Privacy Policy

This Privacy Policy ("Policy") describes how skintoto ("we", "us", "the Operator", "the Platform"), operating the online casino and sports betting platform atskintoto.cam, collects, processes, stores, and shares personal information relating to individuals ("you", "the Player", "the User") who access or use our services.

Skintoto is committed to handling personal data responsibly, transparently, and in a manner consistent with applicable data protection principles. This Policy applies to all personal data collected in connection with your use of the skintoto Platform, including data collected during account registration, identity verification (KYC), financial transactions, customer support interactions, and your ongoing gaming activity on the Platform.

By registering an account on skintoto, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with the terms of this Policy, you should not create an account or use the Platform.

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

• "Personal Data" — any information that relates to an identified or identifiable natural person, including but not limited to name, identification number, email address, IP address, device identifiers, financial account details, and gaming activity records.
• "Processing" — any operation performed on Personal Data, whether automated or manual, including collection, recording, storage, retrieval, use, disclosure, deletion, or destruction.
• "Data Controller" — the entity that determines the purposes and means of processing Personal Data. For the purposes of this Policy, skintoto is the Data Controller in respect of all Personal Data collected through the Platform.
• "Data Processor" — a third party that processes Personal Data on behalf of the Data Controller, under documented instructions and subject to appropriate contractual safeguards.
• "KYC Data" — identity verification documents and information submitted by a Player to satisfy Know Your Customer and Anti-Money Laundering obligations, including government-issued photo identification and proof of address.
• "Cookies" — small text files placed on a Player's device by the Platform to facilitate session management, analytics, and personalisation functions.
• "Third Parties" — entities external to skintoto, including payment processors, game software providers, identity verification services, and analytics partners, that may receive or process Personal Data in connection with the operation of the Platform.

Skintoto collects Personal Data across several categories depending on your interaction with the Platform. The following table summarises the principal categories of data collected, the specific data points within each category, and the primary purpose for which each is collected:

4.1 Data You Provide Directly

We collect Personal Data that you actively provide to us when you create an account on the Platform, complete our KYC verification process, make a deposit or withdrawal request, contact our customer support team, participate in promotional activities, or update your account settings or communication preferences.

4.2 Data Collected Automatically

When you access or use the skintoto Platform, we automatically collect certain technical data about your device and interaction with our services. This includes your IP address, browser type and version, device identifiers, operating system, session start and end times, pages visited, and actions taken on the Platform. This data is collected using standard server logging mechanisms and first-party analytics tools.

4.3 Data Collected via Cookies

The skintoto Platform uses cookies and similar tracking technologies to facilitate your session, remember your preferences, and collect anonymised analytics data about how the Platform is used. For full details on our use of cookies, please refer to Section 8 of this Policy.

4.4 Data Received from Third Parties

We may receive Personal Data about you from third parties in limited circumstances, including from identity verification service providers during KYC processing, from payment processors confirming the status of a financial transaction, or from fraud prevention services conducting checks on your account.

Skintoto uses the Personal Data we collect for the following purposes:

• Account Administration: Creating, maintaining, and securing your player account, including processing login requests, managing account settings, and sending transactional communications such as deposit confirmations and withdrawal notifications.
• Identity and Age Verification: Conducting KYC checks to confirm your identity and verify that you are aged 21 or above, in compliance with our responsible gambling obligations and applicable regulations.
• Payment Processing: Facilitating deposits via Touch 'n Go eWallet, DuitNow, FPX, Maybank, CIMB, and other supported Malaysian payment methods, and processing withdrawal requests to your verified payment instruments.
• Fraud Prevention and Anti-Money Laundering: Monitoring account activity for signs of fraud, money laundering, collusion, bonus abuse, or other prohibited conduct, and taking appropriate action where such activity is detected.
• Responsible Gambling: Monitoring gaming activity patterns to identify potential problem gambling behaviour, administering deposit limits, session reminders, cooling-off periods, and self-exclusion requests, and intervening where necessary to protect player wellbeing.
• Customer Support: Responding to your enquiries, resolving disputes, and processing complaints submitted via live chat, email, or any other support channel.
• Platform Improvement: Analysing aggregated and anonymised usage data to understand how players interact with the Platform and to inform improvements to our services, game selection, and user interface.
• Legal and Regulatory Compliance: Meeting our obligations under applicable law, including the retention of transaction records for Anti-Money Laundering (AML) and regulatory audit purposes.
• Marketing Communications: Sending promotional offers, bonus notifications, and platform updates to players who have opted in to receive such communications. You may withdraw consent at any time via your account settings or by contacting our support team.

