Bobatoto is committed to protecting the privacy and personal data of all users on our platform. This Privacy Policy explains in clear, structured terms what data we collect, how we use it, who we share it with, how long we retain it, and what rights you hold as a data subject. We encourage you to read this document in full before using our services.
All personal data and financial information transmitted to and from the bobatoto platform is protected with 256-bit SSL encryption. Your data is never sent or stored in plaintext.
Bobatoto does not sell, rent, or trade your personal data to third parties for marketing or commercial purposes. Your information is used solely to operate and improve our platform.
You retain the right to access, correct, and request deletion of your personal data at any time. Requests are handled by our data team within a reasonable timeframe.
We collect only the data that is necessary for the purposes stated in this policy. We do not collect sensitive data beyond what is required for KYC compliance, account management, and payment processing.
Personal data is retained only for as long as it is necessary for the purposes for which it was collected, or as required by applicable law. Retention periods are defined per data category in this policy.
We use cookies strictly for platform functionality, session management, and performance analytics. We do not use third-party advertising cookies. Cookie usage is detailed in Section 7 of this policy.
This Privacy Policy ("Policy") sets out the basis on which bobatoto ("bobatoto", "we", "us", "our") collects, processes, stores, and shares personal data obtained from individuals ("User", "you", "your") who access or use the bobatoto website at bobatoto.cam and all related services, features, and content made available thereon (collectively, the "Platform").
Bobatoto is committed to handling personal data responsibly, transparently, and in accordance with applicable data protection principles. We take seriously our obligations as a data controller and have designed our data practices to ensure that your information is collected only where necessary, processed lawfully, and protected appropriately.
This Policy applies to all users of the Platform, including registered account holders and visitors browsing the Platform without an account. By accessing or using the Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.
This Policy should be read together with our Terms & Conditions and Responsible Gambling Policy, both of which form part of the overall agreement governing your use of the bobatoto Platform.
The following terms carry the meanings assigned to them throughout this Policy:
Any information relating to an identified or identifiable natural person — including name, identification number, contact details, financial information, location data, and online identifiers such as IP addresses and device IDs.
Any operation or set of operations performed on personal data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, transmission, restriction, erasure, or destruction.
The entity that determines the purposes and means of processing personal data. Bobatoto acts as the data controller in respect of personal data collected via the Platform.
A third party that processes personal data on behalf of the data controller, under contractual instruction and subject to appropriate data protection obligations.
Know Your Customer — the identity verification process through which bobatoto confirms a User's identity, age, and eligibility, as required by compliance frameworks applicable to the Platform's operations.
Small text files placed on a user's device by the Platform to facilitate session management, performance monitoring, and user preference storage, as further described in Section 7.
Bobatoto collects personal data through multiple channels in the course of operating the Platform. The categories of data collected, together with the circumstances in which they are collected, are set out below.
We collect data that you voluntarily provide when:
When you access the Platform, we automatically collect certain technical and usage data, including:
We may receive personal data from third-party identity verification services used in the KYC process, payment processors facilitating transactions on the Platform, and fraud detection service providers. Such data is processed only for the purposes consistent with those stated in this Policy and subject to appropriate data sharing agreements.
Data Minimisation Principle: Bobatoto collects only the personal data that is necessary for the specific purposes described in this Policy. We do not collect personal data in excess of what is required and do not retain data longer than necessary.
Bobatoto processes your personal data on the following legal bases, as applicable to each processing activity:
| Processing Activity | Legal Basis |
|---|---|
| Account registration and management | Performance of a contract (the Terms & Conditions between you and bobatoto) |
| Processing deposits and withdrawals | Performance of a contract; legal obligation (financial compliance) |
| KYC identity verification | Legal obligation; legitimate interests (fraud prevention, platform security) |
| Customer support communications | Performance of a contract; legitimate interests |
| Fraud detection and platform security | Legitimate interests; legal obligation |
| Platform analytics and performance monitoring | Legitimate interests (improving platform experience) |
| Responsible gambling monitoring | Legitimate interests; legal obligation; protection of vital interests |
| Marketing communications (where applicable) | Consent (you may opt out at any time) |
Personal data collected by bobatoto is used for the following purposes:
To create and manage your bobatoto account; verify your identity and eligibility; process deposits and withdrawals via your chosen payment methods (including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and supported Malaysian banks); and deliver the gaming and betting services that constitute the Platform.
To detect, investigate, and prevent fraudulent activity, money laundering, bonus abuse, unauthorised account access, and other prohibited conduct as defined in our Terms & Conditions. This includes monitoring betting patterns, transaction behaviours, and device/IP signals for anomalies inconsistent with legitimate platform use.
