01 Introduction
Koitoto ("we", "Platform", or "service") is fully committed to protecting the privacy of every user who registers and uses our platform. This Privacy Policy is designed to provide complete transparency about our data management practices to you as a registered user ("you" or "member").
We understand that entrusting your personal data to an online platform is no small matter. That is why we built our privacy system from the ground up on the principle of privacy-by-design — meaning data protection is not an afterthought, but is embedded into every layer of our system from the design stage.
This document covers complete information about the types of data we collect, the legal basis for collection, how it is used, how it is protected, and your rights as a data owner. We encourage you to read this document carefully in its entirety.
02 Data We Collect
Koitoto collects data only in categories that are strictly necessary to deliver our services properly. Below is the complete classification:
Identity & Contact Data:
- Full name as stated on official identification
- Date of birth (for age verification)
- Active email address
- Registered phone number
- Residential address (for KYC and regulatory compliance purposes)
Identity Verification Data (KYC):
- Copy of official identity document (National ID, Driver's License, or Passport)
- Selfie photo for facial biometric verification
- Other supporting documents requested during the verification process
Financial Data:
- Bank account number or e-wallet account for withdrawal processing
- Deposit and withdrawal transaction history
- Payment method information (stored in encrypted format)
Platform Usage Data:
- Game and betting history
- Game preferences and platform activity
- Session time and duration
- Device information (device type, operating system, browser)
- IP address and generic location data
03 How We Use Your Data
The data we collect is used for limited and clearly defined purposes. No data is used for purposes beyond those listed below without your explicit consent.
| Purpose of Use | Legal Basis | Type of Data Used |
|---|---|---|
| Account creation and management | Contract performance | Identity, contact |
| Identity verification (KYC) | Legal obligation | KYC, identity |
| Financial transaction processing | Contract performance | Financial, identity |
| Fraud detection and security | Legitimate interest | Usage, financial |
| Gaming experience personalization | Legitimate interest | Usage, preferences |
| Service and support communications | Contract performance | Contact, usage |
| Promotional and bonus communications | Consent | Contact, preferences |
04 Data Sharing with Third Parties
Koitoto enforces a strict policy on sharing data with parties outside our organization. Your data is never sold and is only shared under very limited conditions:
- Technical service providers: Game providers, payment gateways, and cloud infrastructure providers that process data on behalf of koitoto under binding service agreements with data protection obligations
- Legal obligation: Government authorities, law enforcement agencies, or regulatory bodies that formally request data under applicable legal provisions
- Fraud prevention: Identity verification agencies and anti-fraud bureaus used to validate member identities and prevent illegal activity
- Explicit consent: Other situations where you actively grant permission to share data with a specific party
All third-party partners that process data on behalf of koitoto are bound by a Data Processing Agreement (DPA), ensuring they handle your information to a security standard equal to or higher than our own.
05 Cookies & Tracking Technologies
Koitoto uses cookies and similar technologies to enhance the user experience and ensure the platform operates at its best. Below are the types of cookies we use:
- Essential cookies: Required for core platform functions such as login sessions and security. Cannot be disabled.
- Functional cookies: Saves your preferences such as language, display theme, and game settings for a more personalized experience.
- Analytics cookies: Collects aggregated data on how the platform is used to help us improve features and performance. This data is processed anonymously.
- Security cookies: Used to detect suspicious activity and protect accounts from unauthorized access.
You can manage your cookie preferences through your browser settings. However, disabling essential cookies may affect core platform functionality. Koitoto does not use third-party cookies for targeted advertising purposes.
06 Data Security
Koitoto implements a range of technical and organizational security measures to protect your data from unauthorized access, loss, misuse, or accidental disclosure.
- End-to-end encryption for all data transmissions using TLS 1.3
- At-rest data encryption using AES-256
- Two-factor authentication (2FA) available for all accounts
- 24/7 security monitoring with AI-based anomaly detection
- Regular internal and external security audits
- Role-based access control (RBAC) for internal staff
- Tested incident response plan for handling data breaches
In the event of a security incident that may affect your personal data, Koitoto will provide notification within 72 hours of the incident being detected, in accordance with industry best practice standards.
07 Data Retention & Deletion
Koitoto retains personal data only for as long as needed for the purposes stated in this policy, or as required by applicable law. Below is our data retention policy:
- Active account data: Retained for the duration of the active account plus 5 years after account closure, in accordance with anti-money laundering regulatory requirements
- Financial transaction data: Retained for a minimum of 7 years in accordance with tax and banking regulations
- KYC Data: Retained for the duration of the active account and 5 years after closure
- Access and security logs: Retained for 2 years for security investigation purposes
- Support communication data: Retained for 3 years after the last interaction
Once the retention period expires, data is securely deleted using non-recoverable secure deletion methods. You may request early deletion, though such requests are subject to applicable legal retention obligations.
08 Your Rights as a Data Owner
As a koitoto member, you have a set of rights regarding your personal data. We fully respect and facilitate the exercise of these rights:
Right to Access
You have the right to request a copy of the personal data we hold about you at any time.
Right to Rectification
You have the right to request correction of inaccurate or incomplete data.
Right to Erasure
You may request deletion of your data under certain conditions as provided by law.
Right to Portability
You have the right to receive your data in a structured, machine-readable format.
Right to Restriction
You may request restriction of data processing in certain situations as provided by law.
Right to Object
You have the right to object to data processing based on legitimate interests.
To exercise any of the above rights, contact koitoto's privacy team via our official email. We will respond to requests within a maximum of 30 calendar days from receipt. No fees are charged for submitting privacy rights requests.
09 Minor Protection
Koitoto services are strictly intended for individuals aged 18 and above. We do not knowingly collect personal data from individuals under the age of 18.
If we discover or are notified that personal data from a minor has been collected inadvertently, we will immediately take steps to delete that data and close the associated account. If you are a parent or guardian and suspect that a child in your care has registered on Koitoto, please contact our support team immediately.
10 Privacy Policy Updates
Koitoto may update this Privacy Policy from time to time to reflect changes in practices, technology, regulations, or applicable legal requirements. The date of the last update is always displayed at the top of this page.
For material changes — those that significantly affect your rights or how we use your data — koitoto will send a notification to your registered email at least 14 days before the change takes effect. Continued use of the platform after the effective date constitutes acceptance of the updated policy.
11 Contact Our Privacy Team
If you have any questions, objections, or requests regarding this privacy policy or the handling of your personal data by Koitoto, our privacy team is here to help.
For more information about your rights and how we protect players, visit the Responsible Gaming or read our Terms and Conditions in full.
Koitoto believes trust is built on transparency. Join the millions of players who have already entrusted their privacy to us — a platform that doesn't hide behind confusing terms.