Privacy Policy

This Privacy Policy ("Policy") describes how Capsatoto ("we", "us", "our") collects, processes, stores, and protects the personal information of users ("you", "Player") who register accounts or otherwise interact with the capsatoto.cam platform (the "Platform"). This Policy applies to all services offered by capsatoto, including online casino games, sports betting, live dealer tables, and account-related services.

By registering an account with capsatoto, you confirm that you have read and understood this Policy and that you consent to the collection and use of your personal data as described herein. If you do not agree with this Policy, you must not register or use the Platform.

For the purposes of this Policy:

• "Personal Data" means any information that identifies or could reasonably identify a natural person, either directly or in combination with other data.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, and deletion.
• "Data Controller" means capsatoto, as the entity that determines the purposes and means of processing personal data.
• "Data Processor" means any third party that processes personal data on behalf of capsatoto, under instruction and under a binding data processing agreement.
• "KYC Data" means identity verification documents including government-issued ID, proof of address, and payment method ownership documentation.
• "Technical Data" means information automatically collected by the Platform, including IP addresses, device identifiers, browser type, and session data.
• "Consent" means a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your personal data for a stated purpose.

Capsatoto collects the following categories of personal data:

Capsatoto collects personal data through the following channels:

• Direct Submission: Information you provide when registering an account, completing KYC, contacting support, or participating in promotions.
• Automated Collection: Technical data collected automatically when you visit or use the Platform, including via cookies, web beacons, and server logs.
• Payment Providers: Transaction confirmation data received from Malaysian payment partners including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, and Public Bank when you make deposits or withdrawals.
• Third-Party Verification Services: Identity and fraud check data received from KYC verification providers as part of our licensing compliance obligations.
• Game Providers: Gameplay and session data transmitted by our licensed third-party game studio partners.

Capsatoto processes your personal data on the following legal bases:

• Contractual Necessity: Processing required to fulfil our obligations under the Terms & Conditions you accepted at registration — including account management, payment processing, and dispute resolution.
• Legal Obligation: Processing required to comply with our international licensing conditions, anti-money laundering (AML) obligations, and KYC regulatory requirements.
• Legitimate Interests: Processing for fraud prevention, platform security, responsible gambling monitoring, and general business analytics — where these interests are not overridden by your rights.
• Consent: Processing for optional marketing communications and non-essential analytics cookies, where you have provided explicit opt-in consent. You may withdraw consent at any time.

Capsatoto uses personal data collected from players for the following purposes:

1. To register and maintain your Account on the capsatoto platform.
2. To verify your identity and confirm that you meet the minimum age requirement of 21 years.
3. To process your MYR deposits and withdrawals via your chosen Malaysian payment method.
4. To detect, investigate, and prevent fraud, money laundering, and other prohibited activities.
5. To monitor gameplay for responsible gambling indicators and apply account protection tools where appropriate.
6. To provide customer support and resolve disputes or complaints.
7. To send transactional communications including deposit confirmations, withdrawal notifications, and security alerts.
8. To send promotional and marketing communications where you have provided explicit opt-in consent.
9. To improve Platform performance, user experience, and game content based on aggregate usage analytics.
10. To comply with our international online gaming licensing obligations and any applicable regulatory requirements.

Capsatoto does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may share your data only in the following limited and controlled circumstances:

• Payment Processors: Malaysian and international payment providers (including e-wallet operators and banks) receive the minimum data necessary to process your transactions securely.
• KYC & Fraud Prevention Partners: Licensed identity verification services receive document and identity data solely for the purpose of verification and anti-fraud screening.
• Game Studio Providers: Certified third-party game providers receive session and gameplay data necessary to operate their games within the capsatoto platform.
• Regulatory Authorities: Where required by law or our licensing obligations, we may disclose account and transaction data to relevant regulatory bodies.
• IT Infrastructure Providers: Trusted hosting and cloud infrastructure partners process data on our behalf under strict data processing agreements that prohibit unauthorised access or use.

All third-party data processors are bound by contractual obligations to handle your data securely, use it only for the specified purpose, and delete it when no longer required.

As capsatoto operates under international licensing and uses global technology infrastructure, your personal data may be transferred to and processed in countries outside Malaysia. These transfers are made only to jurisdictions that provide adequate data protection standards or under appropriate contractual safeguards.

Where data is transferred to a third country, capsatoto ensures that appropriate protections are in place, including standard contractual clauses, binding corporate rules, or other recognised transfer mechanisms consistent with international data protection best practice.

Capsatoto retains personal data for the following periods:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with any individual.

Capsatoto implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These include:

• Transport Encryption: All data in transit between your browser and our servers is protected by TLS 1.2 or higher (256-bit SSL encryption).
• Data Encryption at Rest: Sensitive stored data including KYC documents and financial records is encrypted using industry-standard encryption protocols.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. All staff with access to personal data undergo data protection training.
• Two-Factor Authentication: Capsatoto supports and recommends two-factor authentication (2FA) for all player accounts.
• Security Monitoring: Our systems are continuously monitored for suspicious activity, including brute-force attempts, unusual login patterns, and potential data exfiltration.
• Incident Response: In the event of a data breach that poses a risk to players, capsatoto will notify affected individuals and relevant authorities within 72 hours of becoming aware of the incident.

Capsatoto uses cookies and similar tracking technologies to operate the Platform effectively, maintain your session, and improve user experience. A cookie is a small data file stored on your device by your browser.

You may manage your cookie preferences through your browser settings. Disabling strictly necessary cookies will impair your ability to use the capsatoto Platform. For analytics and marketing cookies, you may withdraw consent at any time by adjusting your settings or contacting our support team.

As a data subject whose personal information is processed by capsatoto, you are entitled to the following rights. You may exercise any of these rights by contacting us at support@capsatoto.cam. We will respond to all valid requests within 30 calendar days.

The capsatoto platform is strictly restricted to individuals aged 21 years and above. We do not knowingly collect, process, or retain personal data from any individual below the age of 21. This is a non-negotiable requirement enforced through our KYC verification process at the time of account registration and first withdrawal.

If capsatoto becomes aware that personal data has been submitted by or on behalf of a person under the age of 21, we will immediately suspend the associated account, delete all related personal data, and forfeit any associated balance in accordance with our Terms & Conditions.

Parents and guardians who believe a minor may have accessed or registered on capsatoto should contact us immediately at support@capsatoto.cam so that appropriate action can be taken without delay.

Capsatoto reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or regulatory requirements. The effective date at the top of this Policy will be updated accordingly whenever a new version is published.

Where changes are material — meaning they significantly affect how we collect, use, or share your personal data — we will provide reasonable advance notice via email to the address registered to your account, or via a prominent notice on the Platform. Your continued use of capsatoto after the effective date of any revised Policy constitutes your acceptance of the updated terms.

We recommend that you review this Policy periodically to stay informed of how your data is being protected. All previous versions of this Policy are available upon request by contacting our support team.

If you have any questions, concerns, or requests regarding this Privacy Policy or the way capsatoto handles your personal data, please contact our support team using the details below. All privacy-related enquiries are treated as a priority.

For concerns related to data security incidents or potential breaches, please mark your communication as urgent. Our security team will prioritise all such enquiries.

For responsible gambling data enquiries, including self-exclusion records and account restriction requests, please also visit our dedicated Responsible Gambling page.