate safeguards to ensure your data remains protected. Such safeguards may include contractual clauses equivalent to data protection standards, binding corporate rules, or reliance on applicable adequacy decisions.

Where Lektoto discovers or has reasonable grounds to believe that a registered account belongs to a person under the age of 21, that account will be immediately suspended. Any deposits made will be returned to the verified payment source following applicable verification, and no winnings accumulated during the period of underage use will be paid out.

If you have reason to believe that a minor has registered an account on the Lektoto Platform, please contact our support team immediately at [email protected] (plain text — not a link) so that we can investigate and take appropriate action.

Lektoto reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory requirements, or the nature of our Platform services.

Where any amendment is material — meaning it significantly affects how we process your personal data or the rights you hold — we will provide advance notice of the change via email to your registered email address and/or via a prominent notice displayed on the Platform, at least 14 days before the changes take effect.

The most current version of this Privacy Policy will always be accessible at lektoto.cam/privacy-policy. The "Effective Date" and "Last Reviewed" dates at the top of this document will be updated accordingly. Your continued use of the Platform after any amendment takes effect constitutes your acknowledgement of the updated Policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or the personal data Lektoto holds about you, you may contact us through the following channels. All data rights requests should be directed to the Data Protection contact below and will be acknowledged within 5 business days.