Privacy Policy evostoto — Your Personal Data Protection

Evostoto collects members' personal information solely for the purpose of providing a safe, seamless, and high-quality online entertainment platform service. Information is collected transparently and only when genuinely necessary.

Information you provide directly:

• Full name as it appears on your official identification document.
• An active and reachable mobile phone number.
• A valid email address for account communications and notifications.
• Date of birth for age verification purposes (members must be at least 18 years old).
• Bank account or digital wallet details registered for deposit and withdrawal processing.
• Identity verification (KYC) documents such as national ID, passport, or driving licence when required.

Information collected automatically:

• IP address and general geographic location data (country/state).
• Device type, operating system, and web browser version used.
• Game session data including login time, session duration, and wagering activity.
• Cookie and online tracker data for analytics and user experience improvement purposes.
• Server access logs for security and fraud detection purposes.

The personal information we collect is used responsibly for the following purposes only. evostoto will not use your data for any purpose outside the stated scope without first obtaining your consent.

• Account Management: Creating, verifying, and maintaining your member account on the evostoto platform.
• Transaction Processing: Processing deposits, withdrawals, and all financial transactions related to your account securely and efficiently.
• KYC & AML Compliance: Fulfilling legal obligations related to customer identity verification (Know Your Customer) and anti-money laundering (Anti-Money Laundering).
• Customer Support: Providing technical assistance, resolving complaints, and responding to member enquiries via live chat or email.
• Platform Security: Detecting and preventing fraud, account abuse, unauthorised access, and cybercriminal activity.
• Service Improvement: Analysing usage patterns to improve platform functionality, user interface, and the overall member experience.
• Account-Related Communications: Sending important notifications about account activity, policy changes, eligible promotions, and platform updates.
• Responsible Gaming: Monitoring gameplay patterns to identify members who may require responsible gaming support.

All data usage is carried out on the principle of data minimisation — we only use the information strictly necessary for each stated purpose above.

Evostoto does not sell or trade members' personal information to any external parties. However, in certain limited situations, we may need to share your information with the following parties:

• Payment Service Providers: Processing financial transactions requires sharing necessary information with authorised payment gateway providers, including FPX, Touch 'n Go, GrabPay, and other providers listed on the platform. These providers are bound by strict confidentiality agreements.
• Game Software Providers: Some third-party game providers may require minimal session identification to ensure games function correctly. Data shared is limited to session IDs and contains no personally identifiable information.
• Analytics Services: We use trusted third-party web analytics services to understand platform usage patterns. Any shared data is in aggregated, non-personally identifiable form.
• Legal Authorities: evostoto will disclose members' personal information to law enforcement agencies or government authorities when required by law, court order, or a valid official investigation.

Evostoto uses cookies and similar tracking technologies to enhance the functionality and user experience of our platform. Cookies are small text files stored on your device when you visit our website.

Types of cookies we use:

• Essential Cookies: Required for core platform functions such as login, session management, and security. These cookies cannot be disabled as they are essential to platform usability.
• Functional Cookies: Saving your preferences such as language, theme, and display settings to provide a more personalised experience when you return to the platform.
• Analytics Cookies: Collecting information about how you use the platform to help us understand usage patterns and improve our services.
• Security Cookies: Helping detect suspicious activity, protecting your account from unauthorised access, and preventing fraud.

You can manage your cookie settings through your web browser at any time. Please note that disabling essential cookies may affect the functionality of the evostoto platform. For more information on managing cookies, refer to your web browser's help documentation.

Evostoto continuously invests in a comprehensive cybersecurity infrastructure to protect members' personal data from unauthorised access, disclosure, alteration, or destruction. The technical and organisational security measures we implement include:

• 256-bit SSL/TLS encryption for all data transmitted between the platform and members' devices.
• Sensitive personal data stored in our databases is protected using modern encryption algorithms.
• Two-factor authentication (2FA) available to enhance member account security.
• Next-generation firewalls and intrusion detection systems (IDS/IPS) active 24/7.
• Role-based access controls that ensure only authorised staff can access member personal data.
• Regular security audits and penetration testing by independent security experts.
• A clear incident response procedure to address any data breaches swiftly and effectively.
• Regular data backups at secure, geographically separate server locations to ensure continuity of service.

While we take all reasonable steps to protect your data, no security system can be guaranteed 100% safe from all cyber threats. We therefore encourage members to also take precautions such as using a strong, unique password and never sharing your login credentials with anyone.

As an evostoto member and data subject under Malaysia's Personal Data Protection Act 2010 (PDPA), you have certain rights regarding the personal information we hold about you. evostoto respects and facilitates the exercise of these rights:

To exercise any of the rights above, please contact the evostoto privacy team via email at [email protected] along with proof of your identity. We will process your request within 14 business days.

Evostoto retains members' personal data only for as long as necessary to fulfil the original purpose of collection or any applicable legal obligations. Once the designated retention period expires, data will be securely deleted or anonymised.

• Active Account Data: Retained for the duration the account remains active, plus any additional period required by law.
• Financial Transaction Records: Retained for a minimum of 7 years in accordance with Malaysia's accounting and taxation legal requirements.
• KYC Documents: Retained for the minimum period mandated by applicable AML/CFT legislation.
• Security & Access Logs: Retained for 12 months for security investigation purposes if required.
• Cookie & Analytics Data: Deleted or anonymised after 13 months from the date of collection.
• Closed Account Data: Once an account is closed at a member's request, personal data will be deleted within 90 days, except for data that must be retained to fulfil legal obligations.

The evostoto platform is intended exclusively for individuals aged 18 and above. We do not knowingly collect, store, or process any personal information from children or minors under the age of 18.

Should evostoto discover that personal information of an individual under the age of 18 has been inadvertently collected, we will take immediate steps to delete that information from our systems and close the associated account.

Evostoto reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our privacy practices, new legal requirements, or technological developments. Any changes will take effect immediately upon the updated version being published on this page.

For significant and material changes, evostoto will endeavour to notify members through one or more of the following methods:

• Clear in-platform pop-up or banner notifications when you log in.
• Notification emails sent to the email address registered to your account.
• Updates to the "Last Updated" date displayed at the top of this page.

We encourage you to review this Privacy Policy page periodically to stay informed about how we protect your personal information. Continued use of the evostoto platform after any changes are published will be considered your acceptance of the updated Privacy Policy.

If you have any questions, concerns, or complaints regarding how evostoto handles your personal information, or wish to exercise any of your privacy rights, please do not hesitate to contact us through the following channels:

• Privacy Email: [email protected] — for privacy-related enquiries and personal data requests.
• Live Chat: Available 24/7 within the evostoto platform for immediate assistance.
• Response Time: We are committed to responding to all privacy enquiries within 3 to 5 business days, and to formal data rights requests within 14 business days.

Evostoto values the trust you place in us. Protecting your personal data is not merely a legal obligation — it is our moral responsibility as a platform you trust.