Privacy Policy

This Privacy Policy ("Policy") is issued by Janjitoto ("we", "us", "our") and applies to all personal data collected, processed, and stored in connection with your use of the Janjitoto platform at janjitoto.cam and any related services, applications, or communications.

We understand that privacy matters deeply, particularly in the context of online gaming where financial data and identity information are involved. This Policy sets out, in clear and accessible terms, exactly what data we collect, why we collect it, how we use and protect it, who we share it with, and what rights you have over your own information.

By accessing the Platform, creating an account, or depositing funds, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree to this Policy, please discontinue use of the Platform immediately.

This Policy should be read alongside our Terms & Conditions, which govern the overall agreement between you and Janjitoto.

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" — Any information that identifies or could reasonably be used to identify a natural person, directly or indirectly, including name, identification number, contact details, location data, or online identifiers.
• "Processing" — Any operation or set of operations performed on personal data, including but not limited to collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, and destruction.
• "Data Controller" — Janjitoto, in its capacity as the entity that determines the purposes and means of processing personal data collected through the Platform.
• "Data Processor" — A third party engaged by Janjitoto to process personal data on its behalf and according to its instructions, such as payment processors and KYC verification partners.
• "Consent" — A freely given, specific, informed, and unambiguous indication of the data subject's agreement to the processing of their personal data for a stated purpose.
• "KYC" — Know Your Customer verification procedures conducted to confirm the identity, age, and eligibility of a Player prior to processing financial transactions.

Janjitoto collects personal data across several categories depending on the nature of your interaction with the Platform. The table below summarises the categories of data we may collect and specific examples within each category:

Janjitoto collects personal data through a combination of direct provision by you and automated technical collection mechanisms:

• Direct provision: When you complete the registration form, submit KYC documents, make a deposit, contact support, or respond to any communication from us, you are providing data directly.
• Automated collection: When you access the Platform, our systems automatically collect technical data including your IP address, device identifiers, browser characteristics, and session activity data via cookies, server logs, and similar tracking technologies.
• Third-party sources: We may receive data about you from third-party identity verification providers, fraud detection services, and payment processors in the course of processing your transactions and verifying your identity.

We process your personal data only for legitimate, defined purposes. The primary purposes for which Janjitoto processes player data include:

• Account management: Creating, maintaining, and administering your player account, including processing deposits, withdrawals, and bonus credit.
• Identity verification (KYC): Confirming your identity, age (minimum 21 years), and eligibility to use the Platform in accordance with our licensing obligations.
• Fraud prevention and AML compliance: Detecting, investigating, and preventing fraudulent activity, money laundering, and other financial crimes as required by applicable regulatory frameworks.
• Responsible gambling: Monitoring gaming activity to identify potential problem gambling patterns and facilitating access to self-exclusion, deposit limits, and other player protection tools.
• Customer support: Responding to queries, resolving disputes, and handling complaints submitted through live chat, email, or other support channels.
• Service improvement: Analysing aggregated, anonymised usage data to understand how players interact with the Platform and improve its features, performance, and user experience.
• Legal compliance: Meeting our obligations under applicable international licensing requirements, anti-money laundering regulations, and data protection laws.
• Marketing communications: Where you have provided explicit consent, sending you information about promotions, bonuses, new game releases, and platform updates. You may opt out at any time.

Janjitoto processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing required to perform our obligations under the account agreement, including account management, transaction processing, and KYC verification.
• Legal obligation: Processing required to comply with applicable regulatory requirements including AML obligations, record-keeping mandates, and licensing conditions.
• Legitimate interests: Processing conducted for fraud prevention, platform security, responsible gambling monitoring, and service improvement, where those interests are not overridden by your data protection rights.
• Consent: Processing for optional purposes such as direct marketing communications, where your freely given and explicit consent has been obtained. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

Janjitoto does not sell your personal data to any third party. We may share your data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection agreements:

• Payment processors: Banks, e-wallet providers (DuitNow, FPX, Touch 'n Go eWallet, Boost, Maybank, CIMB, Public Bank, Hong Leong, GrabPay), and cryptocurrency processing partners, to facilitate deposit and withdrawal transactions.
• KYC and identity verification providers: Third-party services engaged to verify the identity and age of Players as part of our KYC compliance programme.
• Fraud prevention and AML screening services: Providers engaged to screen transactions and accounts against risk databases and sanctions lists.
• Regulatory and law enforcement authorities: Where required by applicable law, court order, or regulatory directive, we may disclose personal data to competent authorities.
• IT infrastructure and hosting providers: Cloud hosting and technical service providers who process data on our behalf and are bound by strict confidentiality and data protection obligations.
• Game content providers: Licensed international game studios may receive anonymised session identifiers to facilitate game delivery. No personally identifiable data is shared with game content providers without your explicit consent.

