Privacy Policy

1Introduction

This Privacy Policy ("Policy") is issued by Morfintoto ("Company", "we", "us", "our") and governs the collection, processing, storage, and use of personal data submitted by or collected in connection with individuals ("Member", "User", "you") who access and use the Morfintoto platform at https://morfintoto.cam.

Morfintoto operates an online casino and sports betting platform tailored specifically for the Malaysian market. In providing these services, we necessarily collect and process personal data as described in this Policy. We take our data protection obligations seriously and are committed to handling your personal information with the utmost care, discretion, and security.

This Policy should be read alongside our Terms & Conditions, which govern your broader use of the Morfintoto platform. In the event of any conflict between this Policy and the Terms & Conditions concerning privacy matters, this Policy shall prevail.

2Definitions

For the purposes of this Policy, the following terms shall carry the meanings set out below:

• "Personal Data" means any information that directly or indirectly identifies a natural person, including name, identification number, contact information, financial data, and online identifiers.
• "Processing" means any operation performed on personal data, including collection, recording, storage, use, transmission, disclosure, or deletion.
• "Data Controller" means Morfintoto, being the entity that determines the purposes and means of processing personal data.
• "Data Subject" means you — the natural person to whom the personal data relates.
• "KYC Data" means identity and verification documents collected as part of the Know Your Customer process, including MyKad, passport, and proof of payment instruments.
• "Cookies" means small text files placed on your device by the platform to enable certain functionality and track usage behaviour.
• "Third Party" means any entity other than Morfintoto and the Member, including payment processors, software providers, and analytics services.
• "Sensitive Personal Data" means a subset of personal data including financial account details, identity document numbers, and data relating to health or gambling behaviour patterns.

3Data We Collect

3.1 Registration Data

When you create a Morfintoto Account, we collect the following information:

• Full legal name (as it appears on your MyKad or government-issued identity document)
• Date of birth (for mandatory age verification — Members must be 21 years of age or older)
• Email address
• Mobile phone number
• Residential address (including city — e.g., Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru, Shah Alam)
• Username and encrypted password

3.2 KYC Verification Data

Prior to processing your first withdrawal, and at any point where identity verification is required, we collect:

• Copy of your MyKad, passport, or other government-issued identity document
• A live selfie or photograph holding your identity document
• Proof of ownership for payment instruments used (where required)
• Additional documentation where mandated by applicable law or our compliance framework

3.3 Financial Transaction Data

We collect and retain records of all financial activity on your Account, including:

• Deposit amounts, dates, and payment method used (Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, RHB, etc.)
• Withdrawal requests, amounts, destinations, and processing status
• Account balance history and running transaction ledger
• Cryptocurrency wallet addresses where applicable (BTC, USDT)

3.4 Gameplay & Behavioural Data

We collect data relating to your use of the platform's gaming and betting services, including:

• Games played, wager amounts, win/loss outcomes, and session duration
• Sportsbook bets placed, including event selection, odds accepted, and settlement outcomes
• Responsible gambling tool usage (deposit limits set, cooling-off periods activated, self-exclusion requests)
• Customer support interaction logs and chat transcripts

3.5 Technical & Device Data

Automatically collected when you access the platform:

• IP address and approximate geographic location derived therefrom
• Device type, operating system, and browser version
• Session timestamps and navigation path through the platform
• Cookie identifiers and similar tracking technologies (see Section 10)

4How Data Is Collected

Morfintoto collects personal data through the following channels:

• Directly from you — during account registration, KYC verification, form submissions, live chat interactions, and support communications.
• Automatically — through cookies, session logs, and analytics technologies embedded in the platform, which track your usage behaviour and device characteristics.
• From payment processors — transaction confirmation data provided by licensed Malaysian payment partners including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX-connected banks, and cryptocurrency exchanges.
• From identity verification services — where we engage licensed third-party KYC or anti-fraud service providers to verify the accuracy of identity documents submitted.
• From other Members or third parties — where relevant for fraud investigation, security assessment, or responsible gambling interventions.

