No Sale of Personal Data
paktoto does not sell, rent or trade personal data to third-party advertisers, data brokers or marketers at any time, under any circumstances.
Data & Privacy
Privacy Policy — paktoto
This Privacy Policy explains how paktoto collects, processes, stores, shares and protects personal information provided by users of the paktoto platform. Please read this document carefully before registering an account or submitting any personal data. Your continued use of paktoto constitutes acceptance of this policy.
Last updated: 1 January 2026Introduction
paktoto ("we", "us", "our", "the Platform") is committed to protecting the personal information of all individuals who access or use the paktoto website at paktoto.cam ("the Platform"). This Privacy Policy ("Policy") describes the categories of personal data we collect, the purposes for which we process that data, the parties with whom we may share it, the rights available to you and the measures we take to keep your information secure.
This Policy applies to all registered users, visitors and any other individuals whose personal information is processed in connection with the paktoto platform. It should be read alongside the paktoto Terms and Conditions, which govern the overall agreement between you and paktoto.
paktoto's primary user base consists of Malaysian players accessing the platform in English. All personal data processing described in this Policy applies regardless of the city or region within Malaysia from which a user accesses the platform — whether Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam or elsewhere.
If you have questions about this Policy or wish to exercise any of your data rights, please contact us using the details in Section 14.
Definitions
The following terms carry the meanings assigned to them throughout this Policy.
- Personal Data — Any information that identifies or could reasonably be used to identify a living individual, directly or in combination with other available information.
- Data Controller — paktoto, which determines the purposes and means of processing personal data collected through the platform.
- Data Processor — A third party that processes personal data on behalf of paktoto under a contractual data-processing arrangement.
- Processing — Any operation or set of operations performed on personal data, including collection, recording, storage, retrieval, use, disclosure, erasure or destruction.
- User — Any individual who creates a paktoto account, browses the platform or otherwise provides personal information to paktoto.
- KYC — Know Your Customer: the identity and document verification process required for full paktoto account functionality.
- Cookie — A small text file placed on a user's device by a website to store session, preference or analytical data.
- Sensitive Data — A subset of personal data requiring enhanced protection, including identity document numbers, financial account details and health-related information.
Data We Collect
paktoto collects personal data through several channels: directly from users during registration and account use, automatically during platform interaction, and from third-party verification and payment partners where necessary. The following categories of data may be collected.
Registration Data
Full name, date of birth, email address, username, password (hashed) and preferred language at the time of account creation.
Identity Verification Data
Copies of identity documents such as a Malaysian MyKad, driving licence or passport; proof-of-address documents such as utility bills; and selfie photographs where KYC requires them.
Financial Data
MYR transaction records; payment method identifiers for Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank and Hong Leong; deposit and withdrawal history.
Device & Technical Data
IP address, browser type, operating system, device identifiers, referring URL, session duration and pages visited during platform use.
Behavioural Data
Game selection, wagering history, stake amounts, session patterns and interaction with sports betting markets including football, EPL, Liga Super Malaysia and UFC.
Communications Data
Content of messages sent to paktoto support, live chat transcripts, email correspondence and any information provided when raising a query or complaint.
paktoto collects only data that is relevant and necessary for the purposes described in this Policy. You are not obliged to provide all requested data; however, certain categories — such as KYC identity documents — are required to enable full account functionality including withdrawals.
Data Processing
paktoto processes personal data for the following purposes. Each purpose is supported by a lawful basis as described in Section 5.
- Account creation and management: Creating, maintaining and securing user accounts; verifying user identity through KYC; managing account settings, balance records and transaction history.
- Payment processing: Facilitating MYR deposits and withdrawals through supported Malaysian payment partners; verifying payment method ownership; detecting and preventing fraudulent transactions.
- Service delivery: Providing access to casino games, live tables, sports betting markets and other paktoto platform features; recording wager outcomes and maintaining accurate game and account records.
- Customer support: Responding to account queries, payment issues, KYC questions and general support requests submitted via live chat or email to [email protected].
- Responsible gambling: Monitoring account activity to identify potential problem gambling indicators; enforcing self-exclusion requests and deposit or session limits set by the user; verifying age eligibility.
- Legal and regulatory compliance: Meeting anti-money-laundering obligations; responding to lawful requests from competent authorities; maintaining records required under applicable financial and gaming regulations.
- Platform analytics and improvement: Analysing aggregated usage patterns to improve game catalogue, payment routes and overall platform performance. This analysis does not use personal data for profiling purposes beyond the platform context.
