halimtoto Privacy Policy

01 Introduction

This Privacy Policy ("Policy") is published by halimtoto ("Platform", "we", "us", "our"), the operator of the online betting and live casino platform accessible at https://halimtoto.cam. This Policy describes how halimtoto collects, processes, stores, shares, and protects personal data belonging to registered users, prospective users, and visitors to the Platform ("you", "User", "Player").

halimtoto is committed to handling all personal data responsibly, transparently, and in accordance with applicable international data protection standards and the requirements of our licensing framework. We take the privacy of Malaysian players seriously — whether you are based in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, or elsewhere in Malaysia, your personal data is processed with the same standards of care.

By registering an Account on halimtoto, making a deposit, or otherwise using the Platform, you acknowledge that you have read this Policy and consent to the collection and processing of your personal data as described herein. If you do not consent to this Policy, you must not use the Platform.

02 Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information that relates to an identified or identifiable natural person, including name, email address, identification number, financial data, or device identifiers.
• "Processing" means any operation or set of operations performed on Personal Data, including collection, recording, storage, alteration, retrieval, consultation, use, disclosure, restriction, erasure, or destruction.
• "Data Controller" means halimtoto, the entity that determines the purposes and means of Processing Personal Data.
• "Data Processor" means any third-party service provider that processes Personal Data on behalf of halimtoto, subject to a written data processing agreement.
• "Sensitive Data" means Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, health or biometric data, or financial information beyond standard transactional data.
• "Cookies" means small text files placed on your device by the Platform for the purposes described in Section 8 of this Policy.
• "KYC" means Know Your Customer — the identity verification process required by our licensing obligations prior to processing withdrawals.
• "Platform" means the halimtoto website at https://halimtoto.cam, its subdomains, and associated services.

03 Personal Data We Collect

halimtoto collects the following categories of Personal Data from users of the Platform:

3.1 Registration & Account Data

• Full legal name as it appears on your government-issued identification;
• Date of birth and age verification information;
• Email address and mobile contact number;
• Username and password (stored in encrypted form — we do not have access to your plaintext password);
• Preferred language and communication preferences.

3.2 Identity Verification (KYC) Data

• Copy of government-issued photo identification (e.g., Malaysian MyKad, passport, or driving licence);
• Proof of address documentation (e.g., utility bill or bank statement dated within three months);
• Proof of payment method ownership (e.g., screenshot of registered e-wallet or bank account);
• Where applicable, source-of-funds documentation for transactions above applicable thresholds.

3.3 Financial & Transaction Data

• Deposit and withdrawal transaction records, including amounts (in MYR), timestamps, and payment method identifiers;
• Details of payment methods used, including partial account numbers for bank accounts or e-wallet identifiers for Touch 'n Go, Boost, GrabPay, DuitNow, and FPX;
• Betting and gaming history, including wager amounts, game titles, outcomes, and account balance changes;
• Bonus and promotion usage records.

3.4 Technical & Usage Data

• IP address and approximate geolocation derived from IP;
• Device type, operating system, browser type and version;
• Pages visited, time spent on pages, click-through paths, and session duration;
• Login timestamps, session activity logs, and any error events.

3.5 Communications Data

• The content of communications submitted via our live chat support function;
• Email correspondence with the halimtoto support team;
• Records of any complaints, disputes, or responsible gambling requests submitted by you.

04 How We Collect Personal Data

Personal Data is collected by halimtoto through the following means:

05 Purposes of Data Processing

halimtoto processes Personal Data for the following specific purposes:

5.1 Account Management & Service Delivery

To create and maintain your Player Account, authenticate your identity at login, process deposits and withdrawals, settle bets and gaming transactions, deliver customer support, and communicate service updates relevant to your Account.

5.2 Legal & Regulatory Compliance

To fulfil our obligations under applicable international licensing requirements, including mandatory KYC verification, anti-money laundering (AML) screening, age verification (21+), and suspicious activity reporting obligations. Compliance processing is a non-negotiable requirement of operating a licensed platform and cannot be opted out of.

5.3 Fraud Prevention & Security

To detect, investigate, and prevent fraudulent transactions, unauthorised Account access, bonus abuse, money laundering, match-fixing, and other prohibited conduct as described in our Terms & Conditions. This includes automated monitoring of account activity patterns against behavioural baselines.

5.4 Responsible Gambling

To administer responsible gambling tools including deposit limits, loss limits, session time-outs, and self-exclusion; to identify players who may exhibit signs of problem gambling based on behavioural patterns; and to fulfil responsible gambling obligations under our licensing framework.

