Pajerototo Privacy Policy

This Privacy Policy ("Policy") is issued by Pajerototo ("we", "us", "the Operator", "the Platform") and governs the collection, storage, processing, and disclosure of personal data in connection with your use of the Pajerototo website at pajerototo.cam and all associated services (collectively, the "Services").

Pajerototo operates under an international gaming licence and is committed to processing personal data in a manner that is lawful, transparent, and proportionate. This Policy reflects our obligations under applicable international data protection frameworks, including the principles enshrined in the General Data Protection Regulation (GDPR) as a baseline standard, as well as the Personal Data Protection Act 2010 (PDPA) of Malaysia, which governs the processing of personal data of Malaysian data subjects.

By registering an account, using any feature of the Pajerototo platform, or submitting personal information to us through any channel, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not consent to any aspect of this Policy, you should refrain from using the Services and contact us to request account closure.

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

• "Personal Data" means any information that identifies or could identify a natural person, including name, email address, contact number, date of birth, financial information, and device identifiers;
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, transfer, and deletion;
• "Data Controller" means Pajerototo, the entity that determines the purposes and means of processing personal data collected through this platform;
• "Data Processor" means a third party that processes personal data on behalf of Pajerototo under a data processing agreement, such as a payment gateway or identity verification provider;
• "Data Subject" means any natural person whose personal data is processed by Pajerototo — primarily registered users of the platform;
• "Sensitive Data" means personal data that requires heightened protection due to its nature, including identity document data, financial records, and KYC verification materials;
• "Cookie" means a small data file placed on a user's device by a website, used to store session information, preferences, and analytical data.

Pajerototo collects personal data across several categories depending on your interaction with the platform. The following table sets out the categories of personal data we process:

We do not collect special category personal data (as defined under applicable data protection law) unless it is strictly required by our licensing obligations — for example, information relating to self-exclusion status, which is treated as sensitive welfare data.

Pajerototo collects personal data through the following channels and mechanisms:

• Direct submission: Data you provide when creating an account, completing KYC verification, submitting support requests, or updating your account profile;
• Automated technical collection: Data collected passively as you interact with the platform, including IP addresses, device fingerprints, browser data, and session activity logs;
• Payment processing: Transaction data generated when you deposit or withdraw funds via payment methods such as Touch 'n Go eWallet, DuitNow, FPX, Maybank, CIMB, or other supported Malaysian payment channels;
• Third-party verification services: Identity and age verification data supplied by independent KYC verification providers used to confirm your identity in accordance with our licensing obligations;
• Cookies and similar technologies: As described in Section 10 of this Policy, we use cookies and related technologies to collect session data, remember preferences, and support analytics and fraud prevention functions.

Pajerototo processes personal data for the following defined purposes. We do not process data for any purpose that is not identified in this section without first obtaining your consent or establishing an alternative lawful basis:

1. Account creation and management: Processing registration data to establish and maintain your Pajerototo account, including managing account settings, preferences, and security;
2. Identity and age verification (KYC): Verifying that you meet the 21+ age requirement and confirming your identity as required by our international gaming licence and anti-money laundering (AML) obligations;
3. Transaction processing: Facilitating deposits and withdrawals in MYR through supported payment methods including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and direct bank transfers;
4. Fraud prevention and security: Monitoring account activity to detect and prevent fraudulent transactions, money laundering, account sharing, and other prohibited conduct;
5. Regulatory compliance: Meeting our obligations under our gaming licence, including record-keeping, suspicious activity reporting, and cooperation with lawful regulatory requests;
6. Customer support: Responding to account queries, resolving disputes, and managing complaints submitted via Live Chat, WhatsApp, or email;
7. Platform improvement: Analysing aggregated and anonymised usage data to improve the performance, features, and user experience of the Pajerototo platform;
8. Responsible gambling: Using account activity data to identify potential problem gambling behaviour, enforce self-exclusion requests, and apply deposit or loss limit controls;
9. Marketing communications: Where you have provided express consent, sending promotional communications about bonuses, offers, and platform updates. You may withdraw consent at any time by contacting support or using the unsubscribe mechanism in any marketing email.

Under applicable data protection law, each processing activity must be supported by a lawful basis. The legal bases upon which Pajerototo processes your personal data are as follows:

• Contractual necessity: Processing required to fulfil our contractual obligations to you as a registered user — including account management, transaction processing, and customer support;
• Legal obligation: Processing required to comply with our licensing obligations, anti-money laundering regulations, and any lawfully issued regulatory or court directive;
• Legitimate interests: Processing carried out for fraud prevention, platform security, responsible gambling monitoring, and aggregate analytics where these interests are not outweighed by your fundamental rights and freedoms;
• Consent: Processing for which you have provided a clear, specific, and freely given consent — primarily marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing conducted prior to withdrawal.

Pajerototo does not sell, lease, or commercially transfer your personal data to any third party. Data is shared with external parties only in the following limited and controlled circumstances:

• Payment processors: Transaction data is shared with payment service providers necessary to process your deposits and withdrawals in MYR — including operators of Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and the respective interbank gateway operators for Maybank, CIMB, Public Bank, Hong Leong, and RHB. These parties act as data processors under binding contractual terms;
• KYC and identity verification providers: Identity document data and verification selfies may be processed by independent KYC service providers operating under data processing agreements with Pajerototo, solely for the purpose of verifying your eligibility to use the platform;
• Fraud prevention and AML services: Technical data including IP addresses and device identifiers may be processed by specialist fraud prevention and anti-money laundering platforms to detect and prevent illicit activity;
• Regulatory and law enforcement authorities: Where required by a lawfully issued court order, regulatory directive, or compulsory legal process, Pajerototo may disclose personal data to the relevant authority. We will notify you of such disclosure to the extent permitted by law;
• Group companies and service partners: Personal data may be shared within the Pajerototo corporate group or with technical service providers (such as cloud infrastructure providers) strictly on a need-to-know basis and under binding confidentiality and data protection agreements.

