Your privacy is a priority at Zorototo, not an afterthought. This Privacy Policy explains exactly what personal data we collect, why we collect it, how it is used, who it is shared with, and what rights you hold over your own information.
Our Commitments
All personal data held by Zorototo is stored on encrypted servers. Sensitive fields — including payment information and identification documents — are protected with industry-standard AES-256 encryption at rest.
Zorototo does not sell, rent, or trade your personal data to third-party advertisers, data brokers, or marketing platforms. Your information is collected strictly to operate your account and improve your experience.
You hold meaningful rights over your personal data: the right to access it, correct inaccuracies, request deletion, and object to certain processing. We honour these rights and respond within 30 days of any valid request.
We apply a data minimisation principle: we only collect the personal data that is strictly necessary to provide our services, comply with regulatory obligations, and maintain a safe platform environment.
Where data must be shared with third parties — such as payment processors or KYC verification providers — we use contractual data processing agreements to ensure your data is handled to the same standard we apply internally.
Personal data is not held indefinitely. We apply defined retention periods based on regulatory requirements and operational necessity, after which data is securely deleted or anonymised.
Zorototo Privacy Commitment: We do not sell your personal data. We do not share it with advertisers. We collect only what is necessary to operate your account, process your transactions, and meet our regulatory obligations. This policy is written to be clear and readable — not buried in legalese.
This Privacy Policy ("Policy") is issued by Zorototo ("we", "us", "our", "the Company", "the Platform") and applies to all personal data collected from users ("you", "User", "Player") of the Zorototo website at zorototo.cam and all associated services, features, and content accessible through the Platform.
Zorototo operates as an internationally licensed online sports betting and live casino platform serving players across Malaysia, including users in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and surrounding areas. In the course of providing our services, we necessarily collect and process certain categories of personal data. This Policy sets out the full scope of that processing in clear, accessible terms.
By accessing the Zorototo Platform, registering an account, making a deposit, or otherwise using our services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you must discontinue use of the Platform.
This Policy should be read alongside our Terms & Conditions, which govern the overall contractual relationship between you and Zorototo.
For the purposes of this Privacy Policy, the following definitions apply:
| "Personal Data" | Any information relating to an identified or identifiable natural person — including name, identification number, location data, online identifier, or factors specific to the physical, physiological, economic, or social identity of that person. |
| "Processing" | Any operation performed on Personal Data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, erasure, or destruction. |
| "Data Controller" | Zorototo, the entity that determines the purposes and means of Processing of Personal Data collected through the Platform. |
| "Data Processor" | A third party that Processes Personal Data on behalf of Zorototo pursuant to a written data processing agreement. |
| "KYC Data" | Identity verification documents and supporting materials submitted by a User as part of the Know Your Customer verification process, including government-issued identification, proof of address, and biometric photographs. |
| "Cookies" | Small text files placed on a User's device by the Platform that store session information, preferences, and behavioural data for the purposes described in Section 10. |
Zorototo collects the following categories of personal data in connection with the registration and operation of User accounts and the provision of our services:
Special Category Data: Zorototo does not intentionally collect special category data (including health information, racial or ethnic origin, political opinions, religious beliefs, or biometric data beyond standard KYC photographs). If you voluntarily disclose such information through support communications, we will handle it with heightened care and will not Process it for any purpose beyond resolving the specific matter raised.
Zorototo collects personal data through the following channels and mechanisms:
The majority of personal data we hold is provided directly by you when you: register an account; complete the KYC verification process; make deposits or withdrawal requests; contact our customer support team; participate in promotions or loyalty programmes; or complete any other form or input on the Platform.
Certain technical and behavioural data is collected automatically when you access and interact with the Platform. This includes IP addresses, session data, device information, and in-session activity logs, which are captured through our platform infrastructure and analytics systems.
Where you use a third-party payment channel — such as Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX-connected banks (including Maybank, CIMB, Public Bank, and Hong Leong), or cryptocurrency networks — those providers may pass transaction reference data to Zorototo to confirm the completion and legitimacy of a deposit or withdrawal. We receive only the minimum data necessary for this purpose.
