1
Introduction & Scope of Privacy Policy
This Privacy Policy ("Policy") is published by ormastoto for the website ormastoto.biz and all related services. This policy explains how ormastoto collects, processes, stores and protects the personal data of members using our platform.
At ormastoto, privacy is not something we take lightly. We understand that when you create an account and use our platform, you are trusting us with important personal information. We take that trust seriously — and this policy is our commitment to full transparency in how we handle your data.
This policy applies to all individuals who register, log in or use any ormastoto service, including via web browser and mobile device. The latest version takes effect from 1 January 2026.
By registering an account with ormastoto or continuing to use our platform after the date this policy is updated, you consent to the collection and processing of your data as described in this document. If you do not agree, please stop using the platform and contact us to close your account.
2
Types of Personal Data We Collect
Ormastoto only collects data that is necessary to operate our services safely and effectively. The following are the categories of data we collect:
a) Registration & Identity Data
- Full name (as per Malaysian MyKad)
- Active Malaysian phone number
- Email address
- Date of birth (for age verification)
- Password (stored as an unreadable hash)
b) KYC Data (Identity Verification)
- MyKad copy or other valid Malaysian identification document
- Proof of payment method ownership (for high-value withdrawals)
- Verification selfie (in certain cases)
c) Financial & Transaction Data
- Records of deposits and withdrawals in Malaysian Ringgit (RM)
- Payment methods used — Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, FPX
- EWallet or banking account number (partially masked)
- Complete transaction history
d) Gaming Activity Data
- Game records — bets, wins, and losses across all games (slots, baccarat, poker, e-sports, virtual sports)
- Game types played and frequency of play
- Session start time and duration
- Current VIP tier and tier upgrade history
e) Technical & Device Data
- IP address at login and during gameplay
- Device type and operating system (Android, iOS, Windows)
- Browser type and version
- Cookie and session data
- Activity logs for security and fraud detection purposes
Ormastoto does not collect credit or debit card information directly. All payments are processed through third-party payment gateways that maintain their own security compliance.
3
Purpose of Data Collection & Processing
Ormastoto processes your personal data only for legitimate and necessary purposes. The following are the primary purposes for which your data is used:
Ormastoto will not use your personal data for any purpose other than those stated above without obtaining fresh consent from you. If you have previously agreed to receive marketing communications but later wish to withdraw that consent, you may do so at any time through your account settings or by contacting ormastoto customer support.
4
Data Sharing with Third Parties
Ormastoto does not sell members' personal data to any third party. However, in the course of operating the platform, ormastoto may share necessary data with the following categories of third parties:
- Payment Service Providers: Payment gateways such as Touch 'n Go, GrabPay, Boost, ShopeePay, DuitNow and FPX banks receive the transaction data necessary to process your deposits and withdrawals. These providers maintain their own privacy policies and security standards.
- Game Providers: Companies such as Pragmatic Play, Evolution Gaming, and PG Soft receive the session information needed to run games correctly. They do not receive your full identity details.
- Technical Service Providers: Companies providing cloud infrastructure, security analytics and fraud detection services that ormastoto relies on. All such providers are bound by strict confidentiality agreements.
- Statutory Authority: Ormastoto will disclose data to law enforcement authorities when required to do so under applicable Malaysian law, including for AML (Anti-Money Laundering) compliance purposes.
ormastoto does not share member data with third-party advertising companies, data brokers, or any entity that would use that data for third-party marketing purposes. This is a commitment we uphold firmly.
5
Data Security Measures
Ormastoto implements multiple layers of security to protect your personal data from unauthorised access, disclosure, alteration or destruction:
Data Encryption in Transit
256-bit SSL/TLS encryption for all communications between your device and ormastoto servers.
Data Encryption at Rest
Sensitive data such as passwords and KYC information is stored in encrypted form on secure servers.
Strict Internal Access Controls
Only staff with a legitimate business need are permitted to access member data, and all access is logged in an audit trail.
24/7 Security Monitoring
Threat detection and anomalous activity monitoring systems operate around the clock to identify and respond to security threats.
Regular Security Audits
ormastoto conducts regular internal and external security audits to ensure data protection standards remain up to date.
Staff Privacy Training
All ormastoto staff who handle member data receive regular privacy and data security training.
While ormastoto takes all reasonable steps to protect your data, no security system can guarantee absolute protection. You also play an important role — always keep your account password confidential and never share your login details with anyone.
6
Data Retention Period
Ormastoto retains members' personal data only for as long as necessary to fulfil the purposes set out in this policy or to comply with applicable legal requirements.
