Babeltoto is committed to protecting the privacy of every registered player. This Privacy Policy explains precisely what personal data we collect, why we collect it, how we use and store it, and what rights you hold over your information.
This Privacy Policy ("Policy") describes how Babeltoto ("we", "us", "our", "the Platform") collects, processes, stores, and protects personal data provided by or relating to users ("you", "Player", "User") of the Babeltoto online betting and live casino platform, accessible at babeltoto.cam.
Babeltoto is an English-language online betting platform operated under an international online gaming licence. Our Platform is designed primarily to serve adult players in Malaysia, including users in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and other regions of the country. When you register an account, make a deposit via Touch 'n Go eWallet, DuitNow, Maybank, CIMB, or any other supported payment channel, place a wager, or contact our support team, you provide us with personal data that we are obligated to handle with care.
This Policy is prepared in accordance with the data protection obligations applicable under our international licensing framework. We also acknowledge the standards set under Malaysia's Personal Data Protection Act 2010 (PDPA) as a reference point, and we endeavour to meet those standards in respect of personal data relating to Malaysian players, even where our offshore operational structure does not place us directly within the territorial scope of that legislation.
This Policy should be read alongside our Terms & Conditions and Responsible Gambling Policy. By registering an account or using this Platform, you confirm that you have read and understood this Policy and that you consent to the processing of your personal data as described herein.
Babeltoto collects personal data through several channels: directly from you during registration and account use, automatically through your interaction with the Platform, and from third parties involved in payment processing and identity verification. The categories of personal data we collect are set out below.
3.1 Registration & Account Data
| Data Category | Specific Data Points | Collection Method |
|---|---|---|
| Identity Data | Full legal name, date of birth, gender, nationality | Registration form; KYC documents |
| Contact Data | Email address, mobile number | Registration form |
| Residential Data | Country of residence, city (e.g., Kuala Lumpur, Penang) | Registration form; KYC proof of address |
| Authentication Data | Username, encrypted password, two-factor authentication settings | Registration form; account settings |
| KYC Documents | MyKad, passport, or equivalent ID; proof of address documents | KYC submission portal |
3.2 Financial & Transaction Data
| Data Category | Specific Data Points | Collection Method |
|---|---|---|
| Payment Identifiers | Payment method type (e.g., Touch 'n Go, DuitNow, Maybank2u, CIMB Clicks, FPX), masked account/wallet reference numbers | Cashier/payment gateway |
| Transaction Records | Deposit amounts (MYR), withdrawal amounts, timestamps, transaction reference numbers, payment status | Automated transaction logging |
| Betting History | Wager amounts, markets betted (e.g., EPL, Liga Super Malaysia, UFC), odds, outcomes, winnings | Platform betting engine |
3.3 Technical & Usage Data
3.4 Communications Data
We process the personal data we collect for the following purposes. Each purpose is associated with a legal basis as described in Section 5.
For each processing purpose described in Section 4, we rely on one or more of the following legal bases:
| Processing Purpose | Legal Basis |
|---|---|
| Account creation and management | Performance of contract (our Terms & Conditions with you) |
| KYC / identity verification | Legal obligation (licensing requirements); legitimate interests |
| Payment processing | Performance of contract |
| Customer support | Performance of contract; legitimate interests |
| Fraud prevention and AML | Legal obligation; legitimate interests |
| Responsible gambling tools | Legal obligation; legitimate interests; your consent |
| Marketing communications | Your explicit consent (opt-in) |
| Platform analytics and improvement | Legitimate interests (anonymised/aggregated data only) |
Babeltoto does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may share your personal data with third parties only in the limited circumstances described below.
Babeltoto uses cookies and similar tracking technologies on the Platform. Cookies are small text files stored on your device that allow us to recognise your browser session, remember your preferences, and gather analytical data about Platform usage.
We use the following categories of cookies:
You can manage cookie preferences through your browser settings. Disabling strictly necessary cookies may prevent parts of the Platform from functioning correctly. For detailed information about the specific cookies in use, please contact our support team.
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following indicative retention periods apply:
| Data Category | Retention Period | Rationale |
|---|---|---|
| Account registration data | Duration of account + 5 years after closure | Contractual obligations; licensing requirements |
| KYC documents | 5 years from date of verification | AML compliance; licensing audit obligations |
| Financial transaction records | 7 years from transaction date | Financial record-keeping; AML requirements |
| Betting history | 5 years from wager date | Dispute resolution; licensing compliance |
| Support communications | 3 years from last interaction | Quality assurance; dispute evidence |
| Marketing consent records | Until consent is withdrawn + 2 years | Consent audit trail |
| Self-exclusion records | Duration of exclusion + 5 years | Responsible gambling obligations |
Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised. Where data is anonymised (rendered incapable of identifying you), it may be retained indefinitely for statistical and analytical purposes.
