Privacy Policy

1. Introduction

This Privacy Policy ("Policy") describes how Idamantoto ("we", "us", "our", "Company") collects, processes, stores, and discloses personal data relating to users ("Player", "User", "you") of the Idamantoto online gaming and sports betting platform, accessible at idamantoto.cam ("Platform").

Idamantoto operates its services with a strong commitment to the privacy rights of Malaysian players and all users who interact with the Platform from anywhere in the world. We process personal data in accordance with applicable data protection legislation and industry best practices for online gambling operators.

By creating an account, making a deposit, or otherwise using the Platform, you acknowledge that you have read and understood this Policy. This Policy should be read alongside our Terms & Conditions and Responsible Gambling Policy, both of which are incorporated by reference.

2. Definitions

For the purposes of this Policy:

• "Personal Data" — any information that identifies or can reasonably identify a living natural person, including name, email address, national identification number, payment details, and device identifiers.
• "Processing" — any operation performed on personal data, including collection, storage, use, disclosure, transfer, and deletion.
• "Data Controller" — Idamantoto, as the entity that determines the purposes and means of processing your personal data.
• "Data Processor" — a third party that processes personal data on behalf of Idamantoto under a written data processing agreement.
• "Special Category Data" — personal data revealing racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data, as defined under applicable law.
• "Consent" — a freely given, specific, informed, and unambiguous indication of agreement to the processing of personal data.
• "KYC" — Know Your Customer; the identity verification process required by applicable regulations and our Terms & Conditions.

3. Data We Collect

Idamantoto collects personal data through several channels, including the account registration process, ongoing account activity, payment transactions, and your interactions with our customer support team. The categories of personal data we collect include:

3.1 Registration & Identity Data

• Full legal name as it appears on your government-issued identification document
• Date of birth (for the purpose of verifying you are aged 21 or above)
• Email address and chosen username
• Malaysian IC number (MyKad), Passport number, or Driver's Licence number (for KYC purposes)
• Residential address, including postcode, city (e.g., Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam), and state
• Contact telephone number (optional, used for two-factor authentication)

3.2 Financial & Payment Data

• Malaysian bank account details used for FPX or DuitNow transfers (Maybank, CIMB, Public Bank, Hong Leong, RHB, AmBank)
• eWallet identifiers associated with Touch 'n Go eWallet, Boost, or GrabPay accounts
• Cryptocurrency wallet addresses used for Bitcoin (BTC) or USDT (TRC-20) transactions
• Deposit history, withdrawal history, and transaction identifiers

3.3 Gaming & Activity Data

• Game history, bet amounts, wagering patterns, and session durations
• Sports betting selections, stake values, and odds accepted
• Bonus claims, wagering progress, and promotional participation
• Responsible gambling tool settings (deposit limits, self-exclusion status)

3.4 Technical & Device Data

• IP address and approximate geolocation derived from IP
• Device type, operating system, and browser version
• Unique device identifiers and session tokens
• Log data including pages visited, time on site, and error reports

3.5 Communications Data

• Live chat transcripts and email correspondence with our support team
• Survey responses and feedback submitted voluntarily
• Records of your preferences regarding marketing communications

4. How We Use Your Personal Data

The following table summarises the primary purposes for which Idamantoto processes your personal data:

5. Legal Basis for Processing

Idamantoto processes your personal data on one or more of the following legal bases, depending on the specific purpose of processing:

• Contract Performance: Processing is necessary to perform the contract between you and Idamantoto — i.e., to operate your account, process bets, and handle payments.
• Legal Obligation: Processing is required to comply with applicable law, including anti-money laundering (AML) regulations, responsible gambling obligations, and regulatory reporting requirements.
• Legitimate Interests: Processing serves Idamantoto's legitimate business interests (such as fraud prevention, platform security, and service improvement) where those interests are not overridden by your privacy rights.
• Consent: For marketing communications and non-essential cookies, processing is based on your freely given consent, which you may withdraw at any time without affecting prior lawful processing.

6. Data Sharing & Disclosure

Idamantoto does not sell personal data. We may share your data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate contractual safeguards:

6.1 Payment Service Providers

Licensed payment processors facilitating transactions via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and cryptocurrency gateways receive only the data necessary to authenticate and process your transactions. These providers are bound by their own regulatory obligations and data protection agreements.

6.2 Identity Verification Partners

Third-party KYC and identity verification providers may process your identification documents and cross-reference them against official databases to fulfil our regulatory obligations. All such providers operate under data processing agreements that restrict use of your data to verification purposes only.

6.3 Regulatory & Law Enforcement Authorities

Idamantoto may be required by law or regulatory order to disclose personal data to government authorities, financial intelligence units, or law enforcement agencies. We will only make such disclosures where legally compelled to do so and, where permitted, will notify affected players.

6.4 Fraud Prevention & Security Services

We share limited technical and transactional data with fraud detection and cybersecurity service providers to protect the integrity of the Platform and the financial interests of our players.

