Privacy Policy

Gengtoto ("we", "us", "our", "the Company", "the Platform") operates the online casino and sports betting service accessible at gengtoto.cam. We are committed to protecting the privacy and personal data of every player and visitor who interacts with our Platform.

This Privacy Policy describes how Gengtoto collects, receives, uses, stores, shares, transfers, and protects personal data in connection with your use of our website, games, payment services, and customer support channels. It applies to all registered players, visitors to gengtoto.cam, and any individual who contacts our support team.

By registering an Account on the Gengtoto Platform, you confirm that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you must not use the Platform.

The following definitions apply throughout this Privacy Policy:

• "Personal Data" means any information relating to an identified or identifiable natural person — for example, your name, email address, date of birth, payment details, or device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" means Gengtoto, which determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Processor" means a third party that processes Personal Data on behalf of Gengtoto under a contractual arrangement — for example, a payment gateway, identity verification service, or cloud hosting provider.
• "Cookies" means small text files stored on your device by a website that allow the site to remember information about your visit.
• "KYC" means Know Your Customer — the identity verification and age verification process required to comply with anti-money-laundering and responsible gambling obligations.
• "Account" means the individual registered user account created by a Player on the Gengtoto Platform.

Gengtoto collects the following categories of personal data. The specific data points collected depend on how you use the Platform and the services you access.

Gengtoto collects personal data through the following channels:

4.1 Direct Collection

You provide data directly to us when you register an Account, complete KYC verification, make a deposit or withdrawal, contact our support team, or respond to a survey or promotion. This includes identity documents uploaded for KYC verification and financial data submitted during payment flows.

4.2 Automated Technical Collection

When you visit and interact with the Platform, we automatically collect certain technical data through cookies, log files, and analytics tools. This includes your IP address, device and browser information, session timestamps, and usage patterns within the Platform. See Clause 8 for details on our Cookie use.

4.3 Third-Party Sources

We may receive supplementary data about you from authorised third-party sources, including:

• Identity and age verification service providers used to validate documents submitted during KYC
• Payment processing partners (e.g., FPX, DuitNow, e-wallet operators) — transaction confirmation data only
• Fraud prevention and anti-money-laundering screening services
• Publicly available registers where required by regulatory obligations

Gengtoto processes your personal data on the following legal grounds:

• Contractual Necessity: Processing is necessary to perform the services outlined in our Terms and Conditions — including account management, payment processing, game provision, and customer support.
• Legal Obligation: Certain processing is required by applicable law, including anti-money-laundering regulations, age verification requirements, and tax reporting obligations.
• Legitimate Interests: We process technical and usage data for fraud prevention, platform security, service improvement, and responsible gambling monitoring — where these interests are balanced against your privacy rights.
• Consent: Where we process data for purposes not covered by the above grounds (for example, sending optional promotional communications), we will obtain your explicit consent and you may withdraw it at any time.

Gengtoto uses your personal data for the following purposes:

6.1 Account Management

To create, maintain, and administer your Account, including processing login authentication, managing your balance, recording your transaction history, and responding to Account-related queries.

6.2 Payment Processing

To process your deposits and withdrawals via the payment methods you select — including Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, RHB, Hong Leong, DuitNow, FPX, Bitcoin (BTC), and USDT TRC20. Financial data is shared with payment partners solely for the purpose of completing the requested transaction.

6.3 Identity Verification (KYC)

To verify your age, identity, and the source of funds where required under our responsible gambling obligations and anti-money-laundering compliance framework. Malaysian players will typically be asked to submit a MyKad photograph for identity verification.

6.4 Fraud Prevention & Security

To detect, investigate, and prevent fraudulent activity, multi-accounting, money laundering, bonus abuse, and unauthorised Account access. Technical data including IP addresses and device fingerprints is used in automated fraud detection systems.

6.5 Responsible Gambling

To monitor Account usage for indicators of problem gambling behaviour, enforce deposit limits, loss limits, and self-exclusion requests, and provide appropriate interventions or referrals where Gengtoto's responsible gambling systems flag a concern.

