At Kokitoto, your privacy is a fundamental commitment — not a compliance formality. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and what rights you hold as Kokitoto account holder. Please read this document carefully before registering or using the Platform.
Six core privacy principles that underpin how Kokitoto handles every piece of personal data entrusted to us by Malaysian players.
All personal data stored on the Kokitoto platform is encrypted using AES-256 industry-standard encryption. Data in transit is protected via TLS. We do not store raw payment card numbers on our servers.
We collect only the personal data strictly necessary for account management, KYC verification, payment processing, and responsible gambling compliance. We do not collect data speculatively or unnecessarily.
Kokitoto does not sell, rent, or trade your personal data to third-party marketers or data brokers under any circumstances. Your information exists to serve your account — nothing else.
Where third-party service providers require access to user data — such as payment processors or KYC verification partners — access is governed by strict data processing agreements and limited to what is necessary for the specific service.
You have the right to access, correct, export, and — in certain circumstances — request deletion of your personal data. These rights are exercisable at any time by contacting our support team.
Any material changes to this Privacy Policy will be communicated to registered users via email or platform notification before they take effect. We will never silently update privacy terms in ways that disadvantage you.
This Privacy Policy (hereinafter "the Policy") describes how Kokitoto (hereinafter "the Platform", "we", "us", or "our") collects, processes, stores, shares, and protects personal data provided by users (hereinafter "you", "the User", or "the Data Subject") who access or use the website located at https://kokitoto.cam and all associated services.
Kokitoto is committed to responsible data stewardship and to conducting its operations in a manner consistent with applicable data protection legislation and internationally recognised privacy principles. This Policy is designed to provide you with clear, honest, and accessible information about how your personal data is handled at every stage of your relationship with the Platform.
By registering an account, depositing funds, or otherwise using the Kokitoto platform, you acknowledge that you have read and understood this Privacy Policy and that you consent to the processing of your personal data as described herein. If you do not agree with any part of this Policy, you should cease using the Platform immediately.
For the purposes of this Policy, the following terms have the meanings set out below:
Kokitoto acts as the Data Controller in respect of all personal data collected through or in connection with the Platform. As Data Controller, Kokitoto is responsible for determining how and why personal data is processed, and for ensuring that such processing complies with applicable data protection obligations.
Kokitoto's primary support and data enquiries point of contact is our Customer Support team, accessible via live chat at https://kokitoto.cam or by email at[email protected]. Data Subject rights requests (see Section 12) should be directed to the same contact point, clearly identified as a data rights request in the subject line or opening message.
Kokitoto collects personal data through several channels and at different stages of the User's relationship with the Platform. The categories of personal data we collect are set out in the table below.
| Category | Data Elements | Collection Point |
|---|---|---|
| Identity Data | Full name, date of birth, nationality, government-issued ID number (e.g., MyKad number) | Account registration; KYC verification |
| Contact Data | Email address, phone number, residential address | Account registration; KYC verification |
| Financial Data | Payment method type (e.g., Touch 'n Go eWallet, Boost, Maybank, CIMB), transaction reference numbers, deposit and withdrawal history | Cashier transactions; KYC verification |
| Account Activity Data | Betting history, game session records, bonus usage, login timestamps, device and browser information | Platform use; automated logging |
| Technical Data | IP address, device type and operating system, browser type and version, cookie identifiers, session tokens | Automated collection upon Platform access |
| Communications Data | Records of live chat interactions, email correspondence, support tickets | Customer support interactions |
| KYC Document Data | Scanned copies of government-issued ID, passport, utility bills, and payment method ownership proof | KYC verification process |
4.1 Data You Provide Directly
The majority of personal data processed by Kokitoto is provided directly by you during registration, KYC verification, deposit and withdrawal transactions, and customer support interactions. Providing accurate data is a condition of using the Platform — deliberately providing false or misleading personal information is a breach of ourTerms & Conditions.
4.2 Data Collected Automatically
When you access or use the Platform, certain technical and behavioural data is collected automatically through server logs, cookies, and similar technologies. This includes your IP address, device identifiers, and session activity. This data is used for security monitoring, fraud detection, platform performance optimisation, and responsible gambling monitoring.
