Legal & Compliance
Your privacy is a fundamental right that Lakitoto takes seriously. This Privacy Policy explains precisely what personal data we collect, why we collect it, how we use and protect it, who we share it with, and the rights you hold in relation to your own information. Please read this document carefully alongside our Terms & Conditions.
Contents
Section 1
Lakitoto ("we", "us", "our", or "the Platform") operates the online betting and live casino platform accessible at lakitoto.cam. As a platform that serves players across Malaysia — including users in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and beyond — we collect and process personal data as a necessary part of providing our services safely, securely, and in compliance with our international online gaming licensing obligations.
This Privacy Policy ("Policy") describes our data collection, use, storage, and sharing practices in relation to individuals who visit, register on, or otherwise interact with the Platform. It has been prepared with reference to internationally recognised data protection standards, including principles from the General Data Protection Regulation (GDPR) and the Malaysian Personal Data Protection Act 2010 (PDPA 2010), and reflects our commitment to transparent, lawful, and proportionate data handling.
By creating an account on Lakitoto or by continuing to use the Platform after this Policy has been made available to you, you acknowledge that you have read and understood our data practices as described herein. If you do not agree with how we handle your personal data, you should not create an account or continue using the Platform.
Section 2
For the purposes of this Privacy Policy, the following terms shall bear the meanings set out below:
"Personal Data"
Any information relating to an identified or identifiable natural person ("data subject") — that is, any information that can be used on its own or in combination with other data to identify a specific individual. This includes names, email addresses, phone numbers, identification document numbers, IP addresses, and financial account details.
"Processing"
Any operation or set of operations performed on personal data, including but not limited to collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, restriction, erasure, or destruction.
"Data Controller"
Lakitoto, as the entity that determines the purposes and means of processing your personal data in connection with the Platform.
"Data Processor"
Any third party that processes personal data on behalf of Lakitoto under a data processing agreement — for example, KYC verification providers, payment processors, and cloud hosting providers.
"Consent"
A freely given, specific, informed, and unambiguous indication of the data subject's agreement to the processing of their personal data for a stated purpose. Consent may be withdrawn at any time without detriment, although withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.
"Sensitive Personal Data"
A subset of personal data that warrants heightened protection due to its nature, including financial account information, identity document details, and health information where relevant to responsible gambling assessments.
Section 3
Lakitoto collects personal data in the following categories, depending on how you interact with the Platform:
| Category | Examples | When Collected |
|---|---|---|
| Identity Data | Full name, date of birth, nationality, gender, government-issued ID number (e.g., MyKad number, passport number) | Registration, KYC verification |
| Contact Data | Email address, mobile phone number, residential address | Registration, account updates |
| Financial Data | Bank account details, e-wallet account identifiers (Touch 'n Go, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, DuitNow, FPX), cryptocurrency wallet addresses, transaction history | Deposit / withdrawal processing, KYC |
| Verification Documents | Copies of identity documents, proof of address documents, payment method ownership screenshots | KYC verification process |
| Usage Data | Login timestamps, pages visited, games played, bets placed, session duration, device type, browser type | Automatically, during Platform use |
| Technical Data | IP address, device identifiers, operating system, referring URL, cookie data | Automatically, during Platform use |
| Communications Data | Live chat transcripts, email correspondence, support ticket content | When you contact support |
| Responsible Gambling Data | Self-imposed limits, self-exclusion status, responsible gambling questionnaire responses | When you use responsible gambling tools |
We do not collect data that is not reasonably necessary for the purposes described in this Policy. We do not collect biometric data, precise geolocation data, or data relating to racial or ethnic origin, political opinions, or religious beliefs.
Section 4
We collect personal data through the following primary channels:
Section 5
Lakitoto processes your personal data only where a valid legal basis exists. The applicable bases are as follows:
Section 6
We use the personal data we collect for the following purposes, each of which is tied to a specific legal basis as described above:
Section 7
Lakitoto does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share your data only in the following circumstances and only to the extent necessary:
Section 8
Lakitoto uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files placed on your device by your web browser when you visit our site. We use the following categories of cookies:
You can control cookie behaviour through your browser settings. Note that disabling strictly necessary cookies will impair your ability to use the Platform. Disabling performance cookies will not affect your ability to bet or manage your account. For detailed cookie settings, refer to the help documentation of your browser (Chrome, Firefox, Safari, Edge, or Samsung Internet for Android users).
Section 9
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, comply with applicable legal obligations, resolve disputes, and enforce our agreements. The following indicative retention periods apply:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account & identity data | Duration of account + 5 years after closure | AML/KYC legal obligation |
| Transaction & financial records | 7 years from transaction date | Financial record-keeping obligation |
| KYC verification documents | 5 years after account closure | Licensing & AML obligation |
| Betting & game history | 3 years after account closure | Dispute resolution, regulatory audit |
| Support correspondence | 2 years after resolution | Legitimate interest |
| Marketing consent records | Until consent withdrawn + 2 years | Consent management compliance |
| Technical / log data | 12 months on rolling basis | Security & fraud prevention |
| Self-exclusion records | Indefinite (responsible gambling obligation) | Legal & ethical obligation |
Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that permanently prevents re-identification. We do not retain personal data in identifiable form beyond what is necessary.
