Privacy Policy — Jambitoto

1. Introduction

This Privacy Policy ("Policy") is issued by Jambitoto ("we", "us", "the Operator", "the Platform") and applies to all personal data collected, processed, and stored in connection with your use of the Jambitoto website at jambitoto.cam and all associated products, services, features, and communications.

Jambitoto is committed to protecting the privacy and security of personal information belonging to all members, prospective members, and visitors to our Platform. We operate in accordance with applicable data protection principles, including those consistent with Malaysia's Personal Data Protection Act 2010 (PDPA) and internationally recognised data protection frameworks.

By registering for an account, accessing the Platform, or interacting with our services in any capacity, you acknowledge that you have read and understood this Policy and consent to the collection and use of your personal data as described herein. If you do not agree with any part of this Policy, you should discontinue use of the Platform and contact our support team to arrange account closure.

2. Definitions

For the purposes of this Policy, the following terms shall have the meanings set out below:

• "Personal Data" means any information that relates to an identified or identifiable natural person, including name, identification number, contact details, financial information, and online identifiers.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, alteration, or deletion.
• "Data Controller" means the entity that determines the purposes and means of processing personal data — in this case, the Operator of the Jambitoto platform.
• "Data Processor" means any third party that processes personal data on behalf of the Data Controller under a written agreement.
• "Member" means any individual who has created a registered account on the Jambitoto platform.
• "KYC" means Know Your Customer, being the identity and age verification process required for account activation and withdrawal eligibility.
• "Sensitive Personal Data" means personal data relating to health, biometric identifiers, financial account credentials, or government-issued identification numbers.

3. Data We Collect

3.1 Registration Data

When you create a Jambitoto account, we collect the personal data you provide during the registration process, including your full legal name, date of birth, email address, phone number, and residential address. This data is required to establish your account and verify your eligibility to use the Platform.

3.2 Identity Verification (KYC) Data

To comply with our regulatory and anti-money laundering (AML) obligations, we collect copies of government-issued identity documents (such as your Malaysian MyKad or passport), proof of address documents, and, where required, documentation confirming ownership of your registered payment methods (Touch 'n Go eWallet, Boost, Maybank, CIMB, Public Bank, Hong Leong Bank, RHB, or other methods used).

3.3 Financial Transaction Data

We collect records of all deposits and withdrawals processed through your account, including transaction amounts in MYR, payment method identifiers, transaction timestamps, and reference numbers. This data is retained for regulatory compliance, fraud prevention, and dispute resolution purposes.

3.4 Platform Usage Data

We collect data about how you interact with the Platform, including game session data, betting history, login timestamps, device type, browser type, IP address, and session duration. This data is used to personalise your experience, detect fraud, and improve platform performance.

3.5 Communications Data

If you contact our customer support team via live chat or email, we retain records of those communications, including the content of your enquiry and any information you voluntarily provide during the interaction.

3.6 Summary Table

4. Legal Basis for Processing

We process your personal data on the following legal grounds, consistent with applicable data protection legislation:

• Contractual Necessity: Processing is necessary to perform our contractual obligations to you as a registered Member, including account management, payment processing, and providing access to our services.
• Legal Obligation: Certain processing is required to comply with our obligations under anti-money laundering (AML) regulations, responsible gambling frameworks, and other applicable laws — including the retention of KYC documentation and transaction records.
• Legitimate Interests: We process certain data to protect our Platform from fraud, abuse, and unauthorised access; to improve platform performance and user experience; and to conduct internal analytics that help us serve our members better.
• Consent: Where we rely on your consent to process personal data — for example, for non-essential cookies or optional marketing communications — you may withdraw that consent at any time by contacting our support team or adjusting your account settings.

5. How We Use Your Personal Data

Jambitoto uses the personal data we collect for the following purposes:

• Creating, verifying, and managing your registered account.
• Processing deposits and withdrawals through your chosen payment method (Touch 'n Go eWallet, Boost, GrabPay, DuitNow/FPX, bank transfer, USDT TRC20).
• Verifying your identity and age in compliance with KYC and AML requirements.
• Detecting, preventing, and investigating fraud, money laundering, and platform abuse.
• Personalising your platform experience based on your usage patterns and preferences.
• Communicating with you about your account, including transaction confirmations, security alerts, and support responses.
• Administering and enforcing our responsible gambling framework, including processing self-exclusion requests and deposit limit applications.
• Analysing aggregated, anonymised usage data to improve our platform features and game offerings.
• Complying with our obligations under applicable regulatory and gaming licence frameworks.

6. Data Sharing & Disclosure

We do not sell, rent, or otherwise transfer your personal data to third parties for their own commercial or marketing purposes. We may, however, share your personal data with the following categories of recipients in the circumstances described below:

6.1 Payment Service Providers

To process your deposits and withdrawals, we share necessary transaction data with our payment processing partners, including the operators of Touch 'n Go eWallet, Boost, GrabPay, DuitNow/FPX, and applicable banks (Maybank, CIMB, Public Bank, Hong Leong Bank, RHB). These providers act as data processors under written agreements and are bound by their own privacy and security obligations.

6.2 Identity Verification Services

To fulfil our KYC obligations, we may share identity document data with third-party identity verification service providers who process this data on our behalf under strict confidentiality agreements.

