Privacy Policy

01 Introduction

This Privacy Policy ("Policy") describes how ormastoto ("ormastoto", "the Platform", "we", "us", "our") collects, uses, stores, shares, and protects the personal data of individuals ("you", "your", "Player") who access or use the ormastoto website at https://ormastoto.cam and all associated services (collectively, the "Services").

Ormastoto is committed to handling personal data responsibly, transparently, and in accordance with applicable data protection principles. This Policy has been written in plain language to ensure that every Player — regardless of their familiarity with data protection law — understands precisely how their information is handled.

By creating an Account on ormastoto, you acknowledge that you have read and understood this Policy. Your use of the Platform constitutes your agreement to the data practices described herein. If you do not agree, you should not use the Platform or create an Account.

02 Definitions

The following definitions apply throughout this Policy:

• "Personal Data" — Any information relating to an identified or identifiable natural person. This includes, but is not limited to, name, identification number, contact details, payment information, and online identifiers.
• "Processing" — Any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, transmission, erasure, or destruction.
• "Data Controller" — The entity that determines the purposes and means of Processing Personal Data. For the purposes of this Policy, the Data Controller is ormastoto.
• "Data Processor" — A third party that Processes Personal Data on behalf of ormastoto, under binding instructions and accordance with this Policy.
• "Consent" — A freely given, specific, informed, and unambiguous indication of a Player's agreement to the Processing of their Personal Data for a defined purpose.
• "KYC Data" — Identity and address verification documents collected as part of the Know Your Customer process, including but not limited to national identity cards (MyKad), passports, and utility bills.
• "Cookie" — A small text file placed on a Player's device by the Platform for the purposes of session management, personalisation, and analytics.
• "Sensitive Personal Data" — A subcategory of Personal Data that warants heightened protection, including financial details, identity documents, and data relating to responsible gambling assessments.

03 Data Controller

For the purposes of this Privacy Policy, the Data Controller responsible for your Personal Data is ormastoto, operating the Platform at https://ormastoto.cam.

The Data Controller is responsible for ensuring that Personal Data is collected, stored, and used in compliance with applicable data protection principles, including purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality.

If you have any questions about how ormastoto processes your Personal Data, or if you wish to exercise any of the rights described in Section 11 of this Policy, you may contact us through the channels specified in Section 15 (Contact Us).

04 Data We Collect

Ormastoto collects Personal Data through several channels, including the Account registration process, ongoing use of the Platform, KYC verification, payment transactions, and support interactions. The categories of data collected are as follows:

Ormastoto does not knowingly collect Sensitive Personal Data beyond what is strictly necessary for identity verification, fraud prevention, and compliance with anti-money-laundering regulations. Where such data is collected, it is subject to heightened storage and access controls.

05 Lawful Basis for Processing

Ormastoto processes Personal Data only where a valid lawful basis exists. The primary bases relied upon are as follows:

1. Contractual Necessity: Processing is necessary to perform the contract between you and ormastoto — specifically, to operate your Account, execute deposits and withdrawals, and provide access to the Platform's Services. Without this processing, we cannot deliver the Services you have registered to receive.
2. Legal Obligation: Ormastoto is subject to regulatory requirements — including Know Your Customer (KYC) obligations, anti-money-laundering (AML) duties, and responsible gambling obligations — that require us to collect, retain, and in some cases disclose certain categories of Personal Data. This processing is non-negotiable and cannot be opted out of by Players.
3. Legitimate Interests: Ormastoto processes certain categories of Technical Data and Transaction Data on the basis of legitimate interests — specifically, fraud prevention, platform security, service improvement, and the protection of other Players. We conduct a balancing test before relying on this basis to ensure our interests do not override your privacy rights.
4. Consent: Where processing is not covered by the above bases — for example, in relation to optional marketing communications — we will seek your explicit consent before proceding. You may withdraw consent at any time by contacting our support team or adjusting your Account notification preferences.

06 How We Use Your Personal Data

Personal Data collected by ormastoto is used for the following purposes, each of which corresponds to a lawful basis identified in Section 5:

• Account Administration: Creating, maintaining, and closing your Account; verifying your identity; updating your profile; and communicating account-related information such as transaction confirmations, security alerts, and policy updates.
• Payment Processing: Processing deposits and withdrawals through your chosen payment method — whether that is DuitNow, Maybank2u, CIMB Clicks, FPX, Touch 'n Go eWallet, Boost, GrabPay, or any other supported channel — and maintaining an accurate record of all transactions.
• Regulatory Compliance: Fulfilling KYC, AML, and responsible gambling obligations imposed by ormastoto's operating licence. This includes verifying age (21+ requirement), screening against sanctions lists, monitoring for suspicious transaction patterns, and retaining records for the legally required retention periods.
• Fraud Prevention & Security: Detecting and preventing fraudulent activity, multi-accounting, payment fraud, money laundering, and cyberattacks. This includes automated monitoring of transaction patterns and IP address analysis.
• Customer Support: Providing assistance through live chat, email, and WhatsApp; maintaining records of support interactions for quality assurance and dispute resolution purposes.
• Responsible Gambling: Monitoring play patterns to identify potential problem gambling indicators; administering self-exclusion, deposit limits, and reality checks as requested; and proactively reaching out to Players showing concerning behavioural signals.
• Platform Improvement: Analysing aggregated, anonymised usage data to improve the Platform's features, performance, and user experience. No individual Player is identifiable from this analysis.
• Marketing Communications (Consent Only): Sending promotional emails, bonus notifications, or SMS messages to Players who have explicitly opted in to receive such communications. Players may opt out at any time.

