Privacy Policy

1

Introduction

GTRToto ("we", "us", "our", or "the Company") operates the online entertainment platform accessible at gtrtoto.cam. We offer live casino games, sports betting services, slot titles, lottery draws, and related digital products to registered members globally, including players located in Malaysia.

This Privacy Policy ("Policy") describes how GTRToto collects, processes, stores, discloses, and protects the personal data of individuals who visit our website, register an account, or otherwise interact with our services ("Members", "Users", or "you"). This Policy forms part of the contractual relationship between GTRToto and its Members, to be read in conjunction with our Terms & Conditions.

GTRToto is committed to handling personal data in a responsible, transparent, and lawful manner. We do not sell personal data to third parties. We collect only the data necessary to operate your Account, process transactions, fulfil compliance obligations, and improve our services. By registering an Account or using the GTRToto platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

Malaysian Members: While Malaysia's Personal Data Protection Act 2010 (PDPA) primarily governs domestic data processors, GTRToto applies international data protection principles — including purpose limitation, data minimisation, and subject rights — to all Members including those based in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and elsewhere across the country.

2

Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

Personal Data: Any information relating to an identified or identifiable natural person, including name, contact details, identification documents, financial data, and device identifiers.
Data Controller: GTRToto, which determines the purposes and means of processing your personal data.
Data Processor: Any third party that processes personal data on behalf of GTRToto in accordance with our instructions and this Policy.
Processing: Any operation performed on personal data, including collection, storage, use, disclosure, transmission, modification, or deletion.
Consent: A freely given, specific, informed, and unambiguous indication of agreement to the processing of personal data for a stated purpose.
KYC: Know Your Customer — the identity and age verification process conducted to confirm Member identity and regulatory compliance.
Cookie: A small text file placed on a device by the GTRToto platform to enable session management, analytics, and personalisation.
Sensitive Data: A subset of personal data warranting enhanced protection, including government-issued identification numbers and financial account details.

3

Personal Data We Collect

GTRToto collects personal data across several categories depending on how you interact with the platform:

Identity Data

Full legal name
Date of birth
Government-issued ID (MyKad, passport)
Nationality and country of residence

Contact Data

Email address
Mobile phone number
Residential address
City and postcode (e.g., KL, Penang, JB)

Financial Data

eWallet account identifiers (Touch 'n Go, Boost)
Bank account or FPX details
Cryptocurrency wallet addresses
Transaction history and amounts (MYR)

Gaming Data

Game session history and outcomes
Bet records and wagering patterns
Bonus redemption activity
VIP tier and loyalty status

Technical Data

IP address and geolocation
Device type, OS, and browser
Session duration and timestamps
Login history and authentication logs

Communications Data

Live chat transcripts with support
Email correspondence with GTRToto
Complaint and dispute records
Survey responses (where provided)

We apply the principle of data minimisation — we only collect personal data that is genuinely necessary for the stated purposes. We do not collect sensitive categories of data such as racial or ethnic origin, religious beliefs, health data, or biometric data beyond what is required for age and identity verification.

4

How We Collect Data

GTRToto collects personal data through the following channels:

Direct submission: Information you provide when registering an account, completing KYC verification, submitting a withdrawal request, or contacting our support team.
Automated collection: Technical data collected automatically when you access the Platform, including IP address, device identifiers, and session activity logs generated by our servers.
Cookies and tracking: Session and persistent cookies, local storage, and similar technologies deployed on the GTRToto website to maintain your login session, measure platform performance, and personalise your experience.
Payment processors: Transaction confirmation data shared by your payment provider (e.g., DuitNow, FPX, Maybank, Touch 'n Go) when you complete a deposit or withdrawal. GTRToto does not receive or store full payment card numbers.
Third-party identity verification services: Where KYC verification is facilitated by an accredited third-party provider, identity confirmation data is shared with GTRToto in accordance with that provider's terms and our data processing agreements.
Game providers: Summary session and wagering data shared by our licensed game studio partners to populate your account history and enable bonus tracking.

5

Data Processing & Legal Basis

GTRToto processes personal data on the following legal bases:

Contractual necessity: Processing required to register your Account, verify your identity, process deposits and withdrawals, administer bonuses, and provide the gaming services you have requested.
Legal obligation: Processing required to comply with applicable anti-money laundering (AML) obligations, know-your-customer (KYC) requirements, and licence conditions imposed by our regulatory authority.
Legitimate interests: Processing conducted to prevent fraud, detect prohibited conduct, maintain platform security, resolve disputes, and improve the quality of our services — where these interests are not overridden by your privacy rights.
Consent: Processing for direct marketing communications and non-essential cookies, where we have obtained your specific and informed consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Automated Decision-Making: GTRToto uses automated systems to assess certain Account activities — including fraud risk scoring and bonus eligibility checks. Where an automated decision has significant effect on your Account, you have the right to request human review of that decision. Please contact our support team to exercise this right.

