Introduction
Watitoto ("Company", "We", "Us", "Our") operates the online gaming platform accessible at https://watitoto.casa ("Platform"). We are committed to protecting the privacy and personal data of all individuals who use our Platform, including players based in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and across Malaysia.
This Privacy Policy ("Policy") describes how Watitoto collects, uses, stores, processes, and discloses personal data in connection with the operation of the Platform. It applies to all registered members, visitors, and users of the Platform and forms part of our overall commitment to operating a transparent, trustworthy, and secure gaming environment.
If you do not agree with any part of this Policy, you should discontinue use of the Platform and contact us to request closure of your account. This Policy should be read alongside our Terms & Conditions which govern the overall use of the Watitoto Platform.
Definitions
For the purposes of this Privacy Policy, the following terms carry the meanings set out below:
- "Personal Data" — any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial data, and online identifiers.
- "Data Subject" — any individual whose personal data is collected and processed by Watitoto, including registered players and Platform visitors.
- "Processing" — any operation or set of operations performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
- "Data Controller" — Watitoto, as the entity that determines the purposes and means of processing personal data collected via the Platform.
- "Third Party" — any natural or legal person other than the Data Subject and Watitoto, including payment processors, analytics providers, identity verification services, and regulatory authorities.
- "Cookies" — small data files placed on a user's device by the Platform for the purpose of session management, analytics, and personalisation.
- "KYC" — Know Your Customer, the identity verification process required under anti-money laundering obligations.
Data We Collect
Watitoto collects personal data from you directly when you register an account, make deposits or withdrawals, contact our support team, or interact with the Platform in any way. We also collect certain data automatically through your use of the Platform.
| Category | Data Types Collected | Collection Method |
|---|---|---|
| Identity Data | Full name, date of birth, NRIC / passport number, nationality | Registration form, KYC submission |
| Contact Data | Email address, phone number, residential address | Registration form, account updates |
| Financial Data | Payment method details, transaction history, deposit and withdrawal records in MYR | Payment processing, withdrawal requests |
| Gaming Activity Data | Game sessions, bets placed, wins and losses, bonus usage, wagering history | Platform activity logs |
| Technical Data | IP address, device type, browser type and version, operating system, session duration | Automatic collection via cookies and server logs |
| Communications Data | Live chat transcripts, email correspondence, support tickets | Direct communication with support team |
| KYC Documents | Copies of government-issued ID, proof of address, payment method verification documents | KYC verification process |
We do not collect sensitive personal data categories such as racial or ethnic origin, religious beliefs, biometric data, or health information unless specifically required by applicable regulatory obligations.
Purpose of Processing
Watitoto processes your personal data for the following specific purposes:
- Account Registration and Management: To create, maintain, and administer your player account on the Platform, including processing of login credentials and account profile information.
- Identity Verification (KYC/AML): To verify your identity and age in compliance with Know Your Customer and anti-money laundering obligations applicable to the international gaming licence under which Watitoto operates.
- Payment Processing: To facilitate deposits and withdrawals via supported Malaysian payment methods including DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, and cryptocurrencies (BTC, ETH, USDT, LTC).
- Gaming Services Delivery: To provide and personalise sports betting, live casino, slot games, and number forecast services including live football markets for Liga Super Malaysia, EPL, and UFC events.
- Responsible Gambling Compliance: To monitor gaming behaviour patterns and implement responsible gambling tools including deposit limits, session reminders, and self-exclusion in accordance with our duty of care to players.
- Fraud Prevention and Security: To detect, investigate, and prevent fraudulent transactions, money laundering, collusion, and other prohibited conduct on the Platform.
- Customer Support: To respond to and resolve enquiries, complaints, and support requests submitted via live chat or email.
- Legal and Regulatory Compliance: To comply with obligations imposed by applicable gaming legislation, tax authorities, financial regulators, or court orders.
- Platform Improvement: To analyse Platform usage patterns, troubleshoot technical issues, and improve the user experience — using aggregated and anonymised data where possible.
- Marketing Communications: To send promotional offers, bonus notifications, and platform updates where you have provided explicit consent to receive such communications. You may withdraw consent at any time by contacting support.
