Privacy Policy

eshatoto ("we", "us", "our", "Platform") operates the online gaming platform at https://eshatoto.cam, providing online lottery, sports betting, live casino, slot games, and related entertainment services to registered members ("Users", "Members", "you") primarily located in Malaysia.

We recognise that your personal data belongs to you. This Privacy Policy describes what personal data eshatoto collects, the lawful basis on which it is processed, how it is used, with whom it may be shared, how long it is retained, and what rights you hold in relation to it. This Policy also describes how we use cookies and similar tracking technologies on the Platform.

This Privacy Policy forms part of and should be read alongside our Terms & Conditions. By creating an Account, making a deposit, or otherwise using the eshatoto Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

eshatoto collects only the personal data that is necessary to provide the Platform's services, comply with our legal obligations, and deliver a secure and personalised experience. The categories of personal data we collect are set out below.

3.1 Account Registration Data

• Full legal name as it appears on your Malaysian identification document.
• Date of birth (to verify that you meet the 21+ age requirement).
• Residential address, including city (e.g., Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru, Shah Alam).
• Email address and mobile phone number.
• Username and encrypted password.

3.2 Identity Verification (KYC) Data

• Copy or photograph of a valid Malaysian identity document — MyKad (IC), Driver's Licence, or Passport.
• Proof of residential address — utility bill (TNB, Syabas, Indah Water) or bank statement dated within the past three months.
• Selfie photograph holding the identity document, where required.

3.3 Financial and Transaction Data

• Payment method details — e-wallet IDs (Touch 'n Go eWallet, Boost, GrabPay), FPX bank account references, DuitNow registered details, card last-four digits.
• Deposit and withdrawal transaction history, including amounts MYR, timestamps, and payment method used.
• Wagering history — games played, bet amounts, outcomes, and bonus usage.

3.4 Technical and Usage Data

• IP address, device type, operating system, and browser information.
• Pages visited on the Platform, session duration, click-through patterns, and feature usage.
• Geolocation data (country and city level) derived from IP address, for fraud prevention and jurisdiction compliance purposes.

3.5 Communications Data

• Content of communications between you and eshatoto's support team via live chat, email, or other channels.
• Records of any complaints or formal requests submitted to eshatoto.

eshatoto collects personal data through the following means:

• Directly from you: When you register an Account, complete KYC verification, make a deposit or withdrawal, contact customer support, or respond to a promotion.
• Automatically through the Platform: Technical and usage data is collected automatically as you interact with the Platform, via server logs, cookies, and similar tracking technologies. See Section 9 for details on cookies.
• From payment service providers: When you initiate a financial transaction, our payment partners (e.g., FPX-connected Malaysian banks, e-wallet operators) transmit transaction reference data to us confirm successful payment processing.
• From fraud prevention and KYC partners: We may use third-party KYC and identity verification service providers to cross-reference the identity documents you submit against authoritative records, for the purpose of complying with anti-money laundering (AML) and fraud prevention obligations.

eshatoto processes your personal data on the following lawful bases, depending on the nature and purpose of the processing activity:

eshatoto uses the personal data it collects for the following purposes:

• Account Management: Creating, maintaining, and securing your Account; authenticating your identity at login; providing access to all Platform features and game services.
• Payment Processing: Facilitating deposits via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, bank transfer (Maybank, CIMB, Public Bank, Hong Leong Bank), credit/debit cards, and cryptocurrency; processing withdrawal requests to verified MYR accounts.
• Identity and Age Verification (KYC): Verifying that you are aged 21 or above; confirming your identity and residential address to comply with anti-money laundering (AML) obligations and responsible gambling age enforcement requirements.
• Fraud Prevention and Platform Security: Detecting and investigating suspicious activity, multiple-account abuse, bonus abuse, unauthorised access attempts, and other fraudulent or prohibited conduct.
• Customer Support: Responding to enquiries, complaints, and requests submitted via live chat, email, or other support channels; maintaining records of support interactions for quality assurance purposes.
• Responsible Gambling: Monitoring usage patterns to identify potential problem gambling behaviour; administering self-exclusion arrangements, deposit limits, session time-outs, and reality check notifications at the Member's request.
• Service Improvement and Analytics: Analysing aggregated usage data to improve Platform performance, user experience, game selection, and support quality.
• Marketing Communications (with consent): Sending promotional offers, bonus notifications, and Platform updates to Members who have opted in to receive such communications. Marketing communications may be withdrawn at any time.
• Legal and Regulatory Compliance: Retaining records and responding to lawful requests from regulatory authorities, law enforcement agencies, and courts as required by applicable law.

eshatoto does not sell, rent, or trade your personal data to any third party for commercial or marketing purposes. We may share your personal data with the following categories of third parties, strictly to the extent necessary for the purposes described in this Policy:

• Payment Service Providers: Licensed Malaysian payment gateways and financial institutions (including FPX member banks, e-wallet operators, and card processors) receive transaction data necessary to process your deposits and withdrawals.
• KYC and Identity Verification Providers: Third-party identity verification services receive KYC documents and reference data for the purpose of verifying age and identity. These providers operate under strict data processing agreements and are prohibited from using your data for any purpose other than verification.
• Game Content Providers: Providers of slot games, live dealer games, and sports data feed services may receive a session token or anonymised player identifier to facilitate gameplay. Full personal identity data is not shared with game providers.
• Fraud Prevention and Security Services: Third-party fraud detection, cybersecurity, and platform integrity services may access technical and transactional data to identify and prevent fraudulent activity.
• Legal and Regulatory Authorities: We may disclose personal data to law enforcement agencies, courts, or regulators where we are required to do so by law, or where we believe disclosure is necessary to protect the rights, property, or safety of eshatoto, its Members, or the public.
• Professional Advisers: Legal, accounting, and audit professionals may access personal data as necessary in connection with the provision of professional services to eshatoto, subject to professional confidentiality obligations.

eshatoto retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our internal data disposal procedures.

eshatoto uses cookies and similar tracking technologies on the Platform to ensure functionality, enhance performance, and — where you have consented — support analytics and service improvement. The types of cookies we use are described below.