6

How We Use Your Data

GTRToto uses the personal data we collect for the following specific purposes:

To register and maintain your GTRToto Member Account
To verify your identity and age in compliance with our KYC obligations (minimum age: 21 years)
To process deposits and withdrawals through your chosen payment method (Touch 'n Go, Boost, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, BTC, USDT)
To administer bonus offers and track wagering activity in accordance with applicable promotion terms
To provide 24/7 customer support via live chat and email correspondence
To detect, investigate, and prevent fraud money laundering, and other prohibited conduct
To enforce our Terms & Conditions and other platform policies
To personalise your in-platform experience based on your gaming history and preferences
To send transactional communications (deposit confirmations, withdrawal notifications, security alerts) via email or SMS
To send promotional communications about new games, bonus offers, and platform updates — only where you have provided consent or where permitted under applicable law
To conduct responsible gambling monitoring in accordance with our programme, including identifying patterns indicative of problem gambling and, where appropriate, proactively engaging with affected Members
To comply with our regulatory obligations including record retention requirements under applicable licence conditions

7

Data Sharing & Disclosure

GTRToto does not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes. We share personal data only in the limited circumstances described below:

Service providers and data processors: Third-party companies engaged by GTRToto to provide specific services — including payment processing, identity verification, fraud detection, customer support tools, and IT infrastructure — under binding data processing agreements that restrict them from using your data for any purpose other than providing those services.
Game studio partners: Licensed game studios whose titles are available on the GTRToto Platform may receive anonymised session-level data necessary to operate their games and generate game logs. These studios are contractually prohibited from using this data to identify individual players independently.
Regulatory and law enforcement authorities: Where required by law, court order, or the conditions of our gaming licence, GTRToto may disclose personal data to competent regulatory authorities, financial intelligence units, or law enforcement agencies. GTRToto will notify affected Members of such disclosures where permitted to do so by law.
Corporate transactions: In the event of a merger, acquisition, or sale of assets involving GTRToto, personal data held by GTRToto may be transferred to the successor entity, subject to that entity assuming the data protection obligations described in this Policy.

No Third-Party Marketing: GTRToto will never share your personal data with advertising networks, data brokers, or unafiliated third parties for marketing purposes without your explicit consent.

8

Cookies & Tracking Technologies

The GTRToto Platform uses cookies and similar tracking technologies to enable core platform functionality, maintain session security, and understand how Members interact with the website. The following categories of cookies are used:

Essential cookies: Required for the Platform to function. These include session authentication cookies, security tokens, and load-balancing identifiers. These cannot be disabled without disrupting your use of the Platform.
Functional cookies: Used to remember your preferences, language settings, and display choices to personalise your experience on return visits.
Analytics cookies: Used to collect aggregated, anonymised data about how Members navigate the Platform. This data helps us identifyability issues and improve overall performance. We use privacy-respecting analytics practices and do not share raw analytics data with third parties.
Marketing cookies (consent required): Used to track the effectiveness of any advertising or promotional campaigns GTRToto operates. These are only activated where you have provided explicit consent.

You may manage your cookie preferences through your browser settings. Disabling essential cookies will impair Platform functionality. For more information about how to manage cookies, please consult your browser's help documentation.

9

Data Retention

GTRToto retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or to comply with applicable legal, regulatory, and licence obligations. Our standard retention periods are as follows:

Account data (identity and contact information): Retained for the duration of the active Account relationship and for a minimum of five (5) years following Account closure, in accordance with AML record-keeping requirements.
Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction to satisfy financial regulatory obligations.
KYC documents: Retained for a minimum of five (5) years following the completion of verification or Account closure, whichever is later.
Gaming session logs: Retained for a minimum of three (3) years to support dispute resolution and responsible gambling monitoring.
Support communications: Retained for two (2) years from the date of the final communication in a support interaction.
Analytics data: Retained in anonymised, aggregated form indefinitely; raw session-level analytics data is deleted or anonymised after twelve (12) months.

On expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our data disposal procedures.

