Privacy Policy

1 Introduction

This Privacy Policy ("Policy") sets out how Flokitoto ("Company", "we", "us", "our"), operator of the online gaming platform accessible at https://flokitoto.cam ("Platform"), collects, uses, discloses, stores, and protects the personal data of individuals who register accounts, access, or otherwise interact with our services ("Users", "Players", "you").

Flokitoto recognises that the privacy and security of your personal data is fundamental to a trustworthy gaming experience. We are committed to processing your data lawfully, transparently, and in a manner that respects your rights as a data subject.

This Policy should be read alongside our Terms & Conditions and our Responsible Gambling Policy, both of which form part of your agreement with Flokitoto.

2 Definitions

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" — any information relating to an identified or identifiable natural person, including but not limited to name, email address, date of birth, financial information, and device identifiers.
• "Processing" — any operation or set of operations performed on personal data, including collection, recording, storage, use, disclosure, or deletion.
• "Data Controller" — Flokitoto, the entity that determines the purposes and means of processing personal data collected through the Platform.
• "Data Processor" — any third-party entity that processes personal data on behalf of Flokitoto under a data processing agreement.
• "Consent" — a freely given, specific, informed, and unambiguous indication of a User's agreement to the processing of their personal data for a specified purpose.
• "KYC Data" — identity and age verification documentation provided by a User for Know Your Customer compliance purposes, including government-issued identification and proof of address.
• "Cookies" — small text files stored on a User's device by the Platform for the purposes of session management, user preference storage, and analytics.

3 Personal Data We Collect

Flokitoto collects personal data through a variety of means, including during account registration, KYC verification, payment processing, customer support interactions, and platform usage. The categories of personal data we may collect include:

3.1 Registration & Identity Data

• Full legal name and preferred username
• Date of birth (for age verification — minimum 21 years required)
• Email address and mobile phone number
• Country and state of residence (e.g., Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam)
• Preferred language and currency (MYR/RM by default)

3.2 KYC Verification Data

• Malaysian MyKad, passport, or other government-issued photo identification
• Proof of residential address (utility bills, bank statements)
• Proof of ownership for payment methods used on the Platform
• Selfie or live photograph for biometric identity confirmation where required

3.3 Financial & Transaction Data

• Deposit and withdrawal transaction records denominated in MYR
• Payment method identifiers (e-wallet account references, masked bank account numbers)
• Transaction timestamps, amounts, and status logs
• Cryptocurrency wallet addresses where applicable (BTC, USDT)

3.4 Gaming & Behavioural Data

• Bet history, game session logs, and wagering patterns
• Sports markets accessed (including EPL, Liga Super Malaysia, and other events)
• Responsible gambling tool usage — deposit limits, session timers, self-exclusion requests
• Promotional offer interactions and bonus redemption records

3.5 Technical & Device Data

• IP address and approximate geolocation
• Device type, operating system, and browser version
• Cookies, session tokens, and local storage identifiers
• Platform access timestamps and feature usage logs

3.6 Communications Data

• Customer support chat transcripts and email correspondence
• Responses to surveys, promotions, or feedback requests
• Marketing communication preferences and opt-in/opt-out records

4 How We Use Your Personal Data

Flokitoto processes personal data for clearly defined purposes. The table below summarises our primary processing activities and the corresponding purpose for each:

5 Legal Basis for Processing

Flokitoto processes your personal data on one or more of the following legal bases:

• Contractual Necessity: Processing required to perform the contract between you and Flokitoto — including account registration, payment processing, and delivery of gaming services.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including KYC/AML obligations, age verification requirements, and regulatory reporting.
• Legitimate Interests: Processing undertaken for Flokitoto's legitimate business interests, such as fraud prevention, platform security, and service improvement, where such interests are not overridden by your rights and freedoms.
• Consent: Processing based on your explicit, freely given consent — primarily for marketing communications and non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

6 Data Sharing & Disclosure

Flokitoto does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may share personal data in the following limited circumstances:

6.1 Trusted Service Providers

We engage third-party Data Processors — including payment gateways (covering DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and Hong Leong integrations), KYC verification services, cloud hosting providers, and customer support platforms — who process data on our behalf under strict contractual obligations. These processors are prohibited from using your data for any purpose other than providing services to Flokitoto.

6.2 Game Software Providers

Where required to deliver specific games on the Platform, anonymised or session-level data may be shared with licensed game software providers. Full personal identity data is not transmitted to game providers under standard operating conditions.