Skintoto processes your Personal Data on the following legal bases:

• Contractual Necessity: Processing is necessary to perform the contract between you and skintoto — specifically, to operate your account, process transactions, and deliver the gaming and betting services you have registered to use.
• Legal Obligation: Certain processing activities are required to enable us to comply with applicable legal obligations, including KYC and AML requirements, the retention of financial transaction records, and the reporting of suspicious activity to relevant authorities.
• Legitimate Interests: We process certain data based on our legitimate interests as a platform operator, including fraud detection, security monitoring, platform analytics, and responsible gambling interventions, where these interests are not overridden by your rights and interests.
• Consent: Where processing is not required by contract or law and is not covered by our legitimate interests, we will request your explicit consent. The most common example is marketing communications — we will only send promotional emails or messages if you have opted in to receive them. You may withdraw consent at any time without penalty.

7.1 Our Commitment Against Data Sales

Skintoto does not sell, rent, or trade your Personal Data to any third party for commercial or marketing purposes under any circumstances. This is a firm and unconditional commitment.

7.2 Service Providers and Data Processors

We share Personal Data with trusted third-party service providers acting as Data Processors under our instructions, solely to enable them to provide services on our behalf. These include:

• Payment Processors: Including the operators of FPX, DuitNow, and the merchant processing networks behind Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and Hong Leong integrations, and card networks (Visa/Mastercard) — for the purpose of processing your deposits and withdrawals.
• Identity Verification Providers: Third-party KYC and document verification services that process copies of your identification documents to confirm identity and age.
• Fraud Prevention Services: Services that analyse transaction patterns and account behaviour to detect and prevent fraudulent activity, money laundering, and account takeover.
• Game Software Providers: Casino game developers and live dealer studio operators whose games are integrated into the skintoto Platform may receive limited technical data (such as player session identifiers) to facilitate gameplay and game results.
• Analytics Providers: Anonymised and aggregated usage data may be processed by analytics tools to help us understand platform performance. No individually identifiable data is shared for analytics purposes.

7.3 Legal Disclosures

We may disclose Personal Data to regulatory authorities, law enforcement bodies, or courts where we are legally compelled to do so, or where disclosure is reasonably necessary to investigate or prevent fraud, money laundering, or other unlawful activity related to the use of the Platform.

7.4 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of skintoto's assets, Personal Data held by the Platform may be transferred to the acquiring entity as part of that transaction. We will notify registered players of any such transfer and the acquiring entity will be required to honour this Privacy Policy.

The skintoto Platform uses cookies and similar technologies (including local storage and session tokens) to support the operation and improvement of our services. The following categories of cookies are used:

• Essential Cookies: Required for the Platform to function. These include session authentication cookies that keep you logged in during your session, security tokens that protect against cross-site request forgery (CSRF), and load balancing cookies. These cookies cannot be disabled without preventing normal use of the Platform.
• Functional Cookies: Used to remember your preferences, such as your selected language, display settings, and whether you have accepted this Privacy Policy. These improve your experience but are not strictly necessary for the Platform to operate.
• Analytics Cookies: Used to collect anonymised data about how players navigate the Platform, which pages are most visited, and where technical issues occur. This data helps us improve the Platform and is not used to identify individual players.
• Security Cookies: Used in conjunction with our fraud detection systems to monitor login patterns and flag unusual account activity.

You may manage cookie preferences through your browser settings. Please note that disabling essential cookies will impair your ability to use the Platform, including logging in to your account. Skintoto does not use third-party advertising or behavioural tracking cookies.

