Punktoto is committed to protecting your personal data. This Privacy Policy explains what we collect, why we collect it, how it is used, and the rights you hold as a user of our platform.
Punktoto ("we", "us", "our", "the Company", "the Platform") operates the online betting and live casino platform accessible at https://punktoto.cam. We are committed to protecting and respecting the privacy of every individual who interacts with our services. This Privacy Policy ("Policy") sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by Punktoto.
This Policy applies to all users of the Punktoto platform, including registered account holders, visitors who browse without registering, and individuals who communicate with us through any channel, including live chat, email, or support submissions. It covers all data processing activities carried out by Punktoto in connection with the provision of our betting, live casino, sports wagering, and related services to users in Malaysia and elsewhere.
Please read this Policy carefully. By registering an account or using the Punktoto platform, you confirm that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree, you should not access or use the Platform.
This Policy should be read alongside our Terms & Conditions and Responsible Gambling Policy, each of which forms part of the contractual framework governing your relationship with Punktoto. Capitalised terms used but not defined in this Policy carry the meanings assigned to them in our Terms & Conditions.
For the purposes of this Privacy Policy, the following definitions apply:
| Term | Meaning |
|---|---|
| "Personal Data" | Any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial information, device identifiers, and online identifiers. |
| "Processing" | Any operation performed on personal data, including collection, recording, storage, use, disclosure, transmission, erasure, or destruction, whether by automated means or otherwise. |
| "Data Controller" | Punktoto, as the entity that determines the purposes and means of processing personal data collected through the Platform. |
| "Data Subject" | You — the individual whose personal data is being collected and processed by Punktoto. |
| "Third Party" | Any natural or legal person, authority, or body other than you and Punktoto, including payment processors, game content providers, analytics services, and compliance partners. |
| "Consent" | A freely given, specific, informed, and unambiguous indication of your agreement to the processing of your personal data for one or more specified purposes. |
| "KYC" | Know Your Customer — regulatory identity verification procedures conducted to confirm a user's identity, age, and eligibility to use the Platform. |
Punktoto collects personal data across several categories, depending on your level of interaction with the Platform. The categories of data we may collect include:
When you register an account, we collect your full legal name as it appears on your official identification document, date of birth, nationality, and account credentials (username and encrypted password). This data is required to establish your account and verify that you meet our eligibility requirements, including the minimum age of 21.
We collect your email address and mobile phone number during registration and throughout your use of the Platform. These details are used for account communications, security alerts, promotional notifications (subject to your preferences), and support interactions.
As part of our Know Your Customer obligations, we may collect copies of government-issued identification documents such as your MyKad (front and back), passport, or driving licence, as well as proof of address documentation such as a recent utility bill or bank statement. These documents are used exclusively for identity verification and anti-money laundering compliance.
We collect information relating to your deposits, withdrawals, and betting transactions on the Platform. This includes payment method details (e-wallet identifiers, bank account numbers, cryptocurrency wallet addresses), transaction amounts in MYR, transaction timestamps, and transaction reference numbers. Full payment card numbers are never stored by Punktoto; such data is handled exclusively by our PCI-DSS compliant payment processors.
We collect detailed records of your betting activity, including wagers placed across sports markets (such as Liga Super Malaysia, English Premier League, and UFC), live casino sessions, slot play, and all other Platform interactions. This data serves risk management, responsible gambling monitoring, game integrity, and dispute resolution purposes.
We automatically collect certain technical information when you access the Platform, including your IP address, browser type and version, operating system, device type and identifiers, screen resolution, and session timestamps. This data is used for security monitoring, fraud detection, and Platform performance optimisation.
When you contact our customer support team via live chat, email, or any other channel, we retain records of those communications, including the content of messages and any documents or screenshots you provide. This data is used to manage your support request, improve service quality, and maintain records for compliance purposes.
Punktoto collects personal data through the following means:
Punktoto processes your personal data for the following purposes:
| Purpose | Description |
|---|---|
| Account Management | Creating, maintaining, and managing your registered account, including processing login, password resets, and account setting changes. |
| Service Delivery | Processing bets, facilitating deposits and withdrawals, delivering game content, and providing all features of the Punktoto platform. |
| Identity Verification | Conducting KYC checks to confirm your identity and verify that you are at least 21 years of age and eligible to use the Platform. |
| Regulatory Compliance | Meeting anti-money laundering (AML), counter-terrorism financing (CTF), and responsible gambling obligations under applicable regulations. |
| Fraud Prevention & Security | Detecting, investigating, and preventing fraudulent account activity, bonus abuse, multi-accounting, and unauthorised access. |
| Responsible Gambling | Monitoring betting patterns to identify signs of problem gambling, enforcing self-exclusion arrangements, and applying deposit or loss limits. |
| Customer Support | Responding to queries, resolving disputes, and managing complaints submitted via live chat or any other support channel. |
| Marketing Communications | Sending promotional offers, bonus notifications, and platform updates — subject to your marketing communication preferences and applicable consent requirements. |
| Analytics & Improvement | Analysing Platform usage patterns to improve user experience, optimise features, and develop new services relevant to Malaysian users. |
Punktoto processes your personal data on the following legal bases, depending on the specific processing activity:
Where processing is based on your consent, withdrawal of that consent will not affect the lawfulness of processing carried out prior to withdrawal. Withdrawal of consent for certain data processing activities may affect your ability to use specific Platform features.