To fulfil obligations imposed by applicable laws and regulations, including KYC identity verification requirements, anti-money laundering (AML) obligations, and record-keeping requirements. Where required by law or legal process, we may be required to disclose certain data to competent authorities.
To respond to your enquiries, resolve account issues, process complaints, and provide assistance through our 24/7 support channels in English, Bahasa Melayu, and Chinese.
To analyse aggregated, anonymised usage data for the purpose of improving Platform performance, user experience, game library curation, and payment method integration — particularly as applied to Malaysian mobile users accessing the Platform from Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and other locations.
To monitor gambling behaviour patterns that may indicate potential problem gambling, and to facilitate the application of responsible gambling tools including deposit limits, cooling-off periods, and self-exclusion as requested by users or triggered by internal monitoring protocols.
Where you have provided consent, to send you promotional information about bobatoto's offers, bonuses, and platform updates. You may withdraw marketing consent at any time by contacting our support team or using the unsubscribe functionality in any marketing communication.
Bobatoto does not sell, rent, or trade your personal data. We may share personal data with third parties only in the following limited circumstances:
We engage third-party service providers to assist in operating the Platform, including payment processors (e-wallet operators, FPX / DuitNow network providers, cryptocurrency payment infrastructure), identity verification service providers, platform hosting and infrastructure providers, and customer support technology vendors. All such providers are engaged under written data processing agreements that restrict their use of data to the services they provide to bobatoto.
We may disclose personal data to regulatory authorities, law enforcement agencies, or other competent bodies where required to do so by applicable law, court order, or where we have a good-faith belief that disclosure is necessary to prevent fraud, protect the rights and safety of bobatoto or others, or to comply with a legal process.
In the event of a merger, acquisition, restructuring, or sale of all or part of bobatoto's business assets, personal data held by bobatoto may be transferred to the acquiring entity as part of that transaction, subject to equivalent privacy protections being maintained.
Bobatoto does not share your personal data with third parties for independent marketing, advertising, or commercial purposes. Your data is not processed by advertising networks for targeted advertising.
Where data is shared with third-party processors, we ensure that contractual safeguards are in place and that processors are required to implement appropriate technical and organisational security measures commensurate with the nature of the data processed.
Bobatoto uses cookies and similar tracking technologies to operate the Platform effectively and improve the user experience. By continuing to use the Platform, you consent to the placement of cookies as described in this section.
| Cookie Type | Purpose | Duration |
|---|---|---|
| Strictly Necessary | Essential for the Platform to function. Enables login sessions, navigation, and core security features. Cannot be disabled without impairing Platform functionality. | Session / up to 30 days |
| Performance & Analytics | Collects anonymised data about how users navigate the Platform — pages visited, time on page, error events. Used to identify and resolve technical issues and improve Platform speed. | Up to 12 months |
| Functional | Remembers user preferences such as language settings and display options to provide a more personalised experience on return visits. | Up to 12 months |
| Security | Used for fraud detection, bot prevention, and session integrity verification. Helps identify suspicious login patterns and protect account security. | Session / up to 7 days |
Bobatoto does not use third-party advertising cookies, retargeting pixels, or cross-site tracking technologies. We do not participate in advertising networks that build profiles of users across multiple websites.
You may control cookie settings through your browser's privacy settings. Disabling cookies may affect the functionality of the Platform, including session persistence and login capability. Strictly necessary cookies cannot be disabled without impairing your ability to use the Platform.
Bobatoto retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following indicative retention periods apply:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account registration data | Duration of account + 5 years post-closure | Legal obligation / AML compliance |
| KYC identity documents | Duration of account + 5 years post-closure | Legal obligation / regulatory requirement |
| Transaction and payment records | 7 years from transaction date | Financial record-keeping obligations |
| Betting and gaming activity logs | 3 years from date of activity | Legitimate interests / dispute resolution |
| Customer support records | 3 years from last contact | Legitimate interests / complaint resolution |
| Marketing consent records | Until withdrawal of consent + 3 years | Legal obligation / proof of consent |
| Platform analytics data (anonymised) | Up to 24 months | Legitimate interests / Platform improvement |
Upon expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be associated with an identifiable individual. Where data must be retained for a longer period due to active legal proceedings or regulatory investigations, retention will continue until the matter is resolved.
Bobatoto implements appropriate technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, or alteration. Our security framework includes:
Your Responsibility: While we maintain robust platform-side security, you are responsible for maintaining the confidentiality of your account credentials. Do not share your username or password with any third party. Bobatoto will never request your password through any communication channel.
In the event of a data security incident that is reasonably likely to result in risk to your rights and freedoms, bobatoto will notify affected users and, where required, relevant supervisory authorities, in accordance with applicable data breach notification requirements.
