Privacy Policy

This Privacy Policy ("Policy") describes how benihtoto ("the Platform", "we", "us", "our") — accessible at https://benihtoto.cam — collects, uses, stores, discloses, and otherwise processes the personal data of individuals who visit our website or register and use our services ("you", "User", "Player").

At benihtoto, we understand that your personal data is important to you. We are committed to processing it lawfully, fairly, and transparently. This Policy is designed to help you understand precisely what information we hold about you and how we use it, so you can make informed choices about your engagement with our platform.

By accessing the benihtoto platform, registering an account, making a deposit, or using any of our services, you acknowledge that you have read and understood this Privacy Policy. This Policy should be read alongside our Terms & Conditions, which govern the overall use of the platform.

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information that identifies or could reasonably be used to identify a natural person, including but not limited to name, identification number, contact details, financial account information, and device identifiers.
• "Processing" means any operation performed on personal data, including collection, recording, storage, retrieval, use, disclosure, and deletion.
• "Data Controller" means benihtoto, the entity that determines the purposes and means by which personal data is processed.
• "Data Processor" means any third party that processes personal data on behalf of benihtoto under a written data processing agreement.
• "Consent" means a freely given, specific, informed, and unambiguous indication of agreement to the processing of personal data.
• "KYC" means Know Your Customer — the mandatory identity verification process required before processing withdrawals.
• "Cookies" means small text files placed on your device by the platform to facilitate session management, security, and analytics.

benihtoto collects personal data through several channels, including direct input by you during registration, automated technical collection during platform use, and third-party verification sources. The categories of data collected are described below.

3.1 Data You Provide Directly

• Registration data: Full legal name, date of birth, email address, mobile number, and chosen username.
• Identity verification (KYC) data: Copies of your Malaysian NRIC (MyKad), passport, or other government-issued identification; proof of address documents (utility bills, bank statements); proof of payment method ownership.
• Financial data: Payment method details provided during deposit or withdrawal requests (e-wallet identifiers, bank account numbers, card details processed via payment gateway). Note: full card numbers are not stored by benihtoto — they are handled exclusively by our PCI-DSS compliant payment processors.
• Communications: Records of correspondence with our customer support team via live chat, email ([email protected]), or other channels.
• Responsible gambling preferences: Deposit limits, loss limits, self-exclusion requests, and other self-management settings you configure on your account.

3.2 Data Collected Automatically

• Technical data: IP address, device type and operating system, browser type and version, screen resolution, and language preferences.
• Usage data: Pages visited, features accessed, betting and gaming activity logs, session duration, and click patterns.
• Transaction data: A complete record of all deposits, withdrawals, bets placed, game sessions, bonus claims, and account balance changes.
• Cookie and tracking data: Session identifiers, authentication tokens, and analytics identifiers. See Section 9 for full cookie details.

3.3 Data from Third Parties

• Identity verification results from KYC/AML service providers.
• Fraud detection signals from third-party risk management services.
• Payment verification data from payment processors (Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, and card networks).

We process your personal data for the following specific purposes. The table below sets out each purpose alongside the corresponding type of data used and our legal basis for processing:

benihtoto relies on the following legal bases to process your personal data:

• Contractual Necessity: Processing required to fulfil our obligations to you under the Terms and Conditions — including account management, payment processing, and customer support.
• Legal Obligation: Processing required to comply with applicable laws, including KYC/AML regulations, regulatory reporting requirements, and responsible gambling obligations imposed by our licensing framework.
• Legitimate Interest: Processing carried out for our legitimate business interests — including fraud detection, security monitoring, platform analytics, and responsible gambling risk assessment — where these interests are not overridden by your rights and freedoms.
• Consent: Processing based on your explicit agreement, such as receiving promotional communications or accepting non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

benihtoto does not sell or rent your personal data. We share your personal data only in the following circumstances:

6.1 Service Providers (Data Processors)

We engage third-party service providers who process data on our behalf under strict contractual obligations. These include:

• Payment processors (including Touch 'n Go eWallet, DuitNow/FPX processors, Visa/Mastercard acquirers, and cryptocurrency processors).
• KYC and identity verification providers.
• AML screening and fraud detection services.
• Cloud hosting and data storage providers.
• Customer support platform providers.
• Platform analytics providers (receiving anonymised or aggregated data only).

