Privacy Policy —
Arwanatoto Data Protection Notice

Arwanatoto ("we", "us", "our", "the Platform") is committed to protecting the privacy and personal data of all users who access and use the online gaming services available at arwanatoto.cam. This Privacy Policy ("Policy") sets out in full detail how Arwanatoto collects, processes, stores, shares, and protects personal data in connection with the operation of our platform.

This Policy applies to all individuals who visit, register an account on, or interact with the Arwanatoto platform — including players based in Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru, Shah Alam, and all other locations across Malaysia.

By accessing or using the Arwanatoto platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and use of your personal data as described herein. If you do not agree with any part of this Policy, please discontinue use of the platform and contact us to arrange Account closure and data deletion where applicable.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Account" — a registered user account created on the Arwanatoto platform.
• "Personal Data" — any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial information, and device identifiers.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, transmission, or deletion.
• "Data Controller" — Arwanatoto, as the entity that determines the purposes and means of processing Personal Data.
• "Data Processor" — any third-party service provider that processes Personal Data on behalf of Arwanatoto, subject to appropriate data processing agreements.
• "Cookies" — small text files placed on a user's device by the platform for the purpose of session management, analytics, and personalisation.
• "KYC" — Know Your Customer; the identity and age verification process required before withdrawals can be processed.
• "Sensitive Personal Data" — a subset of Personal Data warranting heightened protection, including identity document numbers, financial account details, and biometric data submitted during verification.

Arwanatoto collects the following categories of personal data from users in the course of operating the platform. The specific data collected depends on the stage of your interaction with us.

We do not collect special categories of sensitive personal data beyond what is strictly required for KYC compliance (identity document numbers, facial biometric data from selfie verification). Such data is handled under heightened security protocols and access restrictions.

Arwanatoto collects personal data through the following channels and mechanisms:

Arwanatoto processes your personal data for the following specific purposes:

• Account creation and management — to set up, maintain, and administer your gaming account, including authentication and account security.
• Identity and age verification (KYC) — to confirm that you meet the minimum age requirement of 21 years and to verify your identity in compliance with our international licensing obligations and anti-money laundering (AML) requirements.
• Payment processing — to facilitate deposits and withdrawals in MYR via supported Malaysian payment methods including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, and USDT TRC20.
• Gaming services delivery — to provide access to sports betting (Liga Super Malaysia, EPL, UFC, esports), live casino, slots, and other gaming products on the platform.
• Fraud prevention and security — to detect, investigate, and prevent fraudulent transactions, prohibited conduct, money laundering, and other illegal activities.
• Regulatory compliance — to meet obligations under our international gaming licence, including record-keeping, reporting, and cooperation with licensing authority requests.
• Customer support — to handle your enquiries, complaints, and support requests effectively and maintain records of communications for quality assurance.
• Responsible gambling — to administer responsible gambling tools including deposit limits, self-exclusion, and session reminders as configured in your Account settings.
• Platform improvement and analytics — to analyse anonymous usage patterns and platform performance data in order to improve the user experience, fix bugs, and optimise game offerings.
• Legal proceedings — to establish, exercise, or defend legal claims where necessary.

We do not use your personal data for automated decision-making or profiling that produces significant legal effects without human review, except where required by fraud prevention algorithms, in which case flagged cases are reviewed by a compliance team member before action is taken.

Arwanatoto processes personal data on the following legal bases, depending on the purpose of processing:

• Contractual necessity — processing required to perform our contract with you (i.e., operating your Account, processing payments, and delivering gaming services).
• Legal obligation — processing required to comply with applicable laws and licensing conditions, including AML obligations and KYC requirements imposed by our gaming licence.
• Legitimate interests — processing conducted for fraud prevention, platform security, and the improvement of our services, where these interests are not overridden by your data protection rights.
• Consent — where we rely on your consent for optional data processing activities such as marketing communications or optional analytics. You may withdraw consent at any time by updating your Account preferences.

Arwanatoto does not sell, rent, or trade your personal data to any third party for commercial purposes. Your data may be shared in the following limited and controlled circumstances only:

Arwanatoto retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal and licensing obligations. The following general retention periods apply:

• Account data and KYC records — retained for a minimum of five (5) years from Account closure, in compliance with AML record-keeping obligations under international licensing requirements.
• Transaction and gaming activity records — retained for a minimum of five (5) years from the date of the transaction, for audit, dispute resolution, and regulatory compliance purposes.
• Customer support communications — retained for up to three (3) years from the date of the last interaction, for quality assurance and dispute resolution purposes.
• Technical and usage data (logs) — retained for up to 12 months, after which they are anonymised or deleted.
• Voluntarily closed accounts — personal data is retained for the minimum period required by our licensing obligations and is then deleted or anonymised, subject to any outstanding legal proceedings or disputes.