Legal Basis for Processing
Watitoto processes personal data on the following legal grounds:
Processing is necessary for the performance of the contract between you and Watitoto — specifically, the provision of online gaming services, account management, payment processing, and customer support as described in our Terms & Conditions.
Processing is necessary to comply with our legal and regulatory obligations including KYC/AML verification requirements, gaming licence conditions, tax reporting, and cooperation with law enforcement or regulatory authorities.
Processing is necessary for the legitimate interests of Watitoto, including fraud prevention, platform security, responsible gambling monitoring, and general business analytics — provided such interests are not overridden by the fundamental rights and freedoms of the Data Subject.
Where processing is based on your consent — such as marketing communications — you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. Withdrawal of consent does not affect the validity of your Account or restrict access to gaming services.
Data Sharing & Disclosure
Watitoto does not sell, rent, or trade your personal data to third parties for their own marketing purposes under any circumstances. We may share personal data with the following categories of recipients, strictly for the purposes described in this Policy:
- Payment Processors: Malaysian and international payment service providers — including operators of DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, and cryptocurrency exchange infrastructure — for the purpose of processing deposits and withdrawals.
- Identity Verification Providers: Third-party KYC and AML screening services used to verify player identity, age, and source of funds in compliance with our regulatory obligations.
- Gaming Content Providers: Licensed game studios and sportsbook data providers whose content is made available on the Platform. Sharing is limited to session tokens and game outcome data required for game delivery.
- IT and Infrastructure Providers: Cloud hosting, cybersecurity, and technology service providers who process data on our behalf under strict data processing agreements that bind them to the same data protection standards as Watitoto.
- Regulatory and Law Enforcement Authorities: Gaming regulators, financial intelligence units, tax authorities, and law enforcement agencies where disclosure is required by applicable law, court order, or regulatory direction.
- Professional Advisors: Lawyers, auditors, accountants, and compliance consultants engaged by Watitoto, subject to professional confidentiality obligations.
Data Retention
Watitoto retains personal data for as long as is necessary to fulfil the purposes for which it was collected, including satisfying legal, regulatory, tax, and accounting obligations. The following general retention periods apply:
- Account Data: Retained for the duration of the active Account relationship and for a minimum of five (5) years following Account closure, in compliance with anti-money laundering record-keeping requirements.
- KYC Documentation: Retained for a minimum of five (5) years from the date of the most recent transaction, or such longer period as may be required by applicable gaming or financial regulation.
- Transaction Records: Financial transaction records are retained for a minimum of seven (7) years for tax and audit compliance purposes.
- Customer Support Communications: Live chat transcripts and email correspondence are retained for a period of three (3) years from the date of the interaction.
- Technical and Analytics Data: Server logs and anonymised analytics data are retained for a period of twelve (12) months, after which they are deleted or permanently anonymised.
- Marketing Consent Records: Records of marketing consent and withdrawal of consent are retained for as long as is necessary to demonstrate compliance.
Upon the expiry of the applicable retention period, personal data is securely deleted or permanently anonymised in accordance with our internal data disposal procedures.
Data Security
Watitoto implements a comprehensive set of technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:
- 256-bit SSL/TLS Encryption: All data transmitted between your device and our Platform is encrypted using industry-standard Transport Layer Security (TLS) protocols.
- Access Controls: Personal data is accessible only to authorised personnel who require access for legitimate business purposes. Role-based access control is implemented across all internal systems.
- Pseudonymisation: Where technically feasible, personal identifiers are pseudonymised in analytical and testing environments to reduce exposure risk.
- Vulnerability Management: Our infrastructure undergoes regular security assessments, penetration testing, and vulnerability scanning conducted by qualified cybersecurity professionals.
- Incident Response: A documented data breach response procedure is maintained. In the event of a breach affecting your personal data, Watitoto will notify you and the relevant regulatory authority within the timeframes required by applicable data protection law.
- Secure Data Disposal: Physical and electronic records containing personal data are securely destroyed at the end of their applicable retention period.
While Watitoto applies rigorous security measures, no online transmission of data is completely risk-free. You are responsible for keeping your Account login credentials confidential and for notifying us immediately at [email protected] if you suspect any unauthorised access to your Account.
