Section 1
Hiatoto respects the privacy of every visitor and registered player. This policy applies whenever an individual visits the Hiatoto website, creates or uses an account, contacts support, completes identity checks, deposits or withdraws MYR, accepts a promotion, or participates in casino and sports betting services.
In this policy, “personal data” means information that identifies an individual or can reasonably be linked to that individual. “Processing” includes collecting, recording, organising, storing, reviewing, using, sharing, correcting, and deleting personal data. Hiatoto processes such information in accordance with applicable privacy principles and operational requirements.
By using Hiatoto, you acknowledge the practices described here. This policy should be read together with the Hiatoto Terms & Conditions. If you do not agree with these practices, you should stop using the platform and contact support regarding any available account options.
Section 2
Hiatoto may collect information directly from you, automatically from your device, and from payment, identity verification, gaming, or technical service providers. The precise categories depend on whether you browse publicly, register an account, make a transaction, or request support.
Account and Identity Information
- Name, date of birth, username, password credentials, mobile number, email address, residential information, and preferred language.
- Identity documents, photographs, proof of address, payment ownership evidence, and verification results where checks are required.
- Records confirming whether a user satisfies the Hiatoto minimum age requirement of 21 years.
Financial and Transaction Information
- Deposit and withdrawal amounts, transaction references, dates, account balances, and payment status information.
- Limited details associated with Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, or Hong Leong transactions.
- Information used to review payment ownership, unusual activity, disputes, refunds, or chargebacks.
Gaming and Technical Information
- Games played, sports wagers, stakes, odds, results, promotion use, reward status, limits, and account preferences.
- IP address, browser type, operating system, device identifiers, screen settings, access times, referring pages, and diagnostic records.
- Messages, complaint records, live support transcripts, and other communications sent to Hiatoto.
Section 3
Most information is provided when a player registers with Hiatoto, updates account details, verifies identity, chooses a payment method, places a wager, claims a bonus, changes responsible gambling controls, or contacts customer support. Hiatoto asks users to provide accurate information and update it when circumstances change.
Technical data may be generated automatically as a browser or device communicates with Hiatoto systems. These records help deliver pages, maintain sessions, remember settings, diagnose faults, prevent automated abuse, and investigate security incidents. Similar technologies may store small identifiers or preferences on a device.
Hiatoto may also receive transaction confirmations from Malaysian banks, e-wallet services, and payment processors. Verification providers may confirm whether submitted information is valid without providing unnecessary underlying data. Game and sports providers may supply wager, result, settlement, and technical event records.
Section 4
Hiatoto processes personal data only where there is a defined operational, contractual, security, compliance, or service purpose. Depending on the circumstances, information may be used to:
- Create, authenticate, administer, and secure a Hiatoto account.
- Confirm identity, age, payment ownership, eligibility, and account details.
- Process MYR deposits, withdrawals, refunds, adjustments, and transaction enquiries.
- Record casino play, EPL or Liga Super Malaysia wagers, UFC bets, live football activity, results, and settlements.
- Apply bonuses, calculate VIP status, administer rewards, and detect promotion misuse.
- Identify fraud, collusion, duplicate accounts, suspicious transactions, cyberattacks, and unauthorised access.
- Respond to support requests, investigate complaints, and maintain service records.
- Apply deposit limits, time-outs, self-exclusion requests, and other responsible gambling measures.
- Test performance, correct faults, improve navigation, and understand how Hiatoto features are used.
- Deliver essential account, security, legal, payment, and policy communications.
Hiatoto does not sell personal data. Information is not used for unrelated purposes merely because it is available. Where a new purpose is materially different from the purpose originally communicated, Hiatoto will provide appropriate notice or seek consent where required.
Section 5
Depending on the activity and applicable requirements, Hiatoto may process information because it is necessary to provide requested account services, fulfil contractual obligations, comply with legal duties, protect legitimate operational interests, establish or defend claims, protect users, or act with valid consent.
Legitimate interests may include maintaining platform security, preventing fraud, improving services, resolving disputes, protecting payment integrity, and communicating relevant account information. Before relying on such interests, Hiatoto considers the nature of the information, the purpose of processing, and the reasonable expectations of affected players.
Where consent is the applicable basis, a user may withdraw that consent for future processing. Withdrawal does not invalidate processing already undertaken lawfully and may not prevent Hiatoto from retaining information required for security, dispute, transaction, or legal purposes.
Section 6
Hiatoto may use essential cookies and comparable technologies to keep users signed in, protect sessions, balance traffic, remember language or display preferences, and enable requested account functions. Blocking essential technologies can prevent parts of Hiatoto from operating correctly.
Performance information may be used to understand page loading times, device compatibility, navigation problems, and feature reliability. Security identifiers may assist with recognising unusual login patterns or repeated attempts to bypass account controls. Hiatoto limits these technologies to relevant platform purposes.
Browser controls may allow users to delete or restrict stored identifiers. The available settings differ by browser and device. Removing them may sign a user out, reset preferences, or require repeated verification when accessing Hiatoto.
