Privacy Policy

This Privacy Policy ("Policy") describes how Kenzototo ("we", "us", "our") collects, uses, stores, discloses, and protects the personal information of individuals ("you", "User") who register for or access the Kenzototo online gaming platform at kenzototo.cam and any associated services (the "Platform").

Kenzototo operates primarily in service of players based in Malaysia, including those located in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and across the broader Malaysian peninsula. Our data handling practices are designed to align with internationally recognised privacy principles and applicable data protection frameworks.

This Policy applies to all personal data we collect through the Platform, including during registration, account use, payment processing, customer support interactions, and marketing communications. It should be read in conjunction with our Terms and Conditions and Responsible Gambling Policy, both of which are published on this website.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

Kenzototo collects Personal Data through several channels during your use of the Platform. The categories of data we collect are described below, along with the specific data points within each category.

3.1 Registration and Account Data

When you create a Kenzototo account, we collect:

3.2 Identity Verification (KYC) Data

For withdrawal processing and regulatory compliance, we collect:

3.3 Financial Transaction Data

We record all financial activity associated with your Account, including:

3.4 Gaming and Behavioural Data

To operate the Platform and detect problem gambling patterns, we collect:

3.5 Technical and Device Data

Automatically collected during Platform access:

3.6 Customer Support Data

Records of all support interactions — including live chat transcripts, email correspondence, and any documentation shared during a support request — are retained for quality assurance and dispute resolution purposes.

Kenzototo processes your Personal Data for the following specific purposes:

Kenzototo processes your Personal Data only where a valid legal basis exists under applicable data protection law. The legal bases we rely upon are as follows:

• Contractual Necessity: Processing required to fulfil our obligations under the Terms and Conditions to which you have agreed — including operating your Account, processing deposits and withdrawals, and delivering gaming services.
• Legal Obligation: Processing required to comply with applicable regulatory requirements, including anti-money laundering (AML) obligations, KYC verification mandates, and responsible gambling compliance.
• Legitimate Interests: Processing carried out in pursuit of Kenzototo's legitimate business interests — including fraud prevention, security monitoring, and platform analytics — provided these interests are not overridden by your fundamental rights.
• Consent: Processing based on your freely given consent, which you may withdraw at any time. This applies specifically to direct marketing communications and non-essential cookies. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

Kenzototo does not sell, rent, or trade your Personal Data to any third party for commercial purposes. We may, however, share your data with the following categories of recipients in the circumstances described:

6.1 Payment Service Providers

Transaction data is shared with our approved payment processing partners — including DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, and cryptocurrency processors — strictly to the extent necessary to process your deposits and withdrawals. All payment partners are contractually bound to protect your data and are prohibited from using it for any other purpose.

6.2 Identity Verification Partners

KYC data (government-issued ID, selfie, proof of address) is processed through our trusted identity verification service provider. This partner operates under binding data processing agreements that restrict use of your data solely to the verification function.

6.3 Game and Software Providers

Some gaming data (such as session identifiers and bet histories) is shared with our game software providers — including live dealer and slot providers — for the purposes of game delivery, dispute resolution, and RNG certification. These providers are not permitted to use this data for independent marketing purposes.

6.4 Regulatory and Law Enforcement Authorities

Kenzototo may disclose Personal Data to competent regulatory bodies, law enforcement agencies, or other authorities where required to do so by applicable law, court order, or where we reasonably believe disclosure is necessary to prevent or investigate fraud, money laundering, or other unlawful activity.

6.5 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets involving Kenzototo, your Personal Data may form part of the transferred assets. We will provide reasonable advance notice of any such transfer and the applicable privacy protections that will apply to your data post-transfer.

Kenzototo retains your Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law or regulatory obligation. Our standard retention periods are as follows:

• Account and registration data: Retained for the duration of your active Account, plus a minimum of 5 years following account closure, in compliance with AML and gaming regulatory record-keeping requirements.
• KYC and identity documents: Retained for a minimum of 5 years following the last transaction on your Account, in line with applicable anti-money laundering obligations.
• Financial transaction records: Retained for a minimum of 7 years for audit and regulatory compliance purposes.
• Gaming history and session data: Retained for a minimum of 3 years following the relevant activity, for responsible gambling monitoring and dispute resolution purposes.
• Customer support records: Retained for 3 years following the closure of the relevant support case.
• Marketing consent records: Retained for the duration of your consent and for 2 years following withdrawal of consent, as evidence of the consent given and the decision to withdraw it.