5Data Processing & Use

Morfintoto processes your personal data for the following purposes:

Purpose	Data Used	Basis
Account creation and management	Registration data, contact details	Contract performance
Identity verification (KYC)	KYC documents, selfie, address	Legal obligation
Processing deposits and withdrawals	Financial transaction data, payment credentials	Contract performance
Anti-fraud and security monitoring	All data categories, device data, IP	Legitimate interest
Responsible gambling monitoring	Gameplay data, deposit patterns, support logs	Legal obligation / Legitimate interest
Customer support provision	Contact details, account history, chat transcripts	Contract performance
Platform analytics and improvement	Anonymised/aggregated behavioural data	Legitimate interest
Marketing communications (opt-in only)	Email address, gameplay preferences	Consent
Legal and regulatory compliance	All data categories as required	Legal obligation

6Legal Basis for Processing

Morfintoto processes your personal data one or more of the following lawful bases:

• Contract Performance: Processing is necessary to perform the contract between Morfintoto and you — including account management, payment processing, and service delivery.
• Legal Obligation: Processing is required to comply with applicable laws and regulatory obligations, including anti-money laundering (AML) requirements, KYC regulations, and responsible gambling mandates.
• Legitimate Interests: Processing is necessary for the legitimate business interests of Morfintoto, including fraud prevention, platform security, and service improvement — provided those interests are not overridden by your fundamental rights.
• Consent: Where you have provided explicit, informed consent for specific processing activities, such as receiving marketing communications. You may withdraw consent at any time without prejudice to prior processing.

7Data Sharing & Disclosure

Morfintoto does not sell, rent, or trade your personal data to third parties. We may disclose your data only in the following limited circumstances:

7.1 Service Providers

We engage carefully selected third-party service providers who process data on our behalf under binding data processing agreements. These include payment processors (Touch 'n Go eWallet, Boost, FPX-connected banks, etc.), KYC verification services, cloud infrastructure providers, and customer support platform operators. All such providers are contractually prohibited from using your data for any purpose beyond the specific service they provide.

7.2 Gaming Software Providers

Game studios and sportsbook software providers who supply content to the Morfintoto platform may receive limited technical data (session IDs, wager records) necessary to operate their games. No personally identifiable registration data is shared with game providers beyond what is technically necessary.

7.3 Legal and Regulatory Disclosure

We may be required to disclose personal data to competent authorities, law enforcement agencies, regulators, or courts where mandated by applicable law, a valid legal order, or regulatory directive. We will notify you of any such disclosure where legally permitted to do so.

7.4 Corporate Transactions

In the event of a merger, acquisition, restructuring, or sale of all or part of Morfintoto's business, personal data held by the Company may be transferred to the acquirer or successor entity, subject to equivalent data protection commitments.

8International Data Transfers

In delivering its services, Morfintoto may transfer your personal data to service providers or infrastructure systems located in jurisdictions outside Malaysia. Where such transfers occur, we ensure that appropriate safeguards are in place — including standard contractual clauses, binding corporate rules, or transfers to jurisdictions with adequacy decisions — to maintain the protection of your personal data to a standard equivalent to that applied within Malaysia.

You may contact us at the details set out in Section 15 to request information about the specific safeguards applied to any international transfer of your personal data.

9Data Retention

Morfintoto retains your personal data for as long as your Account is active and for a defined period thereafter, in accordance with the following retention framework:

• Active Account Data: Retained for the full duration of your Account's active status, plus a minimum of five (5) years following Account closure, to comply with applicable anti-money laundering and legal record-keeping requirements.
• KYC Documents: Retained for a minimum of five (5) years from the date of verification, or longer where mandated by applicable regulation.
• Financial Transaction Records: Retained for a minimum of seven (7) years in compliance with financial record-keeping obligations.
• Customer Support Records: Retained for three (3) years following the resolution of the relevant interaction.
• Marketing Consent Records: Retained until consent is withdrawn, plus a reasonable period thereafter for record-keeping purposes.