6.6 Customer Support

To respond to your enquiries, complaints, and support requests through our 24/7 live chat and email channels. Support communications are logged to maintain accurate records and improve service quality.

6.7 Legal and Regulatory Compliance

To comply with applicable laws, respond to lawful requests from regulatory authorities, law enforcement agencies, and courts, and fulfil our reporting and record-keeping obligations.

Gengtoto does not sell, rent, or trade your personal data. We share personal data only in the limited circumstances described below, and only to the extent necessary for the stated purpose.

7.1 Payment Partners

Deposit and withdrawal transactions require sharing relevant financial and identity information with payment processing partners — including e-wallet operators (Touch 'n Go, Boost, GrabPay), FPX and DuitNow processing networks, and cryptocurrency processing services. All payment partners are required to handle your data in accordance with applicable data protection and financial regulatory requirements.

7.2 Identity Verification Providers

KYC verification may involve sharing your submitted identity documents with certified third-party identity verification service providers. These providers process verification data under strict contractual data processing agreements with Gengtoto.

7.3 Regulatory and Law Enforcement Authorities

Gengtoto may disclose personal data to relevant regulatory authorities, law enforcement agencies, financial intelligence units, or courts where we are legally required to do so, or where disclosure is necessary to prevent, detect, or investigate fraud, money laundering, or other criminal activity.

7.4 Technology and Service Providers

We engage third-party technology providers for cloud hosting, platform infrastructure, analytics, and fraud detection. These providers act as Data Processors under contractual agreements that require them to process your data only on Gengtoto's instructions and in compliance with applicable data protection law.

Gengtoto uses cookies and similar tracking technologies to operate the Platform effectively and securely. The categories of cookies we use are as follows:

8.1 Essential Cookies

These cookies are strictly necessary for the Platform to function. They manage your login session, maintain your authenticated state during a visit, and protect against cross-site request forgery attacks. The Platform cannot function without these cookies and no consent is required for their use.

8.2 Functional Cookies

These cookies remember your Platform preferences — such as display settings, previously selected deposit methods, and language preferences — to improve your experience across sessions.

8.3 Analytics Cookies

We use first-party analytics cookies to understand how players navigate the Platform, which features are used most frequently, and where technical issues may be occurring. This data is used in aggregate form to improve Platform performance and usability.

8.4 Security Cookies

Security cookies assist our fraud detection systems by helping to identify unusual device or session behaviour that may indicate account takeover attempts or bot activity.

You may configure your browser to refuse or delete cookies; however, disabling essential cookies will prevent the Platform from functioning correctly and you will not be able to log in or complete transactions.

Gengtoto implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction.

9.1 Technical Measures

• 256-bit SSL/TLS encryption on all pages, login flows, and transaction pages
• Two-factor authentication (2FA) available and recommended for all Accounts
• Data encryption at rest for stored personal and financial data
• Automated threat detection for login anomalies, unusual IP activity, and suspicious transaction patterns
• Regular security audits and penetration testing of Platform infrastructure
• Firewall and intrusion detection systems protecting the Platform's server environment

9.2 Organisational Measures

Access to personal data within Gengtoto is restricted on a strict need-to-know basis. Staff with access to personal data are trained in data protection obligations. Data processing agreements are in place with all third-party Data Processors. A data breach response procedure is maintained to ensure rapid response to any security incidents.

9.3 Your Responsibility

You are responsible for maintaining the security of your own Account credentials. Gengtoto strongly recommends enabling two-factor authentication, using a unique and strong password, and never sharing your login details with any third party. We will never contact you to ask for your password via email, live chat, or any other channel.

