meriahtoto Privacy Policy

This Privacy Policy ("Policy") sets out how meriahtoto ("Platform", "we", "us", "our"), operating at https://meriahtoto.cam, collects, uses, stores, shares and protects personal data relating to users ("you", "your") who access or interact with the meriahtoto website, account system, payment facilities and related services.

meriahtoto is an English-language online entertainment and information platform providing casino guides, sports betting information, payment documentation and responsible-gambling resources to adults in Malaysia, including users in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam and throughout the country.

By registering an account, submitting personal information or continuing to use meriahtoto, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. This Policy forms part of the meriahtoto Terms and Conditions and should be read alongside the Responsible Gambling policy accessible through the site navigation.

The following definitions apply throughout this Privacy Policy:

• Personal Data: Any information that identifies or could reasonably be used to identify a living individual, directly or in combination with other data.
• Processing: Any operation performed on personal data including collection, recording, storage, use, disclosure or deletion.
• Data Controller: The entity that determines the purposes and means of processing personal data. For meriahtoto, this is the operator of the Platform.
• Data Processor: A third party that processes personal data on behalf of the Data Controller, such as a payment gateway or cloud hosting provider.
• User: Any individual who registers an account on, or otherwise accesses and uses, meriahtoto.
• Cookies: Small text files stored on a user's device by a website to maintain session information, preferences and analytics data.
• KYC Data: Identity and verification documents submitted as part of the Know Your Customer process, including MyKad, passport, proof of address and selfie photographs.

meriahtoto may collect the following categories of personal data, depending on how you interact with the Platform:

3.1 Registration and Account Data

Full name, username, date of birth, email address, mobile phone number, country and state of residence (for example, Kuala Lumpur, Penang or Johor Bahru) and account password in hashed form.

3.2 Identity Verification (KYC) Data

Copies of government-issued identity documents such as Malaysian MyKad, driving licence or passport; proof of address documents such as utility bills or bank statements dated within the last three months; and selfie photographs taken while holding the submitted identity document.

3.3 Financial and Transaction Data

Deposit and withdrawal records, amounts transacted in MYR or cryptocurrency, payment method references (for example, Maybank, CIMB, Public Bank, Touch 'n Go eWallet, Boost, GrabPay, DuitNow or FPX account identifiers), and transaction timestamps. Full payment card numbers or full bank account credentials are not stored by meriahtoto.

3.4 Technical and Device Data

IP address, device type, operating system, browser type and version, screen resolution, referring URL, session duration, pages visited and interactions performed within the Platform.

3.5 Communications Data

Records of correspondence with meriahtoto support, including emails, live chat transcripts and any attachments submitted by the user.

3.6 Behavioural and Gaming Data

Game session history, wagering records, sports bet selections, platform activity timestamps, bonus usage and responsible-gambling tool settings such as deposit limits or self-exclusion status.

meriahtoto collects personal data through the following channels:

• Direct submission: Information you provide when registering an account, completing KYC verification, initiating a deposit or withdrawal, contacting support or updating account preferences.
• Automated collection: Technical and device data collected automatically when you access meriahtoto, through server logs, session cookies, analytics tools and similar technologies.
• Third-party sources: Identity verification data from KYC service providers, fraud-detection signals from payment processors and, where applicable, publicly available data used for compliance screening.
• Cookies and tracking technologies: Data gathered through functional, analytical and security cookies as described in Section 10 of this Policy.

meriahtoto processes personal data for the following purposes:

meriahtoto processes personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing is required to register your account, process transactions, administer bonuses and provide the services you have requested.
• Legal obligation: Processing is required to fulfil anti-money laundering (AML), Know Your Customer (KYC), age verification and other regulatory requirements applicable to the Platform's operating jurisdiction.
• Legitimate interests: Processing is necessary for fraud prevention, security monitoring, platform optimisation and the protection of the meriahtoto platform and its users, where such interests are not overridden by your fundamental rights.
• Consent: Where we rely on your consent for a specific processing activity, such as non-essential cookies or marketing communications, you have the right to withdraw that consent at any time without affecting the lawfulness of prior processing.

meriahtoto does not sell or rent personal data to third parties for their own marketing purposes. Personal data may be disclosed to third parties only in the following circumstances:

• Service providers and data processors: Trusted third-party vendors who process data on our behalf under contractual data-processing agreements. This includes payment gateway operators (covering methods such as FPX, DuitNow, Touch 'n Go eWallet, Boost and GrabPay integrations), KYC verification providers, cloud hosting services, customer support platforms and fraud-detection tools.
• Legal and regulatory bodies: Where disclosure is required by applicable law, court order, regulatory authority or licensing jurisdiction, meriahtoto will comply with valid legal requests. Where legally permissible, we aim to notify affected users before disclosure.
• Business transfers: In the event of a merger, acquisition, restructuring or sale of assets, personal data may be transferred to the relevant successor entity. Users will be notified of any such transfer and any material changes to this Policy that result from it.
• Protection of rights: Where disclosure is necessary to investigate, prevent or act upon fraudulent activity, security incidents, prohibited conduct or violations of the meriahtoto Terms and Conditions.

