Privacy Policy Piktoto — Personal Data Protection for Malaysian Members

1 Introduction and Scope of This Policy

Piktoto (referred to in this document as "we", "Platform" or "the Company") respects the privacy of every individual who uses our services. This Privacy Policy describes our practices regarding the collection, use, disclosure, storage and protection of personal information you provide to us or that is automatically collected when you use the Piktoto platform.

This policy applies to all users of the piktoto platform, including visitors browsing our website, registered members using our gaming services, and any party interacting with us through support channels or other communications. By using piktoto's services, you agree to the terms of this Privacy Policy.

2 Information We Collect

Piktoto collects two main categories of information: information you provide directly and information collected automatically through your use of our platform.

2.1 Information You Provide Directly

• Registration information: Full name, date of birth, identification number (MyKad/Passport), email address, mobile number, and account password.
• Financial information: Bank account number, bank name, and digital wallet information (Touch 'n Go eWallet, GrabPay) used for deposits and withdrawals.
• KYC documents: Copies of your identity card, passport, utility bills or other official documents requested during the identity verification process.
• Communication information: Message content, complaints, feedback, and any correspondence you send to our support team.

2.2 Information Collected Automatically

• Technical data: IP address, browser type, device operating system, screen resolution, and other device information.
• Usage data: Pages visited, session duration, login frequency, games played, and interactions with platform features.
• Cookie data: We use cookies and similar tracking technologies to enhance the user experience, save preferences, and analyze usage patterns.
• Location data: General location information based on your IP address for geographical compliance purposes.

3 Data Usage Purposes

All information we collect is used for clear and legitimate purposes. The table below outlines the primary purposes for which your data is used:

4 Information Sharing and Disclosure

Piktoto does not sell or trade your personal information. However, there are certain situations where we may need to share your information with carefully selected parties:

4.1 Third-Party Service Providers

We work with trusted service providers to help operate the platform, including payment processors, cloud service providers, analytics companies, and security software vendors. All third parties are bound by strict confidentiality agreements and are only permitted to use your data for purposes specified by piktoto.

4.2 Legal Obligations

We may be required to disclose your information to government authorities, law enforcement agencies, or regulatory bodies where mandated by applicable Malaysian law, including compliance with the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLATFPUAA).

4.3 Business Transfers

If Piktoto is involved in a merger, acquisition or asset sale, user information may be transferred as part of that transaction. We will notify you in advance should this occur and ensure the same data protection standards are maintained.

5 Data Storage and Transfer

Your personal data is stored on secure servers with strict access controls. Our primary servers operate to security standards that comply with international industry benchmarks. All data is backed up regularly to ensure continuous service availability.

Data retention periods depend on the type of data and applicable legal requirements. Generally, we retain active account information for the duration of your membership. After account closure, certain data may be retained for up to seven (7) years to meet legal compliance requirements, particularly in relation to financial records and anti-money laundering obligations.

6 Security Measures

Piktoto continuously invests in robust security infrastructure to protect your data from unauthorized access, loss, misuse or disclosure. Key security measures we employ include:

• End-to-end encryption: All communications between your app or browser and our servers are secured by 256-bit TLS/SSL protocol.
• Two-factor authentication (2FA): Members can enable 2FA for an extra layer of security during login.
• 24/7 security monitoring: Automated monitoring systems detect and respond to suspicious activity around the clock.
• Internal access controls: Only staff with specific authorization may access sensitive member data, and every access is logged for audit purposes.
• Regular penetration testing: We conduct regular security assessments by independent parties to identify and patch any vulnerabilities.

7 Cookies and Tracking Technologies

Piktoto uses cookies and similar technologies to enhance your experience on our platform. Cookies are small text files stored on your device that help us recognize you during subsequent visits.

We use several types of cookies: session cookies that expire when you close your browser, persistent cookies that remain for a set period, and preference cookies that save your language and display settings. You can manage cookie settings through your web browser options, though some platform functions may be affected if essential cookies are disabled.

8 Your Rights Under the PDPA

As a user protected under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding your personal data held by Piktoto:

• Right of access: You have the right to know what data we hold about you and to request a copy of it.
• Right to rectification: You can request that we correct any information that is inaccurate or incomplete.
• Right to erasure: Under certain circumstances, you may request the deletion of your personal data, subject to applicable legal obligations.
• Right to restriction of processing: You can request that we restrict how we process your data in certain situations.
• Right to object: You have the right to object to the processing of your data for direct marketing purposes.
• Right to data portability: You can request your data in a machine-readable format for transfer to another service provider.

To exercise any of the above rights, please contact our privacy team by email at [email protected] or via the in-app live chat. We will process your request within 14 business days of receipt.

9 Children's Privacy

Piktoto services are exclusively for individuals aged 18 and above. We do not knowingly collect or process personal data of individuals under 18. Should we discover that a minor's data has been collected without our knowledge, it will be deleted immediately and the relevant account will be closed.

If you are a parent or guardian who believes your child has registered an account on Piktoto, please contact us immediately so we can take appropriate action.

10 Amendments to This Privacy Policy

Piktoto reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our service practices, legal requirements or technological developments. Any amendments will be accompanied by a new update date at the top of this document.

For material amendments that significantly affect your privacy rights, we will send a notification to your registered email address at least 14 days before the changes take effect. Continued use of the piktoto platform after the effective date of any amendment constitutes acceptance of the revised terms.