Pecitoto Privacy Policy

Introduction

This Privacy Policy ("Policy") describes how Pecitoto ("the Platform", "we", "us", "our") collects, uses, stores, discloses, and protects the personal data of individuals ("you", "Player", "User") who access or use the Pecitoto website at pecitoto.cam and any associated services or sub-domains.

Pecitoto is committed to protecting the privacy and personal data of its players. We handle all personal data with respect, in accordance with applicable data protection laws and standards, including the Personal Data Protection Act 2010 (Malaysia) ("PDPA"), and applicable international data protection frameworks where relevant.

By registering an account with Pecitoto or otherwise accessing the Platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you should not use the Platform.

Definitions

In this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" — any information relating to an identified or identifiable natural person, including name, identification number, contact details, financial information, and online identifiers.
• "Processing" — any operation performed on personal data, including collection, recording, storage, use, disclosure, transfer, or deletion.
• "Data Controller" — the entity that determines the purposes and means of processing personal data. For the purposes of this Policy, the Data Controller is Pecitoto.
• "Data Processor" — a third party that processes personal data on behalf of Pecitoto under a data processing agreement.
• "KYC" — Know Your Customer; the identity and age verification process required under anti-money laundering and responsible gambling obligations.
• "Cookies" — small data files placed on your device by the Platform when you visit, used to enhance functionality and collect usage information.
• "PDPA" — the Personal Data Protection Act 2010 (Malaysia), which governs the processing of personal data in commercial transactions in Malaysia.
• "Platform" — the Pecitoto website at pecitoto.cam, its sub-pages, and all associated services and features accessible to registered and non-registered users.

Data Controller

Pecitoto acts as the Data Controller in respect of personal data collected from Players and visitors to the Platform. As Data Controller, Pecitoto determines the purposes for which your personal data is collected and processed, and the means by which that processing is carried out.

Pecitoto engages third-party Data Processors — including payment service providers, identity verification providers, and customer support platform providers — to process certain personal data on its behalf. All such Data Processors are bound by contractual obligations requiring them to process personal data only in accordance with Pecitoto's instructions and applicable data protection law.

For all privacy-related enquiries, requests to exercise your rights, or concerns about how your data is handled, please contact our designated data protection contact using the details provided in Section 15 of this Policy.

Personal Data We Collect

Pecitoto collects personal data from you directly (when you register, make a deposit, contact support, or interact with the Platform) and indirectly (through automated technologies such as cookies and server logs). The categories of personal data we collect include the following:

4.1 Registration & Account Data

• Full legal name as it appears on government-issued identification
• Date of birth (to verify that you are aged 21 or above)
• Malaysian National Identity Card (MyKad) number or passport number for non-citizens
• Email address
• Username and encrypted password
• Residential address (city, state, postcode) — including references to Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, or other Malaysian cities as provided by you

4.2 Financial & Transaction Data

• Deposit and withdrawal transaction history, amounts, and timestamps (denominated in MYR)
• Payment method identifiers — including Touch 'n Go eWallet account reference, Boost account reference, GrabPay account reference, bank account details for Maybank, CIMB, Public Bank, Hong Leong, RHB, or other banks used via DuitNow or FPX
• Cryptocurrency wallet addresses where USDT TRC20 or other crypto deposits are used
• Bonus and promotion redemption records

4.3 KYC & Verification Data

• Copies of government-issued identity documents (MyKad front and back, or passport)
• Proof of address documents (utility bills, bank statements, or official correspondence)
• Proof of payment method ownership documentation
• Selfie or video verification data where required by our verification provider

4.4 Technical & Usage Data

• IP address and approximate geographic location
• Browser type, version, and operating system
• Device identifiers (for mobile web access)
• Pages visited, session duration, and interaction data on the Platform
• Cookies and similar tracking technology data (see Section 11)

4.5 Communications Data

• Records of Live Chat, email, and WhatsApp support interactions
• Content of any complaint or feedback submitted to Pecitoto
• Marketing communication preferences and opt-in / opt-out records