Cookies & Tracking Technologies
The Watitoto Platform uses cookies and similar tracking technologies to deliver a functional, personalised, and secure gaming experience. The following categories of cookies are used:
These cookies are essential for the operation of the Platform. They enable core functionality including user authentication, session management, and security features. The Platform cannot function properly without them and they cannot be disabled.
Functional cookies remember your preferences — such as language settings, preferred game categories, and interface customisations — to improve your experience when you return to the Platform.
These cookies collect anonymised data about how users navigate the Platform — pages visited, time on site, error logs — which we use to improve Platform performance and content. Analytics data is processed in aggregate form and is not linked to individual player identities.
Session tracking cookies support our responsible gambling obligations by recording session duration and activity patterns. This data informs the delivery of session time reminders and alerts to players who may benefit from a break.
You may manage cookie preferences through your browser settings. Note that disabling certain categories of cookies may affect the functionality of the Platform. Strictly necessary cookies cannot be disabled without impacting Platform access.
International Data Transfers
As an internationally operated gaming platform, Watitoto may transfer your personal data to countries outside Malaysia for the purposes of payment processing, cloud infrastructure hosting, identity verification, and regulatory compliance. Where such transfers occur, Watitoto ensures that adequate safeguards are in place to protect your personal data, including:
- Transfers to countries recognised by relevant authorities as providing an adequate level of data protection.
- Standard contractual clauses approved by applicable data protection authorities, binding recipient entities to equivalent data protection standards.
- Data processing agreements with all third-party recipients that impose binding confidentiality, security, and use-limitation obligations.
Watitoto maintains a record of all international data transfers and the safeguards applied. If you have questions about specific transfer mechanisms in use, you may contact us at [email protected].
Your Rights as a Data Subject
Subject to applicable data protection law and the terms of our gaming licence obligations, you have the following rights in respect of your personal data held by Watitoto:
Right of Access
Request a copy of the personal data we hold about you.
Right to Rectification
Request correction of inaccurate or incomplete personal data.
Right to Erasure
Request deletion of your data where there is no longer a legal basis for retention.
Right to Restriction
Request that we restrict processing of your data in certain circumstances.
Right to Portability
Receive your data in a structured, machine-readable format for transfer to another controller.
Right to Object
Object to processing based on legitimate interests or for direct marketing purposes.
To exercise any of the above rights, please submit a written request to [email protected]. We will respond within 30 calendar days of receiving your request. In some cases, we may need to verify your identity before processing a data rights request. Please note that certain rights may be limited where processing is required to comply with our legal or regulatory obligations — for example, we may be unable to delete KYC records that we are required by law to retain.
Minors & Age Restriction
The Watitoto Platform is strictly intended for individuals who are 21 years of age or older. We do not knowingly collect personal data from individuals under the age of 21. If we discover that an Account has been registered by a person under the age of 21, we will immediately suspend the Account, forfeit any associated balances, and securely delete all personal data collected from that individual to the extent permitted by our legal and regulatory obligations.
Parents and guardians are encouraged to implement appropriate parental controls on devices used by minors to prevent access to online gaming platforms. If you believe a minor has accessed or registered on the Watitoto Platform, please contact us immediately at [email protected].
Policy Amendments
Watitoto reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or our data processing practices. Where material amendments are made, we will notify registered Players via email or by posting a prominent notice on the Platform at least seven (7) days before the changes take effect.
The "Last Updated" date displayed at the top of this page reflects the date of the most recent revision. We encourage you to review this Policy periodically to remain informed of how your personal data is being handled. Continued use of the Platform following any amendment to this Policy constitutes your acceptance of the revised terms.
Contact & Complaints
If you have any questions, concerns, or complaints relating to this Privacy Policy or the processing of your personal data by Watitoto, please contact us through the following channels:
Send your enquiry to [email protected]. Please include "Privacy Policy Enquiry" in the subject line. We aim to respond to all data protection correspondence within 10 business days.
Our live chat support team is available 24 hours a day, 7 days a week. For routine privacy enquiries, live chat is the fastest way to get a response — typical wait time is under 2 minutes.
Watitoto operates from its principal office in Kuala Lumpur, Malaysia.
If you are not satisfied with our response to a data protection complaint, you may have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction. We would, however, encourage you to contact us directly in the first instance so that we have the opportunity to address your concern.