DatoJudi Privacy Policy

This Privacy Policy (hereinafter referred to as "the Policy" or "this Policy") issued by DatoJudi (the "Company", "we", "us", or "our"), the operator of the online gaming platform accessible at datojudi.casa (the "Platform" or "Website").

This Policy describes how datojudi collects, uses, stores, discloses, and otherwise processes the personal data of individuals ("you", "Player", or "User") who visit, register on, or use the Platform. It applies to all data processing activities conducted by datojudi in connection with the operation of our online casino, sportsbook, and related gaming services made available to Malaysian players and in other permitted jurisdictions.

By accessing the datojudi Platform, registering an account, or using any of our services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein.

DatoJudi reserves the right to update or amend this Policy from time to time. Where material changes are made, we will notify affected players via their registered email address or via a prominent notice on the Platform. The date at the top of this Policy reflects the most recent revision. Continued use of the Platform following any update constitutes your acceptance of the revised Policy.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" — any information that identifies or can identify a living individual, directly or indirectly. This includes names, email addresses, identification numbers, IP addresses, device identifiers, and transactional records.
• "Processing" — any operation performed on personal data, including collection, storage, use, disclosure, transfer, and deletion.
• "Data Controller" — the entity that determines the purposes and means of processing personal data. For the purposes of this Policy, DatoJudi is the Data Controller.
• "Data Processor" — a third party that processes personal data on behalf of the Data Controller under documented instructions.
• "KYC" — Know Your Customer; the identity and age verification process mandated for all players before processing their first withdrawal.
• "PDPA" — Malaysia's Personal Data Protection Act 2010, the primary legislation governing the processing of personal data in commercial transactions in Malaysia.
• "Cookies" — small text files placed on your device by the Platform for the purposes of functionality, analytics, and session management.
• "Third Party" — any entity other than you and datojudi, including payment processors, identity verification providers, and fraud prevention services.

DatoJudi collects the following categories of personal data from players and website visitors:

DatoJudi does not collect or process special category data (such as health records, political opinions, or biometric data) except where expressly required by law or with your explicit consent.

DatoJudi collects personal data through the following channels:

• Direct collection: When you register an account, complete the KYC process, make a deposit or withdrawal, contact our support team, participate in promotions, or communicate with us by any means, you provide personal data directly to us.
• Automated technical collection: When you access the Platform, our servers automatically record certain technical data including your IP address, browser type, device identifiers, and session activity. This data is collected via server logs, cookies, and similar tracking technologies.
• Third-party sources: We may receive identity verification data from our KYC service providers, fraud signals from fraud prevention partners, and payment confirmation data from payment processors including Touch'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, DuitNow, and FPX. This data is used only for the specific purposes for which it was shared with us.
• Publicly available sources: In limited circumstances, particularly in connection with fraud investigation, we may consult publicly available records such as commercial registers or publicly accessible social profiles to verify information provided by a player.

DatoJudi processes your personal data for the following defined purposes. We do not process personal data for purposes that are incompatible with those described below:

• Account management: To create and maintain your player account, authenticate your identity at login, and manage your account settings and preferences.
• KYC and age verification: To verify that you meet the minimum age requirement of21 years and to confirm your identity in compliance with our legal and operational obligations.
• Payment processing: To facilitate deposits, process withdrawal requests, detect payment fraud, and maintain accurate financial records for your account.
• Platform operation and improvement: To deliver the gaming services you have requested, diagnose technical issues, optimise platform performance, and develop new features based on usage patterns.
• Responsible gambling monitoring: To monitor gaming patterns that may indicate problem gambling behaviour and to provide appropriate interventions, self-exclusion tools, and support resources where necessary.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, money laundering, collusion, bonus abuse, and other prohibited conduct on the Platform.
• Customer support: To respond to your queries, resolve disputes, and maintain a record of communications for quality assurance and legal compliance purposes.
• Marketing communications: With your consent, to send you promotional offers, bonus notifications, and news about the Platform. You may withdraw this consent at any time via the unsubscribe mechanism in any communication or by contacting support.
• Legal compliance: To comply with applicable laws, regulations, and lawful requests from competent authorities in Malaysia and other relevant jurisdictions.

DatoJudi processes your personal data one or more of the following legal bases, consistent with the principles of Malaysia's Personal Data Protection Act 2010 (PDPA) and applicable data protection frameworks:

• Contractual necessity: Processing necessary to fulfil the agreement between you and datojudi — including account operation, payment processing, and delivery of gaming services — is carried out on the basis of contractual necessity.
• Consent: Where we rely on your consent as the legal basis for processing — for example, for marketing communications — we will obtain that consent clearly and separately. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
• Legitimate interests: We may process your personal data where it is necessary for our legitimate business interests — such as fraud prevention, platform security, and product improvement — provided that those interests are not overridden by your fundamental rights and freedoms.
• Legal obligation: Where processing is necessary to comply with a legal obligation applicable to datojudi, including anti-money laundering regulations, age verification requirements, and responses to lawful authority requests.