Punktoto does not sell your personal data to third parties. We share your data only in the circumstances and with the categories of recipients described below, and only to the extent necessary for the specified purpose:
We share necessary transaction data with our payment processing partners — including operators of Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX integrations, and cryptocurrency processing services — to facilitate deposits and withdrawals. These providers process data under their own privacy policies and are bound by contractual obligations to handle your data securely.
KYC documents and identity data are shared with licensed third-party identity verification and age verification service providers for the purpose of confirming your eligibility to use the Platform. These providers are contractually required to use your data solely for the verification purpose and to maintain appropriate security standards.
Certain technical identifiers and session data are shared with the third-party game studios and live casino providers whose content is hosted on the Punktoto platform, to the extent necessary for game functionality, fairness auditing, and dispute resolution.
Punktoto may disclose your personal data to regulatory bodies, law enforcement agencies, courts, or other governmental authorities where required to do so by applicable law, court order, or where we believe in good faith that such disclosure is necessary to protect the rights, property, or safety of Punktoto, our users, or the public.
We may share data with our legal counsel, auditors, and other professional advisers where necessary for the conduct of our business operations, subject to strict confidentiality obligations.
In the event of a merger, acquisition, reorganisation, or sale of all or a portion of Punktoto's assets, personal data held by us may be transferred to the acquiring entity, subject to equivalent privacy protections. You will be notified of any such transfer that materially affects how your data is processed.
Punktoto retains your personal data for the period necessary to fulfil the purposes for which it was collected, and thereafter for as long as required by applicable legal, regulatory, or compliance obligations. The following indicative retention periods apply:
Upon expiry of applicable retention periods, personal data will be securely deleted or anonymised in a manner that prevents re-identification. Where data has been anonymised, it may be retained indefinitely for aggregated analytics and reporting purposes.
Punktoto uses cookies and similar tracking technologies to operate, secure, and improve the Platform. A cookie is a small text file placed on your device by a web server. Cookies cannot access other files on your device and do not carry viruses. The categories of cookies we use are as follows:
These cookies are essential for the Platform to function and cannot be disabled. They are used to maintain your login session, remember items in your session, and ensure secure authentication. No consent is required for these cookies as they are technically necessary for service delivery.
These cookies collect aggregated, anonymised information about how users interact with the Platform — such as which pages are visited most frequently, how long users spend on particular features, and where errors occur. This data helps us identify improvements and optimise the Platform experience for Malaysian users on mobile and desktop.
Functional cookies allow the Platform to remember choices you have made — such as your preferred language, display settings, and notification preferences — to provide a more personalised experience. Disabling these cookies may affect the personalisation features of your account.
These cookies assist in identifying and preventing fraudulent activity, bot access, and unauthorised account access. They may generate device fingerprint data used to flag suspicious login patterns or unusual account behaviour.
You can manage your cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair your ability to log in and use the Platform. For analytics and functional cookies, you may adjust your preferences via the cookie consent notice presented on your first visit.
Punktoto implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:
No method of data transmission over the internet or electronic storage is entirely secure. While Punktoto takes all reasonable precautions, we cannot guarantee absolute security. You play an important role in keeping your account secure: use a strong, unique password and never share your login credentials with anyone.
In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, Punktoto will notify affected users without undue delay and take all reasonable steps to mitigate the impact of the breach.
As a data subject, you hold the following rights with respect to the personal data Punktoto holds about you. These rights may be subject to certain limitations where legal, regulatory, or contractual obligations require us to retain or continue processing specific data.
You have the right to request a copy of the personal data we hold about you. Upon receipt of a verified access request, we will provide you with a summary of your personal data and the purposes for which it is being processed, within 30 days.
If any personal data we hold about you is inaccurate or incomplete, you have the right to request correction. For most account details, you may update your information directly via your account settings. For identity and KYC data, please contact our support team.
You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (and no other legal basis applies), or where the data has been unlawfully processed. This right is subject to overriding legal or regulatory retention obligations — for example, AML record-keeping requirements will take precedence over erasure requests for relevant transaction data.
You may request that we restrict the processing of your personal data in certain circumstances, including where you contest the accuracy of the data or where you have objected to processing pending verification of our legitimate interests.
Where processing is based on your consent or on contractual necessity, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to request its transmission to another controller where technically feasible.
You have the right to object to the processing of your personal data where such processing is based on Punktoto's legitimate interests, including profiling for marketing purposes. You may also object to the use of your data for direct marketing at any time without providing justification.