Given the international nature of Pajerototo's licensing and operational infrastructure, your personal data may be transferred to, stored in, and processed in countries outside of Malaysia. Where such transfers occur, Pajerototo ensures that appropriate safeguards are in place to protect your data to a standard equivalent to the protections afforded under the Malaysian Personal Data Protection Act 2010.

Safeguards applicable to international transfers include: contractual data transfer agreements incorporating standard data protection clauses; transfers only to jurisdictions recognised by applicable regulatory frameworks as providing adequate data protection standards; and technical and organisational security measures applied consistently across all processing locations.

If you require further information about the specific safeguards applicable to any international transfer of your personal data, please contact us using the details set out in Section 15 of this Policy.

Pajerototo retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by our licensing obligations, applicable laws, and legitimate business needs. The following retention parameters apply:

• Account and identity data: Retained for the duration of your account's active status, plus a minimum period of five (5) years following account closure to satisfy our AML record-keeping obligations;
• Financial and transaction records: Retained for a minimum of seven (7) years from the date of the transaction, as required for financial record-keeping and regulatory audit purposes;
• Customer support communications: Retained for up to three (3) years following the resolution of the relevant support interaction, or longer if related to an ongoing dispute or legal proceeding;
• Technical and device data: Retained for up to twelve (12) months from the date of collection unless required longer for ongoing fraud investigation purposes;
• Marketing consent records: Retained for as long as you maintain an active marketing preference, and for up to two (2) years following withdrawal of consent to evidence compliance.

Upon expiry of applicable retention periods, personal data is securely deleted or anonymised in accordance with Pajerototo's internal data disposal procedures.

The Pajerototo platform uses cookies and similar tracking technologies to ensure the correct functioning of the platform, improve your user experience, and support fraud prevention and analytics functions. By accessing the platform, you consent to the placement of cookies in accordance with this Policy.

The categories of cookies used by Pajerototo are as follows:

• Strictly Necessary Cookies: Essential to the operation of the platform — including session management, login state, and security tokens. These cookies cannot be disabled without impairing core platform functionality;
• Functional Cookies: Used to remember your preferences such as language settings, display preferences, and account customisations. Disabling these cookies may reduce the personalisation of your platform experience;
• Analytics Cookies: Used to collect anonymised data about how users interact with the platform — including page views, session duration, and navigation paths — to support platform improvement. These are processed on an aggregated, non-identifiable basis;
• Fraud Prevention Cookies: Used to detect unusual or potentially fraudulent activity by correlating device and session data across interactions. These are necessary for platform security and cannot be disabled.

Pajerototo implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security framework includes:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Pajerototo platform;
• Encryption of sensitive data at rest, including identity documents and financial records stored within our systems;
• Role-based access controls ensuring that internal staff may only access personal data to the extent strictly necessary for their job function;
• Regular penetration testing and vulnerability assessments conducted by independent security specialists;
• Intrusion detection and monitoring systems operating continuously across our platform infrastructure;
• Formal incident response procedures, including a defined process for notifying affected users in the event of a personal data breach that is likely to result in a risk to their rights and freedoms.

While Pajerototo employs industry-standard security practices, no data transmission over the internet or electronic storage system can be guaranteed to be 100% secure. Users are advised to protect their own account credentials and to contact our support team immediately if they suspect any unauthorised access to their account.

As a data subject, you have the following rights in relation to your personal data held by Pajerototo. To exercise any of these rights, please contact us using the details in Section 15. We will respond to all verified data subject requests within thirty (30) calendar days.

To submit a data subject request, please contact our support team via Live Chat or email at [email protected] (plain text — not a clickable link) with the subject line "Data Subject Request". We may ask you to verify your identity before processing your request.

The Pajerototo platform is strictly for individuals aged 21 and above. We do not knowingly collect or process personal data from individuals under the age of 21. Where we become aware that personal data has been submitted by a person under the minimum age requirement, we will take immediate steps to delete that data and terminate the associated account.

Our KYC verification process is specifically designed to identify and reject underage registrations. If you believe that a minor has accessed or registered an account on the Pajerototo platform, please notify our support team immediately so that we may take appropriate action.

Pajerototo reserves the right to update, amend, or replace this Privacy Policy at any time. Material changes to the Policy will be communicated to registered users via email or a prominent notice on the platform prior to the changes taking effect.

The "Last Updated" date at the top of this Policy indicates when the most recent revision was made. It is your responsibility to review this Policy periodically to remain informed of how we are processing your personal data. Continued use of the platform following the effective date of any revision constitutes your acceptance of the updated Policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by Pajerototo, please contact our Data Protection team through the following channels:

• Live Chat: Available 24/7 on the Pajerototo platform — for general privacy enquiries and data subject requests;
• Email: [email protected] (plain text — this is not a clickable link). Please include "Privacy Enquiry" or "Data Subject Request" in the subject line;
• Response Time: We aim to acknowledge all privacy-related enquiries within 3 business days and to provide a substantive response within 30 calendar days of receiving a verified data subject request;
• Operating Hours: 24 hours per day, 7 days per week, on Malaysia Standard Time (MYT, UTC+8). Support is available in English, Bahasa Melayu, and Chinese.