DatoJudi does not sell, rent, or otherwise transfer your personal data to unafiliated third parties for commercial gain. We may share your data with third parties only in the following limited and defined circumstances:

• Payment processors: We share the transaction data necessary to process your deposits and withdrawals with our payment partners, including Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, DuitNow, FPX, and cryptocurrency network facilitators. These parties act as independent data controllers in respect of their own processing.
• Identity verification providers: We engage third-party KYC service providers to verify the identity and age of players. These providers receive copy of your verification documents and return a verification result. They are prohibited from using your data for any purpose beyond providing the verification service to datojudi.
• Fraud prevention and security services: We share technical and transactional data with fraud detection and anti-money laundering service providers to protect the integrity of the Platform and the interests of all players.
• Legal and regulatory authorities: We may disclose personal data to competent Malaysian regulatory authorities, law enforcement agencies, or courts where required to do so by applicable law, court order, or lawful governmental request. We will notify you of such disclosure where permitted by law.
• Corporate transactions: In the event of a merger, acquisition, or sale of all or part of datojudi's business, your personal data may be transferred as part of that transaction. You will be notified of any such transfer and the privacy practices of the acquiring entity before your data is transferred.

All third-party service providers engaged by datojudi are subject to contractual obligations requiring them to maintain appropriate technical and organisational security measures and to process personal data only as instructed by datojudi.

DatoJudi retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention principles apply:

• Active account data: Personal data associated with an active player account is retained for the duration of the account's existence and for a period of up to 7 years following permanent account closure, to satisfy potential legal, regulatory, and dispute resolution requirements.
• KYC and verification documents: Identity documents and verification records are retained for a minimum of 5 years following the closure of an account, in compliance with anti-money laundering record-keeping obligations.
• Financial transaction records: Deposit, withdrawal, and betting transaction records are retained for a minimum of 7 years following the transaction date for accounting and audit purposes.
• Support communications: Live chat transcripts and email correspondence are retained for a minimum of 3 years for quality assurance and dispute resolution purposes.
• Marketing consent records: Records of marketing consent (and any withdrawal of consent) are retained for as long as may be required to demonstrate compliance.
• Cookies and technical data: Session cookies expire at the end of your browser session. Persistent cookies and analytics data are retained for the periods specified in our Cookie Policy section.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised such that it can no longer be associated with an identifiable individual.

DatoJudi implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. Our security infrastructure includes:

• Transport Layer Security: All data in transit between your browser and our servers is encrypted using 256-bit SSL/TLS protocols. We enforce HTTPS across all pages of the Platform.
• Server-side encryption: Personal and financial data stored on our servers is encrypted at rest using industry-standard encryption algorithms.
• Access management: Strict role-based access controls limit staff access to personal data to the minimum necessary for their operational function. All access is logged and subject to periodic review.
• Intrusion detection and monitoring: Our security team operates 24/7 monitoring for anomalous access patterns, suspicious transactions, and potential data breaches.
• Penetration testing: DatoJudi's platform undergoes regular security testing by qualified third-party security professionals to identify and address potential vulnerabilities.
• Data breach response: In the event of a confirmed personal data breach that poses a risk to your rights and freedoms, datojudi will notify affected players and, where applicable, relevant regulatory authorities as promptly as practicable.

As a datojudi player and as a data subject under applicable data protection principles, you have the following rights in respect of your personal data. These rights may be exercised by contacting our support team at any time.

To exercise any of the above rights, please contact our support team via live chat or by email. We will respond to your request within a reasonable timeframe and in any event within 30 days. We reserve the right to verify your identity before processing a data rights request.

DatoJudi uses cookies and similar tracking technologies to provide a functional, secure, and personalised experience on the Platform. The following categories of cookies are used:

• Essential cookies: These are strictly necessary for the Platform to function. They enable session management, authentication, and security features. Essential cookies cannot be disabled without impairing the core functionality of the Platform.
• Functional cookies: These cookies remember your preferences — such as preferred language, currency display settings, and game lobby layout — to provide a consistent experience across sessions.
• Analytics cookies: These cookies collect aggregated, anonymised data about how players use the Platform — including pages visited, time spent, and navigation patterns — to help us improve performance and usability. This data does not identify individual players.
• Security cookies: These cookies assist our fraud detection systems by identifying unusual access patterns, suspicious login behaviour, and other signals that may indicate unauthorised account access.

You may configure your browser to refuse cookies or to alert you when cookies are being sent. Please note that disabling certain categories of cookies may affect the functionality and security of the Platform.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by datojudi, please contact our Data Privacy team through any of the following channels. All formal data-related requests should be submitted in writing to enable proper documentation and processing.