- Communications: Sending account-related notifications, transaction confirmations, security alerts and, where consent has been provided, promotional messages about relevant paktoto offers.
Lawful Basis for Processing
paktoto processes personal data only where a legitimate lawful basis exists. The primary bases relied upon are as follows.
- Contractual necessity: Processing required to fulfil the agreement between paktoto and the user — including account registration, payment processing and game access — is based on the performance of the contract constituted by the paktoto Terms and Conditions.
- Legal obligation: KYC identity verification, anti-money-laundering checks and certain record-keeping activities are carried out to comply with applicable legal and regulatory requirements.
- Legitimate interests: Platform security monitoring, fraud detection, responsible gambling oversight and analytical activities conducted to improve the paktoto service are based on paktoto's legitimate business interests, provided those interests are not overridden by the rights and interests of users.
- Consent: Where paktoto sends direct marketing communications, the lawful basis is your prior explicit consent. You may withdraw marketing consent at any time by contacting [email protected]. Withdrawal of consent does not affect processing carried out before withdrawal.
paktoto does not use personal data to make solely automated decisions that produce significant legal or similarly significant effects on users without human review where required.
Data Sharing
paktoto does not sell personal data to third parties. Personal data may be shared with the following categories of recipients where necessary and subject to appropriate safeguards.
- Payment service providers: Malaysian payment partners including e-wallet operators, FPX participants and banking institutions such as Maybank, CIMB and Public Bank receive transaction data necessary to process deposits and withdrawals.
- KYC and identity verification providers: Third-party services that assist paktoto in verifying identity documents and screening against relevant watchlists as required by compliance obligations.
- Technology and infrastructure providers: Cloud hosting, database management and cybersecurity service providers that process data on paktoto's behalf under contractual data-processing agreements.
- Game content providers: Licensed third-party game studios that power paktoto's catalogue may receive anonymised session data necessary for game integrity and fairness auditing. No directly identifiable personal information is shared beyond what is operationally necessary.
- Competent authorities: paktoto will disclose personal data to law enforcement, regulators or courts where required to do so by applicable law or a valid legal process, or where necessary to protect the rights, safety or property of paktoto, its users or the public.
- Business transfers: In the event of a merger, acquisition or sale of all or part of the paktoto business, personal data held by paktoto may be transferred to the acquiring entity, subject to equivalent privacy protections.
No sale of data: paktoto does not sell, rent or trade personal data to third-party marketers or data brokers. Any commercial relationships with third parties are governed by contracts that restrict the use of user data to the defined operational purpose only.
Data Retention
paktoto retains personal data only for as long as necessary to fulfil the purposes described in this Policy or as required by applicable law. The following general retention principles apply.
- Active account data: Personal data associated with an active paktoto account is retained throughout the period the account remains open and active.
- Closed account data: Following account closure, paktoto retains relevant identity, transaction and compliance records for a minimum period as required by applicable anti-money-laundering and financial regulations. This period is typically five to seven years from the date of account closure, though it may vary based on specific legal requirements.
- KYC documents: Identity verification documents are retained for the period required under applicable regulatory standards. Physical copies are not stored; digital copies are held in secure encrypted systems.
- Support communications: Live chat and email correspondence records are retained for a defined operational period to support quality assurance, dispute resolution and legal compliance.
- Analytical data: Aggregated and anonymised behavioural data that cannot be linked back to an individual user may be retained indefinitely for platform improvement purposes.
When personal data is no longer required and no legal obligation to retain it exists, paktoto securely deletes or anonymises it using industry-standard procedures.
User Rights
Subject to applicable law, paktoto users have the following rights in relation to their personal data. To exercise any of these rights, please contact paktoto at [email protected] with your registered email address and a clear description of your request. paktoto will respond within a reasonable timeframe, typically 30 days.
Right of Access
You may request a copy of the personal data paktoto holds about you, together with information about how it is processed and the purposes for which it is used.
Right to Rectification
If any personal data held by paktoto about you is inaccurate or incomplete, you may request that it be corrected. Some corrections may require re-verification of identity documents.
Right to Erasure
You may request deletion of your personal data in certain circumstances — for example, where data is no longer necessary for the purpose for which it was collected, or where you withdraw consent. This right is subject to overriding legal retention obligations.
Right to Object
You may object to the processing of your personal data where that processing is based on legitimate interests. paktoto will cease processing unless compelling legitimate grounds override your interests.
Right to Restriction
In certain circumstances, you may request that paktoto restrict the processing of your data — for example, while the accuracy of data you have contested is being verified.
