Privacy Policy

dnatoto ("we", "us", "our", "the Platform") operates the online gaming and sports betting platform accessible at dnatoto.cam. We are committed to maintaining the privacy and security of all personal data entrusted to us by our registered players and website visitors.

This Privacy Policy ("Policy") sets out the basis on which dnatoto collects, processes, stores, shares, and retains personal data in connection with the operation of our platform, including account registration, payment processing, customer support, regulatory compliance, and promotional activities.

This Policy should be read alongside our Terms and Conditions, which form the overarching agreement governing your use of the dnatoto platform. By registering an account or using our platform, you acknowledge that you have read, understood, and accepted the practices described in this Policy.

For the purposes of this Policy, the following terms are defined as follows:

• "Personal Data" means any information relating to an identified or identifiable natural person ("Data Subject"), including name, identification number, contact details, financial data, device identifiers, and behavioural data.
• "Processing" means any operation performed on Personal Data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, transmission, restriction, erasure, or destruction.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data — in this context, dnatoto.
• "Data Processor" means any third party that processes Personal Data on behalf of dnatoto under a written data processing agreement.
• "Consent" means a freely given, specific, informed, and unambiguous indication of the Data Subject's agreement to the processing of their Personal Data.
• "Platform" means the dnatoto website, mobile-optimised interface, and any associated applications through which gaming and betting services are delivered.
• "KYC Data" means Know Your Customer documentation, including government-issued photo ID (e.g., MyKad, passport), proof of address, and proof of payment method, collected for identity verification and regulatory compliance.

The Data Controller responsible for the Personal Data collected through the dnatoto platform is the dnatoto operating entity, headquartered in Kuala Lumpur, Malaysia. All data protection queries, access requests, rectification requests, and erasure requests should be addressed to our designated Data Protection contact, details of which are set out in Section 16 of this Policy.

Where dnatoto engages third-party Data Processors — such as payment service providers, fraud detection systems, customer support platforms, and analytics services — such processors operate under written data processing agreements that bind them to the same level of data protection obligations as dnatoto itself.

dnatoto collects Personal Data in the following categories:

4.1 Data You Provide Directly

4.2 Data Collected Automatically

dnatoto processes your Personal Data for the following specific purposes:

• Service Delivery: To create and administer your Account, process deposits and withdrawals in MYR, deliver gaming services, and provide customer support.
• Identity Verification (KYC): To verify your identity and age (21+) in compliance with our licensing obligations and anti-money laundering requirements.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, money laundering, account compromise, and platform abuse.
• Regulatory Compliance: To meet our obligations under applicable gaming licences, anti-money laundering legislation, and financial reporting requirements.
• Responsible Gambling: To monitor player behaviour, enforce self-imposed limits, and identify indicators of problem gambling consistent with our responsible gambling obligations.
• Platform Improvement: To analyse usage patterns, improve platform performance, and personalise the player experience using aggregated or anonymised analytical data.
• Marketing Communications: To send promotional offers, bonus notifications, and platform updates to players who have opted in to receive such communications.
• Legal Proceedings: To establish, exercise, or defend legal claims where necessary.

dnatoto processes Personal Data on the following legal bases:

• Contractual Necessity: Processing required to fulfil our contractual obligations to you under the Terms and Conditions — including account management, payment processing, and game delivery.
• Legal Obligation: Processing required to comply with applicable laws — including KYC verification, anti-money laundering reporting, and licensing authority obligations.
• Legitimate Interests: Processing necessary for dnatoto's legitimate business interests — including fraud prevention, platform security, and analytics — provided such interests are not overridden by your fundamental data protection rights.
• Consent: Processing based on your explicit consent — including marketing communications and the use of non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

dnatoto does not sell, rent, or trade Personal Data to any third party. We share Personal Data only in the following circumstances and only to the minimum extent necessary:

• Payment Processors: We share transaction data with our payment partners — including operators of the Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, DuitNow, and FPX payment channels — solely for the purpose of processing deposits and withdrawals in MYR or cryptocurrency.
• Game Studio Providers: We share limited account and session data with our certified game studio partners for the purpose of delivering games and maintaining game integrity. No financial or identity data is shared beyond what is necessary for session authentication.
• Fraud Detection Services: We engage specialist third-party fraud detection providers who process device and behavioural data on our behalf to protect the platform and its players.
• Regulatory and Law Enforcement Authorities: We will disclose Personal Data to competent authorities, licensing bodies, or law enforcement agencies when required to do so by law or valid legal process, or where we determine in good faith that disclosure is necessary to protect the rights, property, or safety of dnatoto, our players, or the public.
• Professional Advisers: We may share Personal Data with lawyers, auditors, and insurers in connection with the conduct of our business where bound by appropriate professional obligations of confidentiality.

dnatoto retains Personal Data only for as long as is necessary to fulfil the purpose for which it was collected, subject to our legal and regulatory obligations. The indicative retention periods below are applied as a matter of standard practice:

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised using industry-standard methods. Anonymised data may be retained indefinitely for statistical and analytical purposes.

dnatoto implements a comprehensive set of technical and organisational security measures to protect Personal Data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• AES-256 encryption for all Personal Data stored in our database systems
• TLS 1.2 / 1.3 encryption for all data transmitted between the player's device and our servers
• Role-based access controls limiting employee access to Personal Data strictly to those with a job-necessity requirement
• Regular penetration testing and third-party security audits of our platform infrastructure
• Multi-factor authentication for all staff accessing systems containing Personal Data
• Formal data breach response procedures with regulatory notification timelines
• Secure deletion and data disposal protocols for expired data categories