meriahtoto retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. General retention guidelines include:

• Account data: Retained for the duration of the active account relationship and for a defined period following account closure, to facilitate dispute resolution and comply with regulatory obligations.
• KYC and identity documents: Retained for the minimum period required by the Platform's applicable licensing jurisdiction, which commonly ranges from five to seven years from the date of submission or account closure.
• Transaction records: Retained for the period required by anti-money laundering and financial record-keeping regulations applicable to the meriahtoto operating jurisdiction.
• Technical and device data: Retained for periods appropriate to security monitoring and platform analytics purposes, typically up to 24 months in identifiable form, after which data may be anonymised or deleted.
• Support communications: Retained for up to 36 months from the date of the most recent interaction, or longer where a dispute or compliance matter remains unresolved.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in a manner that prevents re-identification.

meriahtoto implements appropriate technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction or disclosure. Measures currently in place include:

• Transport Layer Security (TLS / HTTPS) encryption for all data transmitted between users and the Platform.
• Hashed storage of account passwords; plain-text passwords are never stored or transmitted.
• Role-based access controls limiting internal data access to authorised personnel with a demonstrated business need.
• Routine security assessments and vulnerability monitoring of Platform infrastructure.
• Contractual data-processing obligations imposed on all third-party service providers with access to personal data.

While meriahtoto takes these measures seriously, no internet-based system can guarantee absolute security. Users are also responsible for their own account security, including maintaining a strong, unique password, not sharing login credentials, and reporting suspicious account activity promptly.

meriahtoto uses cookies and similar technologies to operate the Platform, maintain session security and understand how users interact with content. Cookie categories in use include:

• Strictly necessary cookies: Essential for the Platform to function, including session authentication, security tokens and load-balancing. These cannot be disabled without affecting core functionality.
• Functional cookies: Store user preferences such as language settings, display preferences and previously used payment methods to improve the browsing experience across sessions.
• Analytical cookies: Collect anonymised or pseudonymised data about page visits, navigation paths and session duration to help meriahtoto improve content and usability.
• Security cookies: Used to detect and mitigate fraudulent sessions, bot activity and suspicious access patterns.

Users may manage or disable non-essential cookies through their browser's privacy or cookie settings. Note that disabling certain cookies may impair the functionality of meriahtoto, including the ability to maintain a logged-in session. meriahtoto does not use third-party advertising or profiling cookies for the purpose of targeted advertising to its users.

Subject to applicable data protection law and the Platform's legal obligations, users may hold the following rights in relation to their personal data held by meriahtoto:

To exercise any of the above rights, please contact meriahtoto using the details set out in Section 15. We will respond to verifiable requests within a reasonable timeframe, subject to identity verification and any applicable legal constraints.

meriahtoto is strictly intended for adults aged 21 years and above. The Platform does not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory step in the KYC process, and any account found to be held by a person under 21 will be suspended immediately and relevant data reviewed in accordance with applicable law.

If meriahtoto becomes aware that personal data has been collected from a minor without appropriate parental or guardian consent, that data will be deleted promptly. Parents or guardians who believe their child has submitted personal data to meriahtoto are encouraged to contact us immediately at the address in Section 15 so that appropriate action can be taken.

meriahtoto's infrastructure and third-party service providers may be located outside of Malaysia. Personal data may therefore be transferred to and stored in servers or processing facilities in other countries. In such cases, meriahtoto takes steps to ensure that transfers occur only to jurisdictions or providers that offer appropriate data protection safeguards, such as contractual data-processing agreements that include data protection clauses meeting applicable international standards.

By using meriahtoto, you acknowledge and consent to the transfer of your personal data to countries outside Malaysia as described in this Policy. If you have concerns about cross-border data transfers, please contact us using the details in Section 15.

meriahtoto may update this Privacy Policy at any time. Material changes — those that significantly affect how personal data is collected, used or shared — will be communicated through a prominent notice on the Platform for a reasonable period before taking effect. Non-material changes, such as typographic corrections or clarifications that do not alter user rights, may be applied without prior notice.

It is your responsibility to review this Policy periodically. The effective date of the most recent revision will be displayed at the bottom of this page. Continued use of meriahtoto following the effective date of any update constitutes acceptance of the revised Policy. If you disagree with any material change, you should discontinue use of the Platform and contact support to close your account.

If you have any questions, concerns or requests relating to this Privacy Policy or the processing of your personal data by meriahtoto, please contact us using the details below:

Please do not attach sensitive identity documents to standard support emails unless specifically instructed to do so through a verified, secure meriahtoto channel. Always verify the sender address before responding to any communication that requests personal information.

Privacy Policy last revised: 1 January 2026.