• Strictly Necessary Cookies: Required for the Platform to function. These cookies enable session management, login authentication, and core security features. They cannot be disabled without rendering the Platform non-functional.
• Functional Cookies: Remember your preferences such as language settings, last-visited game categories, and display options. These enhance your user experience without collecting data that identifies you to third parties.
• Performance / Analytics Cookies: Collect aggregated, anonymised data about how visitors interact with the Platform — pages visited, session length, feature usage. This data helps us improve the Platform's usability and content. Used only with your consent.
• Security Cookies: Help detect fraud and protect the Platform against malicious activity — for example, by flaging unusual access patterns from a given device or IP address.

You may manage your cookie preferences through your browser settings. Please note that disabling certain categories of cookies may affect the functionality of the Platform. Most modern mobile and desktop browsers — including those commonly used by Malaysian users on Android and iOS devices — allow you to control cookie settings through the browser's privacy menu.

eshatoto implements industry-standard technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. Our key security measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the eshatoto Platform is encrypted in transit using TLS 1.2 or higher. The Platform is HTTPS-only.
• Encrypted Data Storage: Sensitive personal data — including identity documents and payment references — is stored in encrypted form within secured data environments.
• Two-Factor Authentication (2FA): Members are encouraged to enable 2FA on their Accounts. This provides an additional layer of protection against unauthorised login attempts.
• Access Controls: Access to personal data within eshatoto's internal systems is restricted on a need-to-know basis, with role-based access controls and audit logging in place.
• Regular Security Reviews: We conduct periodic internal and independent third-party security assessments to identify and remediate vulnerabilities in our systems.
• Incident Response: In the event of a data breach that is likely to result in a risk to the rights and freedoms of affected individuals, eshatoto will notify affected Members and relevant authorities in accordance with applicable legal requirements.

You are responsible for maintaining the security of your Account credentials. Do not share your username, password, or 2FA codes with any third party. Report any suspected unauthorised access to your Account to our support team immediately.

As a Member of eshatoto, you hold a number of rights in relation to your personal data. These rights may be exercised by contacting us as set out in Section 15. We will respond to all valid requests within a reasonable period, typically within 30 calendar days.

• Right of Access: You have the right to request a copy of the personal data eshatoto holds about you, together with information about how it is being used and with whom it has been shared.
• Right to Rectification: You have the right to request that inaccurate or incomplete personal data held about you be corrected. For basic Account details, you may also update information directly through your Account settings.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (and no other lawful basis applies), or where the data has been processed unlawfully. This right is subject to eshatoto's legal retention obligations — we may be required to retain certain data for regulatory compliance periods as outlined in Section 8.
• Right to Restrict Processing: You may request that we limit the processing of your data in certain circumstances — for example, whilst a correction request is being evaluated.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity, you have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to the processing of your personal data on the basis of legitimate interests, including profiling. You also have an unconditional right to object to processing for direct marketing purposes at any time.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

The eshatoto Platform is strictly intended for individuals who are 21 years of age or older. We do not knowingly collect or process personal data from any person under the age of 21. Age verification is a mandatory part of the Account registration process and is enforced through our KYC procedures.

If eshatoto becomes aware that personal data has been collected from a person under the age of 21, we will take immediate steps to delete such data and close the associated Account. Any winings generated through an underage Account will be voided.

Parents and guardians who believe that a minor may have registered an Account on eshatoto are urged to contact our support team immediately so that the Account can be investigated and closed without delay.

The eshatoto Platform integrates with third-party services — including payment gateways, game content delivery networks, and KYC verification providers — that may process personal data in connection with the delivery of their services to us. All such third parties operate under data processing agreements with eshatoto as described in Section 7.

Where the Platform contains any links to third-party websites or content not operated by eshatoto, we have no control over the privacy practices of those third-party sites. We encourage you to review the privacy policies of any third-party website you visit. eshatoto is not responsible for the privacy practices or content of websites operated by third parties.

eshatoto reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform functionality. We will endeavour to provide reasonable advance notice of material changes — typically by displaying a prominent notice on the Platform homepage or by email to your registered address.

The "Last Updated" date displayed at the top of this page will be updated to reflect the date on which the most recent revision was made. Your continued use of the eshatoto Platform after the effective date of any amendment to this Policy constitutes your acceptance of the revised terms. If you do not agree with any change, you should cease using the Platform and may request Account closure as set out in Section 15.

We recommend that you review this Privacy Policy periodically — particularly if you are a regular user of the Platform — to ensure you remain informed about how your personal data is being handled.

If you have any questions, concerns, or requests relating to this Privacy Policy, or if you wish to exercise any of your data subject rights as described in Section 11, please contact the eshatoto Data Protection team through any of the following channels:

• Email: [email protected] — for formal data rights requests, please use the subject line "Privacy / Data Rights Request" and include brief description of your query. We aim to acknowledge all requests within 48 hours and provide a substantive response within 30 calendar days.
• Live Chat: Available24/7 directly on the Platform. Our English, Bahasa Melayu, and Mandarin Chinese support teams can assist with general privacy queries and escalate formal requests to the appropriate team.
• Peak Support Hours: 8:00 AM – 12:00 AM MYT (Malaysia Time), seven days a week. Average live chat response time: 3–5 minutes during peak hours.

For information about our responsible gambling tools, please visit our Responsible Gambling page. For the full terms governing your use of the Platform, please refer to our Terms & Conditions.