Your privacy is not a compliance checkbox at Dafatoto — it is a foundational commitment. This Privacy Policy explains precisely what personal data we collect from Malaysian players, why we collect it, how it is stored and protected, and the rights you hold over your own information. We encourage you to read it fully before creating an account.
This Privacy Policy (the "Policy") is issued by Dafatoto (the "Platform", "Company", "We", "Us", or "Our"), the operator of the online gaming and sports betting website accessible at https://dafatoto.cam. This Policy applies to all individuals who visit, register on, or otherwise interact with the Dafatoto platform, including players located in Malaysia and other permitted jurisdictions.
Dafatoto is committed to processing personal data in a lawful, fair, and transparent manner, consistent with internationally recognised data protection principles. We collect only the data that is necessary for the provision of our gaming services, fulfilment of regulatory obligations, and delivery of a high-quality player experience. We do not collect personal data beyond what is described in this Policy.
By accessing the Dafatoto platform, creating an account, or using any of our Services, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree with any provision of this Policy, please discontinue use of the platform immediately.
This Privacy Policy should be read in conjunction with Dafatoto's Terms & Conditions. Together, these documents form the full regulatory framework governing your use of the platform.
For the purposes of this Privacy Policy, the following terms carry the meanings assigned below:
Dafatoto collects personal data through several channels: directly from players during registration and KYC verification, automatically during platform usage, and in limited cases from third-party service providers. The categories of personal data we collect are set out below.
| Data Category | Specific Data Points | Collection Method |
|---|---|---|
| Registration Data | Full name, date of birth, email address, username, password (hashed), country of residence | Provided directly by player at registration |
| Identity & KYC Data | Government-issued ID (MyKad, Passport, Driver's License), proof of address document, selfie with ID | Submitted by player via secure upload portal |
| Financial Data | Payment method type, partial account numbers (for verification), transaction history in MYR or cryptocurrency | Generated during deposit / withdrawal transactions |
| Gaming Activity Data | Game sessions, bet amounts, win/loss records, bonus usage history, wagering patterns | Automatically recorded by platform systems |
| Technical Data | IP address, device type, browser type and version, operating system, session duration, referring URL | Automatically collected via server logs and cookies |
| Communication Data | Live chat transcripts, email correspondence, support ticket content | Generated during customer support interactions |
| Marketing Preferences | Communication opt-in/opt-out status, promotional preference history | Set by player in account settings or during registration |
Dafatoto does not knowingly collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, or health information unless specifically required for responsible gambling assessments. If such data is inadvertently received, it will be deleted promptly.
Dafatoto processes personal data on one or more of the following legal bases, depending on the category of data and the specific processing purpose:
Personal data collected through the Dafatoto platform is used exclusively for the following purposes:
Registration data and financial data are used to create and maintain your Dafatoto account, verify your identity during login, process deposits and withdrawals in MYR via Touch 'n Go eWallet, DuitNow, FPX, and partner banks (Maybank, CIMB, Public Bank, Hong Leong), and deliver the gaming content you select.
KYC Data is processed to fulfil Dafatoto's obligations under its international gaming licence, which requires verification of player identity and address prior to processing withdrawal requests. This data is also retained to comply with anti-money laundering record-keeping requirements for the minimum period mandated by applicable law.
Technical Data (including IP address and device identifiers) and gaming activity data are analysed to detect fraudulent behaviour, multi-accounting, bonus abuse, and other activity that breaches our Terms and Conditions. Automated monitoring systems flag unusual patterns for human review by our compliance team.
Gaming activity data is used by our responsible gambling systems to identify potential problem gambling indicators — such as unusual session lengths, escalating deposit patterns, or rapid loss sequences — and to trigger appropriate player welfare interventions, including pop-up messages, account limit suggestions, and outreach from our support team.
Communication data — including live chat transcripts and email correspondence — is retained to provide ongoing support, resolve disputes, and improve the quality of our support team's responses. All support interactions are conducted in English and are accessible to support staff with a legitimate operational need.