6.3 Regulatory & Law Enforcement Authorities

We may be required by law, court order, or regulatory authority to disclose personal data to competent authorities. Any such disclosure will be made in compliance with applicable legal obligations and, where permitted, we will endeavour to notify you of such a request.

6.4 Game Studio Providers

Our licensed game studio partners may receive limited, anonymised session data (such as game round outcomes and RNG verification data) for game integrity and audit purposes. They do not receive your name, contact details, or payment information.

7. Data Retention

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by our legal, regulatory, and contractual obligations. The following indicative retention periods apply:

Following the expiry of applicable retention periods, personal data is securely deleted or anonymised in accordance with our internal data lifecycle procedures.

8. Data Security

Jambitoto implements a comprehensive range of technical and organisational security measures to protect your personal data against unauthorised access, loss, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL (TLS) encryption for all data transmitted between your browser and our servers.
• Encryption of sensitive data at rest, including KYC documents and payment method identifiers.
• Role-based access controls limiting employee access to personal data on a strict need-to-know basis.
• Multi-factor authentication requirements for internal system access by Platform personnel.
• Regular security audits, vulnerability assessments, and penetration testing conducted by independent security professionals.
• Incident response procedures enabling prompt detection, investigation, and notification of any personal data breach affecting Member accounts.

Despite these measures, no system is completely immune to security risks. You also have an important role to play in protecting your account — please use a strong, unique password, enable two-factor authentication where available, and do not share your login credentials with any third party.

9. Cookies & Tracking Technologies

Jambitoto uses cookies and similar tracking technologies to ensure the proper functioning of our Platform and to improve your experience as a Member. The following types of cookies are used:

• Strictly Necessary Cookies: These are essential for the Platform to function. They include session management cookies that keep you logged in and security tokens that protect against cross-site request forgery (CSRF) attacks. These cookies cannot be disabled.
• Functional Cookies: These allow the Platform to remember your preferences, such as your preferred display language and UI settings, to provide a personalised experience.
• Analytics Cookies: We use privacy-respecting analytics tools to understand how Members navigate and use the Platform. This data is aggregated and anonymised and is used solely to improve platform performance and usability.

You can manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies may impair the functionality of the Platform.

10. International Data Transfers

As an internationally operated platform, Jambitoto may transfer your personal data to servers and service providers located outside Malaysia. Where such transfers occur, we take appropriate measures to ensure that your personal data continues to receive a standard of protection consistent with this Policy, including entering into data processing agreements with all third-party processors that incorporate appropriate safeguards.

Our game studio partners operate streaming and game server infrastructure from various jurisdictions, including Eastern Europe and Southeast Asia. Game round and session data processed by these partners is subject to the data protection terms of our agreements with them and is not used for purposes beyond game operation, integrity verification, and audit.

11. Your Rights Over Your Personal Data

Subject to applicable law and certain regulatory restrictions, you have the following rights in relation to your personal data held by Jambitoto:

• Right of Access: You may request a copy of the personal data we hold about you, together with information about how it is processed.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data we hold about you.
• Right to Erasure: You may request deletion of your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose for which it was collected and no overriding legal obligation requires its retention.
• Right to Restrict Processing: You may request that we limit the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or object to our use of it.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity, you may request a copy of your personal data in a structured, machine-readable format.
• Right to Object: You may object to processing based on legitimate interests. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact our support team using the details in Section 15 of this Policy. We will respond to all valid requests within thirty (30) calendar days.

12. Children & Minors

The Jambitoto platform is strictly for individuals aged 21 years and above. We do not knowingly collect personal data from any person under the age of 21. If we become aware that personal data has been collected from a person under the age of 21 — including through a fraudulently created account — we will immediately close the account, return any real-money balance to the deposit source, and delete all associated personal data from our systems as promptly as is practically and legally possible.

If you believe that a minor may have registered on the Platform using false information, please contact us immediately at the address in Section 15 so that we can investigate and take appropriate action.

13. Third-Party Links & Services

The Jambitoto Platform may contain references to third-party services, including payment providers and game studios. When you interact with a third-party service — for example, when you authenticate a payment through your Touch 'n Go eWallet or Boost app — you will be subject to that third party's own privacy policy and data practices.

Jambitoto is not responsible for the privacy practices, data collection, or security measures of third-party services. We encourage you to review the privacy policies of any third-party services you interact with in connection with your use of the Platform.

14. Changes to This Privacy Policy

Jambitoto reserves the right to update or amend this Privacy Policy at any time. We will notify registered Members of material changes to this Policy via their registered email address or by displaying a prominent notice on the Platform prior to the changes taking effect.

The date of the most recent revision is indicated at the top of this Policy. Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Policy. If you do not agree with the revised Policy, you must cease using the Platform and contact our support team to arrange account closure.

15. Contact & Complaints

If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact our Data Protection team through the following channels:

• Email (plain text): [email protected]
• Live Chat: Available 24/7 via the chat function on the Platform

We aim to acknowledge all privacy-related enquiries within 48 hours and to provide a substantive response within 30 calendar days. Where a request is particularly complex or involves a high volume of data, we will notify you of a revised timeframe within the initial 30-day period.