Privacy Policy

This Privacy Policy ("Policy") issued by Mawartoto ("we", "us", "our", or "the Platform"), accessible at mawartoto.buzz. It describes how we collect, use, disclose, store, and protect personal information relating to individuals("you", "your", or "Data Subject") who access or use our online casino and sports betting platform, including all associated services and features.

Mawartoto is committed to handling personal data responsibly and in accordance with applicable data protection principles. This Policy applies to all players registered on the Platform, regardless of the device or network used to access it, including players across Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and all other locations from which the Platform is accessed.

By registering an Account on Mawartoto, or by continuing to use the Platform after this Policy has been updated and communicated to you, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein.

The following definitions apply throughout this Privacy Policy:

The Data Controller responsible for your personal data in connection with your use of the Mawartoto platform is Mawartoto, operating the domain mawartoto.buzz. Mawartoto operates under international online gaming licensing frameworks and is subject to the data protection obligations associated with its licensing jurisdiction.

All enquiries relating to the processing of your personal data, requests to exercise your data rights, or concerns about this Policy should be directed to our Data Protection contact point via the channels listed in Section 16 of this Policy.

Mawartoto collects personal data through several channels: directly from you when you register, deposit, or contact support; automatically through your use of the Platform; and from third-party verification services engaged to fulfil our KYC and fraud prevention obligations.

4.1 Sensitive Data

Mawartoto does not intentionally collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data, unless specifically required and consented to for a lawful purpose (e.g., age verification through a third-party biometric provider where offered as an option).

We process your personal data for the following specific purposes:

• Account Registration and Management: To create, maintain, and manage your player account, including authentication and account security.
• Identity Verification (KYC): To verify your identity and age in accordance with our regulatory and responsible gambling obligations. This includes confirming you are aged 21 or above.
• Transaction Processing: To process deposits and withdrawals in MYR via DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, Touch 'n Go eWallet, Boost, GrabPay, and cryptocurrency channels.
• Customer Support: To respond to your enquiries, complaints, and support requests via live chat and email.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity money laundering, multi-accounting, and other prohibited conduct.
• Responsible Gambling: To monitor for indicators of problem gambling, enforce deposit limits and self-exclusion requests, and fulfil our duty of care obligations.
• Legal and Regulatory Compliance: To comply with applicable laws, regulatory requirements, and requests from competent authorities.
• Platform Improvement: To analyse usage patterns and improve the functionality, performance, and user experience of the platform.
• Marketing Communications (where consented): To send you promotional offers, bonus notifications, and platform updates where you have provided consent or where we have a legitimate interest to do so.

Mawartoto relies on the following legal bases for processing personal data, as applicable to each processing activity:

• Contractual Necessity: Processing required to fulfil the contract between you and Mawartoto — including account creation, transaction processing, and customer support.
• Legal Obligation: Processing required to comply with applicable laws and regulatory requirements, including KYC, anti-money laundering (AML), and age verification obligations.
• Legitimate Interests: Processing carried out for the legitimate business interests of Mawartoto, including fraud prevention, platform security, and product improvement, where these interests are not overridden by your data protection rights.
• Consent: Processing based on your explicit consent, such as for marketing communications. Where consent is the legal basis, you have the right to withdraw it at any time without affecting the lawfulness of prior processing.

Mawartoto does not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes. We may share your personal data only in the following circumstances:

7.1 Service Providers (Data Processors)

We engage third-party service providers to assist in operating the Platform, including payment processors (handling MYR transactions via DuitNow, FPX, and e-wallet rails), identity verification providers (KYC), fraud detection services, cloud hosting providers, and customer support tools. All such providers are contractually bound to process data only for the specified purpose and to maintain appropriate security standards.

7.2 Legal and Regulatory Disclosure

We may disclose personal data to competent authorities, courts, regulators, or law enforcement agencies where required to do so by applicable law, court order, or valid regulatory direction. We will, where permissible, notify you of such a disclosure.

7.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of the Mawartoto business, your personal data may be transferred to the successor entity as part of that transaction, subject to equivalent data protection commitments.

Mawartoto retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law or regulatory obligations. The following general retention periods apply:

• Active Account Data: Retained for the duration of your account and for a minimum of 5 years following account closure, in accordance with standard AML record-keeping requirements.
• KYC Documentation: Retained for a minimum of 5 years following the conclusion of the business relationship, or longer where required by applicable regulatory direction.
• Transaction Records: Retained for a minimum of 5 years for AML, fraud investigation, and dispute resolution purposes.
• Support Communications: Retained for a period of 3 years following the resolution of the relevant support interaction, unless a longer period is required due to an ongoing dispute or investigation.
• Technical and Usage Data: Typically retained in identifiable form for up to 24 months, after which it may be anonymised and retained for analytical purposes.
• Marketing Consent Records: Retained until you withdraw your consent, plus a reasonable additional period for audit purposes.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in manner that prevents reconstruction of the data subject's identity.