While dnatoto employs industry-leading security practices, no method of internet transmission or electronic storage is completely secure. We cannot guarantee absolute security but commit to promptly notifying affected players and relevant authorities in the event of any data breach that carries a high risk to your rights and freedoms.

dnatoto uses cookies and similar tracking technologies to operate the platform, enhance user experience, maintain session state, and analyse platform performance. The following categories of cookies are in use:

• Strictly Necessary Cookies: Required for the platform to function. These cannot be disabled without rendering core features inoperable. They include session authentication tokens, CSRF protection cookies, and load-balancing identifiers.
• Functional Cookies: Used to remember your preferences, such as language settings, preferred payment method, and display preferences. These are not essential but improve your experience.
• Analytics Cookies: Used to collect anonymised or pseudonymised data about how users interact with the platform — including page visits, session duration, and navigation paths. This information helps us improve platform performance and content relevance.
• Marketing Cookies: Used, where you have consented, to present personalised promotional offers on the platform and to measure the effectiveness of our promotional campaigns.

You may manage your cookie preferences through your browser settings. Disabling certain categories of cookies may affect platform functionality. Strictly Necessary cookies cannot be disabled through browser settings without logging out of your session.

Subject to applicable data protection law, you have the following rights in relation to your Personal Data held by dnatoto:

• Right of Access: You may request a copy of the Personal Data we hold about you and information about how it is processed. We will respond within 30 calendar days.
• Right to Rectification: If any Personal Data we hold is inaccurate or incomplete, you have the right to request correction. Where data integrity is critical (e.g., KYC data), supporting documentation may be required.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purpose collected, where you withdraw consent on which processing is based, or where processing is unlawful. This right is subject to our overriding legal retention obligations.
• Right to Restriction of Processing: You may request that we restrict the processing of your Personal Data in certain circumstances — for example, while a rectification request is being assessed.
• Right to Data Portability: You may request that we provide your Personal Data in a structured, commonly used, machine-readable format where processing is based on consent or contract.
• Right to Object: You may object to processing based on legitimate interests, including profiling for marketing purposes. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of the above rights, please contact our data protection team using the details set out in Section 16. We do not charge for exercising your rights except in cases of manifestly unfounded or excessive requests, where a reasonable administrative fee may apply.

The dnatoto platform is strictly prohibited to individuals under the age of 21. We do not knowingly collect Personal Data from anyone under 21 years of age. If we become aware that Personal Data has been collected from a person under 21 — whether through misrepresentation during registration or by any other means — we will immediately suspend the associated Account, delete all Personal Data collected, and where a deposit was made, return any net deposited balance through the original payment method.

Parents or guardians who believe that a minor may have registered an account on dnatoto should contact our support team immediately via live chat. We will treat all such reports as priority cases.

dnatoto may transfer Personal Data to, or process it in, countries outside of Malaysia in connection with our use of internationally-hosted cloud infrastructure, game studio platforms, payment processors, and fraud detection services. Where such transfers occur, we ensure that appropriate safeguards are in place, including:

• Data processing agreements incorporating internationally recognised standard contractual clauses
• Transfer only to third parties that maintain data protection standards equivalent to those required under this Policy
• Periodic review of transfer safeguards in line with evolving regulatory requirements

With your consent, dnatoto may send you promotional emails, SMS notifications, or in-platform messages regarding new games, bonus offers, VIP programme updates, seasonal promotions, and platform announcements. Consent to marketing is optional and separate from the consent required for core service delivery.

You may opt out of marketing communications at any time by:

• Clicking the "Unsubscribe" link in any marketing email
• Updating your notification preferences in your Account settings
• Contacting our support team and requesting removal from all marketing lists

Opting out of marketing will not affect transactional communications — we will continue to send you Account-related messages such as deposit confirmations, withdrawal receipts, and security alerts regardless of your marketing preferences.

dnatoto reserves the right to update or amend this Privacy Policy at any time. Where material changes are made — particularly changes that affect the nature of data collected, the purposes of processing, or your rights as a Data Subject — we will notify you by email to your registered address no fewer than seven (7) days before the changes take effect.

Non-material changes (such as typographical corrections, clarifications, or reorganisation of content without substantive change) may be made without advance notice. The "Last Updated" date at the top of this page will always reflect the most recent revision.

Your continued use of the dnatoto platform following the effective date of any amendment constitutes your acceptance of the revised Policy. If you do not agree to the amended Policy, you must cease using the platform and may request Account closure and data deletion in accordance with Section 11.

For all data protection enquiries — including access requests, rectification requests, erasure requests, consent withdrawals, or complaints about how your Personal Data has been handled — please contact us through the following channels:

• 24/7 Live Chat: Available directly on the dnatoto platform. State that your query is a data protection matter for priority routing to our data team.
• Email: [email protected] — Subject line: "Data Protection Request – [Your Username]" (plain text — not a clickable link)
• Postal address: Data Protection Team, dnatoto Operations, Kuala Lumpur, Malaysia

We will acknowledge all data protection requests within 48 hours and aim to provide a substantive response within 30 calendar days. Where a request is complex or where we receive a high volume of requests, we may extend this period by a further 60 days, notifying you of the extension within the initial 30-day period.