Privacy Policy

This Privacy Policy ("Policy") describes how Birutoto ("we", "us", "our"), the operator of the online gaming and sports betting platform located at birutoto.buzz, collects, processes, stores, and protects personal data submitted by users ("you", "your") when accessing or using any part of the Platform.

Birutoto takes privacy seriously. We process personal data only where a lawful basis exists and only to the extent necessary for the purposes described in this Policy. We do not sell your personal data to third parties for their own marketing use.

By creating a Birutoto account, making a deposit, placing a wager, or otherwise using the Platform, you acknowledge that you have read and understood this Policy and consent to the processing activities described herein. If you do not agree with any part of this Policy, you should refrain from using the Platform.

The following definitions apply throughout this Policy:

• "Personal Data" means any information that identifies or can reasonably identify a living individual, including name, email address, date of birth, financial account details, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, transmission, or deletion.
• "Data Controller" refers to Birutoto as the entity that determines the purposes and means of processing your Personal Data.
• "Data Processor" refers to any third party that processes Personal Data on Birutoto's behalf, subject to contractual data processing agreements.
• "KYC" (Know Your Customer) refers to the identity and age verification process required by Birutoto before activation of real-money play.
• "Cookie" means a small text file stored on your device by your browser when you visit the Platform.
• "Platform" means the birutoto.buzz website and all related services, games, and features offered thereon.

Birutoto collects personal data through several channels. The categories of data we collect are as follows:

3.1 Registration Data

When you create a Birutoto account, we collect your full legal name, date of birth, email address, Malaysian mobile number, residential address, and chosen username and password. This information is required to activate your account and comply with our KYC obligations.

3.2 Identity Verification (KYC) Data

To verify your age (21+) and identity before processing withdrawals or large deposits, we may request copies of government-issued photo identification (Malaysian MyKad, passport, or equivalent) and proof of residential address (utility bill, bank statement, or equivalent).

3.3 Financial Data

To process deposits and withdrawals, we collect payment method details including bank account numbers, e-wallet identifiers (Touch 'n Go eWallet, Boost, GrabPay), FPX or DuitNow reference details, and cryptocurrency wallet addresses where applicable. We do not store full card numbers or card CVV data on our servers.

3.4 Transaction and Gaming Data

We record all deposits, withdrawals, bets, game sessions, bonus claims, and related transaction histories associated with your account. This data is necessary for the operation of the Platform, dispute resolution, and regulatory compliance.

3.5 Technical and Device Data

When you access the Platform, we automatically collect certain technical data including your IP address, browser type and version, operating system, device type and identifiers, screen resolution, referring URL, and session duration. This data assists with fraud detection, security monitoring, and platform performance optimisation.

3.6 Communications Data

We retain records of communications between you and our support team, including live chat transcripts and email correspondence, to ensure consistency of service and for quality assurance purposes.

Birutoto processes your personal data for the following specific purposes:

1. Account Management: Creating, maintaining, and securing your Birutoto account; verifying your identity and age; updating account details upon your request.
2. Service Delivery: Processing deposits and withdrawals; enabling game play and sports betting; calculating and crediting winnings, bonuses, and loyalty points.
3. KYC and Fraud Prevention: Verifying that users meet the 21+ age requirement; detecting and preventing fraudulent activity, money laundering, bonus abuse, and unauthorised access.
4. Customer Support: Responding to your enquiries; resolving disputes; providing technical assistance via live chat and email.
5. Legal and Regulatory Compliance: Maintaining records required under applicable licensing conditions; responding to lawful requests from regulatory authorities or law enforcement agencies.
6. Marketing Communications: Sending promotional emails, bonus notifications, and platform updates to users who have not opted out. You may opt out of marketing communications at any time by contacting our support team.
7. Platform Improvement: Analysing user behaviour patterns and technical performance data (in aggregated, anonymised form where possible) to improve Platform features and user experience.
8. Responsible Gambling: Monitoring account activity to identify patterns that may indicate problem gambling; applying self-exclusion and deposit limit tools as requested.

Birutoto relies on the following lawful bases for processing your personal data:

• Contractual Necessity: Processing required to perform the contract between you and Birutoto (i.e., operating your account, processing bets and payments) is carried out on the basis that it is necessary for the execution of that contract.
• Legal Obligation: Certain processing activities — particularly KYC verification, anti-money laundering checks, and regulatory record-keeping — are required to comply with applicable legal and licensing obligations.
• Legitimate Interests: We process some data on the basis of our legitimate interests as a business, including fraud detection, security monitoring, and platform analytics, provided these interests are not overridden by your fundamental rights.
• Consent: Where required by applicable law, we will seek your explicit consent before processing your data for specific purposes such as direct marketing. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Birutoto does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. We may share your data in the following limited circumstances:

• Payment Processors and Banking Partners: We share necessary financial data with payment service providers (including those facilitating Maybank2u, CIMB Clicks, FPX, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, and cryptocurrency transactions) to process your deposits and withdrawals.
• KYC and Identity Verification Providers: We use third-party identity verification services to process KYC documentation. These providers are contractually bound to process your data only for verification purposes.
• Game Technology Providers: Game studios and live dealer platforms that power the games on Birutoto may receive limited technical identifiers (session tokens, bet records) necessary to deliver their games. These providers operate under data processing agreements.
• Legal and Regulatory Authorities: We will disclose your data to law enforcement agencies, regulatory bodies, or courts where required to do so by applicable law, court order, or lawful regulatory request — including for anti-money laundering or fraud investigation purposes.
• Business Continuity: In the event of a merger, acquisition, or sale of business assets, your personal data may be transferred to a successor entity, subject to equivalent data protection obligations.

