Privacy Policy atto3 — Full Data Protection Commitment to Malaysian Members

This Privacy Policy applies to all users of the platform atto3 in Malaysia, including website visitors, prospective members and registered members. It covers all personal data collected through atto3.my, our mobile app (if applicable) and any interactions with our customer support services.

atto3 is the data controller for all personal information collected through our platform. This means we bear full responsibility for ensuring your data is handled in accordance with this Privacy Policy and applicable data protection laws in Malaysia, including the Personal Data Protection Act 2010.

atto3 collects personal data through three main channels: (1) information you provide directly during registration and platform use, (2) data generated automatically through your use of our services, and (3) information we receive from third-party payment processors during transactions.

Data you provide directly to atto3 includes:

• Full legal name as shown on your Malaysian identification document (MyKad)
• An active Malaysian mobile number
• Date of birth for age verification (18 and above)
• Account password (stored in hashed form — unreadable by anyone, including atto3 staff)
• KYC documents such as a copy of your MyKad, where required for withdrawal verification
• Communication records from live chat sessions or emails with the atto3 support team

Data automatically generated when you use the atto3 platform:

• IP address and approximate geographical location (state within Malaysia)
• Device type, phone model, operating system, and web browser version
• Login, logout, and in-platform activity session records
• Records of games played, wager amounts, and game outcomes

atto3 uses members' personal data solely for legitimate purposes directly related to the delivery of our services. The following outlines the specific purposes for which data is used:

• Account Management: Creating and managing your atto3 account, processing your registration and verifying your identity through the KYC process.
• Transaction Processing: Processing deposits and withdrawals in MYR via your chosen local payment methods, including Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX.
• Customer Support: Responding to enquiries, resolving complaints, and providing technical support to atto3 members in Bahasa Melayu.
• Security & Fraud Prevention: Detecting and preventing fraudulent activity, money laundering, multiple accounts, and other violations of atto3's Terms & Conditions.
• Responsible Gambling: Monitoring gameplay patterns to identify signs of problem gambling and activating appropriate protection tools where necessary.
• Service Improvement: Analysing usage data in aggregate (without identifying individuals) to improve platform performance, the user interface and the overall atto3 experience.
• Service Communications: Sending important notifications regarding your account, security updates, changes to terms, and other essential information relating to your atto3 service.

atto3 never sell, rent, or disclose members' personal data to third parties for their own marketing or commercial purposes — this is an absolute principle we do not compromise on. That said, there are limited situations in which data may be shared with specific parties:

• Payment Processors: Data required to process your MYR transactions is shared with authorised payment providers such as Touch 'n Go, GrabPay, and FPX payment gateways. These providers are bound by their own privacy policies and strict security standards.
• Legal Requirements: atto3 may be required to disclose certain data to Malaysian government authorities or law enforcement bodies where mandated by a court order or applicable law.
• Technical Service Providers: Companies that assist us in managing atto3's technical infrastructure (such as server hosting providers) may have limited access to data solely within the scope of their technical work. They are bound by strict confidentiality agreements.

atto3 continually invests in security infrastructure to ensure your data is protected at the highest achievable standard. The technical and organisational security measures we implement include:

• 256-bit SSL/TLS Encryption: All communications between your device and atto3's servers are encrypted using 256-bit SSL/TLS protocol — making interception by unauthorised parties virtually impossible.
• Password Hashing: Your atto3 account password is never stored in its original form — it is stored as an irreversible hash, meaning no one is able to read your password, including atto3 staff.
• Tiered Access Control: Only atto3 staff who require access to specific data for their assigned duties are granted permission. All access is logged and regularly monitored.
• 24/7 Security Monitoring: The atto3 system is continuously monitored to detect any unusual activity or unauthorised access attempts.
• Regular Security Audits: We conduct regular security testing and audits by independent third parties to identify and address any potential vulnerabilities within the atto3 system.
• Encrypted Data Backups: All atto3 data backups are stored in encrypted form at secure locations to ensure data recovery is possible in the event of any technical incident.

While atto3 takes all reasonable steps to protect your data; however, no system is completely immune to threats. We encourage you to play your part in securing your atto3 account by using a strong password, keeping your login credentials private and notifying us immediately if you suspect any suspicious activity.

Platform atto3 uses cookies and similar tracking technologies to enhance your browsing experience. Cookies are small data files stored on your device when you visit atto3.my. We use the following types of cookies:

• Essential Cookies (Required): These cookies are required for the core functions of the atto3 platform, including maintaining your login session, language preference settings, and basic security. Without them, the platform will not function correctly.
• Performance & Analytics Cookies: We use these cookies to understand how members use the atto3 platform — which pages are visited most frequently, how long users spend on a given page, and so on. This data is used in aggregate form and does not identify individuals.
• Functional Cookies: These cookies remember your personal preferences — such as text size, in-game sound settings, and display options — so you do not have to reconfigure them each time you access atto3.

You can manage or disable cookies through your web browser settings at any time. However, disabling essential cookies may affect the functionality of the platform. atto3. For guidance on managing cookies in popular browsers such as Chrome, Firefox and Safari, please refer to your browser's documentation.

As a member atto3 and as a data subject, you hold several important rights regarding your personal data. atto3 respect and facilitate the exercise of these rights:

To exercise any of the rights above, please contact our support team atto3 via live chat or email at [email protected]. We may need to verify your identity before processing your request to ensure the security of your data.

atto3 only retains your personal data for as long as it is needed for the purpose it was collected, or as required by applicable Malaysian law. Once data is no longer needed, it will be securely deleted or anonymised.

• Active Account Data: Retained for as long as your atto3 account remains active, and for a reasonable period after account closure to support any further service requirements if needed.
• Financial Transaction Records: Retained for a minimum of 7 years in compliance with Malaysian financial and tax regulations. This includes records of all deposits and withdrawals in MYR.
• KYC Records: Identity verification documents are retained for the period prescribed by Malaysian law on anti-money laundering.
• Activity Logs: Technical logs and gaming activity records are retained for as long as necessary for security and dispute resolution purposes, typically between 1 and 3 years.
• Support Communication Data: Conversation records with the atto3 support team are retained for 2 years for service reference and quality improvement purposes.

atto3 may update this Privacy Policy from time to time to reflect changes in our practices, new legal requirements, or improvements to the way we protect your data. When material changes are made to this Privacy Policy, we will:

• Updating the "Last Updated" date displayed at the top of this page.
• Sending notifications to all active atto3 members via email or in-platform notifications.
• Providing reasonable advance notice before material changes take effect.

Latest version of the Privacy Policy atto3 always available on this page. We encourage you to check back periodically so you remain informed about how we protect your privacy. Continued use of the atto3 after the changes take effect will be considered acceptance of the revised policy.

If you have any questions, concerns or complaints regarding the Privacy Policy atto3 or how we handle your personal data, please do not hesitate to contact us. Our team is ready to assist you promptly and in Bahasa Melayu:

• Live Chat: The fastest way to get an immediate response. Available 24/7 directly on the atto3 platform — just click the chat icon at the bottom corner of the page.
• Privacy Email: [email protected] — dedicated to privacy and data protection enquiries that require a written response or official confirmation.

We are committed to responding to all privacy-related enquiries within 5 business days. For more complex requests, such as data access or deletion requests, the process may take up to 14 business days. We will keep you informed of the progress throughout.