Kokitoto processes personal data only where a lawful basis exists under applicable data protection legislation. The primary bases on which we rely are as follows:
Kokitoto uses the personal data it collects for the following specific purposes:
Kokitoto does not sell, rent, or trade your personal data to any third party for commercial or marketing purposes. We may share your personal data with third parties only in the following circumstances:
All third-party Data Processors engaged by Kokitoto are bound by written data processing agreements requiring them to process personal data only on Kokitoto's documented instructions and to maintain appropriate technical and organisational security measures.
Kokitoto retains personal data for as long as is necessary to fulfil the purposes for which it was collected, and thereafter for as long as required by applicable legal or regulatory obligations. The following indicative retention periods apply:
Upon expiry of the applicable retention period, personal data is securely deleted or anonymised using industry-standard data destruction procedures. Where anonymisation is not technically feasible, data will be held in a restricted access state until secure deletion is possible.
Kokitoto implements a comprehensive set of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:
While Kokitoto implements robust security measures, no online platform can guarantee absolute security. You are encouraged to use strong, unique passwords and to enable two-factor authentication on your account to further protect your data.
Kokitoto uses cookies and similar tracking technologies to operate the Platform effectively, enhance user experience, and conduct analytics. The categories of cookies we use are as follows:
Non-essential cookies (functional and analytics) are only placed upon your consent, which is requested via a cookie consent banner on your first visit to the Platform. You may adjust your cookie preferences at any time through your account settings or by clearing cookies from your browser.
Kokitoto does not use third-party advertising or behavioural targeting cookies. Your betting behaviour and account data are not shared with advertising networks.
The Kokitoto platform is strictly for persons aged21 years and above. We do not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory requirement of the registration process, and KYC documents confirming date of birth are required before withdrawal privileges are granted.
Where Kokitoto becomes aware that personal data has been collected from an individual under the age of 21, such data will be deleted immediately, any associated account will be closed, and any deposit funds — less any losses — will be returned to the payment method used. Winings generated by an underage account will not be paid out.
If you believe a minor has registered on the Platform using false information, please contact our support team immediately at [email protected] so that we may take prompt action.
Subject to applicable data protection legislation, you hold the following rights in relation to your personal data held by Kokitoto. These rights may be exercised at any time by contacting our Customer Support team via live chat or by emailing [email protected], clearly identifying your request as a data subject rights request.
Kokitoto will respond to all verified data subject rights requests within 30 calendar days of receipt. Where a request is complex or there is a high volume of requests, this period may be extended by a further 30 days — in which case you will be notified of the extension and the reason for it.
Some of the third-party service providers engaged by Kokitoto — including payment processors, KYC verification providers, and cloud infrastructure providers — may process personal data in jurisdictions outside Malaysia. Where personal data is transferred internationally, Kokitoto ensures that appropriate safeguards are in place to protect the data, including:
Where you interact with the Platform from Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, or any other location within Malaysia, your data is primarily processed within the Platform's secure infrastructure. Any cross-border transfers are subject to the safeguards described above.
Kokitoto reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, applicable legislation, or Platform features. The date of the most recent revision is displayed at the top of the Table of Contents on this page.
When material changes are made to this Policy — particularly where such changes affect how we use your personal data in a way that may impact your rights or expectations — we will notify you via email to your registered address and/or via an on-platform notification prior to the changes taking effect.
Your continued use of the Platform following the effective date of any revised Privacy Policy constitutes your acknowledgement of the revised terms. We encourage you to review this page periodically to stay informed of any updates.
If you have any questions, concerns, or requests in connection with this Privacy Policy or Kokitoto's data processing practices, please contact us using the following details:
For data subject rights requests (access, correction, erasure, portability, objection), please include your full name, account username, and a clear description of your request. You may be asked to provide identity verification before your request is processed.
If you are not satisfied with how Kokitoto has handled a privacy concern, you have the right to escalate your complaint to the relevant data protection authority in your jurisdiction. Kokitoto's support team will provide guidance on the appropriate regulatory body upon request.
Your personal data is handled with the same care we put into every other aspect of the platform. Over 380,000 Malaysian players trust Kokitoto — join them knowing your privacy is fully safeguarded.
For players aged 21 and above only. Please gamble responsibly. Visit our Responsible Gambling page for support tools and resources.