5.5 Platform Improvement & Analytics

To analyse aggregated, anonymised usage data to identify performance bottlenecks, improve platform navigation, optimise game loading speeds, and enhance the overall player experience. Individual player data used for this purpose is anonymised before analysis where technically feasible.

5.6 Marketing Communications

To send you promotional offers, bonus notifications, VIP programme updates, and other marketing communications where you have provided express consent to receive such communications. You may withdraw marketing consent at any time by contacting our support team via live chat or by using the unsubscribe mechanism in any email communication.

06 Legal Basis for Processing

halimtoto relies on the following legal bases for processing Personal Data:

• Contractual Necessity: Processing required to fulfil our obligations under the Terms & Conditions — including Account management, payment processing, and customer support — is performed on the basis of contractual necessity.
• Legal Obligation: Processing required to comply with applicable licensing requirements, AML obligations, KYC regulations, and any reporting duties imposed by our licensing authority is performed on the basis of legal obligation.
• Legitimate Interests: Processing for fraud prevention, security monitoring, platform analytics, and responsible gambling monitoring is performed on the basis of halimtoto's legitimate interests in operating a safe, compliant, and commercially viable platform, balanced against your privacy interests.
• Consent: Processing for direct marketing communications is performed on the basis of your freely given, specific, informed, and unambiguous consent. Where consent is the basis for processing, you have the right to withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

07 Data Sharing & Disclosure

halimtoto does not sell Personal Data to third-party advertisers or data brokers under any circumstances. Personal Data may be shared with the following categories of third parties solely to the extent necessary for the stated purposes:

7.1 Payment Processors

Personal Data necessary to process transactions (including name, Account identifiers, and transaction amounts) is shared with licensed payment processors and financial institutions. This includes e-wallet providers (Touch 'n Go, Boost, GrabPay), DuitNow/FPX infrastructure providers, and cryptocurrency exchange gateways. All payment processors operate under their own independently certified data security frameworks.

7.2 KYC & Identity Verification Providers

Identity documents and verification data are shared with contracted third-party KYC verification service providers for the purpose of fulfilling mandatory identity and age verification obligations. These providers are contractually bound to use the data solely for verification purposes and to maintain appropriate security standards.

7.3 Regulatory & Licensing Authorities

halimtoto may be required to disclose Personal Data to its licensing authority, law enforcement agencies, or other competent regulatory bodies where required by law, court order, or regulatory direction. Such disclosures are made only to the extent legally required and will not be notified to you where notification is prohibited by law.

7.4 Technology & Infrastructure Providers

Personal Data may be processed by contracted cloud hosting, platform infrastructure, and cybersecurity service providers that support the technical operation of the Platform. These providers act as Data Processors under written data processing agreements that impose binding obligations on them with respect to data security and confidentiality.

7.5 Professional Advisers

Personal Data may be disclosed to legal counsel, auditors, and compliance advisers where necessary for the performance of their professional services, subject to applicable professional confidentiality obligations.

08 Cookies & Tracking Technologies

halimtoto uses cookies and similar tracking technologies to operate the Platform, maintain session state, remember your preferences, and gather anonymised analytics. The following categories of cookies may be placed on your device:

Most web browsers allow you to control cookie settings through your browser preferences. However, disabling strictly necessary or fraud prevention cookies may impair Platform functionality, including your ability to log in or process transactions. halimtoto does not use cookies for third-party advertising targeting.

09 Data Retention

halimtoto retains Personal Data for no longer than is necessary for the purposes for which it was collected, subject to any mandatory minimum retention periods imposed by applicable law or our licensing framework. The following indicative retention periods apply:

• Account & Registration Data: Retained for the duration of your Account and for a minimum period of five (5) years following Account closure, in accordance with standard AML record-keeping requirements.
• KYC Documentation: Retained for a minimum of five (5) years from the date of verification, or longer if required by applicable regulatory obligations.
• Financial Transaction Records: Retained for a minimum of five (5) years following the date of each transaction.
• Support & Communications Records: Retained for three (3) years from the date of the last interaction, or for the duration of any unresolved dispute.
• Technical & Usage Logs: Retained for up to twelve (12) months in identifiable form, after which they may be retained in anonymised, aggregated form.
• Marketing Consent Records: Retained for as long as you remain a registered Player and for two (2) years following Account closure, for proof-of-consent purposes.

Upon expiry of the applicable retention period, Personal Data will be securely deleted or irreversibly anonymised.

