latoto Privacy Policy for Malaysian Users

latoto may receive information directly from a user, automatically from a device or from a service provider involved in identity checks, fraud monitoring or payment processing. If a user provides information about another person, the user must have a lawful basis and proper authority to do so.

latoto may process personal data where it is necessary to provide requested services, comply with applicable duties, protect legitimate security interests, resolve a user request or act on valid consent where consent is required. The appropriate basis depends on the nature and context of the processing.

• Account administration: latoto uses registration and profile information to establish, maintain, secure and close user accounts.
• Service delivery: gaming records are processed to accept permitted activity, display balances, settle results and maintain transaction histories.
• Payment processing: latoto uses transaction details to administer MYR deposits and withdrawals through available bank, e-wallet and digital asset methods.
• Identity and security: information may be assessed to verify age, identity and payment ownership, detect duplicate accounts and investigate suspected fraud.
• Responsible gaming: latoto may process deposit limits, cooling-off requests, self-exclusion instructions and unusual account patterns to support player protection.
• Support and disputes: correspondence and transaction records help latoto answer questions, investigate complaints and maintain an appropriate audit trail.
• Website improvement: aggregated or technical information may help latoto diagnose faults, improve mobile usability and understand how important pages are used.

latoto does not treat personal data as an unrestricted asset. A new use that is materially incompatible with the original purpose may require further notice, an additional legal basis or user consent, depending on the circumstances.

latoto may request documents or information to verify a user's identity, age, address, payment ownership or source of funds. A KYC review may occur during registration, before a first withdrawal, after a material account change or when activity requires additional examination. Requested records should be current, legible and submitted only through the designated latoto process.

Payment data may relate to Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, DuitNow, FPX, BTC, ETH or USDT. latoto does not need every credential used to access those services. Users must never provide a banking password, e-wallet PIN, private crypto key or one-time security code to latoto support.

Cookies and similar storage technologies may help latoto recognise a browser, remember preferences, preserve a secure session and identify technical problems. Some cookies are necessary for core functions, while optional measurement tools may be used to understand general website performance where permitted.

Browser controls can remove or restrict cookies. A user should understand that changing these settings may end an authenticated session or remove saved preferences. latoto does not advise users to disable security technologies required to protect account access.

latoto may disclose personal data only where there is an appropriate operational, security or legal reason. Recipients may act under contractual confidentiality and data protection obligations appropriate to the service they perform.

• Payment service providers: Relevant transaction information may be shared to process, trace, verify or reverse an eligible payment.
• Identity and security providers: latoto may use specialist support to verify documents, screen risk, detect fraud or protect account access.
• Technology and support providers: Controlled access may be required for hosting, storage, communications, system maintenance or customer service.
• Professional advisers: Information may be disclosed where reasonably necessary for legal, audit, accounting, insurance or dispute-management services.
• Authorities and lawful requests: latoto may provide information where required by applicable law, a valid order or a legitimate investigation.
• Business restructuring: Data may be transferred as part of a genuine merger, reorganisation or asset transaction, subject to appropriate safeguards.

latoto does not publish a user's identity, MYR balance or gaming history as public content. Anonymised or aggregated information that does not reasonably identify an individual may be used for statistics, security analysis and service planning.

Online services may involve infrastructure, support personnel or service providers located outside Malaysia. As a result, latoto information may be processed in another jurisdiction whose privacy rules differ from those in Malaysia. Where such a transfer occurs, latoto seeks to apply appropriate contractual, organisational or technical safeguards according to the circumstances and applicable requirements.

Cross-border processing does not remove the need for confidentiality or account security. Access should remain limited to authorised purposes, and providers should process latoto data under documented instructions where appropriate.

latoto retains personal data for periods connected to the purpose for which it was collected. Relevant considerations include whether an account remains active, whether a transaction or dispute is unresolved and whether financial, security or compliance records must be preserved. Different record categories may therefore have different retention periods.

Closing a latoto account does not necessarily result in immediate deletion of every record. latoto may retain limited information to administer pending withdrawals, maintain self-exclusion controls, prevent fraud, respond to complaints and satisfy lawful accounting or record-keeping duties. When retention is no longer reasonably required, information may be deleted, anonymised or placed beyond ordinary operational use.

• Access: Ask whether latoto processes personal data and request available information about that processing.
• Correction: Ask latoto to update inaccurate or incomplete profile information.
• Deletion: Request deletion where retention is no longer required and no overriding lawful reason applies.
• Restriction: Ask latoto to limit certain processing while a valid issue is reviewed.
• Objection: Raise an objection to particular processing based on the user's circumstances where that right applies.
• Consent withdrawal: Withdraw consent for future processing where latoto relies specifically on consent.

latoto may request sufficient information to confirm the identity of the person making a privacy request. This protects users in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam and elsewhere from unauthorised access to their records. A request may be limited or refused where disclosure would affect another person's rights, undermine security or conflict with a lawful retention obligation.

latoto uses reasonable administrative, organisational and technical measures intended to protect personal data. These may include access controls, monitoring, secure transmission, credential protection, environment separation and staff or provider confidentiality requirements. No internet system can be guaranteed completely secure, and users also have an important role in reducing risk.

• Use a strong, unique password for latoto and do not reuse a banking or email password.
• Do not disclose passwords, one-time codes, e-wallet PINs or private wallet keys.
• Sign out after using a shared device and keep the device operating system updated.
• Review account and MYR transaction history for unfamiliar activity.
• Notify latoto promptly if account access, identity documents or payment details may be compromised.

If latoto identifies a security incident affecting personal data, it may investigate, contain and document the event and provide notices where required or appropriate. Users should follow genuine security instructions promptly while remaining alert to impersonation attempts.

latoto may revise this Privacy Policy to reflect changes in website functions, payment arrangements, security practices or applicable requirements. The updated version will be published on this page. Users should review the policy periodically, particularly before providing new categories of information.

Questions about this Privacy Policy, a latoto account or a privacy request may be sent to the support team. Support email: [email protected]. The email address is displayed as plain text for safety. Support hours are 24/7, Malaysia Time.

A privacy request should describe the issue clearly and include only the information needed to locate the relevant account. Do not send a password, one-time code, full card credential, e-wallet PIN or private crypto key. General account and payment guidance is also available in the FAQ.