Mawartoto implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Mawartoto platform.
• Encryption at rest for sensitive data stored on our servers, including financial data, KYC documents, and authentication credentials.
• Access controls restricting access to personal data to authorised staff on a need-to-know basis, enforced via role-based access management.
• Two-factor authentication available for player accounts to reduce the risk of unauthorised access.
• Regular security assessments and penetration testing conducted on platform infrastructure.
• Incident response procedures for detecting, containing, and reporting data breaches where applicable.

While we take reasonable steps to protect your data, no system is completely immune from breach. You are also responsible for keeping your account login credentials secure and notifying us immediately if you suspect any unauthorised access to your account.

Mawartoto uses cookies and similar tracking technologies to operate and improve the Platform. The following categories of cookies are used:

10.1 Strictly Necessary Cookies

These cookies are essential for the Platform to function and cannot be disabled. They include session authentication cookies, security tokens, and load-balancing cookies. No consent is required for these cookies as they are integral to the service delivery.

10.2 Functional Cookies

These cookies remember your preferences — such as language settings, display preferences, and previously selected payment methods — to provide a more personalised experience on your return visits.

10.3 Analytical Cookies

We use first-party analytical cookies to understand how players use the Platform — which pages are visited most frequently, where users navigate from, and how long sessions last. This data is used in aggregate and anonymised form to improve Platform performance. We do not use third-party advertising trackers for behavioural profiling.

You may manage cookie preferences through your browser settings. Note that disabling certain cookies may affect the functionality of the Platform. Clearing browser cookies will not affect personal data we hold in our systems.

Mawartoto operates infrastructure in multiple jurisdictions as part of its international licensing framework. As a result, your personal data may be processed or stored in countries other than Malaysia. Where personal data is transferred outside your country of residence, Mawartoto ensures that appropriate safeguards are in place, including:

• Contractual data processing agreements incorporating standard data protection clauses with all third-party service providers.
• Transfer to jurisdictions that maintain equivalent data protection standards.
• Ongoing assessment of the security and compliance posture of data processing partners.

By using the Mawartoto platform, you acknowledge that your data may be processed in jurisdictions outside Malaysia as described in this section.

As a data subject, you hold the following rights in relation to the personal data Mawartoto holds about you. You may exercise any of these rights by contacting us through the channels listed in Section 16.

We will respond to all valid data rights requests within a reasonable timeframe — typically within 30 days of receipt of a complete and verified request. Where requests are complex or numerous, this period may be extended by an additional 30 days with prior notification.

Mawartoto is strictly for individuals aged21 and above. We do not knowingly collect personal data from individuals under the age of 21. All account registrations require acceptance of our age eligibility declaration, and KYC processes are designed to verify minimum age compliance.

If we become aware that we have inadvertently collected personal data from a person under the age of 21, we will immediately suspend the relevant account, delete all associated personal data to the extent permitted by law, and forfeit any balance held in that account.

The Mawartoto platform may integrate with third-party service providers to deliver certain platform features, including payment gateways (for processing MYR transactions via DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, and cryptocurrency networks), identity verification services, fraud detection tools, and platform analytics.

These third parties process personal data only to the extent required to deliver the specific service for which they have been engaged and are bound by data processing agreements. Mawartoto is not responsible for the privacy practices of any website, service, or application that is not operated by or on behalf of Mawartoto.

The Platform does not contain links to external third-party websites for commercial or promotional purposes. All navigation within the Platform remains within the mawartoto.buzz domain ecosystem.

Mawartoto reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, regulatory requirements, or operational procedures. Where changes are material, we will provide notice to registered players via email or a prominent notice on the Platform prior to the changes taking effect.

The "Last Updated" date at the top of this page will always reflect the most recent revision. Your continued use of the Platform following publication of an amended Policy constitutes your acceptance of the updated terms. We recommend reviewing this Policy periodically.

If you have questions about this Privacy Policy, wish to exercise your data rights, or have a concern about how we handle your personal data, please contact us through the following channels:

• Email: [email protected] — average response within 4 hours.
• Live Chat: Available 24 hours a day, 7 days a week, accessible directly from the platform. Average first response: under 90 seconds.
• FAQ: Common privacy and account questions are addressed on our FAQ page.

When submitting a data rights request, please include your registered account username, the specific right you wish to exercise, and sufficient detail to allow us to locate and verify your account before processing the request. We may require identity verification before actioning any data rights request.