10

Data Security

GTRToto implements industry-standard technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. Our security infrastructure includes:

256-bit SSL/TLS encryption for all data transmitted between your device and GTRToto servers
Encrypted storage of sensitive personal data and KYC documentation at rest
Two-factor authentication (2FA) options for all Member accounts
Role-based access controls limiting staff access to personal data on a strict need-to-know basis
Regular security audits, penetration testing, and vulnerability assessments conducted by qualified security professionals
Incident response procedures designed to detect, contain, and remediate data security incidents within minimum timeframes

In the event of a personal data breach that poses a risk to your rights and freedoms, GTRToto will notify affected Members without undue delay and, where required, report the breach to the relevant supervisory authority. While GTRToto maintains robust security practices, no digital system is entirely immune from risk. Members are encouraged to use strong, unique passwords and to enable2FA on their Account.

11

Your Data Rights

GTRToto respects your rights as a data subject. Depending on your jurisdiction and the legal basis for processing, you may be entitled to exercise the following rights in respect of your personal data:

Right of Access

Request a copy of the personal data GTRToto holds about you, along with information about how it is processed.

Right to Rectification

Request correction of inaccurate or incomplete personal data held on your Account.

Right to Erasure

Request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.

Right to Restrict Processing

Request that we limit processing of your data in certain circumstances, such as where accuracy is contested or processing is unlawful.

Right to Data Portability

Request a structured, machine-readable copy of data you have provided to GTRToto, where processing is based on consent or contract.

Right to Object

Object to processing based on legitimate interests, including direct marketing. Objections to marketing will always be honoured immediately.

To exercise any of the above rights, please contact our Data Protection team via the in-platform live chat or by email at [email protected]. GTRToto will acknowledge your request within 5 business days and aim to fulfil it within 30 calendar days. We may request proof of identity before processing your request to prevent unauthorised data disclosure.

Limits on Erasure: Please note that the right to erasure cannot override GTRToto's legal obligations to retain certain data under AML, KYC, and licence compliance requirements. Where we are legally required to retain data, we will inform you of this at the time of your erasure request.

12

Minors & Age Restriction

GTRToto is strictly for individuals aged21 years and above. We do not knowingly collect personal data from individuals under the age of 21. All Account registrations are subject to mandatory age verification as part of our KYC process. Any Account found to belong to a person under 21 will be immediately closed and all personal data associated with it deleted in accordance with our data disposal procedures.

If you are a parent or guardian and believe that a minor has registered an Account on GTRToto without your knowledge, please contact us immediately via live chat so that we can investigate and take appropriate action. We take underage gambling concerns extremely seriously and treat all such notifications as high-priority matters.

13

Cross-Border Data Transfers

GTRToto operates as an international platform and your personal data may be processed in countries outside of Malaysia. These countries may have data protection laws that differ from those applicable in Malaysia. Where personal data is transferred internationally, GTRToto implements appropriate safeguards to ensure your data receives a level of protection consistent with the standards described in this Policy, including:

Contractual data protection clauses binding recipient entities to equivalent data handling standards
Transfer to countries or entities that maintain adequate data protection frameworks assessed by GTRToto's compliance team
Encryption of data in transit across all international transfer channels

By using the GTRToto Platform, you acknowledge and consent to the transfer of your personal data to international data processing locations under the safeguards described above.

14

Amendments to This Policy

GTRToto reserves the right to update or amend this Privacy Policy at any time. When material changes are made, we will update the effective date displayed at the top of this page and, where appropriate, notify active Members via their registered email address. Where changes affect the legal basis or purposes of processing in a way that may affect your rights, we will provide more prominent notification and, where required by law, seek your renewed consent.

We encourage you to review this Privacy Policy periodically to stay informed of how we protect your personal data. Your continued use of the GTRToto Platform following the publication of amendments constitutes your acceptance of the updated Policy.

15

Contact Us

If you have any questions, concerns, or requests in connection with this Privacy Policy or the processing of your personal data by GTRToto, you may reach us through the following channels:

Live Chat: Available 24 hours a day, 7 days a week via the in-platform live chat feature after logging into your Account. This is the fastest channel for data subject requests and privacy concerns.
Email (no-reply reference): [email protected] — please include "Privacy Request" in the subject line and provide your registered Account email address to help us process your query efficiently.

GTRToto will acknowledge all privacy-related communications within 5 business days. Complex data subject requests will be fulfilled within 30 calendar days where possible, with notification provided if an extension is required.

For enquiries related to responsible gambling, self-exclusion, or deposit limits, please visit our dedicated Responsible Gambling page.

Contents