At aatoto, your privacy is a fundamental commitment — not a compliance checkbox. This Privacy Policy explains in clear, plain English exactly what personal data we collect from our Malaysian members, why we collect it, how we use and protect it, and what rights you have over your own information. We encourage you to read it in full before using the Platform.
aatoto uses 256-bit SSL encryption and strict access controls to safeguard every piece of personal data we hold on your behalf.
Six core commitments that underpin our approach to data privacy for all aatoto members across Malaysia.
All data transmitted between your device and our servers is protected by 256-bit TLS 1.3 encryption — the same standard used by Malaysia's leading financial institutions including Maybank and CIMB. Your personal and financial data is never transmitted in plain text.
Personal data is stored in encrypted, access-controlled server environments. Only authorised aatoto personnel with a legitimate operational need can access stored member data, and all such access is logged and audited regularly.
We collect only the data that is strictly necessary for the provision of our services and compliance with applicable law. We do not collect sensitive personal data beyond what is required for KYC verification and responsible gambling obligations.
aatoto does not sell, rent, or otherwise commercially transfer your personal data to any third-party organisation for their own marketing or commercial purposes. Period. Your data serves one purpose: enabling us to deliver services to you.
You retain meaningful rights over your personal data at all times — including the right to access, correct, restrict processing of, and request deletion of your information. These rights can be exercised by contacting our Data Protection team directly.
Our data handling practices are aligned with Malaysia's Personal Data Protection Act 2010 (PDPA) and applicable international data protection standards. We regularly review and update our practices to ensure ongoing compliance.
This Privacy Policy ("Policy") is published by aatoto ("we", "us", "our", "the Company"), the operator of the online gaming platform accessible at aatoto.asia and all associated subdomains and interfaces ("the Platform"). It describes how we collect, use, store, disclose, and protect the personal data of individuals ("you", "User", "Member") who access or use our Platform, including visitors who have not yet registered an account.
This Policy is to be read in conjunction with our Terms & Conditions and our Responsible Gambling Policy, both of which are incorporated herein by reference and together constitute our full suite of governing documentation. Where this Policy conflicts with those documents in relation to data privacy matters, this Policy shall take precedence.
By creating an account on the aatoto Platform or by continuing to use the Platform after this Policy has been made available to you, you acknowledge that you have read and understood this Policy and consent to the collection, use, and processing of your personal data as described herein. If you do not consent, you must not use the Platform.
aatoto takes its obligations under applicable data protection legislation — including but not limited to Malaysia's Personal Data Protection Act 2010 (PDPA) — seriously, and has designed its data handling processes to be consistent with these obligations. We commit to being transparent, proportionate, and accountable in our approach to personal data at all times.
For the purposes of this Privacy Policy, the following definitions apply:
| Term | Meaning |
|---|---|
| "Personal Data" | Any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial information, behavioural data, and technical identifiers. |
| "Processing" | Any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction, whether by automated or manual means. |
| "Data Controller" | aatoto, as the entity that determines the purposes and means of Processing Personal Data collected through the Platform. |
| "Data Processor" | Any third party engaged by aatoto to Process Personal Data on its behalf, including but not limited to payment processors, KYC verification providers, and cloud infrastructure providers. |
| "Cookies" | Small text files placed on your device by the Platform for the purposes of session management, preference storage, analytics, and fraud prevention. |
| "KYC" | Know Your Customer — the identity verification process through which aatoto validates the identity of registered members before processing withdrawals or granting enhanced account access. |
| "Sensitive Data" | A subset of Personal Data requiring enhanced protection, including government-issued identification numbers (e.g., Malaysian MyKad number), financial account details, and data relating to responsible gambling self-assessments. |
aatoto collects the following categories of Personal Data from Users of the Platform:
3.1 Registration Data
When you create an account, we collect your full legal name, date of birth, email address, phone number, and residential address. This information is required to establish your identity, confirm your eligibility to use the Platform (including age verification), and maintain an accurate member record.
3.2 Identity Verification (KYC) Data
Prior to processing any withdrawal, we are required to collect and verify copies of government-issued photo identification (Malaysian MyKad, passport, or equivalent), proof of residential address (utility bill, bank statement), and, where applicable, proof of ownership of the payment method used for deposits. This is a regulatory requirement, not a commercial one.