Section 10
Lakitoto implements a range of technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our current security controls include:
Section 11
Subject to applicable law, you hold the following rights in relation to your personal data held by Lakitoto. To exercise any of these rights, please contact our support team via live chat or email as described in Section 16.
You have the right to request a copy of the personal data we hold about you, along with information about how it is being processed. We will provide this in a structured format within 30 days of a verified request.
You have the right to request correction of any inaccurate or incomplete personal data we hold about you. You can update most account information directly through your account settings without contacting support.
You have the right to request deletion of your personal data in certain circumstances — for example, where the data is no longer necessary for the purposes for which it was collected. Note that this right is subject to our legal retention obligations; we cannot erase data we are legally required to retain.
You have the right to request that we limit the processing of your personal data in certain situations — for example, while a dispute about data accuracy is being resolved, or where you have objected to processing and we are assessing whether our legitimate interests override your objection.
Where processing is based on your consent or on a contract, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format, and to request that it be transmitted to another controller where technically feasible.
You have the right to object to processing of your personal data carried out on the basis of legitimate interests, including profiling for direct marketing purposes. Once you object to marketing processing, we will cease that activity immediately.
Where processing is based on your consent (e.g., marketing communications), you have the right to withdraw that consent at any time without giving reasons. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.
We will respond to all data rights requests within 30 calendar days. Where a request is particularly complex or we receive multiple requests from the same individual, we may extend this period by a further two months, notifying you accordingly. We will not charge a fee for exercising your rights unless requests are manifestly unfounded or repetitive.
Section 12
The Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect, solicit, or process personal data from individuals under the age of 21. If we become aware that we have inadvertently collected personal data from a person under 21, we will take immediate steps to delete that data and suspend the associated account.
If you are a parent or guardian and believe that a minor in your care has registered on the Platform or provided us with personal data without your knowledge, please contact our support team immediately via live chat. We will investigate and take prompt corrective action, including permanent account closure and data deletion.
Section 13
Lakitoto operates under international online gaming licensing and may use service providers located in jurisdictions outside of Malaysia. Your personal data may therefore be transferred to, stored in, or processed in countries other than Malaysia — including countries whose data protection laws may differ from those in Malaysia.
Where we transfer personal data internationally, we take steps to ensure that appropriate safeguards are in place to protect your data to a standard equivalent to that applied within Malaysia. Safeguards may include:
You may contact our support team to request further information about the safeguards applicable to any specific international transfer of your personal data.
Section 14
The Platform may contain references to or integrations with third-party payment services (including e-wallets such as Touch 'n Go, Boost, and GrabPay, and banking services such as Maybank and CIMB). While we take care to work with reputable service providers, Lakitoto is not responsible for the privacy practices or content of any third-party platform, service, or application.
When you interact with a third-party payment provider — for example, when authorising a DuitNow or FPX transfer — you are subject to that provider's own privacy policy and terms of service. We encourage you to review the privacy policies of all payment service providers you use in connection with your Lakitoto account. Lakitoto has no control over, and accepts no responsibility for, how third-party providers collect or handle your data.
Section 15
Lakitoto reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or operational requirements. The effective date of the most current version will always be displayed at the top of this page.
For material changes — amendments that significantly affect the way in which we collect, use, or share your personal data — we will provide notice to active registered users via email to your registered address or via a prominent on-platform notification, at least 14 days prior to the change taking effect.
Your continued use of the Platform after the effective date of any amendment constitutes your acknowledgement of and agreement to the revised Policy. If you do not agree with the amended Policy, you should discontinue use of the Platform and request account closure before the amendment date. We recommend reviewing this page periodically.
Section 16
If you have any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact our Data Protection team through the following channels. All privacy-related enquiries will be handled with priority and confidentiality.
For formal data subject rights requests (access, rectification, erasure, restriction, portability, or objection), please provide your full registered name, account email address, and a clear description of your request. For identity verification purposes, we may ask you to confirm your identity before processing your request.
Privacy at a Glance
Six commitments that define how Lakitoto handles your personal information every day.
All data transmitted between your device and our servers is protected by industry-standard 256-bit SSL encryption. Whether you're depositing via Touch 'n Go or placing a live bet, your information is encrypted in transit.
Access to personal data is restricted to authorised staff with a genuine operational need. Multi-factor authentication and role-based access controls are enforced across all internal systems that handle player data.
Lakitoto does not sell, rent, or trade your personal data to third parties for their independent marketing purposes. Your data is used exclusively to operate, secure, and improve the services we provide to you.
We retain your personal data only for as long as required to fulfil our contractual and legal obligations. Data is securely deleted or anonymised when it is no longer required, in accordance with the retention schedules outlined in this Policy.
You can request access to, correction of, or deletion of your personal data at any time. We respond to data subject rights requests within 30 days, with no fees charged for legitimate requests.
Our data handling practices are aligned with the principles of Malaysia's Personal Data Protection Act 2010 — including notice, consent, purpose limitation, data integrity, access rights, and security obligations.
Start Playing with Confidence
Now that you understand how we handle your privacy, explore everything Lakitoto has to offer — live sports betting, premium casino games, and a VIP programme built specifically for Malaysian players.
For players aged 21 and above only. Please gamble responsibly. For privacy enquiries, contact our support team via live chat any time.