6.5 Professional Advisers

Our legal advisers, auditors, and accountants may access personal data where necessary for the provision of their professional services, subject to professional confidentiality obligations.

7. Cookies & Tracking Technologies

Idamantoto uses cookies and similar technologies (collectively "Cookies") to operate the Platform, remember your preferences, and analyse usage patterns. Cookies are small text files stored on your device when you access the Platform.

7.1 Categories of Cookies We Use

• Essential Cookies: Required for the Platform to function. These include session authentication tokens, anti-CSRF tokens, and security identifiers. You cannot opt out of essential cookies without ceasing to use the Platform.
• Functional Cookies: Remember your preferences such as language settings, notification preferences, and responsible gambling tool configurations.
• Analytics Cookies: Help us understand how players navigate the Platform so we can improve user experience. Analytics data is aggregated and anonymised where possible.
• Marketing Cookies: Used to present relevant promotional content based on your activity. These are only deployed with your explicit consent.

You may manage your cookie preferences via your browser settings or through the cookie consent manager available on the Platform. Note that disabling certain cookies may affect the functionality of the Platform.

8. Data Retention

Idamantoto retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. General retention principles are as follows:

• Active Account Data: Retained for the duration of the account relationship plus a minimum of 5 years following account closure, to satisfy AML record-keeping obligations.
• KYC Documents: Retained for a minimum of 5 years from the date of the last transaction, in accordance with anti-money laundering regulations.
• Transaction Records: Retained for 7 years for financial audit and regulatory compliance purposes.
• Communications Data: Live chat and email records retained for 2 years from the date of the interaction, unless required longer for dispute resolution.
• Marketing Preference Records: Retained until you withdraw consent or request deletion, whichever is earlier.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our internal data destruction policy.

9. Data Security

Idamantoto implements a comprehensive range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These include:

• 256-bit SSL/TLS encryption for all data in transit between your browser and our servers
• AES-256 encryption for sensitive data at rest, including stored payment identifiers and identity documents
• Role-based access controls limiting staff access to personal data on a strict need-to-know basis
• Multi-factor authentication required for all internal systems that handle player data
• Regular independent security audits and penetration testing of platform infrastructure
• Intrusion detection systems and 24/7 security monitoring
• Formal incident response procedures for the detection, containment, and notification of data breaches

10. Your Data Subject Rights

Subject to applicable law and certain exceptions, you hold the following rights in respect of your personal data held by Idamantoto:

You may exercise any of these rights at any time by contacting our Data Protection team via the details in Section 14 of this Policy. We will acknowledge your request within 5 business days and respond substantively within 30 calendar days.

Where processing is based on your consent, you may withdraw that consent at any time by updating your communication preferences within your Account settings or by contacting support. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

11. Minors & Age Verification

The Idamantoto Platform is strictly restricted to individuals aged 21 years and above. We do not knowingly collect or process personal data from individuals under the age of 21. During the registration process, all users are required to confirm that they meet the minimum age requirement and to submit to formal age verification as part of our KYC process.

If Idamantoto discovers or has reasonable grounds to believe that an Account is held by an individual under the age of 21, that Account will be immediately suspended, all balances frozen pending investigation, and the personal data of the underage individual deleted or retained only to the extent required by applicable law to record the regulatory breach.

12. International Data Transfers

Your personal data may be processed by Idamantoto or its authorised processors in jurisdictions outside your country of residence, including countries that may not provide the same level of data protection as Malaysia. Where such transfers occur, Idamantoto ensures that appropriate safeguards are in place, including:

• Standard contractual clauses approved by relevant data protection authorities
• Data processing agreements imposing equivalent data protection standards on the receiving party
• Transfers made only to jurisdictions recognised as providing adequate data protection

You may request further information about the safeguards applicable to any specific international transfer by contacting us at the details provided in Section 14.

13. Changes to This Privacy Policy

Idamantoto reserves the right to update this Privacy Policy from time to time to reflect changes in applicable law, regulatory guidance, or our data processing practices. Material changes will be communicated to registered players by email or prominent in-platform notification at least 14 calendar days before the revised Policy takes effect.

The "Last Updated" date at the top of this Policy indicates when the most recent revision was made. Your continued use of the Platform following the effective date of any revision constitutes your acceptance of the updated Policy. If you do not accept the revised terms, you should cease using the Platform and may request closure of your Account.

14. Contact Us & Data Enquiries

If you have any questions about this Privacy Policy, wish to exercise any of your data subject rights, or wish to raise a complaint regarding our data processing activities, please contact us:

• Live Chat: Available 24/7 directly on the Platform — the fastest route for urgent data concerns.
• Email: [email protected]
• Subject Line: Please include "Privacy Request" or "Data Subject Rights" in your subject line to ensure your enquiry is routed to our data protection team.
• Response Time: We acknowledge all data enquiries within 5 business days and provide a substantive response within 30 calendar days of receipt of a complete and verified request.

For responsible gambling matters, please also refer to our Responsible Gambling page, which provides information on self-exclusion, deposit limits, and third-party support organisations.