Babeltoto implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security measures include, but are not limited to:
Despite these measures, no internet-based system can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials (username, password, two-factor authentication codes) and for notifying us immediately if you suspect any unauthorised access to your account.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, Babeltoto will notify affected Players without undue delay and in accordance with our notification obligations under applicable law.
Depending on your location and applicable law, you may hold some or all of the following rights in respect of your personal data held by Babeltoto. We will endeavour to respect these rights for all Players, including those in Malaysia, as a matter of our commitment to fair and transparent data practices.
You have the right to request a copy of the personal data we hold about you and to receive information about how it is processed. We will respond to access requests within 30 days.
You have the right to request correction of inaccurate or incomplete personal data held about you. Contact support with the relevant correction request and supporting documentation.
In certain circumstances, you may request deletion of your personal data. This right is subject to our legal retention obligations — data required for AML, KYC, or licensing compliance cannot be deleted before the applicable retention period expires.
You may request that we restrict the processing of your personal data in certain defined circumstances, for example while the accuracy of data is contested or where processing is unlawful but you prefer restriction over erasure.
Where processing is based on your consent or on a contract, you may request a copy of your personal data in a structured, machine-readable format for transfer to another service provider.
Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
To exercise any of the above rights, please contact us at the details set out in Section 14. We will acknowledge your request within 5 business days and endeavour to fulfil it within 30 days. In certain circumstances (e.g., complex requests or high volume), we may extend this period by a further 30 days, with notice to you.
Babeltoto operates under an international online gaming licence and employs cloud infrastructure and third-party service providers located in various jurisdictions. Accordingly, your personal data may be transferred to and processed in countries outside Malaysia, including countries that may not offer the same level of data protection as Malaysia's Personal Data Protection Act 2010.
Where such international transfers occur, we ensure that appropriate safeguards are in place to protect your personal data, including:
By using the Platform and registering an account, you acknowledge and consent to the transfer of your personal data to jurisdictions outside Malaysia for the purposes described in this Policy.
Parents and guardians who believe that a minor has registered on or accessed the Platform without authorisation are encouraged to contact our support team immediately. We will act on all such reports promptly and with appropriate care. Use of appropriate parental control software is also recommended as a precautionary measure.
Babeltoto reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable legal requirements, or our operational structure. Where changes are material — meaning they substantively affect how your personal data is processed or the rights available to you — we will provide advance notice by email to registered Players and/or by displaying a notice on the Platform.
The "Last Updated" date at the top of this page indicates the date of the most recent revision. We encourage you to review this Policy periodically. Your continued use of the Platform following the publication of updated Policy terms constitutes your acceptance of the revised Policy. If you do not accept the updated terms, you should cease using the Platform and contact support to request account closure.
If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by Babeltoto, please contact our Data Support team using the channels below. All communications are handled in English.
We will acknowledge all data rights requests within five (5) business days and aim to provide a substantive response within thirty (30) days of receipt.
Six core privacy principles that guide how Babeltoto handles your personal data
All personal data transmitted between your device and Babeltoto's servers is protected with bank-grade 256-bit SSL/TLS encryption. Sensitive data at rest is encrypted using AES-256 standard.
Babeltoto does not sell, rent, or trade your personal data to third-party marketers under any circumstances. Data sharing is limited strictly to service providers necessary for Platform operations and legal compliance.
Access, rectify, delete, restrict, or export your personal data at any time. We acknowledge all data rights requests within 5 business days and fulfil them within 30 days — in writing, via email, in English.
We do not keep your data indefinitely. Clear retention schedules apply to each data category, from 3 years for support records to 7 years for financial transactions, aligned with licensing and AML obligations.
We categorise and disclose every type of cookie used on the Platform. Marketing cookies are opt-in only. Essential session cookies keep your account and payments secure; they cannot be disabled without impairing functionality.
Babeltoto does not knowingly collect or process personal data from anyone under 21. Mandatory KYC identity verification acts as the primary safeguard. Suspected underage accounts are suspended immediately pending investigation.
Babeltoto treats your personal data with the same care it treats your funds — securely, transparently, and with your rights always in view. For players aged 21 and above only.
🔞 21+ only | Play responsibly | Responsible Gambling Resources