Privacy Policy

1 Introduction

This Privacy Policy ("Policy") is published by Evostoto ("we", "us", "our", "the Platform") and governs the collection, use, storage, sharing, and protection of personal data in connection with the operation of the website at evostoto.cam and all associated gaming, sports betting, and account services provided through it.

By registering an account on evostoto, depositing funds, or otherwise using the platform, you acknowledge that you have read and understood this Policy and that you consent to the collection and processing of your personal data as described herein. If you do not consent to the practices described in this Policy, you should not use the evostoto platform.

This Policy applies to all users of the evostoto platform, including registered players located in Malaysia — across Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and all other locations from which access is made. This Policy should be read in conjunction with our Terms & Conditions and Responsible Gambling Policy.

2 Definitions

The following terms have specific meanings within this Privacy Policy:

3 Personal Data We Collect

Evostoto collects personal data through several distinct channels. The categories of data we collect are described below, along with the context in which each category is gathered.

3.1 Registration Data

When you create an account on evostoto, we collect the information you provide in the registration form, including:

• Full legal name
• Date of birth (to verify that you meet the 21+ age requirement)
• Email address and mobile number
• Residential address (city, postcode, country)
• Preferred currency (MYR)
• Account username and hashed password

3.2 Identity Verification (KYC) Data

To comply with our licensing obligations and to verify the identity and age of players, we collect KYC documentation including: a copy of your Malaysian MyKad, passport, or equivalent government-issued photo identification; proof of current residential address; and in some cases, a selfie or live video verification image. This data is processed securely and is used exclusively for compliance purposes.

3.3 Financial Transaction Data

When you make deposits or withdrawals using supported Malaysian payment methods — including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB Bank, Public Bank, Hong Leong Bank, or USDT cryptocurrency — we collect transactional data including the payment method used, transaction amount in MYR (or equivalent), transaction reference number, and timestamp. We do not store full card numbers or bank account passwords.

3.4 Gaming Activity Data

We collect records of your gaming activity on the platform, including game history, wager amounts, win and loss records, session durations, and bonus usage. This data is used for account management, dispute resolution, responsible gambling monitoring, and regulatory compliance.

3.5 Technical and Device Data

We automatically collect certain technical data when you access the platform, including: IP address, browser type and version, device type and operating system, referring URL, pages visited, and session duration. This data is used for security monitoring, fraud prevention, and platform performance optimisation.

3.6 Communications Data

If you contact evostoto support via live chat or email, we retain records of those communications, including the content of messages, timestamps, and the nature of the query or complaint. These records are maintained for quality assurance, training, and dispute resolution purposes.

4 How We Use Your Personal Data

Evostoto uses the personal data it collects for the following specific purposes:

5 Legal Basis for Processing

Evostoto processes personal data under one or more of the following lawful bases, as applicable to each processing activity:

• Contract Performance: Processing that is necessary to fulfil our contractual obligations to you — including account management, deposits, withdrawals, and gameplay records.
• Legal Obligation: Processing required to comply with our international operating licence, including KYC verification, age enforcement, anti-money laundering checks, and regulatory reporting.
• Legitimate Interest: Processing carried out to protect the security and integrity of the platform, prevent fraud, improve platform performance, and monitor for responsible gambling concerns — where such interests do not override your fundamental rights.
• Consent: Certain processing activities — such as sending personalised promotional offers or marketing communications — are carried out only with your express consent, which you may withdraw at any time through your account settings or by contacting support.

6 Data Sharing & Disclosure

Evostoto does not sell, rent, or trade your personal data to any third party. We share personal data with external parties only in the following specific and limited circumstances:

6.1 Payment Service Providers

When you make a deposit or withdrawal using a supported payment method (such as Touch 'n Go eWallet, Boost, GrabPay, DuitNow, Maybank, or USDT), we share necessary transaction data with the relevant payment processor to facilitate the transaction. These processors act as Data Processors under written agreements that restrict their use of your data.

6.2 KYC and Identity Verification Partners

We engage accredited third-party KYC verification service providers to assist in verifying player identity and age. Your identity documents are shared with these providers solely for verification purposes, under strict data processing agreements.

6.3 Regulatory and Law Enforcement Bodies

Evostoto may disclose personal data to competent regulatory authorities, law enforcement agencies, or courts where required to do so by applicable law, by court order, or in connection with investigations into suspected fraud, money laundering, or other criminal activity. In such cases, we will disclose only the minimum data necessary.

6.4 Platform Service Providers

We engage certain trusted technology service providers — including hosting infrastructure providers, analytics platforms, and security monitoring services — who process data on our behalf as Data Processors. All such providers are bound by data processing agreements that prohibit unauthorised use of your data.

7 Cookies & Tracking Technologies

Evostoto uses cookies and similar tracking technologies to operate the platform effectively, ensure security, and provide a personalised user experience. A cookie is a small text file stored on your device by your browser at the instruction of a website.

