Privacy Policy

This Privacy Policy ("Policy") describes how cucutoto ("the Platform", "we", "us", "our") collects, processes, stores, shares, and protects the personal data of individuals ("you", "User", "Player") who access or use the cucutoto website at https://cucutoto.cam, its associated subdomains, and any related mobile-optimised services.

cucutoto provides online casino gaming, sports betting, live dealer tables, and related entertainment services primarily to players in Malaysia. As a platform that processes financial transactions, verifies player identities, and operates across digital payment infrastructure — including Touch 'n Go eWallet, DuitNow, FPX, Maybank, CIMB, and cryptocurrency networks — the responsible management of personal data is central to our operations.

By registering an account with cucutoto or continuing to use the Platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. This Policy forms part of, and should be read in conjunction with, the cucutoto Terms & Conditions.

For the purposes of this Policy, the following terms carry the meanings set out below:

• "Personal Data" — Any information that identifies or can reasonably identify a natural person, directly or in combination with other available data.
• "Processing" — Any operation performed on personal data, including collection, storage, use, disclosure, erasure, or destruction.
• "Data Controller" — cucutoto, being the entity that determines the purposes and means of processing personal data collected through the Platform.
• "Data Processor" — A third party that processes personal data on behalf of cucutoto under a contractual data processing agreement.
• "KYC" — Know Your Customer verification, a regulated identity and address verification procedure required before certain account actions may be completed.
• "Cookies" — Small text files placed on your device by the Platform to enable session management, analytics, and personalisation functions.
• "Special Category Data" — Sensitive personal data warranting enhanced protection, including health data, which may arise in the context of responsible gambling self-assessments.

The following categories of personal data are collected by cucutoto:

We do not collect payment card numbers, full bank account credentials, or e-wallet passwords. Payment authentication is handled directly by the respective payment processors (e.g., Touch 'n Go, Boost, GrabPay, DuitNow, FPX, Maybank) through their own secure interfaces.

cucutoto collects personal data through the following channels:

• Direct interactions: Information you provide when creating an account, completing KYC verification, making deposits or withdrawals, contacting our customer support team, or updating your account settings.
• Automated technologies: Technical and usage data collected automatically when you access the Platform, including through cookies, web beacons, server logs, and similar tracking technologies described further in Section 10.
• Third-party sources: Data received from KYC verification service providers, fraud detection agencies, and payment processing partners in the course of identity verification and transaction processing. In certain cases, limited supplementary identity data may be obtained from publicly available or licensed identity databases in compliance with applicable law.

We process your personal data for the following purposes:

1. Account administration: Creating, maintaining, and managing your cucutoto account, including authentication and access control.
2. Service delivery: Enabling you to access and use the Platform's gaming, betting, and payment services.
3. Payment processing: Facilitating MYR deposits and withdrawals via supported Malaysian payment channels including Touch 'n Go eWallet, DuitNow, FPX, and cryptocurrency networks.
4. Identity verification (KYC): Confirming your identity and age (21+) as required by applicable gaming regulations and anti-money laundering obligations.
5. Fraud and security monitoring: Detecting and preventing fraudulent activity, unauthorised account access, money laundering, and other security threats.
6. Responsible gambling: Administering deposit limits, self-exclusion tools, reality checks, and other responsible gambling controls you have elected, or that we are required to impose.
7. Customer support: Responding to your enquiries, resolving disputes, and maintaining support records.
8. Legal compliance: Meeting our obligations under applicable gaming, financial, and data protection regulations.
9. Platform improvement: Analysing usage patterns in aggregate to identify technical issues, improve platform performance, and develop new features.
10. Marketing communications: Sending you promotional offers, bonus notifications, and relevant gaming content where you have opted in to receive such communications and have not subsequently withdrawn consent.

Each processing activity conducted by cucutoto rests on one or more of the following legal bases, consistent with applicable data protection principles:

• Contractual necessity: Processing required to perform our obligations under the agreement established when you create an account and accept our Terms & Conditions — including account management, payment processing, and service delivery.
• Legal obligation: Processing necessary to comply with KYC requirements, anti-money laundering regulations, age verification obligations, and other applicable laws.
• Legitimate interests: Processing carried out for the legitimate operational interests of cucutoto, including fraud prevention, platform security, and service analytics, where these interests are not overridden by your rights and interests.
• Consent: Processing based on your freely given, specific, and informed consent — primarily for marketing communications and for the processing of any special category data such as responsible gambling self-assessment information. You may withdraw consent at any time without affecting the lawfulness of prior processing.

cucutoto does not sell, rent, or otherwise commercially transfer your personal data to any third party. We share personal data only in the following controlled circumstances:

• Payment service providers: We share necessary transaction data with payment processors facilitating your deposits and withdrawals — including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and banks including Maybank, CIMB, Public Bank, RHB, and Hong Leong — solely to process those transactions.
• KYC and identity verification partners: We share identity documents and verification data with contracted KYC providers to fulfil our regulatory age and identity verification obligations.
• Game content providers: Licensed third-party studios that power games on our platform may receive anonymised session and game performance data to enable proper game function. These providers do not receive personally identifiable information beyond what is technically necessary.
• Fraud prevention and security services: We may share technical data (IP addresses, device fingerprints, transaction patterns) with contracted fraud detection services to identify and prevent abuse of the Platform.
• Regulatory and law enforcement authorities: We will disclose personal data where legally required to do so by court order, regulatory requirement, or lawful law enforcement request.
• Corporate restructuring: In the event of a merger, acquisition, or sale of all or substantially all assets of cucutoto, personal data may be transferred to the acquiring entity, subject to the same privacy protections set out in this Policy.

