Privacy Policy — How Hondatoto Protects Your Personal Data

This Privacy Policy ("Policy") is issued by Hondatoto ("the Platform", "we", "us", "our") and governs the collection, use, storage, disclosure, and protection of personal data in connection with your use of the hondatoto online gaming platform at hondatoto.lat and all associated services.

Hondatoto takes its data protection obligations seriously. This Policy has been prepared to provide you with full transparency regarding how your personal information is handled and to ensure you understand the rights available to you as a data subject.

By registering an account, accessing the platform, or interacting with any hondatoto service, you acknowledge that you have read and understood this Policy. If you have any questions about how your data is handled, please contact our support team via live chat or at the email address provided in Section 14 of this Policy.

For the purposes of this Privacy Policy, the following terms carry the meanings defined below:

• "Personal Data" — any information that identifies or could reasonably be used to identify a living individual, whether directly (e.g., full name, national identification number) or indirectly (e.g., account username combined with device fingerprint).
• "Processing" — any operation or set of operations performed on personal data, including but not limited to collection, storage, retrieval, use, disclosure, erasure, and destruction.
• "Data Controller" — hondatoto, being the entity that determines the purposes and means of processing your personal data.
• "Data Subject" — you, the individual whose personal data is collected and processed by hondatoto.
• "Third Party" — any natural or legal person other than hondatoto and the data subject, including payment processors, KYC service providers, and analytical service providers.
• "Sensitive Personal Data" — a subset of personal data requiring heightened protection, including government-issued identification numbers, financial account details, and data relating to health or criminal record.
• "Cookie" — a small text file placed on your device by the hondatoto platform for the purposes described in Section 7 of this Policy.

Hondatoto collects personal data through several means: information you provide directly during registration and account management, data generated automatically through your use of the platform, and information received from third-party service providers. The categories of personal data we collect are set out below.

We do not intentionally collect special category data such as health information or biometric data. Where the provision of KYC documentation inadvertently includes such information, it is processed solely for the purpose of identity verification and is not used for any other purpose.

Hondatoto uses personal data only for clearly defined and legitimate purposes. The primary purposes for which we process your data are as follows:

• Account Management: Creating, maintaining, and administering your player account, including processing registrations, managing account settings, and verifying your identity.
• KYC and Age Verification: Verifying that you meet the minimum age requirement of 21 years and that your identity is consistent with the information provided during registration.
• Payment Processing: Processing deposits and withdrawals via supported payment methods including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, USDT TRC20, and 7-Eleven Cliqq, and maintaining accurate financial transaction records.
• Service Delivery: Providing access to games, live casino tables, sports betting markets, and all other platform features and functionality.
• Regulatory and Compliance Obligations: Meeting anti-money laundering (AML) screening requirements, record-keeping obligations, and other applicable legal and regulatory duties.
• Responsible Gambling: Monitoring gaming activity to identify players who may be showing signs of harmful gambling behaviour, and facilitating the responsible gambling tools available within your account settings.
• Fraud Prevention and Security: Detecting, investigating, and preventing fraudulent account activity, unauthorised access, and other security threats to the platform and its users.
• Customer Support: Responding to your support queries, complaints, and other communications through live chat and email.
• Platform Improvement: Analysing aggregated and anonymised usage data to improve platform performance, user experience, game selection, and service quality.
• Direct Marketing (where consented): Sending promotional communications about bonuses, new games, and platform updates, where you have provided explicit consent to receive such communications. You may withdraw this consent at any time.

Hondatoto processes your personal data on the following legal grounds:

• Contractual Necessity: Processing required to perform the contract between you and hondatoto — specifically, to operate your player account, process transactions, and deliver the gaming services you have requested.
• Legal Obligation: Processing necessary to comply with legal requirements, including KYC/AML obligations, record retention requirements, and cooperation with lawful regulatory or law enforcement requests.
• Legitimate Interests: Processing necessary for the legitimate interests of hondatoto, including fraud prevention, platform security, system integrity, and service improvement — provided such interests are not overridden by your rights and interests as a data subject.
• Consent: Processing based on your explicit and freely given consent, specifically for direct marketing communications. You retain the right to withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Hondatoto does not sell your personal data to third parties. We may share your personal data with the following categories of recipients, strictly for the purposes described:

• Payment Service Providers: To process deposits and withdrawals. This includes the operators of Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX banking partners (Maybank, CIMB, Public Bank, Hong Leong Bank), USDT TRC20 infrastructure providers, and 7-Eleven Cliqq. These providers receive only the minimum data necessary to process the relevant transaction.
• KYC and Identity Verification Providers: Third-party identity verification services engaged to assist with the processing and authentication of KYC documentation submitted by players.
• Fraud and Security Services: Specialist providers engaged to assist with fraud detection, risk scoring, and platform security monitoring.
• Analytics Providers: Services used to analyse aggregated, anonymised platform usage data. No personally identifiable information is shared with analytics providers in a manner that identifies you as an individual.
• Regulatory and Law Enforcement Authorities: Where required by applicable law or pursuant to a lawful request from a competent authority. Hondatoto will disclose only the minimum information required by the relevant legal obligation.
• Professional Advisers: Legal, accounting, audit, and compliance professionals engaged by hondatoto, subject to appropriate confidentiality obligations.

All third-party recipients of personal data are required to process such data in accordance with applicable data protection standards and are contractually obligated to maintain appropriate technical and organisational security measures.