Purposes of Processing

Pecitoto processes your personal data for the following purposes:

Legal Basis for Processing

Pecitoto processes your personal data on one or more of the following legal bases, consistent with the requirements of the PDPA and applicable international data protection standards:

1. Contractual Necessity: Processing is necessary to perform the contract between you and Pecitoto — i.e., to operate your account, process your transactions, and deliver the gaming services you have registered to use.
2. Legal Obligation: Processing is required to comply with legal obligations applicable to Pecitoto, including KYC, AML, and responsible gambling requirements.
3. Legitimate Interests: Processing is necessary for Pecitoto's legitimate business interests, including fraud prevention, platform security, and service improvement — provided those interests are not overridden by your rights and interests.
4. Consent: Where processing is based on your consent — such as for marketing communications — you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Data Sharing & Third Parties

Pecitoto does not sell, rent, or trade your personal data to any third party for that party's own marketing purposes. We share personal data with third parties only to the extent necessary for the following purposes:

• Payment Service Providers: We share the minimum necessary payment and identity data with our payment processing partners — including Touch 'n Go eWallet, Boost, GrabPay, DuitNow network banks (Maybank, CIMB, Public Bank, Hong Leong, RHB), FPX, and cryptocurrency processing partners — to execute your deposit and withdrawal transactions.
• Identity Verification Providers: We engage third-party KYC and identity verification providers to process your identity documents and confirm your eligibility to use the Platform. These providers act as Data Processors under strict contractual obligations.
• Customer Support Platforms: Our Live Chat and support communication tools are operated by third-party platform providers who process communication data on our behalf.
• IT & Infrastructure Providers: Our hosting, cloud infrastructure, and cybersecurity service providers may have access to personal data stored on the Platform's servers in the course of providing their services.
• Regulatory & Law Enforcement Authorities: Pecitoto may be required by law to disclose personal data to regulatory bodies, law enforcement agencies, or courts of competent jurisdiction in response to a lawful request or order.
• Business Transfers: In the event of a merger, acquisition, restructuring, or sale of Pecitoto's business or assets, personal data may be transferred to the relevant successor entity, subject to the same privacy protections as set out in this Policy.

Data Retention

Pecitoto retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, to comply with applicable legal and regulatory obligations, and to resolve any disputes that may arise. The specific retention periods that apply to different categories of data are summarised below:

• Account and KYC data: Retained for a minimum of five (5) years from the date of account closure, in accordance with AML record-keeping requirements.
• Transaction and financial records: Retained for a minimum of seven (7) years from the date of the transaction, consistent with standard financial record-keeping practices.
• Customer support communications: Retained for three (3) years from the date of the communication, or longer if relevant to an ongoing dispute or legal matter.
• Marketing consent records: Retained for the duration of your account relationship, plus a reasonable period thereafter as evidence of your consent status.
• Technical and usage data (server logs, cookies): Retained for up to thirteen (13) months from the date of collection, after which they are anonymised or deleted.

Following the expiry of applicable retention periods, personal data is securely deleted or anonymised such that it can no longer be associated with an identifiable individual. Where data is anonymised rather than deleted, the resulting anonymous data may be retained indefinitely for statistical and research purposes.

Your Rights as a Data Subject

Subject to applicable law and the limitations set out below, you have the following rights in respect of your personal data held by Pecitoto:

1. Right of Access: You have the right to request a copy of the personal data that Pecitoto holds about you, along with information about how and why it is being processed.
2. Right to Rectification: You have the right to request correction of any personal data that is inaccurate or incomplete. You may update certain account information directly from within your account settings.
3. Right to Erasure: In certain circumstances, you have the right to request deletion of your personal data. This right is subject to overriding legal obligations — for example, we cannot delete transaction records that we are required to retain under AML law.
4. Right to Restriction: You may request that Pecitoto restrict the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or have objected to processing.
5. Right to Object: You have the right to object to processing of your personal data where such processing is based on legitimate interests or is carried out for direct marketing purposes.
6. Right to Data Portability: Where processing is based on your consent or is carried out by automated means, you may request that your personal data be provided to you in a structured, commonly used, and machine-readable format.
7. Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time by contacting our support team. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, please contact Pecitoto using the details provided in Section 15. We will endeavour to respond to all valid data subject requests within thirty (30) calendar days of receipt. In complex cases we may extend this period by a further sixty (60) days with prior notice to you.

