How Fulltoto Collects, Uses, and Protects Your Personal Data

1. Introduction

This Privacy Policy describes the data-processing activities of Fulltoto in connection with the Fultoto website and player account services. Fulltoto operates under international licensing arrangements and is not regulated by any Malaysian government authority. References to MYR, Malaysian payment brands, Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, and Shah Alam reflect the practical service context for Malaysian-based players and do not imply local regulatory oversight.

Fulltoto is committed to collecting only the personal data that is necessary for legitimate operational purposes, storing it securely, and providing players with meaningful control over their own information. Data protection standards applied by Fulltoto are informed by internationally recognised frameworks, including principles equivalent to those found in the General Data Protection Regulation (GDPR) where applicable.

2. Definitions

The following definitions apply throughout this Privacy Policy:

• "Personal Data" means any information that identifies or could reasonably identify a living individual.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, transfer, and deletion.
• "Data Subject" means the individual to whom Personal Data relates — this context, the registered Fulltoto player.
• "Controller" means the entity that determines the purposes and means of processing Personal Data. Fulltoto acts as Controller in respect of player data.
• "Processor" means a third party that processes Personal Data on behalf of the Controller under documented instructions.
• "Cookies" means small text files or similar technologies placed on a player's device to support session management, security, analytics, and functionality.
• "KYC" means Know Your Customer verification processes undertaken for identity, age, address, and payment confirmation purposes.

3. Personal Data We Collect

Fulltoto collects personal data through account registration, account use, payment transactions, KYC submissions, customer support interactions, and website activity. The categories of data collected include:

3.1 Identity and Contact Data

Full name, date of birth, nationality, residential address (which may include Malaysian cities such as Kuala Lumpur, Petaling Jaya, Penang, Shah Alam, or Johor Bahru), email address, and telephone number provided during account registration or verification.

3.2 Identity Verification Documents

Government-issued identity documents such as a Malaysian MyKad, passport, or equivalent, together with proof of address documents submitted during KYC processes. Fulltoto does not retain document images beyond the period required for verification and compliance obligations.

3.3 Financial and Payment Data

Details relating to deposit and withdrawal transactions, payment method references (such as e-wallet identifiers for Touch'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, or Hong Leong), transaction amounts in MYR, cryptocurrency transaction identifiers, and records of source-of-funds information where requested.

3.4 Account Activity Data

Wager history, game session records, bonus claims, withdrawal requests, account balance history, responsible gambling settings, self-exclusion records, and related account activity logs.

3.5 Technical and Device Data

IP address, device type, operating system, browser type and version, screen resolution, referring URL, pages visited on the Fulltoto website, session duration, and approximate geographic location derived from the IP address.

3.6 Communications Data

Records of correspondence with Fulltoto customer support by live chat, email, or other supported channels, including the content of queries, timestamps and the resolution recorded against each interaction.

4. Lawful Basis for Processing Personal Data

Where Fulltoto relies on legitimate interests as a lawful basis, a balancing assessment is conducted to ensure that the interests pursued do not unfairly override the rights and reasonable expectations of the Data Subject.

5. How We Use Your Personal Data

Fulltoto processes personal data only for purposes that are connected to the operation of the platform, the management of player accounts, and the fulfilment of applicable legal and compliance obligations. Specific uses include:

• Opening, maintaining, verifying, and closing player accounts;
• Processing MYR deposits and withdrawals through supported Malaysian e-wallets, FPX, DuitNow, bank transfers, and cryptocurrency channels;
• Settling sports wagers on markets including EPL, Liga Super Malaysia, UFC, live football, and other events;
• Investigating, detecting, and preventing fraudulent transactions, multi-accounting, bonus abuse, and other prohibited conduct;
• Verifying player identity and age as required by KYC procedures;
• Administering responsible gambling tools including deposit limits, time-outs, self-exclusion, and account monitoring;
• Responding to customer support requests submitted by live chat, email, or WhatsApp;
• Complying with applicable licensing conditions, anti-money-laundering obligations, and lawful requests from competent authorities;
• Improving website functionality, page performance, and user experience through aggregated analytics.

Fulltoto does not sell personal data to third parties for their own marketing purposes. Fulltoto does not use personal data to make fully automated decisions that produce significant legal effects without a human review process being available.

6. Data Sharing and Disclosure

Fulltoto may share personal data with the following categories of recipients, each bound by appropriate confidentiality or data-processing obligations:

6.1 Payment Service Providers

E-wallet operators, banks, FPX clearing networks, DuitNow processors, and cryptocurrency exchange services require transaction and identity information to process payments authorised by the player.

6.2 Identity Verification and Fraud Prevention Services

Third-party KYC providers and fraud-screening tools may receive identity document data and device information to verify account eligibility and detect suspicious activity.

6.3 Technology and Infrastructure Providers

Cloud hosting, database management, customer support platforms, and site analytics services that process data solely under Fulltoto's documented instructions as Processors.