3.3 Financial Transaction Data
We collect records of all deposits and withdrawals made on the Platform, including transaction amounts, dates, payment method types, and processing reference numbers. We do not store full bank account numbers or card numbers — payment processing is handled by our certified Payment Card Industry (PCI-DSS) compliant payment partners, including those facilitating DuitNow, FPX, Touch 'n Go eWallet, Maybank2u, and CIMB Clicks transactions.
3.4 Gaming Activity Data
We maintain records of your gaming activity on the Platform, including games played, bet amounts, win/loss outcomes, session durations, and bonus interactions. This data is used for account management, responsible gambling monitoring, dispute resolution, and fraud prevention purposes.
3.5 Technical & Device Data
When you access the Platform, we automatically collect certain technical information about your device and connection, including IP address, browser type and version, operating system, device type, screen resolution, time zone, and pages visited. This data is used for security, fraud prevention, and analytics purposes.
3.6 Communication Data
We retain records of communications between you and our customer support team — including live chat transcripts, email correspondence, and support ticket records — for quality assurance, dispute resolution, and regulatory compliance purposes.
3.7 Responsible Gambling Data
Where you voluntarily engage with our responsible gambling tools — including deposit limits, self-exclusion, or reality check settings — we record and retain these preferences as part of your account profile. This data is treated with enhanced sensitivity and is not used for marketing purposes.
aatoto collects Personal Data through the following channels and mechanisms:
Note: aatoto does not purchase Personal Data lists or obtain your data from social media platforms for direct marketing purposes. All Personal Data held by aatoto was collected directly from you or generated through your use of our Platform.
aatoto processes your Personal Data on one or more of the following legal bases, consistent with applicable data protection law:
| Legal Basis | Application to aatoto's Data Processing |
|---|---|
| Contractual Necessity | Processing required to deliver the services described in our Terms & Conditions — including account management, transaction processing, game provision, and customer support. |
| Legal Obligation | Processing required to comply with applicable law — including KYC/AML verification obligations, responsible gambling regulatory requirements, and tax/financial record-keeping obligations. |
| Legitimate Interests | Processing for fraud prevention, platform security, abuse detection, product improvement analytics, and internal business administration — where these interests are not overridden by your data protection rights. |
| Consent | Processing for direct marketing communications (email newsletters, promotional offers) and non-essential cookies — where you have given explicit, freely withdrawn consent. You may withdraw consent at any time. |
aatoto uses the Personal Data it collects for the following purposes:
We do not use your Personal Data for automated decision-making that produces legal or similarly significant effects on you without your explicit consent, other than automated screening required by applicable AML/KYC regulations.
aatoto does not sell your Personal Data to third parties for their own commercial use. However, in order to deliver our services, we engage the following categories of third-party Data Processors who may have access to your Personal Data on a strictly need-to-know basis:
All third-party Data Processors engaged by aatoto are bound by contractual obligations requiring them to process your Personal Data only for the specified purpose, to maintain appropriate security measures, and to prohibit onward transfer to further third parties without aatoto's prior written consent.
aatoto uses cookies and similar tracking technologies on the Platform for the following purposes:
| Cookie Type | Purpose & Details |
|---|---|
| Strictly Necessary | Essential for core Platform functionality — session management, login state, security token validation. Cannot be disabled without preventing Platform access. No consent required. |
| Functional | Remembers your preferences such as language settings, display options, and responsible gambling configurations. Improves your experience without tracking behavioural data. |
| Analytics | Collects anonymised data on how Users navigate the Platform — pages visited, session duration, features used. Helps us improve the Platform. Requires your consent. |
| Security & Fraud | Device fingerprinting and behavioural analytics used to detect abnormal activity, bot traffic, and potential security threats. Essential for Platform integrity. |
You may manage your cookie preferences through your browser settings. Please note that disabling certain cookie categories may impact the functionality of the Platform. For mobile users accessing the Platform via a browser on Android or iOS, standard browser cookie management controls apply.
aatoto retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply as a general guide:
Upon expiry of the relevant retention period, Personal Data is either securely deleted or irreversibly anonymised. aatoto does not retain Personal Data in identifiable form beyond what is legally or operationally necessary.
aatoto implements a comprehensive set of technical and organisational security measures to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction. These measures include:
Your responsibility: While we implement robust security measures, you also play a role in protecting your account. Use a strong, unique password for your aatoto account, enable two-factor authentication, and never share your login credentials with any third party. If you suspect your account has been compromised, contact us immediately at [email protected].