To exercise any of the rights described above, please contact our customer support team via live chat or email at [email protected]. We will respond to all verified requests within 30 days. For complex or multiple requests, this period may be extended by a further 30 days, with notification provided.
Certain personal data processed by Punktoto may be transferred to, stored, or processed in countries outside Malaysia. This may occur where our third-party service providers — such as cloud infrastructure providers, game content studios, or KYC verification partners — operate servers or processing facilities in other jurisdictions.
When personal data is transferred internationally, Punktoto ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that required under applicable data protection law. Such safeguards include contractual clauses that impose equivalent data protection obligations on recipient parties, and selection of third-party processors subject to recognised security and privacy certifications.
By using the Punktoto platform, you acknowledge and consent to the transfer of your personal data to countries outside Malaysia where such transfers are necessary for service delivery or compliance purposes, subject to the safeguards described in this section.
The Punktoto platform is strictly intended for persons aged 21 and above. We do not knowingly collect, process, or retain personal data from individuals under the age of 21. Our registration process includes age verification controls, and KYC procedures are used to confirm that all users meet the minimum age requirement.
If Punktoto becomes aware that personal data has been collected from a person under the age of 21, that account will be immediately suspended, the data will be reviewed, and all winnings and deposits associated with the account will be subject to investigation. Any personal data collected in such circumstances will be deleted as promptly as permitted by applicable law.
If you believe that a person under 21 has registered on our Platform, please contact our support team immediately. We take child protection obligations seriously and will act promptly on any such notification.
The Punktoto platform may contain integrations with third-party services, including game content providers, live streaming services, and payment gateways. When you interact with third-party services embedded within the Platform, those interactions are governed by the privacy policies of the respective third parties, and Punktoto is not responsible for the data practices of those third parties.
We conduct due diligence on all third-party service providers we engage with and require, through contractual arrangements, that they process personal data only for specified purposes and maintain appropriate security standards. However, we recommend that you review the privacy policies of key service providers — such as your chosen e-wallet provider (Touch 'n Go, Boost, GrabPay) or your bank — to understand how they process your data independently of Punktoto.
Punktoto does not embed social media widgets, third-party advertising networks, or cross-site tracking tools on the Platform that would transmit your data to social media platforms or advertising exchanges without your knowledge.
Punktoto reserves the right to amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory requirements, or Platform features. When material changes are made, we will update the "Last Updated" date at the top of this Policy and, where practicable, notify registered users via email or an in-platform notification prior to the changes taking effect.
Continued use of the Platform following the publication of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with any amendment, you should cease using the Platform and may request account closure in accordance with our Terms & Conditions.
We recommend bookmarking this page and reviewing it periodically. Archived versions of previous policies are available upon request from our support team.
For any questions, concerns, or requests relating to this Privacy Policy, or to exercise any of the data rights described in Section 11, please contact the Punktoto data protection team through the following channels:
Live Chat Support: Available 24/7 directly on the Platform. Peak staffing hours: 8:00am – 2:00am MYT.
Email: [email protected]
We are committed to addressing all data protection enquiries promptly and in good faith. Where a request relates to the exercise of a formal data subject right, we will acknowledge receipt within 5 business days and provide a substantive response within 30 days.
If you are not satisfied with our response to a privacy concern, you have the right to escalate the matter to the relevant data protection authority in your jurisdiction.
This Privacy Policy was last reviewed and updated on 1 January 2026. This document supersedes all prior versions of the Punktoto Privacy Policy. For players across Kuala Lumpur, Petaling Jaya, Shah Alam, Penang, Johor Bahru, and throughout Malaysia — your privacy and the security of your personal data remain a core commitment of the Punktoto platform. Play safely. 21+ only.
Six commitments that underpin how we handle every piece of personal information you entrust to us.
All data transmitted between your device and Punktoto's servers is protected with industry-standard 256-bit SSL encryption — the same standard used by major financial institutions and banks in Malaysia.
We verify every user's identity and confirm a minimum age of 21 before processing withdrawals. Your KYC documents are encrypted at rest and accessed only by authorised compliance personnel.
Punktoto does not sell or rent your personal data to any third party for commercial purposes. Data shared with payment partners such as Touch 'n Go eWallet and DuitNow is strictly limited to transaction processing.
You can access, correct, restrict, or request deletion of your personal data at any time. Marketing preferences can be updated in account settings. Data subject requests are handled within 30 days.
We use strictly necessary, performance, and functional cookies only. No third-party advertising cookies or social media trackers are embedded on the Platform. Cookie preferences can be managed through your browser settings.
We don't keep your data indefinitely. Defined retention periods apply to every data category, from five-year AML records to three-year support communications. Data is securely deleted once retention periods expire.
Our support team handles data protection enquiries 24/7 via live chat. You can also visit our FAQ page for answers to common questions about account data and privacy on the Punktoto platform.