In some cases, third-party KYC verification service providers may supplement the data you provide with verification results or risk scores derived from publicly available databases. This is solely for the purpose of identity verification and fraud prevention.
Zorototo processes your personal data only for specific, legitimate purposes. The table below maps the categories of data we collect to the purposes for which they are used:
| Purpose | Data Categories Used |
|---|---|
| Account registration and management | Identity Data, Contact Data |
| Identity verification (KYC) and age confirmation | Identity Data, KYC documents, photographs |
| Processing deposits and withdrawals | Financial Data, Identity Data |
| Anti-money laundering (AML) compliance monitoring | Financial Data, Betting Activity, Identity Data |
| Fraud detection and prevention | Technical Data, Financial Data, Betting Activity |
| Provision of betting and gaming services | Betting Activity Data, Technical Data |
| Customer support and dispute resolution | Communications Data, Identity Data, Financial Data |
| Responsible gambling monitoring and intervention | Betting Activity Data, Financial Data, Communications Data |
| Loyalty programme operation | Betting Activity Data, Identity Data |
| Platform security and access control | Technical Data, Identity Data |
| Legal and regulatory compliance | All categories as required |
Zorototo does not use your personal data for unsolicited marketing to third parties, profiling for commercial sale, or any purpose not listed above without obtaining your prior explicit consent.
Zorototo processes personal data under the following legal bases, in accordance with applicable data protection principles:
Zorototo does not sell, rent, or trade your personal data. We share personal data only in the following limited and controlled circumstances:
Financial data is shared with the payment service providers you choose to use — including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX banks (Maybank, CIMB, Public Bank, Hong Leong), and cryptocurrency network processors — solely to facilitate the deposit and withdrawal transactions you have requested. These providers are bound by their own data protection obligations.
Identity Data and KYC documents are shared with our third-party identity verification service provider(s) for the purpose of verifying your identity and confirming your age. These providers are engaged under contractual data processing agreements and are not permitted to use your data for any other purpose.
Zorototo may disclose personal data to competent regulatory authorities, law enforcement agencies, or courts where required or permitted to do so by applicable law — including in connection with anti-money laundering investigations, fraud inquiries, or lawful court orders. We will notify you of such disclosure where we are legally permitted to do so.
In the event of a merger, acquisition, restructuring, or sale of all or substantially all of Zorototo's assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and the applicable data protection terms that will govern your data going forward.
We do not share your data with advertisers. Third-party marketing platforms, data brokers, and ad networks have no access to Zorototo user data. Your personal data is never used to serve you targeted advertising on other platforms.
As an internationally licensed platform, Zorototo may process or store your personal data in jurisdictions outside Malaysia, including in the jurisdiction in which our platform is licensed and operated. When your personal data is transferred internationally, we take appropriate measures to ensure that such transfers are lawful and that your data is afforded a level of protection equivalent to that applied within Malaysia.
Such measures may include the use of standard contractual clauses, data processing agreements, or reliance on adequacy decisions applicable to the receiving jurisdiction. By using the Zorototo Platform, you consent to the international transfer of your personal data on these terms.
Zorototo retains personal data for only as long as necessary to fulfil the purposes for which it was collected, subject to applicable legal retention requirements. The following general retention principles apply:
Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Anonymised, aggregated data (from which individual Users cannot be identified) may be retained indefinitely for platform analytics and improvement purposes.
The Zorototo Platform uses cookies and similar tracking technologies to operate effectively, maintain session security, and improve the user experience. Cookies are small text files stored on your device by your browser when you visit the Platform.
You can manage or disable cookies through your browser settings. Please note that disabling strictly necessary cookies may prevent you from logging in to your Zorototo account or using core Platform features. For performance and functionality cookies, disabling them may reduce the quality of your experience without affecting core functionality.
No Third-Party Advertising Cookies: Zorototo does not allow third-party advertising networks to place cookies on our Platform for the purpose of tracking you across other websites or serving you targeted advertisements.