Upon expiry of the applicable retention period, personal data will be securely deleted, anonymised, or archived in accordance with Morfintoto's internal data governance procedures.

10Cookies & Tracking Technologies

10.1 Types of Cookies Used

Morfintoto uses the following categories of cookies and similar tracking technologies on its platform:

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. They cannot be disabled without preventing access to the platform.
• Functional Cookies: Enable personalised features such as remembering your language preference, deposit method defaults, and display settings.
• Analytics Cookies: Used to collect anonymised or aggregated data about how Members navigate the platform — including page visit frequency, session duration, and feature usage — to help us improve the platform experience.
• Security and Anti-Fraud Cookies: Used to detect and prevent fraudulent activity, multiple account creation, and bot activity.

10.2 Managing Cookies

You may manage non-essential cookies through your browser settings at any time. Please note that disabling certain cookies may affect the functionality or accessibility of the Morfintoto platform. Strictly Necessary and Security cookies cannot be disabled without impacting the platform's ability to serve your Account.

11Your Rights as a Data Subject

As a data subject whose personal data is processed by Morfintoto, you hold the following rights, subject to applicable law and any overiding legal obligations:

• Right of Access: You may request a copy of the personal data Morfintoto holds about you, together with information about how it is used and shared.
• Right to Rectification: You may request the correction of inaccurate or incomplete personal data held about you. Where possible, corrections to non-KYC data may be made directly within your Account settings.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you have withdrawn consent. This right is subject to overiding legal retention obligations.
• Right to Data Portability: You may request your personal data in a structured, commonly used, and machine-readable format for the purpose of transfering it to another service, where technically feasible.
• Right to Object: You may object to the processing of your personal data where Morfintoto relies on legitimate interests as the legal basis, or where processing is used for direct marketing purposes.
• Right to Restriction of Processing: You may request that Morfintoto restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data is being contested.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

12Data Security

Morfintoto implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• 256-bit SSL/TLS encryption applied to all data transmitted between your device and the Morfintoto platform.
• Encrypted storage of passwords using industry-standard hashing algorithms; plain-text passwords are never stored.
• Role-based access controls ensuring that only authorised personnel with a legitimate business need may access Member personal data.
• Regular penetration testing and security audits of the platform infrastructure.
• Intrusion detection systems and continuous monitoring of platform activity for anomalous behaviour.
• Secure data centres with physical access controls and redundancy protocols.

Notwithstanding the above, no security system is impenetrable. If you have reason to believe that your Account has been compromised or that your personal data has been subject to unauthorised access, please contact us immediately at [email protected].

13Minors & Age Restriction

The Morfintoto platform is strictly restricted to individuals aged21 years and older. We do not knowingly collect personal data from individuals under the age of 21. If Morfintoto becomes aware that personal data of an individual under the age of 21 has been collected — whether through misrepresentation or otherwise — we will immediately suspend the relevant Account, delete the associated personal data to the extent legally permissible, and take such further action as is appropriate in the circumstances.

Age verification via KYC documentation is a mandatory prerequisite for withdrawal processing and forms a core part of our responsible gambling framework. If you believe a minor has accessed the platform using false information, please notify us immediately at [email protected].

14Policy Amendments

Morfintoto reserves the right to amend, update, or replace this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, platform functionality, or internal data governance practices. The most current version of this Policy will always be published at https://morfintoto.cam/privacy-policy and will display the "Last Updated" date at the top of the page.

Material changes to this Policy — particularly those affecting how your personal data is used or your rights as a data subject — will be communicated to active Members via the registered email address on their Account. Continued use of the platform following notification of any such change constitutes your acceptance of the revised Policy.

15Contact & Complaints

For all privacy-related enquiries, requests to exercise your data subject rights, or formal complaints concerning the handling of your personal data, please contact the Morfintoto data team using the details below:

We are committed to resolving privacy concerns promptly and transparently. If you are not satisfied with the response you receive from Morfintoto regarding a data privacy complaint, you may have the right to lodge a complaint with a relevant data protection supervisory authority in your jurisdiction.