Birutoto uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files stored on your device when you visit the Platform. We use the following categories of cookies:

• Strictly Necessary Cookies: Required for core Platform functionality including account session management, login state maintenance, and security features. These cannot be disabled without impairing your use of the Platform.
• Performance and Analytics Cookies: Used to collect aggregated information about how users interact with the Platform — such as pages visited, session duration, and error rates — to help us improve performance and user experience.
• Functional Cookies: Store user preferences such as language settings, preferred payment method, or responsible gambling tool settings to improve your experience on return visits.
• Fraud Detection Cookies: Used to identify suspicious activity patterns and protect accounts from unauthorised access.

You may control non-essential cookie preferences through your browser settings. Note that disabling certain cookies may affect the functionality of the Platform. Birutoto does not use third-party advertising or behavioural profiling cookies.

Birutoto retains personal data for as long as is necessary to fulfil the purposes for which it was collected, including ongoing account operation, legal compliance, and legitimate business interests. The following general retention periods apply:

• Active Account Data: Retained for the duration of your account's active status plus a minimum of five (5) years following account closure, to comply with anti-money laundering record-keeping requirements.
• Transaction and Gaming Records: Retained for a minimum of five (5) years from the date of each transaction, in accordance with international gaming licensing obligations.
• KYC Documentation: Retained for a minimum of five (5) years following KYC completion or account closure, whichever is later.
• Support Communications: Retained for three (3) years from the date of the last communication, unless a longer period is required for an ongoing dispute.
• Marketing Opt-Out Records: Retained indefinitely to ensure that opted-out users are not contacted in error.

At the end of applicable retention periods, personal data is securely deleted or anonymised in accordance with our internal data disposal procedures.

Birutoto operates as an internationally licensed platform, and your personal data may be transferred to and processed in jurisdictions outside Malaysia, including the jurisdiction of our licensing authority and the locations of our technology and payment service providers.

Where personal data is transferred internationally, Birutoto takes appropriate steps to ensure that adequate protections are in place — including contractual data processing agreements with service providers that impose obligations equivalent to applicable data protection standards.

Subject to applicable law and certain conditions, you have the following rights in respect of your personal data held by Birutoto. To exercise any of these rights, please contact our support team via live chat or email at [email protected] (plain text only — not a clickable link):

• Right of Access: You have the right to request confirmation of whether Birutoto processes your personal data and, if so, to receive a copy of that data along with details of the processing purposes.
• Right to Rectification: If your personal data is inaccurate or incomplete, you have the right to request that we correct or complete it without undue delay.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal obligations to retain certain data.
• Right to Restriction: You may request that we restrict the processing of your personal data in certain circumstances, such as while a rectification request is being assessed.
• Right to Data Portability: Where processing is based on your consent or on a contract, you may request that we provide your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing based on our legitimate interests. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to the withdrawal.
• Right to Opt Out of Marketing: You may opt out of receiving direct marketing communications from Birutoto at any time by contacting our support team. We will action your request within 72 hours.

Birutoto will respond to verified data rights requests within thirty (30) days. We may require identity verification before actioning a request to protect against fraudulent data access claims.

Birutoto employs industry-standard technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. Security measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Platform.
• Encrypted storage of sensitive data, including passwords (stored as salted cryptographic hashes) and financial identifiers.
• Two-factor authentication (2FA) available for all user accounts as an additional access control layer.
• Regular independent security audits and penetration testing conducted by third-party specialists.
• Strict role-based internal access controls limiting staff access to personal data on a need-to-know basis.
• Automated fraud detection systems monitoring for suspicious login patterns, unusual transaction activity, and multiple-account abuse.

While Birutoto takes every reasonable precaution, no system can guarantee absolute security against all threats. In the event of a data breach that poses a material risk to affected users, Birutoto will notify affected users and relevant authorities in accordance with applicable notification obligations.

Birutoto strictly prohibits use of the Platform by persons under the age of 21. We do not knowingly collect personal data from individuals under 21 years of age. All accounts are subject to KYC age verification before real-money play is activated.

If Birutoto becomes aware that personal data has been collected from a user who is under 21 years of age, we will immediately suspend the relevant account, delete the collected data to the extent permissible by law, and refund any deposited funds to the originating payment method. Parents or guardians who believe their child may have accessed the Platform should contact our support team immediately.

The Platform may integrate third-party services such as payment processors and game providers. These third-party services operate their own privacy policies and data processing practices, which are independent of Birutoto's. Birutoto is not responsible for the privacy practices of third-party service providers, though we do require them to meet minimum data protection standards through contractual obligations.

Users are encouraged to review the privacy policies of any third-party services they interact with in connection with their use of the Platform.

Birutoto reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or our data processing practices. Where amendments are material, we will notify you via a prominent notice on the Platform or by email to your registered address at least seven (7) days before the amended Policy takes effect.

The date of the most recent revision is displayed at the top of this page. We recommend reviewing this Policy periodically. Your continued use of the Platform following any amendment constitutes your acceptance of the revised Policy.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact Birutoto's data privacy team through the following channels:

• Live Chat: Available 24/7 directly on the Platform at birutoto.buzz — quickest response, typically under 60 seconds.
• Email: [email protected] — responses within 24 hours during business hours aligned with Malaysia Time (MYT, UTC+8). This is a plain text address and is not a clickable link.

When submitting a data rights request, please include your registered email address, your account username (if applicable), and a clear description of your request. We will verify your identity before processing any request involving access to or deletion of personal data.

For related policies, please also review our Terms & Conditions and our Responsible Gambling page.