Dumaitoto Privacy Policy — Member Personal Data Protection

1.Information We Collect

In the course of its operations, dumaitoto collects several categories of personal information from members. This collection is necessary to enable us to deliver quality services, process financial transactions securely, and comply with applicable legal requirements.

We only collect information that is strictly necessary for the stated purposes. We do not collect sensitive data categories such as medical information, religious beliefs, or members' political views.

2.How We Use Your Data

The information we collect is used solely for legitimate and transparent purposes. Below is a full list of how your personal data is used on the dumaitoto platform:

• Account management — registering new accounts, verifying identity, managing profile information, and providing effective customer support.
• Transaction processing — processing deposits, handling fund withdrawals, and maintaining accurate financial records for each member.
• Platform security — detecting and preventing fraud, money laundering, unauthorised access, and harmful activities that could affect the platform and other members.
• Legal compliance — fulfilling reporting obligations to regulatory bodies, complying with court orders, and carrying out identity verification processes required by law.
• Service improvement — analysing platform usage patterns to enhance user experience, develop new features, and optimise system performance.
• Marketing communications — sending promotional information, special offers, and platform updates to members who have given their consent to receive them.
• Responsible gaming — monitoring betting patterns to identify early signs of problem gambling and offering appropriate assistance to members who need it.

3.Data Sharing with Third Parties

Dumaitoto understands that your trust is our most valuable asset. We do not sell or disclose your personal data to third parties for their own commercial purposes. However, in the following limited situations, data sharing may occur:

• Payment providers — to process your deposits and withdrawals, we share the necessary transaction information with payment service providers bound by strict confidentiality agreements.
• Identity verification providers — to carry out the required KYC process, we use approved third-party services to verify the authenticity of members' identity documents.
• Technology service providers — our technical partners, such as cloud hosting providers and analytics services, only access data necessary to perform their technical functions.
• Legal requirements — we will disclose required information when mandated by law, a valid court order, or directions from a competent authority.
• Legitimate interest protection — in circumstances where it is necessary to prevent fraud, protect member safety, or defend the platform's legal rights, limited disclosure may be made.

All third parties that receive data from dumaitoto are required to comply with data protection standards equal to or higher than our own. We periodically audit our partners to ensure ongoing compliance.

4.Data Storage & Security

The security of your data is a responsibility we take extremely seriously. dumaitoto implements multiple layers of technical and organisational protection to ensure your information remains safe from unauthorised access, modification, disclosure, or destruction.

Security measures we have implemented include:

• End-to-end encryption using TLS 1.3 protocol for all communications between your device and our servers.
• Data-at-rest encryption using AES-256 for all sensitive data stored in our database.
• Role-based access control ensuring that only staff who require access to carry out their duties are able to view member data.
• 24/7 security monitoring by our cybersecurity team, which monitors any suspicious activity in real time.
• Regular penetration testing conducted by independent security experts to identify and address any system vulnerabilities before they can be exploited.
• Automatic data backup ensuring your data remains safe even in the event of a system failure or technical disaster.

5.Cookies & Tracking Technologies

The dumaitoto platform uses cookies and similar tracking technologies to enhance your experience while using our services. Cookies are small text files stored on your device when you visit our website.

The types of cookies we use are as follows:

• Essential cookies — required for core platform functions such as login sessions and security. These cookies cannot be disabled as the platform will not function properly without them.
• Performance cookies — collecting information about how you use our platform, including the most frequently visited pages and time spent. All such information is anonymised and used solely for platform improvement.
• Functional cookies — enabling the platform to remember your preferences such as language, region, and other personal settings to provide a more personalised experience.
• Analytics cookies — helping us understand how members interact with our platform so we can continually improve the services we offer.

You can manage cookie settings through your web browser. However, disabling certain cookies may affect the functionality of the dumaitoto platform.

6.Your Rights as a Member

As a dumaitoto member, you have the following rights regarding your personal data that we hold. We are committed to respecting and facilitating the exercise of these rights within a reasonable timeframe:

• Right of access — you have the right to obtain a copy of the personal data we hold about you, along with information on how it is used.
• Right to rectification — if any information we hold is inaccurate or incomplete, you have the right to request immediate correction.
• Right to erasure — under certain circumstances, you have the right to request that your personal data be deleted. Please note that this right may be limited by specific legal obligations.
• Right to restrict processing — you may request that we restrict how we process your data in certain circumstances.
• Right to object — you have the right to object to the processing of your data for direct marketing purposes at any time.
• Right to data portability — you have the right to receive your personal data in a machine-readable format for transfer to another service provider.

To exercise any of the rights above, please contact our data protection team. We will process your request within 30 calendar days from the date of receipt.

7.Children's Data Protection

Dumaitoto strictly prohibits the use of its platform by individuals under the age of 18. Our platform is not designed for children, and we do not intentionally collect any personal data from minors.

If we discover that we have inadvertently collected information from a minor, we will take immediate action to delete that information and close the relevant account. Parents or guardians who believe their child may have registered an account on our platform are encouraged to contact us immediately.

8.Cross-Border Data Transfers

In some situations, your personal data may be transferred to, processed in, or stored in countries other than Malaysia. This occurs primarily when we use cloud hosting providers or international technology partners.

In all cross-border data transfers, dumaitoto ensures that:

• The recipient country has an adequate level of data protection, or
• Appropriate data transfer agreements have been put in place to protect your rights, or
• Other protection mechanisms recognised under applicable data protection laws have been applied.

You can contact us for more information about the data transfer mechanisms used in specific cases.

9.Data Retention Period

Dumaitoto retains your personal data for as long as necessary to fulfil the purposes stated in this Privacy Policy, unless a longer retention period is required or permitted by law. In general, our data retention principles are as follows:

• Active account data — retained for the duration of your active membership on the dumaitoto platform.
• Financial transaction records — retained for a minimum of 7 years after a transaction occurs, in line with Malaysia's accounting and financial legal requirements.
• Identity verification (KYC) records — retained for a minimum of 5 years after account closure, in accordance with anti-money laundering requirements.
• Communication and customer support logs — retained for 2 years after the last interaction.
• Cookie and analytics data — retained for no longer than 13 months from the date of collection.

Once the specified retention period has ended, your personal data will be securely deleted or converted into an anonymised format that cannot be linked to your identity.

10.Amendments to This Privacy Policy

Dumaitoto reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or technological developments. All amendments take effect as soon as the latest version is published on our platform.

For material amendments — changes that significantly affect how we use your data — we will provide clear notice to members via:

• In-platform notification upon next login.
• Email to the registered address at least 14 days before the amendment takes effect.
• A prominent announcement on the dumaitoto website homepage.

Continued use of the platform after amendments take effect constitutes acceptance of the revised terms. If you do not agree with the amendments, you have the right to close your account before they take effect.

11.Contact Us Regarding Privacy

If you have any questions, concerns, or complaints regarding this Privacy Policy or how we handle your personal data, our data protection team is ready to assist you.

You can reach us through the following channels:

• Live Chat — available 24 hours a day, 7 days a week, directly within the dumaitoto platform.
• Data Protection Email — privacy@dumaitoto.bio (please state "Privacy Inquiry" in the email subject line).
• General Support — support@dumaitoto.bio for general enquiries.

We are committed to responding to every privacy inquiry within 3 working days. For more complex complaints, we will provide a realistic resolution timeframe in our initial response.