Subject to applicable data protection law, you have the following rights in relation to your Personal Data held by aatoto. These rights may be exercised by submitting a written request to [email protected] with the subject line "Data Rights Request":
Request a copy of all Personal Data we hold about you, together with information about how and why it is being processed.
Request correction of any inaccurate or incomplete Personal Data we hold about you. You may also update basic account information directly through your account settings.
Request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected — subject to legal retention obligations.
Request that we restrict the Processing of your Personal Data in certain circumstances, such as while a dispute about its accuracy is being resolved.
Request a copy of Personal Data you provided to us in a structured, commonly used, machine-readable format for transfer to another service provider where technically feasible.
Object to the Processing of your Personal Data for direct marketing purposes at any time. You may also object to Processing based on legitimate interests in certain circumstances.
aatoto will respond to all valid data rights requests within 30 calendar days of receipt. Where a request is complex or numerous, this period may be extended by a further 60 days, in which case we will notify you of the extension and the reason for it within the initial 30-day window.
We may need to verify your identity before processing a data rights request to ensure we do not disclose your Personal Data to an unauthorised third party. We may request a copy of your government-issued identification for this purpose.
The aatoto Platform is strictly restricted to individuals aged 21 years and above. We do not knowingly collect, store, or process Personal Data from anyone under the age of 21. Our registration process includes age verification steps designed to prevent minors from creating accounts.
If we become aware that we have inadvertently collected Personal Data from a person under the age of 21, we will take immediate steps to delete that data and close the associated account. If you are a parent or guardian and believe your child has created an account on the Platform, please contact us immediately at [email protected] with the subject line "Minor Account Report" and we will investigate and take appropriate action without delay.
aatoto's primary operations serve the Malaysian market, and the majority of data processing takes place within or in connection with our hosting infrastructure. However, some of the third-party service providers we engage — including certain game content providers and cloud infrastructure partners — may be located in jurisdictions outside Malaysia.
Where Personal Data is transferred outside Malaysia, aatoto ensures that such transfers are made only to jurisdictions that provide an adequate level of data protection, or are subject to appropriate contractual safeguards (including standard contractual clauses) that provide equivalent protections to those available under Malaysian data protection law.
We do not transfer Personal Data internationally without first conducting due diligence on the data protection standards of the receiving jurisdiction and, where required, implementing contractual protections to safeguard your data.
aatoto reserves the right to update or amend this Privacy Policy at any time. When we make material changes to the Policy — changes that meaningfully affect how we collect, use, or share your Personal Data — we will notify registered members by email to the address associated with their account, and post a prominent notice on the Platform, at least 14 days before the changes take effect.
For minor amendments — such as clarifications, corrections of typographical errors, or adjustments reflecting changes in applicable law — the Policy will be updated and the "Last Updated" date revised accordingly, without specific prior notice.
Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. If you do not agree with the amended Policy, you must cease using the Platform and may request account closure in accordance with our Terms & Conditions.
For any questions, requests, or concerns relating to this Privacy Policy or the processing of your Personal Data by aatoto, please contact our Data Protection team through the following channels:
[email protected]
Subject: "Privacy Policy Enquiry"
Response within 30 days
Available 24/7 on the Platform
In English, Bahasa Melayu & 中文
Avg. response: 3–5 minutes
For details of your rights in relation to responsible gambling data specifically, please visit our Responsible Gambling page. For full service terms, please review our Terms & Conditions.
Over 350,000 Malaysian players trust aatoto with their personal and financial data. Our commitment to privacy, security, and transparency is the foundation of everything we do. Have questions? Our support team is here 24/7 in English, Bahasa Melayu, and Chinese.