Data Security

Pecitoto implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, loss, destruction, or disclosure. These measures include:

• Transport Layer Security (TLS/SSL) encryption for all data transmitted between your device and the Pecitoto Platform
• Encryption at rest for sensitive personal data stored on Pecitoto's servers
• Role-based access controls limiting access to personal data to authorised personnel on a need-to-know basis
• Multi-factor authentication requirements for administrative system access
• Regular security audits, vulnerability assessments, and penetration testing
• 24/7 intrusion detection and monitoring systems
• Staff training on data protection and privacy obligations

Notwithstanding these measures, no data transmission over the internet or electronic storage system can be guaranteed to be completely secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, Pecitoto will notify you in accordance with applicable law.

Cookies & Tracking Technologies

Pecitoto uses cookies, web beacons, pixel tags, and similar tracking technologies on the Platform. This section explains what these are and how we use them.

11.1 What Are Cookies?

Cookies are small text files placed on your device (computer, smartphone, or tablet) when you visit the Platform. They allow the Platform to recognise your device on subsequent visits and store certain information about your preferences and interactions.

11.2 Types of Cookies We Use

11.3 Managing Your Cookie Preferences

You can control and manage cookies through your browser settings. Most browsers allow you to refuse cookies, delete existing cookies, or be notified when new cookies are set. Please note that disabling strictly necessary cookies will impair the functionality of the Platform and may prevent you from logging in or using certain features.

Minors & Age Restriction

The Pecitoto Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. If you are under 21 years of age, you must not register an account, make a deposit, or use any service on the Platform.

As part of the KYC process, Pecitoto requires all Players to verify their age and identity before withdrawal privileges are granted. If Pecitoto becomes aware that personal data has been collected from a person under the age of 21 without verifiable parental or guardian consent, it will take steps to delete that information and close the associated account as promptly as possible.

International Data Transfers

Pecitoto's primary operations serve Malaysian users, and the Platform is designed with the Malaysian market — including players in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and East Malaysia — as its core audience. However, some of our third-party service providers (including cloud infrastructure providers, KYC verification services, and payment processors) may be located or process data outside of Malaysia.

Where personal data is transferred outside Malaysia, Pecitoto ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that provided under the PDPA and this Policy. Such safeguards may include contractual clauses binding the recipient to adequate data protection standards, or reliance on the adequacy of the data protection regime in the destination country.

Changes to This Privacy Policy

Pecitoto reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or the structure of the Platform. The date of the most recent revision is clearly displayed at the top of this document.

Where a change is material — meaning it significantly affects your rights or the way your data is processed — Pecitoto will provide reasonable advance notice via email to your registered address or by way of a prominent notice on the Platform. Your continued use of the Platform following the effective date of any updated Policy constitutes your acceptance of those changes.

We encourage you to review this Privacy Policy periodically to stay informed about how Pecitoto protects your personal data.

Contact Us & Data Subject Requests

If you have any questions about this Privacy Policy, wish to exercise any of your data subject rights, or have a concern about how Pecitoto handles your personal data, please contact us through the following channels:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24/7 via the Live Chat widget on the Platform — average response time 3–5 minutes
• Support Languages: English, Bahasa Melayu, and Mandarin
• Support Hours: Round the clock, Malaysia Standard Time (MYT, UTC+8)

All data subject rights requests will be acknowledged within two (2) business days and resolved within thirty (30) calendar days of receipt. For complex requests, this period may be extended to ninety (90) days in total with prior notification to you.