The following categories of cookies are used on the evostoto platform:

• Strictly Necessary Cookies: Required for the platform to function, including session authentication, security tokens, and load balancing. These cookies cannot be disabled without preventing core platform functionality.
• Functional Cookies: Used to remember your preferences, such as language settings, game history, and display options, to provide a consistent and personalised experience across sessions.
• Analytics Cookies: Used to collect aggregated, anonymised data about how users interact with the platform. This data helps us identify technical issues, improve page performance, and understand which features are most commonly used.
• Security Cookies: Used to detect and prevent fraudulent account access, automated abuse, and other security threats. These are part of our fraud prevention infrastructure.

You may manage your cookie preferences through your browser settings. Please note that disabling certain categories of cookies may impact the functionality of the evostoto platform.

8 Data Retention

Evostoto retains personal data for the minimum period necessary to fulfil the purposes for which it was collected, and in compliance with applicable legal, regulatory, and contractual obligations. The following general retention periods apply:

• Active Account Data: Retained for the full duration of your account relationship with evostoto, plus a minimum of five (5) years following account closure, as required under our licensing and anti-money laundering compliance obligations.
• KYC and Identity Documents: Retained for a minimum of five (5) years following the end of the account relationship, as required by anti-money laundering regulations applicable to our licensing jurisdiction.
• Financial Transaction Records: Retained for a minimum of five (5) years following the date of the transaction, in compliance with financial record-keeping obligations.
• Support Communications: Retained for up to three (3) years following the close of the relevant support case, for quality assurance and dispute resolution purposes.
• Technical and Device Logs: Retained for up to twelve (12) months for security and fraud monitoring purposes, then aggregated or deleted.

Upon the expiry of applicable retention periods, personal data is securely deleted or anonymised in a manner that renders individual identification impossible.

9 International Data Transfers

Evostoto operates under an international online gaming licence and engages service providers located in multiple jurisdictions. As a consequence, your personal data may be transferred to and processed in countries outside of Malaysia. In each case where such transfers occur, evostoto ensures that appropriate safeguards are in place to protect your personal data, including contractual data transfer provisions and data processing agreements that impose obligations equivalent to those set out in this Policy.

By using the evostoto platform, you consent to the international transfer of your personal data on the terms described in this Policy.

10 Data Security

Evostoto takes the security of your personal data seriously and maintains appropriate technical and organisational measures to protect it against unauthorised access, accidental loss, alteration, disclosure, or destruction. Key security measures include:

1. TLS/SSL Encryption: All data in transit between your browser or device and the evostoto platform is encrypted using industry-standard TLS/SSL protocols.
2. Encryption at Rest: Sensitive personal data stored in our databases — including identity documents, financial data, and account credentials — is encrypted using strong encryption standards.
3. Access Controls: Access to personal data within the evostoto organisation is restricted on a strict need-to-know basis. Staff with access to sensitive data are subject to background checks, training, and confidentiality obligations.
4. Two-Factor Authentication: Account security is enhanced through optional two-factor authentication for player accounts and mandatory multi-factor authentication for internal administrative access.
5. Security Monitoring: The platform is subject to continuous automated security monitoring, intrusion detection, and periodic third-party security assessments.
6. Incident Response: In the event of a data security incident affecting your personal data, evostoto will take immediate steps to contain the breach and will notify affected players as required by applicable obligations.

11 Your Data Rights

Subject to applicable law and to certain exceptions necessary for compliance with our legal obligations and licensing requirements, you hold the following rights in respect of the personal data evostoto processes about you. To exercise any of these rights, please submit a written request to [email protected]. We will acknowledge receipt of your request within five (5) business days and aim to complete your request within thirty (30) days.

12 Children and Minors

The evostoto platform is strictly intended for individuals aged 21 and above. We do not knowingly collect personal data from any person under the age of 21. The minimum age requirement is enforced through our KYC verification process, which requires government-issued photo identification confirming date of birth before withdrawal privileges are activated.

If evostoto discovers or is notified that personal data has been collected from a person under the age of 21, the account will be immediately closed, all associated data will be reviewed, and we will take appropriate steps to delete or anonymise such data to the extent permitted by our legal obligations. Funds associated with underage accounts will be handled in accordance with our Terms & Conditions and applicable regulatory requirements.

If you are a parent or guardian and you believe your child under 21 has registered or used the evostoto platform, please contact us immediately at [email protected] so that we may take prompt action.

13 Changes to This Privacy Policy

Evostoto reserves the right to update or amend this Privacy Policy at any time in response to changes in applicable law, regulatory requirements, platform features, or data processing practices. Material changes to this Policy will be communicated to registered players by email notification and/or by a prominent notice displayed on the platform, specifying the effective date of the changes.

The current version of this Privacy Policy is always available at evostoto.cam/privacy-policy and will display the "Last Updated" date at the top of the document. Your continued use of the evostoto platform following the effective date of any amended Policy constitutes your acceptance of the changes. If you do not accept the updated Policy, you should discontinue use of the platform and request account closure.

14 Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data rights, or have concerns about how evostoto processes your personal information, please contact us using the details below. All privacy-related requests should be submitted in writing in English.

For account-specific queries, responsible gambling tool access, or self-exclusion requests, please also visit our Responsible Gambling page.