Section 7
Hiatoto may share limited personal data with organisations that support platform operation. These may include hosting and cybersecurity providers, payment processors, banks, e-wallet operators, identity verification services, game providers, sports data suppliers, customer support systems, professional advisers, and fraud prevention specialists.
A provider should receive only information reasonably needed to perform its assigned function. Hiatoto expects providers handling personal data to apply appropriate confidentiality, access, and security measures. Providers are not authorised to use Hiatoto player data for unrelated independent marketing.
Hiatoto may also disclose information when reasonably necessary to respond to lawful authority requests, protect legal rights, investigate suspected wrongdoing, enforce platform terms, prevent harm, or support a corporate reorganisation. Any disclosure is assessed according to the circumstances and applicable obligations.
Section 8
Some technical, payment, verification, support, or gaming providers may process information outside Malaysia. Privacy standards and legal procedures can differ between jurisdictions. Where cross-border processing occurs, Hiatoto takes reasonable steps to select suitable providers and apply contractual, organisational, or technical safeguards.
Cross-border processing does not change the purposes described in this policy. Hiatoto remains committed to using personal data only for legitimate platform functions, account protection, transaction processing, service delivery, and compliance requirements.
Section 9
Hiatoto uses layered security controls designed to protect personal data against unauthorised access, accidental loss, misuse, alteration, and improper disclosure. Measures may include encrypted connections, restricted access, authentication controls, monitoring, logging, backups, staff procedures, and service provider reviews.
No internet service can guarantee absolute security. Players also have an important role. Hiatoto users should create a strong unique password, protect one-time codes, secure their devices, avoid shared logins, and report suspicious activity promptly. Account credentials should never be disclosed to another person.
If Hiatoto identifies a security incident involving personal data, the platform will investigate, contain the issue where possible, preserve relevant records, and provide notices when required or reasonably appropriate.
Section 10
Hiatoto retains personal data for as long as reasonably required to operate an active account and fulfil the purposes described in this policy. Some records may remain after account closure where necessary for payment reconciliation, fraud prevention, responsible gambling enforcement, complaint handling, legal claims, security investigations, or applicable record-keeping duties.
Retention periods vary according to data type, sensitivity, transaction history, legal significance, and operational risk. When information is no longer required, Hiatoto may securely delete it, anonymise it, or restrict further use. Anonymised statistical data that no longer identifies a player may be retained for platform analysis.
A deletion request does not always result in immediate removal of every record. Hiatoto may retain information needed to prevent a self-excluded person from reopening an account, resolve an outstanding MYR transaction, investigate misconduct, or meet a binding obligation.
Section 11
Subject to applicable law and verification, a Hiatoto player may request access to personal data, correction of inaccurate information, deletion of eligible data, restriction of certain processing, or information about how data is used. A player may also object to particular processing or withdraw consent where consent applies.
Hiatoto may request sufficient information to confirm the identity of the person making a request. This protects account data from unauthorised disclosure. A request may be limited or refused where it is manifestly unreasonable, affects another person’s rights, conflicts with security needs, or concerns records that Hiatoto must retain.
Hiatoto will review valid privacy requests within a reasonable period. Complex or extensive requests may require additional time, and support may ask for clarification to identify the relevant account, communication, or transaction records.
Section 12
Hiatoto may send essential communications about login security, identity checks, payment status, account changes, responsible gambling controls, policy updates, and service interruptions. These operational messages are necessary to maintain and protect an active account.
Promotional messages may relate to Hiatoto games, sports markets, bonuses, or rewards. Where preference controls are available, players may change promotional choices. Opting out of promotional communication does not prevent essential service or security messages.
Hiatoto does not intentionally direct casino promotions to persons under 21 or to players subject to an active self-exclusion. Users should inform support if they receive promotional material that appears inconsistent with their account restriction.
Section 13
Hiatoto services are intended only for persons aged 21 and above. Age information and verification records may be processed to enforce this restriction. If Hiatoto reasonably suspects that an account belongs to an underage person, access may be suspended while verification is completed.
Responsible gambling information can be sensitive. Hiatoto may process limit settings, time-outs, self-exclusion status, support messages, and relevant account activity to apply player protection controls. Access is restricted to personnel and providers who reasonably require the information for their duties.
Further information about deposit limits, account breaks, self-exclusion, and support options is available on the Responsible Gambling page.
Section 14
Hiatoto may update this Privacy Policy to reflect changes in services, security controls, providers, operational practices, or applicable requirements. The effective date shown at the top of the page indicates when the current version applies.
Material changes may also be communicated through an account notice or another appropriate channel. Continued use of Hiatoto after an update means that the revised notice has been made available, but consent will be requested separately where legally required.
Section 15
Questions, complaints, correction requests, or privacy rights enquiries may be directed to Hiatoto support. To help the team locate relevant records, include your registered username, a clear description of the request, and any useful transaction or communication reference.
The Hiatoto contact email is displayed as plain text: [email protected]. Do not include passwords, one-time codes, or unnecessary payment credentials in your message. Hiatoto may request identity confirmation before discussing account-specific personal data.
General account guidance is also available through the FAQ. Privacy enquiries are reviewed separately from ordinary promotional or game questions where specialist assessment is appropriate.