Privacy Policy

Section 01
Introduction

This Privacy Policy ("Policy") applies to all personal data processed by yupitoto ("yupitoto", "we", "us", "our") in connection with the operation of the website at yupitoto.cam and all associated services, games, payment systems and communications channels (collectively, the "Platform").

By registering an Account on yupitoto, accessing the Platform or providing personal information in any form, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. This Policy forms part of the yupitoto Terms and Conditions, which should be read alongside this document.

If you do not agree with any part of this Policy, you should refrain from using the Platform and contact us to close your Account.

Section 02
Definitions

The following defined terms are used throughout this Policy:

• "Personal Data" means any information relating to an identified or identifiable natural person, including names, identification numbers, contact details, financial information and online identifiers.
• "Processing" means any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, consultation, use, disclosure, deletion or destruction.
• "Data Controller" means yupitoto, as the entity that determines the purposes and means of processing personal data collected through the Platform.
• "Data Processor" means a third party that processes personal data on behalf of yupitoto in accordance with a written data processing agreement.
• "User" / "you" means any individual who accesses, registers on or otherwise uses the yupitoto Platform.
• "Account" means a registered user account on the yupitoto Platform.
• "Cookies" means small text files placed on your device by the Platform to record certain data about your session and preferences.
• "KYC" means Know Your Customer — the identity and age verification process applied to Accounts under yupitoto's compliance obligations.

Section 03
Data We Collect

yupitoto collects personal data in several categories depending on your interaction with the Platform. The categories below outline the types of information we may hold:

Category	Examples	When collected
Identity Data	Full legal name, date of birth, nationality, government-issued ID number	Registration; KYC verification
Contact Data	Email address, phone number, residential address	Registration; support interactions
Verification Documents	Copies of national identity card, passport, proof of address	KYC; withdrawal requests
Financial Data	Bank account details, e-wallet identifiers, transaction reference numbers, deposit and withdrawal history in MYR	Payment processing; fraud checks
Account Activity Data	Login timestamps, game history, bet records, wagering activity, bonus claims	Ongoing platform use
Technical Data	IP address, device type, browser, operating system, session duration, referring URL	Automatically on platform access
Communication Data	Support chat transcripts, email correspondence, feedback submissions	Support and service communications
Responsible Gambling Data	Self-exclusion status, deposit limit settings, cooling-off periods	When responsible-gambling tools are used

Section 04
Collection Methods

yupitoto collects personal data through the following primary channels:

• Direct provision: Information you provide voluntarily when registering an Account, completing KYC verification, initiating a deposit or withdrawal, contacting our support team or participating in a promotion.
• Automated collection: Technical and usage data collected automatically when you access the Platform, including IP address, device identifiers, browser characteristics and session activity logs.
• Cookies and similar technologies: Data collected through cookies, web beacons and analytics tools as described in Section 8 of this Policy.
• Third-party sources: Identity verification data and fraud-check results received from licensed KYC service providers, and payment confirmation data from payment processors including those supporting Maybank2u, CIMB Clicks, Public Bank, Hong Leong Connect, Touch 'n Go eWallet, Boost, GrabPay, DuitNow and FPX.

Section 05
Data Processing Purposes

yupitoto processes personal data for the following specific and legitimate purposes:

• Account creation and management: Establishing, maintaining and administering your registered Account, including authentication and credential management.
• Identity and age verification (KYC): Confirming that users are aged 21 or above and meet applicable eligibility requirements before allowing participation in any wagering activity.
• Payment processing: Processing MYR deposits and withdrawals via supported Malaysian payment channels, reconciling transactions and managing refunds or disputed payments.
• Legal and regulatory compliance: Satisfying obligations under applicable anti-money laundering (AML) legislation, responsible gambling regulations and other legal requirements applicable to the Platform's operations.
• Fraud prevention and security: Identifying, investigating and preventing fraudulent activity, money laundering, account takeover attempts and other prohibited conduct.
• Customer support: Responding to enquiries, resolving complaints and providing assistance through live chat and email channels.
• Platform improvement: Analysing aggregated usage data to improve game navigation, payment user experience and Platform performance.
• Responsible gambling: Monitoring account patterns to identify users who may benefit from responsible-gambling interventions and enforcing limits or exclusions.
• Communications: Sending service-related notices, security alerts, promotional updates (where consented to) and policy change notifications.

Section 06
Legal Bases for Processing

yupitoto relies on the following legal bases when processing personal data:

• Contractual necessity: Processing required to fulfil our obligations under the Terms and Conditions you accepted at registration, including account administration and payment processing.
• Legal obligation: Processing required to comply with applicable laws, including identity verification, AML checks and responsible-gambling obligations.
• Legitimate interests: Processing carried out for fraud prevention, platform security, customer support quality improvement and other activities where our legitimate business interests are not overridden by your rights.
• Consent: Where we rely on consent for a specific processing activity (such as sending marketing communications), you may withdraw that consent at any time by contacting us. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Section 07
Data Sharing

yupitoto does not sell personal data to third parties for marketing purposes. Personal data may be disclosed to the following categories of recipients where there is a lawful basis for doing so:

