Privacy Policy — Popotogel

Introduction

This Privacy Policy ("Policy") is issued by Popotogel ("the Company", "we", "our", "us") and applies to all users ("User", "you", "your") of the Popotogel platform accessible at popotogel.cam and any related services, features, or communications (collectively, "the Platform").

Popotogel takes the privacy and security of your personal data seriously. We operate an online casino and sports betting platform that serves Malaysian users and players in other permitted jurisdictions. In the course of providing our services, we necessarily collect and process certain personal information. This Policy explains what that information is, how it is used, how long it is retained, and what rights you have in relation to it.

This Policy should be read in conjunction with our Terms & Conditions. By registering an account, making a deposit, or otherwise using the Platform, you acknowledge that you have read and understood this Policy and consent to the data practices described herein.

Definitions

For the purposes of this Policy, the following terms shall have the meanings assigned to them below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial information, and online identifiers.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, transmission, erasure, or destruction.
• "Data Controller" means the Company, which determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Processor" means any third party that processes Personal Data on behalf of the Company under a data processing agreement.
• "KYC Data" means identity verification documentation submitted by a User in fulfilment of Know Your Customer requirements, including government-issued identity documents and proof of address.
• "Cookies" means small text files placed on your device by the Platform to enable functionality, remember preferences, and gather analytics data.
• "Sensitive Personal Data" means Personal Data revealing racial or ethnic origin, religious beliefs, health information, financial account details, or biometric data, which is subject to heightened protection under this Policy.

Data We Collect

We collect the following categories of Personal Data in connection with the provision of our services:

3.1 Identity & Registration Data

• Full legal name as it appears on your government-issued identity document.
• Date of birth (used to verify the 21+ age eligibility requirement).
• Nationality and country of residence.
• Username and encrypted password for your Account.

3.2 Contact Data

• Email address registered to your Account.
• Mobile telephone number.
• Residential or mailing address (including city — e.g., Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru).

3.3 KYC Verification Data

• Copy of government-issued identity document (e.g., Malaysian MyKad, passport).
• Proof of address documentation (e.g., utility bill, bank statement dated within three months).
• Where required, verification documentation for payment methods used (e.g., screenshot of e-wallet account to confirm ownership).

3.4 Financial & Transaction Data

• Details of deposits and withdrawals, including payment method used (Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, bank transfer, or cryptocurrency), transaction amounts in MYR, and transaction timestamps.
• Partial payment instrument identifiers (e.g., last four digits of a bank account number or e-wallet number) retained for fraud prevention and withdrawal matching purposes.
• Betting and gaming transaction history, including wagers placed, outcomes, and resulting account balance movements.

3.5 Technical & Usage Data

• IP address and approximate geolocation data.
• Device type, operating system, browser type and version.
• Session timestamps, pages visited, and features used within the Platform.
• Referral source data (how you arrived at the Platform).

3.6 Communications Data

• Records of your communications with our support team via live chat, email, or WhatsApp.
• Feedback, complaints, and dispute correspondence.
• Marketing preference settings (opt-in / opt-out records).

How We Collect Your Data

We collect Personal Data through the following mechanisms:

• Direct collection: Data you provide voluntarily when registering an Account, completing KYC, making deposits or withdrawal requests, contacting support, or participating in promotions.
• Automated collection: Data gathered automatically when you access the Platform, including via Cookies, web beacons, server logs, and similar tracking technologies.
• Third-party payment providers: Transaction confirmation data received from payment processors (e.g., Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, or bank transfer systems) in order to verify and reconcile deposits and withdrawals.
• KYC and fraud prevention partners: In certain cases, we may receive identity verification confirmation or fraud risk signals from third-party KYC service providers engaged by the Company.
• Publicly available sources: We may supplement your information with data from publicly available databases where necessary for compliance or fraud prevention purposes.

Purpose & Legal Basis for Processing

The table below summarises the primary purposes for which we process your Personal Data and the legal basis applicable to each processing activity:

Data Processing Activities

6.1 Account Management

Personal Data collected at registration is used to create and administer your Account, verify your identity, process your transactions, and maintain your Account history. This processing is necessary to deliver the services you have requested from Popotogel and is carried out as a matter of contractual necessity.

6.2 KYC & Compliance Processing

KYC documentation is processed to verify your identity and age, comply with anti-money laundering (AML) obligations, and ensure that the Platform is not used for financial crime. This processing is mandatory — without completing KYC, withdrawal requests cannot be processed. KYC data is handled by trained personnel under strict confidentiality protocols and is not used for any purpose beyond compliance verification.

6.3 Transaction Processing

Financial transaction data is processed to execute deposits and withdrawals in MYR via your chosen payment method (Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, or bank transfer), to record your betting and gaming activity, and to calculate any applicable bonuses, cashback, or loyalty rewards. Transaction records are retained for the periods described in Section 8 of this Policy.

6.4 Responsible Gambling Monitoring

We analyse your account activity, deposit patterns, and gaming behaviour to identify potential signs of problem gambling. Where indicators are detected, our responsible gambling team may proactively reach out to offer support resources, apply temporary limits, or — where we consider it necessary — initiate protective measures on your Account. This processing is conducted in your interests and in accordance with our responsible gambling obligations.