All third parties with whom Janjitoto shares personal data are required to maintain the confidentiality and security of that data and are prohibited from using it for any purpose other than the service they are contracted to provide.

Janjitoto takes the security of financial data with the utmost seriousness. All payment transactions on the Platform are processed through PCI-compliant payment gateways. Janjitoto does not store full card numbers, CVV codes, or complete bank account credentials on its own servers.

Transaction records — including deposit amounts in MYR, withdrawal requests, payment method types, and timestamps — are retained as required by applicable AML regulations and our licensing obligations. These records are used solely for compliance, dispute resolution, and audit purposes.

Janjitoto uses cookies and similar tracking technologies to deliver, maintain, and improve the Platform. Cookies are small text files placed on your device when you access our website. They enable us to recognise your browser, maintain your session, and collect usage analytics.

We use the following categories of cookies:

• Strictly necessary cookies: Required for the Platform to function correctly, including session management, authentication, and security. These cannot be disabled without affecting core functionality.
• Performance and analytics cookies: Collect anonymised data on how players navigate and use the Platform, enabling us to identify performance issues and improve user experience.
• Functional cookies: Remember your preferences such as language settings, preferred payment method, and display options to provide a personalised experience.
• Marketing cookies: Used only where consent has been provided, to deliver relevant promotional content and measure the effectiveness of marketing campaigns. These can be disabled at any time.

You may manage your cookie preferences through your browser settings. Please note that disabling certain cookies may impair the functionality of some Platform features.

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable regulatory and legal obligations. Our general retention principles are as follows:

• Active account data: Retained for the duration of your account and for a period of five (5) years following account closure, in accordance with standard AML and KYC record-keeping requirements.
• Transaction records: Financial transaction records, including deposit and withdrawal history, are retained for a minimum of five (5) years as required by anti-money laundering regulations.
• KYC documentation: Identity verification documents are retained for the minimum period required by our licensing obligations, typically five (5) years after the end of the customer relationship.
• Support communications: Live chat transcripts and email correspondence are retained for three (3) years for dispute resolution and quality assurance purposes.
• Marketing data: Where consent for marketing communications has been withdrawn, your contact details will be removed from marketing lists within 30 days and permanently deleted after the applicable retention period for your account has expired.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised in accordance with our data disposal procedures.

Janjitoto implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Our security framework includes:

• 256-bit SSL/TLS encryption for all data transmitted between your device and our servers.
• Encryption at rest for sensitive personal and financial data stored on our infrastructure.
• Role-based access controls ensuring that staff and contractors access only the data necessary for their specific function.
• Two-factor authentication available to all player accounts and mandatory for internal administrative access.
• Regular independent security audits and penetration testing of our platform infrastructure.
• Intrusion detection and monitoring systems operating continuously across our server environment.
• A formal incident response and data breach notification procedure.

Subject to applicable law and our legal obligations (including AML and KYC record-keeping requirements which may limit or delay certain rights), you have the following rights in respect of your personal data held by Janjitoto:

To exercise any of the above rights, please submit a written request to our Data Privacy team at [email protected]. We will acknowledge your request within 5 business days and respond fully within 30 days of receipt.

The Janjitoto platform is strictly for users aged 21 and above. We do not knowingly collect, process, or store personal data from individuals under the age of 21. If we become aware, through our KYC processes or otherwise, that a registered Player is under 21 years of age, we will immediately suspend the account, forfeit any winnings, and securely delete all associated personal data as expeditiously as legally permissible.

If you have reason to believe that a minor has accessed or registered on the Janjitoto platform, please contact us immediately at [email protected] so that we may investigate and take appropriate action without delay.

Janjitoto operates as an internationally licensed platform, and as such, personal data collected from Malaysian players may be transferred to and processed in countries outside Malaysia. These countries may have data protection laws that differ from those in Malaysia.

Where such transfers occur, Janjitoto ensures that appropriate safeguards are in place, including contractual data protection clauses with all relevant service providers, to maintain equivalent levels of data protection. We only transfer data to countries or organisations that provide adequate data protection guarantees consistent with our obligations under applicable international licensing conditions.

Janjitoto reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, applicable regulatory requirements, or the services we offer. Material changes will be communicated to registered Players via email notification or prominent notice on the Platform at least 7 days prior to taking effect.

The version of this Privacy Policy currently published at janjitoto.cam/privacy-policy constitutes the operative and binding version. We encourage you to review this page periodically to stay informed of how we are protecting your information. The effective date at the top of this document indicates when the current version was last updated.

Your continued use of the Platform following any revision constitutes your acceptance of the updated Policy. If you object to any revised terms, you must discontinue use of the Platform and request account closure.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to raise a concern about how we handle your personal data, please contact our Data Privacy team using the information below. We are committed to addressing all privacy-related enquiries with care and promptness.

This Privacy Policy is effective as of 1 January 2026 and supersedes all prior versions.