Right to Portability
Where processing is based on consent or contractual necessity and is carried out by automated means, you may request your personal data in a structured, commonly used and machine-readable format.
paktoto will not discriminate against users who exercise their data rights. Exercising a data right does not affect the validity of your paktoto account unless the right exercised — such as erasure — necessarily requires account closure.
Data Security
paktoto implements technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, disclosure or destruction. These measures include the following.
- HTTPS encryption for all data transmitted between users and the paktoto platform.
- Encrypted storage of sensitive personal and financial data, including KYC documents.
- Access controls restricting internal access to personal data on a need-to-know basis, with role-based permissions.
- Regular security assessments to identify and address vulnerabilities in the paktoto infrastructure.
- Contractual obligations on all third-party data processors to maintain equivalent security standards.
No data transmission or storage system is entirely free from risk. In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected users, paktoto will take appropriate steps to notify affected individuals and relevant authorities in accordance with applicable obligations.
Your responsibility: You are responsible for maintaining the confidentiality of your paktoto account credentials. Never share your password with anyone and contact [email protected] immediately if you suspect unauthorised access to your account.
Minors
paktoto's services are exclusively intended for adults aged 21 and above. paktoto does not knowingly collect personal data from individuals under the age of 21. Age is verified during the account registration and KYC process.
If paktoto becomes aware that it has inadvertently collected personal data from a minor, the relevant account will be closed immediately, all associated data will be deleted as soon as is practicable, and any funds held will be handled in accordance with applicable law and the paktoto Terms and Conditions.
If you believe that a minor has registered an account on paktoto, please notify us immediately at [email protected] so that we can take prompt action.
International Data Transfers
paktoto may transfer personal data to infrastructure providers, technology partners or compliance service providers that operate in jurisdictions outside Malaysia. Where such transfers occur, paktoto takes steps to ensure that appropriate safeguards are in place to protect your personal data at a standard equivalent to that described in this Policy.
These safeguards may include contractual data-processing agreements incorporating standard data protection clauses, transfer impact assessments and restrictions on further onward transfers by recipients.
Malaysian users whose data is transferred internationally retain the same rights described in Section 9 of this Policy. Questions about international data transfers may be directed to [email protected].
Policy Amendments
paktoto reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements or platform operations. When material changes are made, the revised Policy will be published on this page with an updated "Last updated" date, and registered users will be notified where reasonably practicable.
Your continued use of paktoto following publication of an amended Policy constitutes your acceptance of the revised terms. If you do not agree to the updated Policy, you should cease using the platform and request account closure in accordance with the paktoto Terms and Conditions.
Contact Us
If you have questions about this Privacy Policy, wish to exercise a data right or need to report a privacy concern, please contact the paktoto data team using the information below. All communications should be submitted in English and include your registered account email address together with a clear description of your request or concern.
paktoto Data & Privacy Contact
Website email: [email protected]
Live chat: Available 24 hours a day, Malaysia Time
Response target: Within 30 days for formal data rights requests; within 24–48 hours for general privacy queries via email.
Website email: [email protected]
Live chat: Available 24 hours a day, Malaysia Time
Response target: Within 30 days for formal data rights requests; within 24–48 hours for general privacy queries via email.
For account security emergencies — such as suspected unauthorised access — please use the paktoto live chat for the fastest response. For self-exclusion or responsible gambling queries, please also refer to the Responsible Gambling page accessible through the paktoto main navigation.
Privacy at a Glance
Six things paktoto commits to regarding your data
These highlight cards summarise the most important data protection commitments from the full paktoto Privacy Policy above.
Encrypted Data Storage
Sensitive information including KYC documents and financial transaction records is stored using encryption at rest and transmitted exclusively over HTTPS connections.
Purpose-Limited Collection
paktoto collects only the personal data categories necessary for the stated purposes: account operation, payments, KYC, support and compliance. Unnecessary data is not collected.
Your Rights are Respected
Access, rectification, erasure, objection and portability rights are available to all paktoto users. Requests are processed within 30 days of receipt.
No Data from Minors
paktoto does not knowingly collect data from anyone under 21 years of age. Age verification is enforced through registration and KYC. Accounts found to belong to minors are closed promptly.
Transparent Communication
Material Privacy Policy changes are communicated to registered users. Marketing communications are only sent where explicit consent has been obtained and can be withdrawn at any time.
Continue Exploring paktoto
Your privacy is taken seriously here
Now that you have reviewed how paktoto handles your personal data, explore the homepage for the full game catalogue and payment information, or read our FAQ for common account and privacy questions. All content is in English and all transactions are in MYR. 21+ only.