Nawatoto values the privacy of every member. This document clearly explains what data we collect, how it is used, how it is protected, and your rights as a Malaysian user under the Personal Data Protection Act 2010 (PDPA).
Before reading the full policy, here are the core principles that shape how Nawatoto handles the personal data of all Malaysian members.
Nawatoto fully complies with the requirements of Malaysia's Personal Data Protection Act 2010 (PDPA). This means your data is collected, used, and stored within a legal framework that protects your privacy rights as a Malaysian user. We do not take this compliance responsibility lightly.
Every bit of data transmitted between your device and Nawatoto's servers is protected by 256-bit SSL encryption — the same level of protection used by Malaysia's leading banks, including Maybank and CIMB. This ensures that your login credentials, transaction data, and personal information cannot be intercepted by unauthorised parties.
Nawatoto only collects personal data that is necessary for clear and legitimate purposes — account verification, payment processing, customer support, and service improvement. We do not collect data that is excessive or irrelevant to the platform's operational needs.
Your personal data will not be sold, rented, or shared with any third party for marketing or commercial purposes without your explicit consent. This is a line Nawatoto will never cross under any circumstances. Your trust is an asset we value beyond measure.
As a Nawatoto member, you have the right to access, correct, transfer, and request the deletion of your personal data at any time. Requests will be processed within 14 business days, and we will ensure your data is handled in accordance with your wishes within the bounds of applicable legal obligations.
Nawatoto believes you deserve to know exactly what we do with your data. This Privacy Policy is written in plain, straightforward English — no confusing legal jargon or hidden clauses that make it hard to understand your actual rights.
Nawatoto collects personal data from members in several situations — during registration, while using the platform, and when you interact with our services. Each category of data is collected for a specific reason and does not exceed what is necessary for that purpose.
Data collected at registration:
Data collected during platform use:
Data collected for the KYC (Know Your Customer) process:
Nawatoto only uses the personal data we collect for legitimate and transparent purposes. We will not use your data for any other purpose without first notifying you and obtaining the necessary consent.
The primary purposes for which Nawatoto uses your personal data are as follows:
Protecting member personal data is Nawatoto's highest priority. We continuously invest in the latest security infrastructure and practices to ensure your data is safeguarded against all forms of cyber threats.
Technical security measures we have in place:
While Nawatoto takes all reasonable steps to protect your data, no digital security system can guarantee 100% absolute protection. In the event of a security incident that may affect your personal data, we will notify you within 72 hours of detecting the incident and take appropriate remediation measures.
Nawatoto does not sell members' personal data to any party. However, in the course of normal platform operations, there are specific situations where selected information must be shared with trusted third parties. All such sharing is strictly controlled and limited to what is necessary.
Third parties that may receive limited data from Nawatoto:
| Third Parties | Data Type | Purpose | For Sale? |
|---|---|---|---|
| Payment Gateway (TnG, GrabPay, FPX) | Transaction information | Deposit/withdrawal processing | No |
| Game Providers | Player ID, game session | Technical / dispute resolution | No |
| Malaysian Authorities | As required by law | Legal compliance | No |
| IT Infrastructure Provider | Limited technical data | System maintenance | No |
| Third-Party Marketing Companies | None | Not Applicable | Never |
Nawatoto uses cookies and similar tracking technologies to enhance your experience on the platform. Cookies are small text files stored on your device when you visit our website — they help us recognise you on return visits and ensure the platform functions correctly according to your preferences.
Types of cookies used by Nawatoto:
You can manage cookie usage through your web browser settings. However, disabling essential cookies may affect platform functionality. For information on how to manage cookies in your browser, please refer to the relevant browser's help section.
As a Malaysian user protected under the Personal Data Protection Act 2010 (PDPA), you have a range of rights in relation to your personal data. Nawatoto respects and will fulfil all these rights in accordance with the applicable legal provisions.
Right of Access
You have the right to request a copy of the personal data we hold about you. Nawatoto will provide a comprehensive report of the data in our records within 14 working days of receiving your request. The first request is free of charge; subsequent requests may be subject to a reasonable nominal fee.
Right to Rectification
If the personal data we hold is inaccurate, incomplete, or outdated, you have the right to request a correction. You can update basic details such as your phone number and payment information directly through your account settings. For corrections to more sensitive information such as your name or date of birth, please contact customer support with the relevant supporting documents.
Right to Erasure
You may request the deletion of your personal data. Nawatoto will fulfil such requests to the extent permitted by law — some data may need to be retained for legal compliance, financial auditing, or unresolved dispute resolution purposes.
Right to Object to Processing
You have the right to object to the processing of your personal data for specific purposes — in particular, for direct marketing. Once an objection for marketing purposes is received, Nawatoto will immediately cease using your data for that purpose.
Data Portability Right
You may request a copy of your personal data in a machine-readable format (CSV or JSON) for transfer to another service provider. Nawatoto will provide the data export within 30 working days of receiving a valid request.
Right to Restriction of Processing
In certain circumstances — such as when you are disputing the accuracy of your data or are in the process of objecting to its processing — you may request that the processing of your personal data be temporarily restricted until the matter is resolved.
Nawatoto retains your personal data for as long as it is needed to fulfil the purposes stated in this policy, or as required by applicable Malaysian law. Retention periods vary by data type:
Once the applicable retention period has expired, your personal data will be securely deleted or anonymised so that it can no longer be linked to you personally.
