Privacy Policy & Data Protection Exotot

Exotot Entertainment ("exotot", "we") operates an online entertainment platform accessible via https://exotot.app and our mobile app. As a platform built on user trust, we take the privacy and security of your personal data seriously.

This Privacy Policy ("Policy") explains in detail how we collect, use, store, protect, and in certain circumstances, share your personal information when you use the exotot platform. This Policy applies to all users who register, browse, or interact with any part of our platform, whether via web browser or mobile app.

By registering or continuing to use the exotot platform, you acknowledge that you have read and understood this Privacy Policy and agree to how we handle your personal data as described herein. If you do not agree with any part of this Policy, we encourage you to contact us for further clarification before continuing to use the platform.

This Policy should be read together with Terms and Conditions and Responsible Gaming Policy exotot, all of which form a comprehensive user protection framework on our platform.

Exotot collects various types of data depending on how you interact with our platform. Generally, the data we collect can be categorized as follows:

We only collect data that is strictly necessary for the stated purpose. We do not collect sensitive information such as biometric data, medical records, or political affiliations.

Exotot collects your personal data through the following channels:

• Account Registration: Information you provide when creating a new account, including your name, email, phone number, and date of birth.
• KYC Verification: Identity documents and proof of address that you upload during the account verification process.
• Financial Transactions: Information shared by payment processors such as FPX, DuitNow, Touch 'n Go eWallet, Boost, and GrabPay during deposits or withdrawals.
• Platform Usage: Data collected automatically when you use the platform, including game records, clicks, and navigation patterns.
• Cookies & Similar Technologies: Information collected through cookies, tracking pixels, and local storage to enhance user experience.
• Direct Communication: Information you share via live chat, support email, or feedback forms.
• Third-Party Sources: In certain cases involving fraud prevention or identity verification, we may receive data from authorised identity verification agencies.

Every piece of data we collect has a clear and legitimate purpose. exotot uses your personal data for the following purposes:

• Account Management: Creating and managing your account, including identity verification (KYC) and user profile maintenance.
• Transaction Processing: Processing deposits, withdrawals, and all financial activities securely and accurately.
• Service Provision: Enabling you to access all platform features including sports betting, Live Casino, bingo, and other games.
• Security & Fraud Prevention: Detecting and preventing fraudulent activity, money laundering, and platform abuse.
• Legal Compliance: Fulfilling compliance obligations under applicable Malaysian law, including PDPA 2010 and regulatory requirements.
• Platform Improvements: Analyzing usage patterns to improve performance, interface design, and overall user experience.
• Service Communication: Sending important notices related to your account, security updates, and information relevant to your transactions.
• Marketing (with consent): Notifying you about exotot's latest promotions, bonuses, and offers — only if you have given consent to receive marketing communications.

Exotot does not sell or trade your personal data. However, under limited and controlled circumstances, we may share your data with the following parties:

• Payment Processors: Payment service providers such as FPX, DuitNow, and e-wallets that require transaction details to process your payments securely.
• Technology Service Providers: Companies that help us manage the platform's infrastructure, including cloud services, analytics, and technical support — all bound by strict confidentiality agreements.
• Identity Verification Agency: Parties that assist us in carrying out the KYC process to ensure compliance with legal requirements related to age and identity verification.
• Legal Authorities: Regulatory bodies, law enforcement agencies, or courts when we are required to do so by Malaysian law or a valid court order.
• Professional Advisors: Auditors, lawyers, and consultants bound by professional confidentiality obligations when providing advice to exotot.

In all data sharing instances, exotot ensures that recipients comply with equivalent data protection standards and use the data only for the stated purposes.

Exotot implements comprehensive technical and organizational security measures to protect your personal data from unauthorized access, disclosure, alteration, or destruction.

• 256-bit SSL Encryption: All communications between your device and our servers are secured with the latest TLS protocols, ensuring data is fully encrypted in transit.
• Two-Factor Authentication (2FA): An additional security layer available to all user accounts to prevent unauthorized access even if a password is compromised.
• Real-Time Monitoring: An automated threat detection system operating 24/7 to identify and respond to any suspicious activity.
• Internal Access Controls: The principle of least privilege ensures that only staff who need access can view user data, with every access recorded in an audit log.
• Regular Data Backups: Data is regularly backed up to separate locations to ensure service continuity and data recovery in the event of a technical incident.
• Security Testing: Security audits and penetration testing are conducted periodically by independent parties to identify and patch system vulnerabilities.

Exotot retains your personal data only for as long as necessary to fulfill the purpose it was collected for, or as required by applicable Malaysian law. General retention period guidelines are as follows:

Once the retention period expires, your data will be securely deleted or converted to an anonymised format that cannot be linked back to your identity.

As an exotot user, you have the following rights regarding your personal data under Malaysia's Personal Data Protection Act 2010 (PDPA):

• Right of Access: You may request a copy of all personal data we hold about you.
• Right to Rectification: You may request that we correct any personal data that is inaccurate or incomplete.
• Right to Erasure: Under certain circumstances, you may request that we delete your personal data, subject to our legal obligations.
• Right to Object: You may object to the processing of your data for direct marketing purposes at any time.
• Right to Data Portability: You may request your data in a structured, machine-readable format for transfer to another platform.

To exercise any of the above rights, please contact our privacy team by email at [email protected]. We will handle your request within 30 business days.

Exotot uses cookies and similar tracking technologies to enhance user experience, analyze platform traffic, and maintain the security of your login session. Below are the types of cookies we use:

• Essential Cookies: Required for core platform functions such as login authentication, session security, and language preferences. These cookies cannot be disabled as they are essential for the platform to function.
• Performance Cookies: Collecting information on how you use the platform — pages visited, time spent, errors encountered — to help us improve platform performance.
• Functional Cookies: Saving your preferences such as language, display settings, and login information to deliver a more personalized experience.
• Analytics Cookies: We use internal analytics tools to understand aggregated usage patterns for platform improvement purposes. This data is anonymized.

You can manage or delete cookies through your web browser settings at any time. Please note that disabling essential cookies may affect platform functionality.

The exotot platform is exclusively for users aged 18 years and above only. We do not knowingly collect any personal data from individuals under the age of 18.

If we discover that personal data of a minor has been collected without our knowledge, we will take immediate steps to delete that data and close the account in question. Parents or guardians who become aware that their child has registered on the exotot platform are requested to contact us immediately at [email protected].

Exotot reserves the right to modify this Privacy Policy from time to time to reflect changes in our practices, new legal requirements, or platform improvements. Any significant changes will be communicated to you via:

• An email notice to your registered address at least 14 days before the changes take effect.
• A clear notice on the platform's home page and login page.
• Update the "Last Updated" date at the top of this document.

Continued use of the platform after the effective date of any amendment constitutes acceptance of the updated terms. We encourage you to review this page periodically.

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, the exotot privacy team is here to help:

• Privacy Email: [email protected]
• Live Chat: Available 24/7 via the chat icon at the bottom right corner of the platform.
• Response Time: Within 5 business days for privacy-related enquiries.

For general inquiries about the platform, you may also visit the FAQ us.