At ikontoto, we take your privacy seriously. This Policy explains exactly what personal data we collect, why we collect it, how we use and protect it, and the rights available to you as a player. We are committed to handling your information with care, transparency, and in accordance with applicable data protection principles.
This Privacy Policy ("Policy") describes how ikontoto ("we", "us", "our", "the Platform"), the operator of the online gaming platform accessible at ikontoto.cam, collects, uses, stores, discloses, and otherwise processes personal data relating to you ("you", "the Player", "User") when you visit our website, register an account, make transactions, or otherwise interact with our services.
ikontoto is committed to protecting the privacy and security of your personal data. We process personal data in accordance with applicable international data protection principles, including those set out in relevant data protection frameworks governing our licensing jurisdiction. While Malaysia has its own data protection legislation under the Personal Data Protection Act 2010 (PDPA), Malaysian-resident Players are advised that ikontoto operates as an internationally licensed platform, and data processing is governed primarily by the data protection obligations of our licensing jurisdiction.
By registering an account on ikontoto, depositing funds, or otherwise using our services, you acknowledge that you have read and understood this Policy and consent to the collection and use of your personal data as described herein. If you do not agree to this Policy, you should not register or continue using the Platform.
This Policy should be read alongside our Terms & Conditions and Responsible Gambling Policy, which are incorporated by reference.
This Policy applies to all personal data processed by ikontoto in connection with the use of our Platform, whether accessed via web browser or mobile device. It does not apply to third-party websites or services to which we may link.
The following definitions apply throughout this Privacy Policy:
ikontoto collects personal data from you directly (when you provide it during registration, KYC, or support interactions), automatically (via cookies and technical systems), and in some cases from third parties (such as payment processors and fraud detection services). The categories of personal data we collect include:
| Category | Examples | Source |
|---|---|---|
| Identity Data | Full name, date of birth, nationality, government ID number (MyKad, Passport, Driver's Licence) | You, KYC verification |
| Contact Data | Email address, mobile phone number, residential address (city, state, postcode) | You |
| Account Data | Username, encrypted password, account creation date, account status, communication preferences | You, system |
| KYC Documents | Photographs of government-issued ID, proof of address documents, selfie images | You |
| Financial Data | Payment method type, masked account/wallet identifiers, deposit and withdrawal amounts, transaction timestamps | You, payment processors (Maybank, CIMB, Touch 'n Go, DuitNow, FPX, etc.) |
| Gaming Activity | Games played, wagers placed, bet history, session duration, bonus participation history, win/loss records | Platform system |
| Technical Data | IP address, device type, browser, operating system, session tokens, access logs | Automated collection |
| Communications | Live chat transcripts, email correspondence, support ticket content | You |
| Marketing Preferences | Opt-in/opt-out status for promotional communications, preferred contact channel | You |
We do not collect or store full payment card numbers. All payment transactions are processed by our payment partners, who are independently responsible for the security of cardholder and financial account data.
We process your personal data for the following purposes. Each processing activity is linked to a lawful basis as described in Section 5 below:
Where data protection law requires a lawful basis for the processing of personal data, ikontoto relies on the following bases:
ikontoto does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share personal data only in the following limited circumstances:
We will never sell your personal data to third-party advertisers, data brokers, or marketing companies. Any service provider that processes data on our behalf is bound by contractual obligations consistent with this Policy.
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligations. The following general retention periods apply:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account & Identity Data | Duration of account + 5 years post-closure | AML regulatory requirement |
| KYC Documents | Duration of account + 5 years post-closure | Licensing & AML obligation |
| Transaction Records | Duration of account + 7 years post-closure | Financial record-keeping requirement |
| Gaming Activity Logs | Duration of account + 3 years post-closure | Responsible gambling monitoring, dispute resolution |
| Support Communications | 3 years from last interaction | Quality assurance, legal defence |
| Marketing Data (opted-in) | Until opt-out + 1 year | Consent-based; ceases on withdrawal of consent |
| Technical / Log Data | 12 months | Security monitoring |
Upon expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be attributed to an identifiable individual. Where data is anonymised and retained for statistical purposes, it is no longer considered personal data under applicable data protection law.
ikontoto implements a comprehensive suite of technical and organisational security measures designed to protect your personal data from unauthorised access, disclosure, alteration, loss, or destruction. Our security infrastructure includes:
While we implement robust security measures, no internet-based service can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for notifying us immediately at [email protected] if you suspect any unauthorised access to your account.
ikontoto uses cookies and similar tracking technologies (such as web beacons, pixels, and local storage objects) on the Platform. Cookies are small data files placed on your device that help us deliver a functional and personalised experience. The categories of cookies we use are as follows:
You can manage cookie preferences through your browser settings. Please note that disabling certain categories of cookies may affect the functionality of the Platform. For detailed instructions on managing cookies in popular browsers, refer to your browser's help documentation.