Upon expiry of the applicable retention period, Personal Data will be securely deleted or anonymised in a manner that renders it irreversibly non-identifiable.

Kenzototo uses cookies and similar tracking technologies to enhance your experience on the Platform, maintain session continuity, and gather analytics data that helps us improve our services.

8.1 Types of Cookies We Use

8.2 Managing Your Cookie Preferences

You may manage or withdraw your consent for non-essential cookies at any time through your browser's cookie settings. Most modern browsers allow you to view, delete, and block cookies on a per-site basis. Note that disabling functional or analytics cookies may impair certain features of the Platform.

Kenzototo implements a multi-layered security framework to protect your Personal Data against unauthorised access, disclosure, alteration, and destruction. Our security measures include, but are not limited to:

• 256-bit SSL/TLS encryption on all data in transit between your device and our servers;
• AES-256 encryption for sensitive data stored in our databases;
• Two-factor authentication (2FA) available to all registered users for account login;
• Role-based access controls ensuring that only authorised personnel can access specific categories of personal data;
• Regular independent security audits and penetration testing by accredited third-party security firms;
• Automated fraud detection and anomaly monitoring systems that operate in real time;
• Secure, segmented server infrastructure with intrusion detection and firewall protection.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, Kenzototo will notify affected users promptly and take all reasonable steps to contain, investigate, and remediate the breach.

As a Kenzototo user, you hold the following rights with respect to your Personal Data. Requests to exercise any of these rights should be submitted to our support team and will be processed within 30 calendar days of receipt, unless the complexity of the request warrants a reasonable extension, of which you will be informed.

To exercise any of the above rights, please contact our support team via live chat or at support@kenzototo.cam with the subject line "Data Rights Request". We may require identity verification before processing your request to protect against unauthorised access.

Kenzototo's services are strictly intended for individuals aged 21 years and above. We do not knowingly collect, process, or store Personal Data from individuals under the age of 21. All registration processes include mandatory age declaration, and accounts are subject to KYC verification to confirm eligibility.

If we become aware that Personal Data has been collected from a person under the age of 21 without verifiable parental consent, we will take immediate steps to delete that data and close the associated account. If you believe that a minor may have registered on our Platform, please contact our support team immediately at support@kenzototo.cam.

As an internationally operating platform serving primarily Malaysian users, Kenzototo may transfer your Personal Data to servers and service providers located outside of Malaysia. Where such transfers occur, we ensure that appropriate safeguards are in place to protect your data, including:

• Binding contractual clauses with recipient entities requiring equivalent data protection standards;
• Transfers only to jurisdictions recognised as providing an adequate level of data protection;
• Technical safeguards including encryption of data both in transit and at rest, irrespective of storage location.

By using the Kenzototo Platform, you acknowledge and consent to the transfer of your Personal Data to such international locations under these protective conditions.

Kenzototo reserves the right to update or amend this Privacy Policy at any time. Where changes are material — such as those affecting the categories of data collected, the purposes of processing, or your rights — we will notify you by email to your registered address or by prominent in-platform notification, with at least 14 calendar days' advance notice before the changes take effect.

The current version of this Policy, along with the date of the most recent revision, is always available at kenzototo.cam/privacy-policy. Your continued use of the Platform following the effective date of any update constitutes your acceptance of the revised Policy. If you do not agree with an amendment, you must cease using the Platform and may close your Account in accordance with our Terms and Conditions.

If you have any questions, concerns, or requests regarding this Privacy Policy or the way Kenzototo handles your Personal Data, please contact our Data Privacy team through any of the following channels:

• Email: support@kenzototo.cam — please use subject line "Privacy Enquiry" or "Data Rights Request"
• Live Chat: Available 24 hours a day, 7 days a week, directly through the Kenzototo Platform
• Languages: Support available in English, Bahasa Melayu, and Chinese
• Response Time: We aim to acknowledge all privacy-related queries within 48 hours and resolve them within 30 calendar days

Kenzototo's support team serves players throughout Malaysia — including Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, and Shah Alam. All formal privacy and data-related correspondence will be handled with the strictest confidentiality by our dedicated data protection personnel.