Hondatoto uses cookies and similar tracking technologies on the platform. Cookies are small text files stored on your device that enable the platform to recognise your browser, maintain your session, and provide a personalised experience.

• Strictly Necessary Cookies: Essential for the platform to function correctly. These include session cookies that maintain your login state and security cookies that prevent cross-site request forgery. These cookies cannot be disabled without impairing platform functionality.
• Performance Cookies: Collect anonymised data about how players use the platform, including pages visited and error messages encountered, to help us improve performance and reliability.
• Functionality Cookies: Remember your preferences such as language settings, preferred currency display (MYR), and responsible gambling limit configurations.
• Analytics Cookies: Enable aggregated analysis of platform usage patterns. Data collected is anonymised and used solely for internal improvement purposes.

You may manage cookie preferences through your browser settings. Most modern browsers allow you to block or delete cookies. Please note that disabling strictly necessary cookies will impair your ability to log in and use the platform. Disabling performance or analytics cookies will not affect your core gaming experience.

Hondatoto retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal or regulatory obligations. The following general retention principles apply:

• Active Account Data: Retained for the duration of the active account relationship and for a defined period following account closure, to meet legal obligations and resolve any outstanding disputes.
• Financial Transaction Records: Retained for a minimum of five (5) years following the date of the transaction, in compliance with anti-money laundering record-keeping requirements applicable to financial services operations.
• KYC Documentation: Retained for a minimum of five (5) years from the date of completion of the business relationship, in accordance with AML obligations.
• Customer Support Correspondence: Retained for a period of two (2) years following resolution of the relevant inquiry, to facilitate follow-up and internal quality review.
• Technical and Log Data: Retained for a period of twelve (12) months in anonymised or pseudonymised form for platform security and performance monitoring purposes.
• Marketing Consent Records: Retained for the duration of the consent and for a period following withdrawal of consent, solely to maintain an accurate record that the consent was given and subsequently withdrawn.

Following the expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised.

Hondatoto implements a comprehensive range of technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the hondatoto platform;
• Encryption of sensitive data fields at rest within our database infrastructure;
• Role-based access controls limiting internal access to personal data to authorised personnel with a documented need;
• Regular security testing and vulnerability assessments of the platform infrastructure;
• Multi-factor authentication requirements for internal administrative access to systems holding personal data;
• Incident response procedures and a data breach notification process aligned with applicable regulatory requirements.

While hondatoto takes all reasonable precautions to secure your personal data, no internet-based system can be guaranteed to be completely secure. You are responsible for maintaining the security of your account credentials. Please use a strong, unique password and enable any two-factor authentication options available within your account settings.

As a data subject, you have the following rights in relation to the personal data that hondatoto holds about you. You may exercise any of these rights by contacting our support team via live chat or by writing to the email address provided in Section 14.

Hondatoto will respond to valid data rights requests within 30 days of receipt. In complex cases, this period may be extended by a further 60 days, in which case you will be notified. We may require you to verify your identity before actioning a rights request to ensure we do not disclose or modify personal data at the request of an unauthorised third party.

The hondatoto platform is strictly restricted to individuals aged 21 and above. We do not knowingly collect personal data from individuals below this age threshold. If we become aware that personal data has been collected from a person under the age of 21 without appropriate verification having been completed, we will immediately suspend the relevant account, delete the associated personal data to the extent permitted by law, and return any real-money funds held in the account following appropriate verification of the depositor's identity.

If you are a parent or guardian and believe that a minor has registered an account on hondatoto, please contact our support team immediately at the details provided in Section 14. We take such reports very seriously and will investigate promptly.

In certain circumstances, the personal data you provide to hondatoto may be transferred to, stored, or processed in a jurisdiction outside of Malaysia. This may occur where, for example, our KYC verification provider or payment processing partner operates infrastructure in another country.

Where such cross-border transfers occur, hondatoto will ensure that appropriate safeguards are in place to protect your personal data to a standard at least equivalent to the protections afforded under applicable data protection principles. Such safeguards may include contractual clauses between hondatoto and the receiving party that require the recipient to protect your personal data to the same standard as we do.

For further information about the safeguards in place for any specific cross-border transfer, please contact our support team using the details in Section 14.

Hondatoto reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or platform functionality. Where changes are material, we will notify you via an in-platform notice upon your next login or by email to the address associated with your account.

The "Last Updated" date at the top of this Policy indicates when the most recent revision was made. We encourage you to review this Policy periodically to remain informed of how we handle your personal data. Your continued use of the platform following publication of an updated Policy constitutes acceptance of the revised terms.

If you have questions, concerns, or wish to exercise your data rights, please contact the hondatoto data privacy team through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week through the hondatoto platform. This is the fastest way to reach our team for data rights requests.
• Support Email: [email protected] — for written data rights requests or formal privacy complaints. Please include your registered account email address and a clear description of your request or concern.

We aim to acknowledge all privacy-related enquiries within 48 hours and to provide a substantive response within 30 days. For complex erasure or portability requests, the 30-day period may be extended where necessary, and you will be kept informed of progress.

If you are not satisfied with our response to a privacy complaint, you have the right to escalate your concern to the relevant data protection authority or regulatory body in the jurisdiction applicable to your circumstances.

Our support team serves players across Malaysia, including Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, Ipoh, and Kota Kinabalu. Assistance is available in English and Bahasa Melayu.