As a user of the bobatoto Platform, you hold certain rights in relation to your personal data. These rights are described below. To exercise any of the rights listed, please contact our support team as described in Section 15.
You have the right to request a copy of the personal data that bobatoto holds about you, together with information about how it is being used. We will respond to access requests within a reasonable timeframe.
If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You may update certain account details directly via your account settings. For KYC-related corrections, please contact our support team.
You may request that we delete your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where no other lawful basis for processing applies. Note that certain data must be retained for legal and regulatory compliance purposes and cannot be erased on request.
You may request that we restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data is being verified following a rectification request, or where processing is unlawful but you prefer restriction over erasure.
Where processing is based on your consent or performed by automated means, you have the right to receive a copy of your personal data in a structured, commonly used, and machine-readable format, and to request that it be transmitted to another controller where technically feasible.
You have the right to object to the processing of your personal data where such processing is based on bobatoto's legitimate interests. You also have an absolute right to object to the use of your data for direct marketing purposes, which will be honoured without the need for justification.
Where processing is based on your consent — including consent to receive marketing communications — you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.
The bobatoto Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect or process personal data from persons under the age of 21. Age verification is conducted as part of the KYC process for all registered accounts, and any account found to be held by a person under 21 will be immediately closed with funds returned to the source of deposit.
If you are a parent or guardian and believe that a minor has accessed the Platform or provided personal data to bobatoto without your consent, please contact us immediately via the channels described in Section 15 so that we may take appropriate action.
Bobatoto takes the protection of minors seriously and invests in technical and procedural measures to prevent under-age access, including date-of-birth verification at registration, KYC document checks, and monitoring for behavioural signals inconsistent with adult users.
The Platform may contain references to or integrations with third-party payment services — including Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, DuitNow, FPX, and cryptocurrency network infrastructure — as well as third-party game studios that provide content on the Platform. These third parties operate their own privacy policies and data practices independent of bobatoto.
When you interact with a third-party payment provider to complete a deposit or withdrawal, data submitted directly to that provider's interface (such as bank login credentials for FPX transactions) is processed by that provider under their own privacy policy. Bobatoto does not receive or store your banking credentials.
We encourage you to review the privacy policies of any third-party services you interact with in connection with your use of the bobatoto Platform. Bobatoto is not responsible for the privacy practices of third-party operators.
In operating the Platform, personal data may be transferred to, and processed in, countries outside of Malaysia. This may occur where our hosting infrastructure, third-party service providers, or game studio partners are located in jurisdictions other than Malaysia.
Where such transfers occur, bobatoto takes appropriate measures to ensure that personal data is protected to a standard equivalent to the protections afforded under applicable Malaysian data protection principles, including through contractual data transfer mechanisms with recipient entities.
If you have questions about the specific safeguards applied to international data transfers involving your personal data, you may contact us as described in Section 15.
Bobatoto reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, applicable laws, or Platform features. Material changes to this Policy will be communicated to registered users via email notification or through a prominent notice on the Platform prior to the effective date of the change.
The date of the most recent revision is displayed at the top of this page. We encourage you to review this Policy periodically to stay informed of how we manage your personal data. Your continued use of the Platform following publication of a revised Policy constitutes your acceptance of the changes.
Where changes relate to processing activities for which you have previously provided consent, we will seek fresh consent where required before proceeding with the revised processing.
If you have any questions about this Privacy Policy, wish to exercise any of your data subject rights described in Section 10, or need to report a concern relating to the handling of your personal data, please contact us through the following channels:
Submit data subject requests, privacy questions, or formal complaints in writing to: [email protected] — Please include "Data Privacy Request" in the subject line and your registered account username. We aim to respond within 30 days of receipt.
For general privacy-related questions, live chat agents are available around the clock on the Platform in English, Bahasa Melayu, and Chinese. Live chat is available for initial queries; formal data subject requests should be submitted in writing.
WhatsApp support is available for account-related and privacy enquiries. Contact details are available within your account's support section following login.
Bobatoto endeavours to respond to all data subject requests and privacy enquiries within 30 calendar days of receipt. Where a request is complex or involves a large volume of data, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reasons for it.
For matters relating to responsible gambling, including requests to set deposit limits, initiate cooling-off periods, or activate self-exclusion, please contact our 24/7 support team directly or visit our Responsible Gambling page. Malaysia's national helpline Talian Kasih 15999 is also available for gambling-related support.
Your privacy and security are not afterthoughts at bobatoto — they are core to how we build and operate the platform. For players aged 21 and above across Malaysia. Play responsibly.
🔞 21+ only · 256-bit SSL encryption · No data selling · Play responsibly