BebToto Privacy Policy for Malaysian Players

This Privacy Policy applies to personal information processed through the BebToto website, account interface, sportsbook, casino services, payment functions, customer support channels, promotions, and responsible gambling controls. References to “BebToto”, “we”, “our”, or “us” refer to the operator of these services. References to “you” or “player” mean the visitor or registered account holder.

By accessing BebToto or supplying personal information, you acknowledge the processing practices described in this policy. This policy should be read together with the BebToto Terms & Conditions. It is intended to reflect relevant privacy principles, including transparency, security, data minimisation, and the applicable requirements of Malaysian data protection law where those requirements apply.

BebToto collects information you provide when registering, updating a profile, completing KYC, depositing or withdrawing funds, claiming a bonus, setting a responsible gambling limit, submitting a complaint, or speaking with support. Required fields will normally be identified during the relevant process.

You must provide accurate and current information. BebToto may request supporting evidence where an account detail changes or where a transaction, withdrawal, security event, or identity review requires confirmation. Failure to provide required information may prevent BebToto from opening an account, processing a withdrawal, or continuing to provide a regulated or security-sensitive service.

When a person accesses BebToto, technical information may be recorded automatically. This can include an IP address, approximate location, device identifier, browser type, operating system, referral page, visited pages, session duration, login attempts, and interaction with navigation or betting features.

BebToto uses this information to maintain website performance, remember account preferences, identify suspicious access, prevent automated abuse, investigate technical faults, and understand how services are used. Approximate location information may also support access controls and help BebToto identify activity inconsistent with an account holder's ordinary login pattern.

BebToto may process personal information for the following purposes:

• Creating, authenticating, maintaining, and securing player accounts.
• Confirming that a player is aged 21 or above and verifying identity.
• Processing MYR deposits, withdrawals, refunds, and payment enquiries.
• Recording and settling sports wagers, casino rounds, bonuses, and account adjustments.
• Providing support in English, Bahasa Melayu, or Chinese according to player preference.
• Detecting fraud, collusion, payment abuse, account sharing, and cyber-security threats.
• Applying deposit limits, cooling-off periods, self-exclusion, and safer gambling reviews.
• Handling complaints, legal requests, disputes, and service-quality monitoring.
• Communicating essential account, security, payment, or policy information.

BebToto seeks to use information in a manner proportionate to the purpose for which it was collected. Where consent is required for a particular activity, that consent may be requested separately and can ordinarily be withdrawn for future processing.

BebToto may require Know Your Customer checks to confirm identity, prevent fraud, protect withdrawals, and restrict underage access. Verification information may include a valid MyKad, passport or driver's licence, a utility bill or bank statement dated within three months, and a selfie or live identity check.

Documents should be uploaded only through the secure BebToto account process. Players should not send identity documents through unsecured chat services. Access to KYC material is limited to authorised personnel and approved verification providers who require the information to perform the relevant review.

BebToto processes financial information when players use supported options such as DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, or Hong Leong. BebToto generally records transaction references, payment type, amount, date, status, and masked account details rather than complete banking credentials.

Payment information is used to complete transactions, verify ownership, reconcile balances, respond to disputes, detect suspicious activity, and satisfy financial record-keeping obligations. A payment provider may process information under its own privacy terms. BebToto does not ask players to disclose online banking passwords or one-time authorisation codes to customer support.

BebToto may use cookies, local storage, session identifiers, and comparable technologies. Essential cookies support login sessions, account security, language settings, and website operation. Analytics technologies help BebToto assess performance, identify broken pages, and understand broad usage patterns.

Browser controls may allow users to delete or block cookies. Disabling essential cookies can prevent login, interrupt sportsbook updates, or stop account features from working correctly. Cookie data is not used by BebToto to obtain a player's complete banking password or access unrelated files stored on a personal device.

BebToto does not sell personal information. Information may be shared with carefully selected service providers where necessary to operate the platform. These providers may support identity verification, payments, hosting, cyber security, fraud monitoring, customer service, game delivery, analytics, or professional advice.

BebToto may also disclose information where required by applicable law, a valid legal process, a competent authority, or a legitimate investigation involving fraud, money laundering, match manipulation, threats, or player safety. Only information reasonably relevant to the request should be disclosed.

If the BebToto business undergoes a restructuring, merger, financing, or transfer, relevant information may be provided to professional advisers or a successor subject to appropriate confidentiality and privacy safeguards.

Some technical, payment, verification, or customer service functions may involve processing outside Malaysia. Privacy and security rules can differ between countries. Where international processing occurs, BebToto seeks to use contractual, organisational, and technical safeguards appropriate to the sensitivity of the information.

Access is limited according to role and operational need. Service providers are expected to process BebToto information only for agreed purposes, maintain confidentiality, apply reasonable security, and delete or return information when their services end, subject to lawful retention duties.

BebToto applies safeguards intended to protect information against accidental loss, alteration, unauthorised disclosure, or misuse. These measures may include encrypted website connections, password controls, restricted administrative access, monitoring, system backups, verification procedures, and staff confidentiality requirements.

No online system can guarantee absolute security. Players also have an important role: use a unique password, protect one-time codes, keep devices updated, sign out on shared devices, and report suspicious account activity promptly. BebToto support will never require a player to reveal their complete password.

BebToto retains information for as long as reasonably required to operate an active account and fulfil the purposes described in this policy. After account closure, certain records may remain necessary for fraud prevention, financial reconciliation, responsible gambling enforcement, complaint handling, security, and legal obligations.

Retention periods vary according to the type of record, sensitivity, risk, and applicable requirement. BebToto may anonymise information when identifiable details are no longer required. Properly anonymised statistics may be retained for platform analysis because they no longer identify an individual player.

Where permitted and requested, BebToto may send information about sportsbook events, casino features, bonuses, or account offers. Marketing preferences may be updated through available account settings or by contacting support. Withdrawing marketing consent does not prevent essential service messages.

BebToto may still communicate about password security, payment status, KYC requirements, material policy changes, responsible gambling restrictions, or account closure. These operational messages are necessary for the service and are not promotional advertising.

Subject to applicable law and identity verification, a player may ask BebToto whether personal information is processed, request access to certain records, correct inaccurate information, or raise an objection to particular processing. A player may also request deletion or restriction where the information is no longer required and no overriding retention duty applies.

BebToto may need to retain transaction, verification, security, or self-exclusion records despite a deletion request. This can be necessary to protect players, prevent fraud, resolve disputes, or meet legal obligations. BebToto will explain a material limitation where reasonably appropriate.

BebToto services are intended only for people aged 21 and above. Personal information is not knowingly collected to enable underage gambling. If BebToto identifies an underage account, access may be suspended while identity and payment activity are reviewed.

Information relating to deposit limits, cooling-off periods, self-exclusion, or indicators of harmful gambling may be processed to protect a player and enforce restrictions. BebToto handles these records carefully and limits access to personnel who need the information for responsible gambling support, security, or compliance.

BebToto may update this Privacy Policy when services, payment methods, security practices, legal expectations, or data-processing activities change. The revised version will be published on this page with an updated effective date where appropriate.

Material changes may also be highlighted through the website or account interface. Players should review this page periodically. Continued use of BebToto after a revised policy becomes effective acknowledges the updated processing information, although separate consent will be requested where required.