Skintoto retains your Personal Data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. The following general retention principles apply:

• Active Account Data: Personal Data associated with an active player account is retained for the duration of the account's active status.
• Financial and Transaction Records: Records of deposits, withdrawals, and betting activity are retained for a minimum of five (5) years following the relevant transaction date, in compliance with AML and financial record-keeping obligations.
• KYC Documents: Identity verification documents are retained for a minimum of five (5) years following account closure or the last transaction date, whichever is later.
• Customer Support Records: Communications with our support team are retained for a minimum of three (3) years to facilitate dispute resolution and service quality assurance.
• Marketing Data: Consent records and marketing communication logs are retained for as long as the associated marketing preference remains active, plus a reasonable period thereafter for compliance purposes.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised so that it can no longer be attributed to any individual.

Skintoto implements technical and organisational security measures designed to protect your Personal Data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• Transport Layer Security (TLS) encryption for all data transmitted between your device and the skintoto Platform.
• Encryption of sensitive data at rest, including financial account details and KYC documents.
• Access controls ensuring that Personal Data is accessible only to authorised personnel who require it for their designated role.
• Regular security assessments and penetration testing of Platform infrastructure.
• Multi-factor authentication options for player account access.
• Incident response procedures to detect, contain, and report data security incidents in a timely manner.

In the event of a data security incident that is likely to result in a risk to your rights and freedoms, we will notify affected players without undue delay in accordance with our obligations under applicable data protection law.

As a player on the skintoto Platform, you hold following rights in respect of your Personal Data. You may exercise any of these rights by contacting our support team via live chat or at [email protected]:

We will acknowledge all data rights requests within 5 business days and respond substantively within 30 calendar days. Where a request is complex or we receive a high volume of requests, we may extend this period by a further 30 days and will notify you accordingly. There is no charge for exercising your rights in ordinary circumstances.

Please note that certain rights, particularly the right to erasure, are subject to overiding legal obligations. For example, we cannot delete financial transaction records that we are legally required to retain under AML regulations. Where we cannot fully satisfy a request, we will explain the legal basis for the limitation in our response.

The skintoto Platform is strictly for individuals aged 21 years and above. We do not knowingly collect, process, or retain Personal Data from individuals under the age of 21. Age verification is a mandatory component of our KYC process, and we actively screen for and take action against underage account registrations.

If we become aware that Personal Data has been collected from an individual who is under 21 years of age, we will promptly close the associated account, erase the collected data to the extent permitted by law, and take any other steps required by our responsible gambling obligations. If you have reason to believe that a person under 21 has registered an account on the Platform, please notify us immediately via our support team.

The skintoto Platform does not contain links to third-party websites or services, except where expressly required for payment processing (e.g., redirecting to your bank's online portal for FPX transactions). Skintoto is not responsible for the privacy practices or content of any external websites or services that you may access in connection with payment processing.

When you are redirected to a third-party payment portal (for example, your Maybank online banking portal, the FPX gateway, or the Touch 'n Go eWallet app), you are subject to that third party's privacy policy and terms of service for the duration of that interaction. Skintoto does not collect or retain your full banking credentials — we receive only a confirmation of transaction status from the payment gateway.

Skintoto reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or the services we offer. The "Last updated" date at the top of this page indicates when the most recent revision was made.

Where changes to this Policy are material — for example, where we introduce a new category of data processing or change how we share data with third parties — we will notify registered players via on-platform notification and/or their registered email address at least 14 days before the changes take effect.

Your continued use of the skintoto Platform following the effective date of any amendment constitutes your acceptance of the revised Policy. If you do not agree with the amended Policy, you should discontinue use of the Platform and may request account closure in accordance with Section 12.2 of our Terms and Conditions.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data by skintoto, please contact us through any of the following channels:

• Live Chat: Available24/7 directly on the skintoto Platform. Average response time: 3–5 minutes. This is the recommended channel for urgent matters including suspected data breaches or account security concerns.
• Email: [email protected] — for non-urgent privacy enquiries, data rights requests, and formal complaints. Responses within 24–48 hours for standard enquiries.

When submitting a data rights request by email, please include your registered email address, account username, and a clear description of the right you wish to exercise or the data matter you are enquiring about. We may need to verify your identity before processing your request to ensure the security of your Personal Data.

For general questions about how the Platform works, ourFAQ page covers the most common questions from Malaysian players. For questions about your rights as a user of the Platform, our Terms and Conditions provide additional context alongside this Privacy Policy.