The Nawatoto platform is exclusively for individuals aged 18 and above. We do not knowingly collect or process personal data of minors. All members are required to confirm that they are at least 18 years of age at the point of registration.
If Nawatoto discovers that personal data of a minor has been inadvertently collected, we will take the following steps immediately:
Nawatoto reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, new legal requirements, or technological developments that affect how we handle personal data.
When material amendments are made to this policy, Nawatoto will:
Your continued use of the Nawatoto platform after any policy changes take effect will be considered acceptance of the updated policy. If you disagree with any changes, you have the right to close your account before those changes come into effect.
If you have any questions, concerns, or requests regarding this Privacy Policy or how Nawatoto handles your personal data, we encourage you to reach out to us through the appropriate channels:
All privacy-related complaints are handled by Nawatoto's Data Protection Officer (DPO), who is responsible for ensuring PDPA compliance and processing all data rights requests accurately and in a timely manner.
If, after contacting Nawatoto, you remain unsatisfied with how your privacy complaint was handled, you have the right to lodge a complaint with the Personal Data Protection Commissioner of Malaysia in accordance with the procedures set out under PDPA 2010.
Many Malaysian online players sign up on platforms without ever reading the privacy policy — and honestly, it's easy to see why. These documents are usually lengthy, full of legal language, and seem designed to confuse rather than clarify. At Nawatoto, we take a different approach. This Privacy Policy is written for you to actually read and understand — not to be scrolled past and "Agreed" to without knowing what you're signing up for.
The first thing you should know: Nawatoto operates under Malaysia's Personal Data Protection Act 2010 (PDPA). This isn't just a label we put on for appearances — the PDPA is legislation that gives you real, enforceable rights over your personal data. We are legally required to comply with it, and we also believe it's simply the right way to operate.
When you register at Nawatoto and make a deposit using Touch 'n Go eWallet, GrabPay, DuitNow or FPX, you grant us access to certain personal information. We understand that this trust should never be taken lightly. Your phone number, transaction records, and gaming activity are all sensitive data that we store and protect with the utmost seriousness. 256-bit SSL encryption is more than just a technical term — it means every transaction you make, from an RM50 deposit to an RM5,000 withdrawal, is transmitted through a channel that no third party can intercept or read.
One thing Nawatoto wants to make absolutely clear: we have never sold and will never sell your data to any third party. This is not merely a moral commitment — it is an operational policy enforced at a technical level as well. Our systems have no mechanism to export member data lists to external third parties. When you receive promotions or communications from Nawatoto, they come directly from us, based on your activity on the platform — not from data companies or third-party information brokers.
On the topic of cookies — yes, Nawatoto uses cookies. But our use of them is limited and purposeful. Essential cookies ensure you don't have to log in again every time you open a new tab. Preference cookies remember things like your preferred slots display size or layout settings. Analytics cookies help us understand that more Malaysian players prefer to play Live Casino baccarat on Saturday nights than Tuesday mornings — this kind of insight helps us plan our promotion schedules and ensure our servers can handle peak-hour demand.
Your PDPA rights at Nawatoto are not just words on paper — they are fully enforceable. If you want to know what data we hold about you, you can request it and we are obligated to provide it within 14 working days. If any information is incorrect — such as an old phone number or a misspelled name — you can request a correction and it will be updated. If you ever decide to stop playing and close your account, we will delete any data that does not need to be retained under applicable law within the stipulated timeframe.
On data retention — this is an area many people don't fully understand. Nawatoto cannot simply delete all your records immediately upon account closure. Financial transaction records must be kept for 7 years under Malaysian tax law. KYC records must be retained for 6 years under AMLA. These are not choices we make — they are legal obligations that, if breached, would expose us to legal action. What we can and will do is ensure that retained data is not used for any other purpose and is securely protected until the retention period ends.
Finally, if you have any questions about how Nawatoto handles your data privacy, don't hesitate to ask. Our Live Chat is available 24/7, and our team is fluent in Bahasa Malaysia — no language barrier stands between you and a clear answer. Your privacy is our responsibility, and it's one we take seriously.
Contact the Privacy Team
Related Documents
Current Version
January 2026
This update reflects the addition of data portability provisions and further clarification on the use of analytics cookies.
Previous versions are available upon request at support@nawatoto.best.
Answers to the most frequently asked questions about privacy and data protection at Nawatoto.
Data privacy and responsible gambling go hand in hand at Nawatoto — two commitments that strengthen each other.
Deposit Limit Information is Strictly Confidential
When you set deposit limits or responsible gambling controls on your Nawatoto account, that information is kept strictly confidential. It will not be shared with game providers or any other third parties, and will not be used to target you with marketing communications.
Self-Exclusion Enforced Across Platforms
When you choose to self-exclude on Nawatoto, this information is securely shared with game providers to ensure you cannot access their games through other platforms that use the same system. This is in place to protect your best interests.
Activity Data Used to Detect Risk Patterns
Nawatoto uses gameplay activity data responsibly to identify patterns that may indicate problem gambling — such as sudden spikes in deposits or unusually long play sessions. This is one use of data we consider both responsible and meaningful.
Assistance Referrals Handled Confidentially
If Nawatoto's support team refers you to responsible gambling resources such as Talian Kasih 15999, that interaction is handled in strict confidence and is not recorded in your promotional profile. Full privacy controls are maintained in these sensitive situations.