6.5 Marketing Communications

Where you have opted in to receive promotional communications from Popotogel, we will use your contact details and platform usage data to send you relevant offers, bonus notifications, and promotional updates. You may opt out of marketing communications at any time. Opting out will not affect transactional communications (e.g., deposit confirmations, withdrawal notifications, security alerts).

Data Sharing & Disclosure

Popotogel does not sell, rent, or trade your Personal Data with third parties for commercial purposes. We may, however, share your data in the following limited circumstances:

• Payment processors: We share the minimum necessary data with payment service providers (e.g., Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and bank partners) to execute your financial transactions.
• KYC and identity verification services: Identity documents may be shared with accredited third-party identity verification providers engaged by the Company solely for the purpose of fulfilling our KYC obligations.
• Fraud prevention and security partners: We may share technical and transaction data with fraud detection services to protect the Platform and its users from financial crime.
• Legal and regulatory obligations: We may disclose Personal Data to law enforcement, regulatory authorities, or courts where required to do so by applicable law, court order, or in response to a lawful request from a competent authority.
• IT infrastructure and hosting providers: Our Platform infrastructure partners process data on our behalf as Data Processors, subject to data processing agreements that bind them to the same data protection standards as described in this Policy.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of the Company's assets, your Personal Data may be transferred to the relevant successor entity. We will provide reasonable notice of any such transfer.

Data Retention

We retain Personal Data only for as long as is necessary for the purposes described in this Policy, or as required by applicable law. Our general retention guidelines are as follows:

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in accordance with our data disposal procedures. Where data is anonymised rather than deleted, the anonymised data may be retained indefinitely for statistical and analytical purposes.

Cookies & Tracking Technologies

9.1 What Are Cookies?

Cookies are small text files placed on your device when you visit the Platform. They allow the Platform to recognise your device, remember your preferences, maintain your session, and gather anonymised usage statistics. Cookies do not contain executable code and cannot access other files on your device.

9.2 Types of Cookies We Use

• Essential Cookies: Required for the Platform to function correctly. They manage your login session, maintain your Account authentication state, and enable core transaction functionality. These cookies cannot be disabled without impairing Platform functionality.
• Analytics Cookies: Used to collect anonymised information about how users interact with the Platform — pages visited, session duration, errors encountered. This data helps us improve the Platform experience for all Malaysian users.
• Functional Cookies: Remember your preferences such as language settings, display preferences, and session timeouts to deliver a more personalised experience.
• Security Cookies: Assist in fraud detection and security monitoring by identifying unusual access patterns or device anomalies.

9.3 Managing Cookies

You may configure your browser to refuse or delete cookies at any time. Note that disabling essential cookies will impair the functionality of the Platform and may prevent you from logging in or completing transactions. Instructions for managing cookies are available in your browser's settings menu.

Your Data Rights

Subject to applicable law and our legal obligations (including KYC and AML retention requirements), you have the following rights in relation to your Personal Data held by Popotogel:

Children's Privacy & Age Verification

The Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect or process Personal Data from individuals under the age of 21. Age verification is a mandatory step in the KYC process, and we take all reasonable steps to ensure that minors cannot access the Platform.

If we become aware that Personal Data has been collected from a person under the age of 21 without verifiable parental consent, we will take immediate steps to delete that data and close the associated Account. If you are a parent or guardian and believe that a minor in your care has registered an Account, please contact us immediately via the support channels listed in Section 15.

Security Measures

The Company implements a comprehensive suite of technical and organisational security measures to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction. Our security measures include, but are not limited to:

• 256-bit SSL/TLS encryption for all data transmitted between your device and our servers.
• Encrypted data storage for all sensitive Personal Data at rest, including KYC documents and financial records.
• Two-factor authentication (2FA) available for all Accounts to prevent unauthorised login.
• Role-based access controls ensuring that only authorised personnel can access Personal Data, limited to the minimum necessary for their role.
• Regular security audits and penetration testing of Platform infrastructure.
• Incident response procedures — in the event of a data breach that may affect your rights, we will notify affected users in accordance with applicable notification requirements.

Notwithstanding the above, no data transmission over the internet or storage system can be guaranteed as 100% secure. You use the Platform at your own risk and are responsible for keeping your Account credentials confidential.

International Data Transfers

As an international online gaming platform serving Malaysian users, the operation of the Platform may involve the transfer of Personal Data to servers or service providers located outside of Malaysia. Where such transfers occur, we take appropriate steps to ensure that your Personal Data receives an adequate level of protection, consistent with the principles set out in this Policy.

Such steps may include the use of standard contractual clauses with data processors, ensuring that recipients of data are bound by equivalent data protection obligations, and selecting service providers in jurisdictions that maintain adequate data protection frameworks.

Amendments to This Policy

We reserve the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or platform features. Where changes are material, we will provide reasonable advance notice by posting a prominent notice on the Platform or by sending an email to your registered address.

Your continued use of the Platform following the effective date of any revised Policy constitutes your acceptance of the updated terms. We encourage you to review this page periodically to stay informed of our current data practices. The "Effective Date" at the top of the sidebar indicates when this Policy was last updated.

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data by Popotogel, please contact us through the channels below. All privacy-related enquiries will be acknowledged within 5 business days and substantively resolved within 30 calendar days.

This Policy was last reviewed and updated on 1 January 2026. In the event of any inconsistency between this English version and any translated version, the English version shall prevail in all respects.