Subject to applicable data protection law and our legal and regulatory obligations, you have the following rights in respect of your personal data held by ikontoto. To exercise any of these rights, please contact our Data Protection team at [email protected] with the subject line "Data Rights Request":
Request a copy of all personal data we hold about you (a Subject Access Request). We will respond within 30 days of receipt.
Request correction of inaccurate or incomplete personal data. Minor corrections (e.g., email address) can be made directly in Account Settings.
Request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
Request that we restrict processing of your data while a rectification or objection request is being assessed.
Object to processing carried out on the basis of legitimate interests, including direct marketing. Marketing opt-outs take effect immediately.
Request a structured, commonly used, machine-readable copy of personal data you have provided to us, where processing is based on consent or contract.
Withdraw consent for any processing based on consent (such as marketing) at any time, without affecting prior lawful processing.
Lodge a complaint with a competent data protection supervisory authority if you believe your rights have been infringed.
Please note that some rights are subject to limitations. For example, we cannot delete data that we are legally required to retain for AML or licensing compliance purposes. Where a request cannot be fully complied with, we will explain the reason in our response.
ikontoto's services are strictly intended for individuals who are 21 years of age or older. We do not knowingly collect personal data from, or offer services to, any person under the age of 21.
All account registrations are subject to mandatory age verification as part of our KYC process. Where we become aware or have reasonable grounds to suspect that personal data has been collected from an individual under the age of 21, we will:
Parental Advisory: If you believe that a minor in your household may have accessed or registered on the Platform, please contact us immediately at [email protected]. We will prioritise all such reports and take immediate action to safeguard the minor's data and close any affected account.
As an internationally operated online gaming platform, ikontoto may transfer your personal data to countries other than your country of residence for processing and storage. This may include transfers to our cloud infrastructure providers, KYC partners, payment processing networks, and game studio providers, which may be located in various jurisdictions.
Where personal data is transferred internationally, we take steps to ensure that appropriate safeguards are in place to protect your data to a standard consistent with applicable data protection requirements. Such safeguards may include:
For Malaysian-resident Players, your data will be processed in accordance with the principles of this Policy regardless of the jurisdiction in which processing occurs.
The ikontoto Platform may contain links to third-party websites or may integrate third-party services (such as payment gateways for Maybank, CIMB, Touch 'n Go eWallet, GrabPay, Boost, DuitNow, and FPX). These third-party services operate under their own privacy policies and terms of use, which are independent of this Policy.
We are not responsible for the privacy practices of third-party websites or service providers. Once you navigate away from the ikontoto Platform to a third-party site, or interact directly with a third-party payment interface, this Policy no longer applies. We encourage you to review the privacy policies of any third-party service you use in connection with your ikontoto account.
We reserve the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory requirements, or Platform functionality. When material changes are made, we will notify registered Players by:
Your continued use of the Platform following the effective date of any updated Policy constitutes your acceptance of the revised terms. If you do not agree to the changes, you should cease using the Platform and may request account closure in accordance with the Terms & Conditions.
If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data by ikontoto, please contact our Data Protection team using the following channels:
We will acknowledge your privacy-related request within 72 hours of receipt and will endeavour to respond fully within 30 calendar days, in accordance with applicable data protection standards. Complex requests may require additional time, in which case we will inform you of the extended timeline.
The core principles that underpin how ikontoto handles your personal data — built on transparency, security, and respect.
All data transmitted between your device and our servers is protected by bank-grade TLS 1.3 encryption. Your personal information and financial data are secured at every point of transit.
ikontoto does not sell, rent, or trade your personal data to third-party advertisers or data brokers — ever. Your data is used solely to deliver and improve our services to you.
Access, rectification, erasure, portability, and objection rights are available to all Players. Submit a data rights request via live chat or email and we'll respond within 30 days.
Access to your personal data within our organisation is restricted to staff with a legitimate operational need. Role-based access control and multi-factor authentication are enforced across all systems.
We retain your data only for as long as necessary to fulfil its original purpose or satisfy regulatory obligations. Data that is no longer needed is securely deleted or anonymised.
In the unlikely event of a data breach affecting your rights, our breach response procedures ensure timely notification to affected individuals and relevant authorities within legally required timeframes.
Our team is here to help with any privacy-related questions, data access requests, or concerns. Reach us via live chat 24/7, or visit our FAQ for quick answers to the most common questions from Malaysian players.
🔞 For players aged 21 and above only. Gambling involves financial risk — please play responsibly.