As an online platform serving Malaysian players through global technical infrastructure, certain personal data may be transferred to or processed in countries outside Malaysia. This may occur, for example, when data is processed by cloud hosting providers, game studios operating in Europe or Asia, or KYC verification partners.

Where personal data is transferred internationally, cucutoto ensures that appropriate safeguards are in place to protect your data, including contractual protections equivalent to applicable data protection standards. We do not transfer data to jurisdictions that lack adequate legal frameworks for personal data protection without implementing additional protective measures.

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, to comply with legal and regulatory obligations, or to resolve disputes. The following general retention principles apply:

• Account and identity data: Retained for the duration of your active account relationship and for a minimum of five (5) years following account closure, in compliance with anti-money laundering record-keeping requirements.
• Transaction and financial records: Retained for a minimum of seven (7) years following the transaction date for regulatory and audit purposes.
• KYC documentation: Retained for the duration stipulated by applicable gaming and financial compliance regulations, typically a minimum of five (5) years post-account closure.
• Customer support records: Retained for three (3) years from the date of last contact, unless longer retention is required to manage an ongoing dispute.
• Marketing preferences and consent records: Retained for the duration of your account relationship and for a reasonable period following account closure to evidence compliance.
• Technical and usage data: Typically retained in identified form for up to twenty-four (24) months, after which data is anonymised for aggregate analytics purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be linked to an identifiable individual.

The cucutoto Platform uses cookies and similar technologies to enable core platform functionality, improve user experience, and analyse usage patterns. The following categories of cookies are in use:

• Strictly necessary cookies: Essential for the Platform to function. These include session authentication cookies, load-balancing tokens, and security cookies. These cannot be disabled without materially impairing Platform access.
• Functional cookies: Enable enhanced personalisation features such as remembering your preferred language, display settings, and session preferences across visits.
• Analytics cookies: Used to collect aggregated, anonymised data on how players navigate and interact with the Platform. This data is used internally to identify performance issues and improve user experience.
• Marketing cookies: Used to record your visit to the Platform for the purpose of delivering relevant content. These are only deployed where you have provided consent and can be withdrawn at any time through your account settings or browser controls.

You may manage your cookie preferences at any time through your browser settings. Disabling non-essential cookies will not prevent you from using core Platform features but may limit certain personalisation functionality.

Subject to applicable data protection law, you hold the following rights with respect to your personal data held by cucutoto. To exercise any of these rights, please contact us at [email protected] (plain text — not a link). We will respond to verified requests within 30 calendar days.

The cucutoto platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect personal data from any person under the age of 21.

If we become aware that personal data has been collected from a person under 21, we will immediately suspend the associated account, delete all related personal data as quickly as practically possible, and report the matter to appropriate regulatory authorities where required by law.

cucutoto implements a layered set of technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These include:

• Transport layer encryption: All data in transit between your device and our servers is encrypted via TLS 1.3.
• Data at rest encryption: All persistent data stores employ AES-256 encryption.
• Access control: Personal data is accessible only to cucutoto personnel and contracted service providers who have a demonstrable need to access it in the performance of their duties, under role-based access control policies.
• Two-factor authentication: Available to all account holders and mandatory for certain high-risk account actions.
• Intrusion detection: Automated monitoring systems are in place to detect anomalous access patterns and potential data breaches in real time.
• Regular security audits: Our platform undergoes periodic independent security assessments to identify and remediate vulnerabilities.

Despite these measures, no method of data transmission or storage is entirely risk-free. In the event of a personal data breach that poses a material risk to affected individuals, cucutoto will notify relevant authorities and affected players in accordance with applicable law.

cucutoto reserves the right to update or revise this Privacy Policy at any time. Changes reflecting new legal requirements, regulatory guidance, or material changes to our data processing practices will be communicated to all registered users via their registered email address no fewer than 14 days prior to the revised policy taking effect.

Non-material changes — such as clarifications to existing provisions, formatting adjustments, or corrections to typographical errors — may be made without prior notice. The "Last Updated" date displayed at the top of this page will be updated to reflect any revision.

Continued use of the cucutoto Platform following the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the revised policy, you should cease using the Platform and request account closure in accordance with the Terms & Conditions.

For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact our Data Protection team using the details below. All privacy-related enquiries will be acknowledged within 72 hours.

• Email (plain text — not a clickable link): [email protected]
• Subject line: Please include "Privacy Request" or "Data Rights" in the subject line for prompt routing.
• Response time: Standard requests within 30 days; complex requests within 90 days with prior notification.
• Support hours: Monday to Sunday, 00:00–23:59 Malaysian Standard Time (UTC+8).

If you are dissatisfied with our handling of a privacy complaint, you may have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction, or to seek a judicial remedy through the courts.