Gengtoto retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. The following retention guidelines apply:

• Active Account data: Retained for the duration of the Account and updated as necessary to keep it current and accurate.
• Transaction and financial records: Retained for a minimum of five (5) years following the transaction date in accordance with anti-money-laundering regulatory requirements.
• KYC verification documents: Retained for a minimum of five (5) years following Account closure or the end of the business relationship, as required by applicable AML regulations.
• Support and communication records: Retained for three (3) years from the date of the interaction, unless retention is required for ongoing dispute resolution or legal proceedings.
• Technical and usage logs: Retained for up to twenty-four (24) months for security and platform improvement purposes, then deleted or anonymised.
• Closed Account data: Following Account closure, data that is no longer required for legal or compliance purposes will be securely deleted within twelve (12) months of the closure date.

Where data is retained beyond the active Account period purely for legal compliance purposes, access to that data is restricted to authorised compliance and legal personnel only.

Subject to applicable law and Gengtoto's legal obligations, you have the following rights with respect to your personal data:

11.1 Right of Access

You have the right to request a copy of the personal data we hold about you, along with information about how it is processed. Requests will be responded to within a reasonable timeframe.

11.2 Right to Rectification

If the personal data we hold about you is inaccurate or incomplete, you have the right to request correction. Minor details (such as contact number or address) may be updated directly through your Account settings. Changes to core identity data require verification through our support team.

11.3 Right to Erasure

You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and no other legal basis applies. Note that certain data must be retained to comply with legal obligations (see Clause 10) — erasure requests cannot override mandatory retention requirements.

11.4 Right to Restrict Processing

You may request that we restrict the processing of your personal data in specific circumstances — for example, where you contest the accuracy of the data, or where processing is unlawful but you prefer restriction to erasure.

11.5 Right to Data Portability

Where processing is based on your consent or on a contract, and is carried out by automated means, you have the right to receive your personal data in a structured, machine-readable format so that it can be transferred to another controller.

11.6 Right to Object

You have the right to object to processing based on our legitimate interests. We will cease the processing unless we can demonstrate compelling legitimate grounds that override your interests, or where processing is necessary for legal claims.

11.7 Right to Withdraw Consent

Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of any processing carried out before withdrawal.

The Gengtoto Platform is strictly restricted to individuals aged 21 years and above. We do not knowingly collect, process, or store personal data from individuals under the age of 21. Age verification is conducted as part of the KYC process for all registered players.

If Gengtoto becomes aware that personal data has been collected from a person under the age of 21, that Account will be immediately suspended, all associated data will be deleted in accordance with our legal obligations, and the matter will be escalated in accordance with our responsible gambling and child protection policies.

If you are a parent or guardian and believe that a person under the age of 21 has registered an Account on the Platform, please contact our support team immediately via live chat or at [email protected] (plain text — not a link).

Some of Gengtoto's service providers — including cloud infrastructure, payment processing partners, and identity verification services — may be located in jurisdictions outside Malaysia. Where personal data is transferred internationally, Gengtoto ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that applied within Malaysia, including through contractual clauses and data processing agreements with all third-party processors.

By using the Gengtoto Platform, you acknowledge that your personal data may be transferred to and processed in countries outside of Malaysia in connection with the services described in this Policy. Gengtoto takes reasonable steps to ensure that any such transfers are compliant with applicable data protection requirements and that your data receives adequate protection regardless of where it is processed.

Gengtoto reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we offer. The most current version of the Privacy Policy will always be available at gengtoto.cam/privacy-policy, with the effective date clearly indicated at the top of the document.

Where changes to the Privacy Policy are material — meaning they significantly affect your rights or how your data is used — we will notify registered players by email or through an on-Platform notification, providing reasonable advance notice before the changes take effect.

Your continued use of the Platform after any Privacy Policy update has taken effect constitutes your acknowledgement of and agreement to the revised Policy. If you do not accept the revised Policy, you may close your Account as described in our Terms and Conditions.

If you have questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by Gengtoto, please contact us through the following channels. We are committed to responding to all privacy-related enquiries in a timely and thorough manner.

When submitting a data subject access request or an erasure request, please include your registered email address or username so that we can locate your Account records and verify your identity before processing your request.