6.4 Game and Betting Platform Partners

Licensed game studios and betting platform providers may receive session data necessary to operate their products within the Fulltoto environment. Data shared is limited to what is operationally required.

6.5 Regulatory and Legal Authorities

Fultoto may disclose personal data where required by a court order, subpoena, valid legal process, regulatory direction, or anti-money-laundering investigation. Fulltoto will generally not notify a player of such a disclosure where doing so would prejudice the investigation.

6.6 Business Transfers

In the event of a corporate restructuring, merger, or acquisition involving Fulltoto, personal data held by Fulltoto may form part of the assets transferred to a successor entity, subject to equivalent privacy protections remaining in place.

7. Cookies and Tracking Technologies

Fulltoto uses cookies and similar technologies on its website for the following operational purposes:

• Essential cookies: Required to maintain a logged-in session, manage security tokens, and enable core account functions. These cannot be disabled without impairing platform use.
• Functional cookies: Store player preferences such as language selection and display settings to improve the consistency of the experience across sessions.
• Analytics cookies: Collect aggregated and anonymised data about page visits, session duration, and navigation paths to help Fulltoto improve performance and content relevance.
• Security cookies: Detect unusual access patterns, rate-limit automated requests, and protect accounts from credential-stuffing and session hijacking attempts.

Players may configure browser settings to restrict or delete cookies, subject to understanding that essential cookies are necessary for normal account operation. Fulltoto does not use cookies to track activity on unrelated third-party websites.

8. Data Retention

Fulltoto retains personal data for as long as is necessary for the purposes for which it was collected, subject to any longer retention period required by applicable law, licensing obligations, or financial record-keeping standards.

As a general principle, account data, transaction records, and KYC documentation are retained for a period of at least five years following account closure or the date of the last material transaction, in line with typical anti-money-laundering and fraud investigation timelines. Data held solely for analytics purposes is anonymised or deleted at earlier intervals where practicable.

Following the expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Players may request confirmation of retention periods applicable to their specific account data through the contact details in Section 13.

9. Security Measures

Fulltoto implements a combination of technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, and destruction. These measures include:

• 256-bit TLS/SSL encryption applied to all data in transit between the player's device and Fulltoto systems;
• Encrypted storage for sensitive data fields including identity document references and payment identifiers;
• Role-based access controls restricting internal access to personal data to staff with a demonstrated operational need;
• Two-factor authentication options for player account login;
• Automated monitoring for unusual account access patterns, including simultaneous session detection and impossible travel alerts;
• Periodic internal reviews of data handling procedures and access logs.

No security system is completely impenetrable. In the event of a data security incident that materially affects player rights or account safety, Fulltoto will take appropriate investigative and containment action and notify affected players within a reasonable timeframe where required.

10. Your Rights as a Data Subject

Subject to verification of identity and applicable legal limitations, players whose data is processed by Fulltoto may exercise the following rights:

To exercise any of these rights, please contact Fulltoto support using the details provided in Section 13. Requests will be assessed and responded to within a reasonable period, typically thirty (30) calendar days, subject to complexity and any applicable legal exemptions.

Fulltoto may request proof of identity before processing a data subject request to ensure that personal data is not disclosed to, or modified at the direction of, an unauthorised third party.

11. Protection of Minors

Fulltoto does not knowingly collect personal data from individuals under the age of 21. The Fulltoto platform is intended solely for adults aged 21 and above. Age verification is conducted as part of the KYC process to enforce this restriction.

If Fulltoto becomes aware that personal data has been collected from an individual under the minimum age, the relevant account will be suspended, any funds held will be managed in accordance with applicable procedures, and the personal data will be deleted or anonymised as promptly as practicable.

Parents and guardians who believe that a minor may have registered with Fulltoto should contact the support team immediately using the details in Section 13.

12. Changes to This Privacy Policy

Fulltoto may update this Privacy Policy periodically to reflect changes in services, applicable data protection standards, technical practices, or legal obligations. The revised policy will be published on this page with an updated effective date.

Where a material change affects the way in which personal data is processed, Fulltoto will communicate the update through an account notice or website announcement before the change takes effect. Continued use of Fulltoto following notification of a material change constitutes acceptance of the updated Privacy Policy.

Players are encouraged to review this page periodically. The date displayed in the page header reflects the most recent version in effect.

13. Contact Us

Questions, concerns, or formal data subject requests relating to this Privacy Policy or the personal data Fulltoto holds about you may be submitted to the Fulltoto customer support team. The support email address is displayed below as plain text and is not a clickable link:

[email protected]

Support is available around the clock by live chat and WhatsApp, with additional assistance provided by email. Our team handles data privacy enquiries in English and can assist with queries submitted in Bahasa Melayu and Mandarin where possible.

When submitting a data subject request, please include your registered username, the nature of your request, and proof of identity so that Fulltoto can verify your identity before processing the request. Fulltoto will acknowledge receipt and respond within the applicable timeframe described in Section 10.