Where data is no longer required for its original purpose and no retention obligation applies, it is securely deleted or irreversibly anonymised.

Arwanatoto implements a layered security framework to protect personal data against unauthorised access, accidental loss, disclosure, alteration, or destruction. Our security measures include, but are not limited to:

• Transport Layer Security (TLS/SSL) — all data transmitted between your device and the Arwanatoto platform is encrypted using 256-bit TLS encryption. The presence of HTTPS in the URL confirms this encryption is active.
• Access controls — access to personal data within our systems is restricted on a strict need-to-know basis. Staff with access to sensitive data are subject to background checks and confidentiality obligations.
• Data minimisation — we collect only the data necessary for the defined purposes and do not retain data beyond required retention periods.
• Intrusion detection and monitoring — our platform systems are monitored for suspicious activity, unusual access patterns, and potential security breaches around the clock.
• Incident response procedures — we maintain documented data breach response procedures. In the event of a breach affecting your personal data, we will notify affected users and relevant authorities in accordance with applicable obligations.

While we maintain robust security measures, no online platform can guarantee absolute security. You are responsible for maintaining the security of your own Account credentials and are encouraged to use a strong, unique password and to enable two-factor authentication where available.

Arwanatoto uses cookies and similar technologies (such as web beacons and local storage) to operate the platform effectively. Cookies are small data files stored on your device when you access the platform.

Arwanatoto does not use cookies for third-party advertising or to track your activity on other websites. All cookies placed by the platform relate directly to your use of arwanatoto.cam.

As a user of Arwanatoto, you hold the following rights in relation to your personal data. To exercise any of these rights, please contact our support team using the details provided in Section 15. We will respond to all valid requests within 30 days of receipt.

The Arwanatoto platform is strictly for individuals aged 21 years and above. We do not knowingly collect personal data from persons under the age of 21. All Accounts are subject to mandatory KYC age verification before withdrawal access is granted.

If we become aware that personal data has been collected from a person under the age of 21, we will immediately suspend the Account, void any transactions, and delete the associated personal data from our systems as promptly as technically feasible, subject to any retention obligations under applicable law.

As an internationally licensed online gaming platform, Arwanatoto operates infrastructure and engages service providers that may be located outside of Malaysia. Your personal data may therefore be transferred to, stored in, or processed in countries other than Malaysia.

Where personal data is transferred internationally, Arwanatoto ensures that appropriate safeguards are in place, including contractual data protection clauses with receiving parties, ensuring that the recipient jurisdiction provides an adequate level of data protection, or other legally recognised transfer mechanisms. We do not transfer personal data to jurisdictions that do not provide equivalent protection standards without implementing appropriate safeguards.

By using the Arwanatoto platform, Malaysian users acknowledge that their personal data may be processed in jurisdictions outside Malaysia in connection with the delivery of gaming services and platform operations.

Arwanatoto reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or platform features. The effective date displayed at the top of this page indicates when the current version came into force.

Where changes are material — such as a new category of data being collected or a new purpose of processing — we will notify registered users by email or through a prominent in-platform notice at least 14 days before the changes take effect. For minor or clarificatory changes, we will update the effective date without separate notification.

Your continued use of the platform after any updates to this Policy takes effect constitutes your acceptance of the revised Policy. We recommend bookmarking this page and reviewing it periodically.

For any questions about this Privacy Policy, to exercise your data rights, or to report a data protection concern, please contact the Arwanatoto data team through the following channels:

• Email: [email protected] — please include "Privacy Request" or "Data Enquiry" in the subject line for prioritised routing.
• Live Chat: Available 24/7 on the platform — suitable for general queries; complex data requests should be directed to email for written confirmation.
• Response Time: We acknowledge all data rights requests within 5 business days and provide a substantive response within 30 calendar days of a valid, verified request.

To exercise your data rights, we are required to verify your identity before processing any request. This is to ensure that data is not released to unauthorised parties. Verification typically involves confirming Account details and may require a copy of the identity document already held on file for your KYC record.