Where a Player has provided consent to receive marketing communications, we may use their email address or contact details to send promotional offers, bonus notifications, and platform updates. Players located across Malaysia — including Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, and Shah Alam — may receive localised promotional content including seasonal offers, EPL and Liga Super Malaysia bonus campaigns, and payment method promotions. Marketing consent may be withdrawn at any time.
Dafatoto does not sell, rent, or trade personal data to third-party commercial entities for their own marketing or commercial purposes. Data is shared only in the following limited and controlled circumstances:
Dafatoto has never sold player personal data to advertising networks, data brokers, or third-party marketers, and has no plans to do so. This commitment is unconditional and is not subject to any commercial arrangement.
Dafatoto retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law and regulatory obligations. The following retention periods apply as a general guide:
| Data Category | Retention Period | Basis for Retention |
|---|---|---|
| Account Registration Data | Duration of account + 5 years post-closure | Contractual & legal obligation |
| KYC / Identity Documents | 5 years from account closure or last transaction | AML regulatory requirement |
| Financial Transaction Records | 5–7 years (varies by jurisdiction) | AML & accounting legal obligation |
| Gaming Activity Logs | 3 years from last activity | Legitimate interest (dispute resolution) |
| Support Communications | 2 years from last interaction | Legitimate interest (service quality) |
| Marketing Preferences & Logs | Until consent withdrawn + 1 year | Consent-based processing |
| Technical / Server Log Data | 90 days (rolling) | Security & fraud monitoring |
Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our data disposal procedures. Anonymised data that cannot be re-identified may be retained indefinitely for statistical and analytical purposes.
Dafatoto implements a multi-layered security architecture designed to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. Our technical and organisational measures include:
While Dafatoto takes comprehensive measures to protect your data, no digital system is entirely immune from security risks. You should protect your own account by choosing a strong, unique password and not sharing your login credentials with any third party.
Dafatoto uses cookies and similar tracking technologies to enable essential platform functionality, remember your preferences, and analyse platform performance. The categories of cookies we use are described below:
These cookies are required for the platform to function correctly and cannot be disabled. They include session authentication tokens, security cookies, and cookies that maintain your account login state during a session. No consent is required for strictly necessary cookies.
Functional cookies remember your preferences — such as language settings, preferred game categories, and display options — so that you do not need to re-enter them on each visit. These cookies improve your user experience but are not required for core platform functionality.
With your consent, Dafatoto may use analytics cookies to collect anonymised data about how visitors interact with the platform — including pages visited, time spent, and navigation paths. This data helps us identify areas for improvement. Analytics cookies do not identify you personally.
You may manage non-essential cookie preferences through your browser settings or through any cookie preference tool available on the platform. Please note that disabling certain cookies may affect the functionality of some platform features.
Subject to applicable law and certain exceptions permitted by law (such as data retained for AML compliance), you hold the following rights in respect of your personal data held by Dafatoto. You may exercise any of these rights by contacting us at the details set out in Clause 14.
As a Dafatoto player, you hold meaningful rights over the personal data we hold about you. These rights are not conditional on your account status and may be exercised at any time.
You have the right to request a copy of all personal data Dafatoto holds about you. We will respond to verified access requests within 30 days. The data will be provided in a structured, machine-readable format where possible.
If you believe any personal data we hold about you is inaccurate or incomplete, you may request correction at any time. Account-level corrections (such as address updates) can be made directly through your account settings.
You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected and no overriding legal obligation requires its retention. Data subject to AML retention requirements cannot be erased ahead of schedule.
In certain circumstances — for example, where you contest the accuracy of your data or have objected to processing — you may request that we restrict further processing of your personal data while the matter is under review.
Where processing is based on your consent or contractual necessity, and is carried out by automated means, you have the right to receive your personal data in a portable format suitable for transfer to another service provider of your choice.