Zorototo implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. These measures include:
Whilst Zorototo takes all reasonable and practicable security measures, no online system can guarantee absolute security. In the event of a personal data breach that poses a risk to your rights, we will notify affected Users as soon as reasonably practicable and in accordance with our notification obligations under applicable law.
Security Tip: You play an important role in protecting your own data. Use a strong, unique password for your Zorototo account. Never share your login credentials with anyone. Zorototo staff will never ask you for your password by any means of communication.
Subject to applicable law and certain conditions, you hold the following rights in relation to your personal data held by Zorototo. To exercise any of these rights, please contact us at [email protected] with "Data Rights Request" in the subject line. We will respond within 30 calendar days of receipt.
Request a copy of all personal data we hold about you, along with information on how it is used and to whom it has been disclosed.
Request correction of any inaccurate or incomplete personal data we hold about you. Certain fields can be updated directly in your account settings.
Request deletion of your personal data where it is no longer necessary, subject to legal retention obligations (e.g., AML record-keeping requirements).
Request that we restrict processing of your data in certain circumstances — for example, while the accuracy of data you have contested is being verified.
Receive a structured, machine-readable copy of the personal data you have provided to us, where processing is based on your consent or a contract.
Object to processing of your personal data where that processing is based on Zorototo's legitimate interests, including for direct marketing purposes.
We will not charge a fee for processing data rights requests unless the request is manifestly unfounded, excessive, or repetitive. Where we are unable to fulfil a request — for example, due to mandatory legal retention obligations — we will explain the reason in our response.
The Zorototo Platform is strictly for persons aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. The minimum age requirement is enforced through our mandatory KYC verification process, which requires government-issued identification confirming date of birth before any account can be fully activated or any withdrawal processed.
If Zorototo becomes aware that personal data has been collected from a person under the age of 21, the associated account will be immediately suspended, all data relating to that individual will be reviewed, and any balance held will be dealt with in accordance with our Terms and Conditions and applicable regulatory guidance. Parents or guardians who believe their child may have registered an account should contact us immediately at [email protected].
⚠️ 21+ Policy: Zorototo enforces a strict minimum age of 21 for all accounts. This applies to all players regardless of local jurisdiction. Age verification documents are reviewed manually by our compliance team.
The Zorototo Platform may reference or interact with third-party services — including payment providers such as Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, and cryptocurrency networks. Zorototo is not responsible for the privacy practices of these third-party services. When you interact with a third-party payment channel, you are also subject to that provider's own privacy policy and terms of service.
We encourage you to review the privacy policies of any third-party services you use in connection with your Zorototo account, particularly your chosen payment methods and your device's operating system and browser providers, which may also collect usage data.
Zorototo reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory requirements, or platform features. Where changes are material — meaning they meaningfully affect your rights or the way we use your data — we will provide notice to registered Users via the email address associated with their account and/or by posting a prominent notice on the Platform.
Non-material updates (such as clarifications of existing practices or corrections of typographical errors) may be made without specific notification, though the "Last Updated" date at the top of this Policy will always reflect the most recent revision.
Your continued use of the Platform following the effective date of any update constitutes your acceptance of the revised Privacy Policy. We recommend reviewing this Policy periodically. The current version is always accessible at zorototo.cam/privacy-policy.
If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or wish to raise a concern about our data processing practices, please contact the Zorototo Data Protection team using the details below. All privacy-related correspondence should be in writing.
Zorototo — Data Protection
Email: [email protected]
Subject Line: "Privacy Policy Enquiry" or "Data Rights Request"
Response Time: Within 30 calendar days of receipt
Support Hours: 24 hours a day, 7 days a week
If you are not satisfied with our response to a privacy complaint, you may have the right to escalate the matter to the relevant data protection authority in your jurisdiction. We take all privacy complaints seriously and will work with you in good faith to resolve any concerns.
For questions about our responsible gambling practices, please visit our Responsible Gambling page. For questions about our general Terms of Service, please visit our Terms & Conditions page.
Confident in how we handle your privacy? Explore the full Zorototo experience — Malaysia's trusted platform for sports betting and live casino. Questions? Our FAQ has answers.
21+ only. Please gamble responsibly. Responsible Gambling