Privacy Policy pulitoto — Your Data is Safe, Your Rights are Protected

Pulitoto collects members' personal information through several channels — directly when you register and use the platform, and automatically via industry-standard tracking technologies. Below are the types of information we collect and the purposes they serve:

Pulitoto does not directly collect credit card numbers — all payments are processed through licensed third-party payment gateways (such as Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX via Maybank2u or CIMB Clicks), each with their own privacy and security policies. This means your card or bank account details never pass through or get stored on pulitoto's servers directly.

For players who play baccarat, roulette, blackjack, sic bo, or any other live casino games at pulitoto, game sessions may be recorded for dispute resolution and audit compliance purposes. These records are retained for a defined period and are accessible only to authorised staff and legitimate regulatory bodies.

Pulitoto uses the personal information collected for legitimate, necessary purposes that are directly related to platform operations. We do not use your data for purposes unrelated to the services you use. Below are the primary purposes for data use at pulitoto:

If you have agreed to receive marketing communications from pulitoto, we may use your email address or phone number to send you information about the latest promotions, bonuses, and special offers. You may withdraw this consent at any time without affecting any other services you use on pulitoto.

Pulitoto takes member data sharing very seriously. We do not share your personal information with external parties except in the circumstances clearly stated below. Data disclosure only occurs when it is genuinely necessary for platform operations or required by law.

Trusted Third-Party Service Providers: Pulitoto works with carefully selected third-party companies to support platform operations — including payment gateway providers (to process deposits and withdrawals via Touch 'n Go, GrabPay, DuitNow, and FPX), Live Casino software providers, cloud hosting providers, and web analytics companies. All partners are bound by strict confidentiality and data protection agreements, and they are only permitted to use your data for the specific services they provide to pulitoto.

Legal Compliance & Regulatory Authorities: Pulitoto may be required to disclose certain information to Malaysian authorities or legitimate regulatory bodies where mandated by law, court order, or an official investigation related to criminal activity such as money laundering, fraud, or terrorism financing. In such circumstances, we will comply with all applicable legal requirements.

Business Transfer: In the event that pulitoto undergoes a merger, acquisition, or business asset transfer, user data may be transferred to the new entity as part of those business assets. Members will be notified in advance by email if such a situation arises and will be given the option to delete their account if they do not wish to proceed.

Pulitoto takes technical security infrastructure seriously to ensure the personal data of Malaysian members is protected to the highest standard. The security measures we have in place operate across multiple layers — from the network level through to the database level and staff access controls.

• Data Encryption in Transit: All communications between your browser or app and pulitoto's servers are encrypted using TLS 1.3 / 256-bit SSL. This means that even if someone were to intercept your connection, they would be unable to read its contents.
• Data Encryption at Rest: Sensitive information such as passwords (stored as irreversible bcrypt hashes) and financial data is encrypted within pulitoto's database. Even our staff cannot view your password in its original form.
• Two-Factor Authentication (2FA): Members are encouraged to enable 2FA on their account and may do so at any time. Every login from a new device requires additional verification via an OTP code sent to the registered Malaysian mobile number.
• 24/7 Security Monitoring: The pulitoto security team continuously monitors all system activity to detect and respond to any threats or suspicious activity in real time.
• Penetration Testing: Pulitoto conducts regular security assessments by independent experts to identify and address system vulnerabilities before they can be exploited.
• Internal Access Controls: Access to member data within pulitoto's systems is restricted on a "need-to-know" basis — only staff with a legitimate operational need are granted access to specific data categories, and all access is logged for audit purposes.

While we take all reasonable steps to protect your data, no online system can be guaranteed 100% secure against every threat. In the event of a data security breach affecting members' personal information, pulitoto will notify affected members within the timeframe required by applicable law.

Pulitoto uses cookies and similar tracking technologies to enhance the user experience, maintain session security, and understand how the platform is used. Cookies are small text files stored on your device when you visit our website.

Types of cookies used by pulitoto:

• Essential Cookies: These cookies are essential for pulitoto's platform to function correctly — including login session verification, CSRF security, and basic user preferences. Disabling these cookies will impair platform functionality.
• Analytics Cookies: We use analytics cookies to understand how players interact with the pulitoto platform — which pages are visited most frequently, where users drop off, and how navigation can be improved. This data is processed in aggregate and is never used to identify individual users.
• Functional Cookies: Storing your personal preferences — such as your preferred language (Bahasa Melayu or English), display settings, and odds display options — so you do not have to reconfigure them every time you log in to pulitoto.
• Security Cookies: Used to detect suspicious login activity, verify new devices, and protect against automated bot attacks.

You can manage or delete cookies through your web browser settings. Please note, however, that disabling certain cookies may prevent you from logging in or using some features of the pulitoto platform properly. For guidance on managing cookies in popular browsers, please refer to the help documentation for Chrome, Safari, or Firefox.

As a pulitoto member and an individual whose personal data we process, you have certain rights regarding your information, all of which we fully respect. Here are your rights and how to exercise them:

To exercise any of the rights above, please contact the pulitoto privacy team by email at support@pulitoto.run, stating the specific right you wish to exercise along with your account details for identity verification. We will respond within 30 business days from the date your request is received.

Pulitoto retains members' personal data only for as long as necessary for the stated purposes, or as required by applicable laws in Malaysia. Below are the general data retention guidelines at pulitoto:

• Active account data — retained for the full duration of an active and regularly used account.
• Financial transaction records — retained for a minimum of 7 years in accordance with Malaysian financial and anti-money laundering (AML) legal requirements.
• Customer support communication records — retained for 3 years for dispute resolution and team training purposes.
• Security and activity logs — retained for 1 year for security forensics and fraud detection purposes.
• Marketing data (with consent) — retained until you withdraw consent or request deletion.

Once the retention period expires or upon a valid account deletion request, pulitoto will permanently delete or anonymise your personal data in an irreversible manner. Anonymised data may be retained for aggregate statistical purposes, with all personally identifying information removed.

Please note that in cases where an account is frozen or closed due to fraud or a breach of terms, relevant records may be retained beyond the standard period for investigation purposes and to protect the platform against repeat misuse.

Pulitoto takes every privacy-related enquiry, concern, and complaint from Malaysian members seriously. If you have any questions about this privacy policy, how your data is used, or wish to exercise any of your privacy rights, please do not hesitate to contact us.

Our Malay-speaking pulitoto support team is ready to assist you through:

• Privacy Email: support@pulitoto.run — include "Privacy Enquiry" in your email subject line for faster handling.
• Live Chat: Available 24 hours a day, 7 days a week via the chat icon at the bottom right corner of the pulitoto platform.

We are committed to responding to all privacy-related enquiries within 5 business days. For more complex requests such as data portability or formal complaints, the response period is within 30 business days in accordance with legal requirements.

This privacy policy was last updated in January 2026. pulitoto reserves the right to amend this policy from time to time to reflect changes in platform operations, applicable laws, or industry best practices. All material amendments will be communicated to active members via their registered email or in-platform notifications, with at least 14 days' notice before the changes take effect.