07 Data Sharing with Third Parties

Ormastoto does not sell, rent, or commercially exploit your Personal Data. We share Personal Data with third parties only in the following circumstances:

• Payment Processors: Your financial data is shared with our payment processing partners (including FPX gateway operators, e-wallet providers, and bank transfer facilitators) solely to process your deposits and withdrawals. These partners are bound by their own regulatory obligations as licensed financial service providers.
• Identity Verification Partners: KYC Data is shared with licensed identity verification service providers who assist in validating your identity documents against issuing authority databases. All such providers operate under binding data processing agreements.
• Game Studio Software Providers: Limited Account identifiers (not full personal details) are shared with game software providers to facilitate game-session management, RNG certification audits, and dispute resolution for individual game outcomes.
• Regulatory Authorities: Where required by applicable law or by a lawful order from a competent authority, ormastoto may be required to disclose Personal Data to regulatory bodies, law enforcement agencies, or financial intelligence units. We will notify you of any such disclosure where legally permitted to do so.
• Security & Fraud Prevention Partners: Certain Technical Data (including IP addresses and device fingerprints) may be shared with cybersecurity and fraud prevention platforms for the purpose of detecting and blocking malicious activity targeting the Platform or individual Player accounts.
• Analytics Providers: Aggregated, anonymised behavioural data may be shared with analytics platforms to assist in Platform performance monitoring. No individual Player is identifiable from this data.

All third-party Data Processors with whom Personal Data is shared are subject to written data processing agreements that restrict their use of your data to the specified purpose, require them to maintain appropriate security measures, and prohibit them from disclosing your data to sub-processors without prior authorisation from ormastoto.

08 Cookies & Tracking Technologies

Ormastoto uses cookies and similar tracking technologies to operate the Platform, maintain session integrity, and improve user experience. The categories of cookies used are as follows:

• Strictly Necessary Cookies: Essential for the Platform to function. These enable session authentication, Account login, and basic security features. They cannot be disabled without preventing core functionality from working. No consent is required for these cookies.
• Functional Cookies: Used to remember your preferences — such as language settings, preferred game category, and deposit method — to provide a more personalised experience. These are activated based on your Account settings.
• Analytical Cookies: Used to collect anonymised data about how Players navigate the Platform. This data helps us identifyability issues and improve page performance. Consent is sought before these cookies are activated.
• Security Cookies: Used to support fraud detection and prevention, including identifying unusual login patterns, detecting automated bot activity, and verifying device consistency.

You may manage your cookie preferences through your browser settings at any time. Disabling strictly necessary cookies will impair the functionality of your Account and may prevent you from completing deposits, withdrawals, or gameplay. Disabling analytical and functional cookies will not affect access to core services.

09 Data Retention

Ormastoto retains Personal Data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following general retention periods apply:

• Active Account Data: Retained for the duration of the Account's active status and for a period of five (5) years after Account closure, to comply with anti-money-laundering record-keeping requirements.
• KYC Documents: Retained for a minimum of five (5) years following the end of the business relationship, in accordance with regulatory requirements applicable to the Platform's licensing jurisdiction.
• Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, for audit and regulatory compliance purposes.
• Support Communications: Retained for three (3) years from the date of the interaction, for quality assurance, dispute resolution, and training purposes.
• Analytical Data: Anonymised analytical data, which cannot be linked back to any individual, may be retained indefinitely for statistical and product improvement purposes.
• Self-Excluded Players: Identity and exclusion records for self-excluded Players are retained for the duration of the exclusion period, and for a further five (5) years thereafter, to prevent re-registration in breach of a self-exclusion commitment.

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised. You may request early deletion of your data (subject to regulatory retention obligations that override deletion rights) by contacting our support team.

10 Data Security

Ormastoto implements a layered security architecture to protect your Personal Data against unauthorised access, disclosure, alteration, and destruction. Our security measures include:

• Encryption in Transit: All data exchanged between your device and our servers is protected using TLS 1.2 or higher (effectively 256-bit encryption). This applies to all Platform pages, including login, deposit, and withdrawal interfaces.
• Encryption at Rest: Sensitive data stored on our servers — including identity documents, financial details, and password hashes — is encrypted using AES-256 or equivalent algorithms.
• Access Controls: Access to Player Personal Data byormastoto staff is restricted on a strict need-to-know basis, governed by role-based access control policies. All staff with data access undergo data protection training.
• Two-Factor Authentication: All Platform accounts support two-factor authentication (2FA). We strongly recommend all Players activate 2FA as an additional safeguard against unauthorised account access.
• Regular Security Audits: The Platform undergoes periodic third-party penetration testing and security assessments. Identified vulnerabilities are remediated according to risk priority.
• Incident Response: In the event of a confirmed data breach, ormastoto's incident response protocol is activated immediately. Affected Players will be notified promptly and provided with clear information about the incident and recommended protective steps.

Notwithstanding these measures, no digital platform can guarantee absolute security against all possible attack vectors. You are responsible for maintaining the security of your own login credentials and for notifying ormastoto immediately if you suspect unauthorised access to your Account.

11 Your Data Protection Rights

As a Player whose Personal Data is processed by ormastoto, you hold the following rights. All requests can be submitted through the contact channels specified in Section 15. We will respond within thirty (30) days of receiving a valid request.