10 Data Security

halimtoto implements a layered set of technical and organisational security measures to protect Personal Data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the Platform is encrypted using industry-standard Secure Sockets Layer (SSL) / Transport Layer Security (TLS) protocols;
• Password Hashing: User passwords are stored exclusively in hashed, salted form using a robust cryptographic hashing algorithm. Plaintext passwords are never stored or accessible to Platform staff;
• Access Controls: Access to Personal Data within halimtoto's internal systems is restricted on a need-to-know basis, with role-based access controls and audit logging applied;
• Segregated Data Storage: Financial transaction data and identity documentation are stored in separate, access-controlled environments;
• Regular Security Testing: The Platform undergoes periodic security assessments and vulnerability testing.

Notwithstanding these measures, no data transmission or storage system can be guaranteed to be 100% secure. In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, halimtoto will notify affected users without undue delay in accordance with our licensing obligations.

11 Your Data Subject Rights

Subject to applicable law and the limitations imposed by our licensing and AML obligations, you hold the following rights in relation to your Personal Data held by halimtoto:

• Right of Access: You may request a copy of the Personal Data halimtoto holds about you, along with information about how it is processed.
• Right to Rectification: You may request the correction of any inaccurate or incomplete Personal Data held about you.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to our retention obligations under applicable law.
• Right to Restriction of Processing: You may request that we restrict the processing of your Personal Data in certain circumstances, for example where you contest the accuracy of the data.
• Right to Data Portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you may request that we provide your Personal Data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing carried out on the basis of legitimate interests, including profiling for responsible gambling monitoring or fraud detection.
• Right to Withdraw Consent: Where processing is based on consent (e.g., marketing communications), you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of the above rights, please contact our support team via live chat or by email at the address provided in Section 15 below. We will respond to all verifiable data subject requests within thirty (30) calendar days. In complex cases, this period may be extended by a further two months with advance notice.

Please note that certain rights are subject to limitations. For example, we cannot delete data that we are legally required to retain under AML or licensing regulations, and we cannot restrict fraud-prevention processing where such restriction would compromise platform security.

12 Children & Minors

The halimtoto Platform is strictly for individuals aged 21 years and above. We do not knowingly collect Personal Data from any person under the age of 21. Age verification is a mandatory step in the KYC process, and Account registration by minors is prohibited.

If halimtoto becomes aware that Personal Data has been collected from a person under the age of 21 — whether through a misrepresentation of age at registration or otherwise — the relevant Account will be immediately suspended, all associated Personal Data will be deleted as soon as practicable (subject to any mandatory retention obligations), and any funds in the Account will be handled in accordance with our Terms & Conditions and licensing obligations.

Parents and guardians who believe that a minor in their care has registered on the Platform are urged to contact our support team immediately via live chat so that the matter can be resolved without delay.

13 Third-Party Services & Links

The halimtoto Platform does not include links to third-party websites for general browsing purposes. However, the Platform integrates with certain third-party services — including payment gateways (Touch 'n Go, Boost, GrabPay, DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank, Hong Leong Connect) and KYC verification providers — in order to operate core platform functions.

When you are directed to a third-party payment gateway to complete a deposit or withdrawal, that gateway's own privacy policy and data handling practices apply to the transaction. halimtoto is not responsible for the privacy practices of independent third-party services. We recommend reviewing the privacy policy of any third-party service through which you conduct a transaction.

All third-party service providers engaged by halimtoto are subject to contractual data processing agreements that require them to handle Personal Data in a manner consistent with the standards set out in this Policy.

14 Amendments to This Policy

halimtoto reserves the right to update or amend this Privacy Policy at any time to reflect changes in data processing practices, applicable law, or platform services. Material amendments — those that significantly affect your rights or how your data is used — will be communicated to registered Players by email to the address on file, or via a prominent notice on the Platform, prior to taking effect.

The "Last Updated" date at the top of this page reflects the date on which the most recent version of this Policy was published. We encourage you to review this Policy periodically. Your continued use of the Platform following the publication of an amended Policy constitutes your acceptance of the updated terms.

15 Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy — including requests to exercise your data subject rights — please contact halimtoto through the following channels:

• Live Chat: Available 24/7 directly on the Platform — the fastest channel for all enquiries, including data access requests and consent withdrawals.
• Email (plain text — not a clickable link): [email protected]
• Correspondence Region: Kuala Lumpur, Malaysia

We will acknowledge receipt of all written privacy enquiries within five (5) business days and aim to resolve or substantively respond to all data subject requests within thirty (30) calendar days.