6.3 Legal and Regulatory Authorities

Flokitoto may disclose personal data to regulatory bodies, law enforcement agencies, or courts where required by applicable law or a valid legal order. We will notify affected Users of such disclosures to the extent permitted by law.

6.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of Flokitoto's business, personal data held by the Company may be transferred to the acquiring entity, subject to the same privacy protections set out in this Policy.

7 Data Retention

Flokitoto retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Active Account Data: Retained for the duration of the account relationship and for a minimum of five (5) years following account closure, in accordance with anti-money laundering record-keeping requirements.
• KYC Documents: Retained for a minimum of five (5) years from the date of verification or account closure, whichever is later.
• Transaction Records: Retained for a minimum of seven (7) years to satisfy financial audit and AML compliance obligations.
• Customer Support Records: Retained for three (3) years from the date of last interaction or dispute resolution.
• Marketing Consent Records: Retained for the duration of the consent period and for three (3) years following withdrawal of consent as proof of prior consent status.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our data destruction procedures.

8 Data Security Measures

Flokitoto implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security measures include, but are not limited to:

• 256-bit SSL/TLS encryption for all data transmitted between your device and our servers
• At-rest encryption for all stored personal data and financial records
• Role-based access controls limiting data access to authorised personnel on a need-to-know basis
• Two-factor authentication (2FA) available for all User Accounts
• Regular third-party penetration testing and security audits
• Intrusion detection and real-time anomaly monitoring systems
• Strict internal data handling policies and staff data protection training

In the event of a data security incident that affects your personal data, Flokitoto will notify affected Users and relevant authorities in accordance with applicable data breach notification obligations.

9 Cookies & Tracking Technologies

Flokitoto uses cookies and similar tracking technologies on our Platform. Cookies are small data files placed on your device that help us deliver a better, more personalised experience. We use the following categories of cookies:

• Strictly Necessary Cookies: Required for the Platform to function. These cookies enable secure login sessions, maintain your Account state, and process transactions. They cannot be disabled.
• Performance & Analytics Cookies: Used to collect anonymised information about how Users interact with the Platform, enabling us to identify improvements and optimise page performance.
• Functionality Cookies: Store your preferences — such as language, currency display (MYR), and notification settings — so they persist between sessions.
• Marketing Cookies (with consent only): Used to deliver relevant promotional content to Users who have explicitly opted in. These are never shared with third-party advertisers.

You may manage or disable non-essential cookies through your browser settings. Note that disabling strictly necessary cookies will impair Platform functionality. For further information on managing cookies in your browser, refer to your browser's help documentation.

10 Your Data Subject Rights

Subject to applicable data protection laws, you have the following rights in relation to the personal data Flokitoto holds about you:

• Right of Access: You may request a copy of the personal data we hold about you.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
• Right to Restriction of Processing: You may request that we restrict the processing of your personal data in certain circumstances, such as while a dispute is being investigated.
• Right to Data Portability: You may request a structured, machine-readable copy of the personal data you provided to us, where processing is based on consent or contract.
• Right to Object: You may object to processing based on legitimate interests, including profiling for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

11 Minors & Age Verification

The Flokitoto Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory step in our KYC process and is enforced prior to any withdrawal being processed.

If Flokitoto discovers or is notified that personal data has been collected from a person under the age of 21, we will take immediate steps to delete that data and close the associated Account. Any balance associated with an underage Account will be forfeited in accordance with our Terms & Conditions.

If you are a parent or guardian and believe your child may have registered on Flokitoto, please contact us immediately using the details in Section 14.

12 International Data Transfers

Flokitoto primarily stores and processes data within secure data centre facilities. Where it is necessary to transfer personal data to service providers or partners located outside the country of data collection, Flokitoto ensures that appropriate safeguards are in place to protect your personal data.

Such safeguards may include data processing agreements incorporating standard contractual clauses, adequacy decisions by relevant regulatory authorities, or other legally recognised transfer mechanisms. We will not transfer your personal data to any jurisdiction that does not offer an adequate level of data protection without appropriate safeguards in place.

13 Amendments to This Policy

Flokitoto reserves the right to update or amend this Privacy Policy at any time. When material changes are made, we will update the "Last Updated" date at the top of this Policy and, where appropriate, notify active Users via email or a prominent notice within the Platform.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data. Your continued use of the Flokitoto Platform following the publication of any amended Policy constitutes your acceptance of the revised terms.

14 Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please contact the Flokitoto Data Protection team using the details below. All communications should be submitted in English.