6.2 Regulatory and Legal Disclosures

We may disclose your personal data to regulatory authorities, law enforcement bodies, or courts where required to do so by applicable law, a valid court order, or a legally binding regulatory request. We will notify you of such disclosure where permitted by law to do so.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of all or part of benihtoto's business, your personal data may be transferred to the successor entity, subject to equivalent privacy protections. We will notify affected users of any such transfer via the platform or registered email address.

benihtoto retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Account data and KYC records: Retained for a minimum of five (5) years following account closure, in accordance with AML regulatory requirements.
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction.
• Customer support communications: Retained for a minimum of two (2) years from the date of the last interaction.
• Marketing preferences and consent records: Retained until you withdraw consent or close your account, plus one (1) year for audit purposes.
• Technical/log data: Retained for a maximum of twelve (12) months, after which it is anonymised or deleted.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. We will not retain data in a form that identifies you beyond the required retention period without your explicit consent.

benihtoto implements a multi-layered approach to data security, incorporating the following technical and organisational measures:

• Encryption in transit: All data transmitted between your device and our servers is protected using TLS 1.2/1.3 with 256-bit encryption.
• Encryption at rest: Sensitive personal data stored in our databases is encrypted at rest using industry-standard algorithms.
• Access controls: Access to personal data is restricted on a strict need-to-know basis. All staff with access to player data are subject to background checks and confidentiality obligations.
• Two-factor authentication (2FA): Available and recommended for all player accounts to prevent unauthorised access.
• Regular security audits: Our platform undergoes periodic third-party security audits and penetration testing.
• Incident response: We maintain a documented data breach response procedure. In the event of a security incident affecting your data, we will notify you and relevant authorities in accordance with applicable law.

benihtoto uses cookies and similar tracking technologies on the platform. Cookies are small data files placed on your device that serve several important functions.

9.1 Types of Cookies Used

• Essential cookies: Required for core platform functionality — session management, authentication, and security. These cannot be disabled without impairing your ability to use the platform.
• Functional cookies: Remember your preferences such as language settings and responsible gambling limits set on your account.
• Analytics cookies: Collect anonymised data about how users interact with the platform, which pages are visited most, and where errors occur. This data is used solely to improve the platform experience.
• Security cookies: Support fraud detection, bot identification, and account integrity monitoring.

9.2 Managing Cookies

You may manage non-essential cookie preferences through your browser settings. Most modern browsers allow you to block, delete, or receive alerts about cookies. Disabling essential cookies may prevent you from accessing certain platform features or completing transactions.

benihtoto does not use third-party advertising cookies or behavioural targeting cookies to serve personalised advertisements to users on external websites.

Subject to applicable law and certain limited exceptions, you have the following rights with respect to your personal data held by benihtoto. To exercise any of these rights, contact our support team via live chat or email at [email protected].

We will respond to all verifiable data rights requests within 30 calendar days. Where requests are complex or numerous, we may extend this period by a further 30 days, with prior notice. Identity verification may be required before processing rights requests to protect against unauthorised disclosures.

The benihtoto platform is strictly intended for users who are 21 years of age or older. We do not knowingly collect personal data from individuals under the age of 21.

As part of our KYC process, all registered users are required to verify their age before withdrawal functionality is activated. Accounts identified as belonging to individuals under 21 will be closed immediately, with any real-money balance returned via the original deposit method and all gaming activity voided.

If you have reason to believe that a minor has accessed or registered on the benihtoto platform, please contact our support team immediately at [email protected] so we can take appropriate action.

The benihtoto platform may contain references to or integrations with third-party services, including payment processors such as Touch 'n Go eWallet, Boost, GrabPay, and banking systems including DuitNow, FPX, Maybank, CIMB, Public Bank, and Hong Leong Connect. When you interact with these services, you are subject to their respective privacy policies, which are separate from this Policy.

benihtoto is not responsible for the privacy practices or content of any third-party services. We encourage you to review the privacy policies of any third-party payment provider or service you use in connection with your benihtoto account.

As an internationally licensed platform, benihtoto may transfer your personal data to service providers and infrastructure located in jurisdictions outside Malaysia. Where such transfers occur, we take steps to ensure that appropriate safeguards are in place to protect your data, including:

• Contractual clauses that require recipient parties to apply data protection standards equivalent to those applied by benihtoto.
• Transfers only to jurisdictions with adequacy determinations, or where alternative safeguards are documented and enforceable.
• Technical measures including encryption of data in transit and at rest, regardless of the geographic location of processing.

benihtoto reserves the right to update or amend this Privacy Policy at any time. Material changes will be communicated to registered users via the platform notification system or by email to the address on record, at least seven (7) days prior to the effective date of the change.

The date at the top of this document reflects the most recent revision. We recommend reviewing this Policy periodically to stay informed of how we handle your personal data. Continued use of the platform after the effective date of any amendment constitutes your acceptance of the revised Policy.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by benihtoto, please contact our Data Protection team through the following channels:

• Live Chat: Available 24/7 on the benihtoto platform. Average response time under 5 minutes. Please mark your enquiry "Privacy / Data Request" for routing to the appropriate team.
• Email: [email protected] (plain text only — not a clickable link). Subject line: "Privacy Policy Enquiry" or "Data Rights Request".
• Supported Languages: English, Bahasa Melayu, Mandarin
• Response Time: Privacy and data rights requests are acknowledged within 5 business days and resolved within 30 calendar days.

Where your concern relates to the handling of a data breach, suspected unauthorised access, or any urgent security matter, please contact our support team immediately via live chat and mark the enquiry "URGENT — Security".