• Payment service providers: Banks, e-wallet operators and financial intermediaries necessary to process MYR deposits and withdrawals, including those supporting Maybank2u, CIMB Clicks, Public Bank, Hong Leong Connect, Touch 'n Go eWallet, Boost, GrabPay, DuitNow and FPX.
• Identity verification providers: Licensed KYC and document-verification services used to confirm user eligibility and comply with legal obligations.
• Technology and infrastructure providers: Hosting, cloud storage, cybersecurity and analytics vendors engaged under appropriate data processing agreements to support Platform operations.
• Customer support tools: Live chat and ticketing platforms used to manage support interactions.
• Regulatory and law enforcement authorities: Government bodies, regulators or law enforcement agencies where disclosure is required by applicable law or a valid legal order.
• Fraud and AML agencies: Shared databases or industry bodies where information sharing is necessary to prevent financial crime, subject to applicable legal requirements.
• Business successors: In the event of a merger, acquisition, restructuring or transfer of substantially all assets, personal data held at the time may form part of the transferred assets, with users notified in advance.

Section 08
Cookies & Tracking Technologies

yupitoto uses cookies and similar technologies to support the operation of the Platform and improve the user experience. The main categories of cookies used are:

• Strictly necessary cookies: Required for core Platform functions such as session management, authentication and security. These cannot be disabled without affecting your ability to use the Platform.
• Functional cookies: Store your preferences such as language settings, display options and responsible-gambling configurations to improve usability across sessions.
• Analytics cookies: Collect aggregated, anonymised information about how users interact with the Platform, including which pages are visited most frequently, to support Platform improvements. No individual user is identified through these analytics.
• Security cookies: Assist in identifying and preventing fraudulent activity, bot access and account takeover attempts.

You may adjust cookie preferences through your browser settings at any time. Disabling strictly necessary cookies may affect core Platform functionality. yupitoto does not use third-party advertising or targeting cookies that profile users for commercial advertising purposes.

Section 09
Data Retention

yupitoto retains personal data only for as long as is necessary to fulfil the purposes outlined in this Policy, or as required by applicable law and regulation. Specific retention considerations include:

• Active Account data is retained for the duration of your relationship with yupitoto plus any legally mandated period following Account closure.
• KYC and identity documents may be retained for a period of years after Account closure in accordance with AML obligations.
• Transaction and financial records are retained in accordance with applicable financial record-keeping requirements.
• Responsible gambling records, including self-exclusion status, are retained to ensure exclusions are honoured if a user attempts to re-register.
• Support communications are retained for a period sufficient to resolve disputes and meet service-quality obligations.

When personal data is no longer required and no legal obligation requires its retention, it will be securely deleted or anonymised so that it can no longer identify you.

Section 10
Data Security

yupitoto implements technical and organisational measures appropriate to the sensitivity and volume of personal data processed. These measures include but are not limited to:

• Encrypted transmission of data in transit using industry-standard protocols.
• Access controls restricting data access to authorised personnel with a demonstrable need.
• Regular review of security practices to respond to evolving threats.
• Incident response procedures for the detection, investigation and notification of personal data breaches where required.

Despite these measures, no data transmission over the internet or digital storage system can be guaranteed as completely secure. You are responsible for maintaining the confidentiality of your Account credentials and should contact us immediately at [email protected] if you suspect unauthorised access to your Account.

Section 11
User Rights

Subject to applicable law and any overriding legal obligations, you may have the following rights in relation to the personal data yupitoto holds about you:

To exercise any of these rights, submit your request in writing to [email protected]. We will respond within a reasonable period as required by applicable law. We may request verification of your identity before processing a rights request. Certain rights may be subject to exemptions where legal obligations require us to retain or process data regardless of your request.

Section 12
Minors

yupitoto strictly prohibits the registration or participation of individuals under the age of 21. The Platform is designed solely for adult entertainment and is not directed at, and should not be used by, individuals who have not reached their twenty-first birthday.

yupitoto does not knowingly collect personal data from persons under 21. If we become aware that personal data has been collected from an underage user, that Account will be closed immediately, all data associated with the underage registration will be deleted or retained only as required by applicable law, and any funds will be handled in accordance with regulatory requirements.

If you believe an individual under 21 has registered an Account on yupitoto, please contact us immediately at [email protected].

Section 13
International Data Transfers

yupitoto may store or process personal data in countries other than Malaysia, including through third-party service providers such as cloud hosting and identity verification vendors. Where personal data is transferred outside your country of residence, yupitoto takes steps to ensure that appropriate safeguards are in place to protect your data to a standard consistent with this Policy, including the use of contractual protections with data processors.

By using the Platform and accepting this Policy, you acknowledge that your data may be transferred to, stored and processed in jurisdictions that may have different data protection standards to those in your home country.

Section 14
Policy Changes

yupitoto reserves the right to update or revise this Privacy Policy at any time. Where a material change is made, we will endeavour to provide advance notice through a platform notification or by email to the address registered on your Account. The effective date at the top of this document will be updated to reflect the date of the most recent revision.

Your continued use of the Platform following publication of a revised Policy constitutes acceptance of the changes. We encourage you to review this Policy periodically to stay informed about how we handle your personal data.

Section 15
Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data rights or have a concern about how yupitoto handles your personal information, please contact our support team using the following details:

Support email: [email protected]
Live chat: Available 24 hours daily through the Platform interface
Response time: Approximately 3–5 minutes via live chat; email enquiries handled within 24–48 hours

For data-related requests such as access, correction or deletion, please include your registered email address and a brief description of your request. We may ask for identity verification before processing the request.