You may object to processing based on our legitimate interests — including direct marketing and certain analytics activities. Objections to marketing are actioned immediately. Other objections will be assessed against applicable legal grounds.
To exercise any of the above rights, please contact Dafatoto's support team via live chat or by sending a written request to [email protected]. We may ask you to verify your identity before processing any rights request. All requests will be acknowledged within 5 business days.
The Dafatoto platform is strictly restricted to individuals who are at least 21 years of age. We do not knowingly collect personal data from anyone under the age of 21. If you are under 21, you are not permitted to register an account, use any of our gaming Services, or provide any personal data to Dafatoto for any purpose.
Age verification is a mandatory component of the KYC process for all accounts. Any account found to belong to a person under 21 years of age will be immediately suspended, all associated data reviewed, and the matter escalated to our compliance team. Real Money Funds will be returned; Bonus Funds and winnings derived from underage gameplay will be forfeited.
If a parent or guardian believes that a minor has registered on the Dafatoto platform using their identity or has accessed the platform through a shared device, they should contact our support team immediately at [email protected]. We take underage access extremely seriously and will act swiftly to investigate and remediate any such situation.
21+ Only: Dafatoto enforces a strict 21+ minimum age policy. For guidance on responsible gaming and parental controls, please visit our Responsible Gambling page.
As an internationally operated gaming platform, Dafatoto may transfer personal data across national borders in connection with the provision of its Services. This may occur, for example, when data is processed by a payment service provider, identity verification partner, or game content supplier located in a different jurisdiction to the player.
Where personal data is transferred internationally, Dafatoto ensures that appropriate safeguards are in place, including contractual data protection clauses with the receiving entity, to provide a level of protection equivalent to the standards described in this Policy. Dafatoto does not transfer personal data to jurisdictions that do not provide an adequate level of data protection without implementing appropriate additional safeguards.
Dafatoto reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or platform functionality. Material changes to this Policy will be communicated to registered players via their registered email address and/or through a prominent notice on the platform at least 7 days before the changes take effect.
The "Last Updated" date at the top of this Policy indicates when the most recent revision was made. Continued use of the platform following the effective date of any amendment constitutes acceptance of the revised Policy. If you do not agree to the revised Policy, you should cease using the platform and request account closure.
If you have any questions, concerns, or requests regarding this Privacy Policy or the manner in which Dafatoto processes your personal data, please contact our Data Protection team through the following channels:
Our support team serves players across all regions of Malaysia — including Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and beyond — and operates in English at all hours. We endeavour to respond to all formal data rights requests within 5 business days of receipt.
This Privacy Policy was last reviewed and updated on 1 January 2026. In the event of any conflict between this Privacy Policy and the privacy provisions of the platform's Terms & Conditions, this Privacy Policy shall take precedence in all matters specifically relating to personal data and data protection.
Six concrete data protection practices that set Dafatoto apart from less scrupulous operators in the market.
Dafatoto has never sold player personal data to advertisers, data brokers, or any third-party commercial entity. Player data is used solely to deliver Services — never as a commercial product.
Every data transmission between your device and Dafatoto's servers is protected by bank-grade 256-bit SSL/TLS encryption. KYC documents and financial data are encrypted at rest using AES-256.
We collect only the data strictly necessary for account management, KYC compliance, and service delivery. No speculative data collection — every data point collected has a documented, lawful purpose.
Dafatoto's systems undergo regular penetration testing and third-party security audits to identify and close vulnerabilities before they pose a risk to player data or platform integrity.
Marketing communications are sent only to players who have explicitly opted in. Every marketing email includes a clear, one-click unsubscribe option. Consent withdrawal is processed immediately.
Every category of personal data has a defined maximum retention period. Data is securely deleted or anonymised when the retention period expires — not held indefinitely "just in case".
Our support team handles data rights requests 24/7. Whether you want to access your data, update it, or have it deleted — we'll help you every step of the way.