- Active Account Data: Retained for as long as your account remains active on the ormastoto platform. Following account closure, basic account data is kept for the period required by law.
- KYC Data (Identity Verification): Retained for a minimum of 5 years after the business relationship ends, in accordance with applicable AML compliance requirements in Malaysia.
- Financial Transaction Records: Retained for a minimum of 7 years for tax and financial compliance purposes as required under Malaysian law.
- Game Activity Data: Retained for 5 years for audit, dispute resolution and security analysis purposes.
- Security & Technical Logs: Retained for 12 months for fraud detection and system security purposes.
- Customer Support Communication Data: Retained for 3 years for reference and service quality purposes.
Once the relevant retention period has expired, data will be securely deleted or anonymised so that it can no longer be linked to any individual.
7
Your Rights as an Ormastoto Member
As an ormastoto member, you have the following rights regarding your personal data. To exercise any of these rights, please contact ormastoto through the channels listed in Section 10.
Right of Access
You have the right to request a copy of the personal data ormastoto holds about you. Requests will be processed within 14 business days and the data will be provided in a readable format.
Right to Rectification
If you believe the personal data ormastoto holds about you is inaccurate or out of date, you have the right to request a correction. ormastoto will review the request and make the appropriate amendments.
Right to Erasure
Under certain circumstances, you may request the deletion of your personal data. Please note that this right is subject to legal retention obligations binding on ormastoto — not all data can be deleted upon request.
Right to Withdraw Consent
For data processing based on your consent (such as marketing), you may withdraw that consent at any time through your account settings or by contacting customer support. Withdrawal of consent does not affect any processing that has already taken place.
Right to Data Portability
You have the right to receive your personal data in a structured, machine-readable format for your own use. This makes it easy to transfer your data to another platform if needed.
Right to Object to Processing
You have the right to object to the processing of your personal data for specific purposes. ormastoto will review each objection and respond within 30 business days.
8
Cookie Policy
The ormastoto platform uses cookies — small text files stored on your device when you visit our website. Cookies help us deliver a better, safer, and more personalised experience to every member.
Types of cookies ormastoto uses:
- Essential Cookies (Required): These cookies are required for the platform's core functions — login, session management, security, and transaction processing. Without them, the platform cannot function properly. These cookies do not require your consent.
- Functional Cookies: Helps the platform remember your preferences such as language, display size and interface settings. This improves usability but is not essential to core functionality.
- Analytics Cookies: Ormastoto uses analytics cookies to understand how members interact with the platform — which pages are visited most, where users encounter issues, and how navigation flows. This data is used in aggregate form and does not directly identify individuals.
- Security Cookies: Helps ormastoto's fraud detection system identify unusual activity and protect member accounts from unauthorised access.
Essential cookies — required
Functional cookies — enhanced UX
Analytics cookies — aggregated data
Security cookies — anti-fraud
You can manage or delete cookies through your web browser settings. However, disabling essential cookies may affect platform functionality and you may be unable to log in or play as normal. For more information on managing cookies in your browser, refer to your browser's documentation.
9
Children & Age Restrictions
Ormastoto platform is strictly limited to individuals aged 18 and above. ormastoto does not knowingly collect or process personal data of children or minors.
All account registrations require age verification. Should ormastoto discover that personal data of an underage individual has been collected without our knowledge, we will take the following steps immediately:
- Closing the relevant account without any prior notice.
- Delete all personal data associated with the individual.
- Returning any available funds to the original deposit method following appropriate verification.
If you have reason to believe that someone under the age of 18 has registered or used the ormastoto platform, please contact us immediately at support@ormastoto.biz so that we can take prompt action.
Parents and guardians are advised to monitor the online activity of children in their care. If you suspect your child is accessing an online gambling platform, please take immediate action and contact the platform directly.
10
Contact Us Regarding Privacy
If you have any questions, concerns, or wish to exercise your rights under this privacy policy, please contact ormastoto through the following channels:
Live Chat
Available 24/7 from the ormastoto platform. The fastest way to get answers to general privacy queries.
Privacy Email
support@ormastoto.biz
Please use the subject line "Data Privacy Enquiry" for priority handling.
For formal requests relating to data rights (access, correction, deletion, portability), please send an email to support@ormastoto.biz with the subject line "Data Rights Request", along with your account number and a clear description of your request. ormastoto is committed to processing all requests within 14 working days from the date of receipt.
Ormastoto reserves the right to amend this privacy policy from time to time to reflect changes in our privacy practices, legal requirements, or the way we operate. Every change will include a clear effective date at the top of this page, and material changes will be communicated to members via email or in-platform notification.