Batmantoto is committed to protecting the personal information of every member who trusts us with their data. This policy explains clearly what we collect, why we collect it, how we use it, and the rights you hold over your own information.
This Privacy Policy ("Policy") describes how Batmantoto ("we", "us", "our", "the Platform", "the Operator") collects, processes, stores, uses, and protects personal data belonging to individuals ("you", "the User", "the Member") who access or use the services available at https://batmantoto.cam and any associated mobile applications or sub-domains.
Batmantoto operates as an online sports betting and gaming platform primarily serving members across Malaysia, including Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and other regions. In providing these services, we necessarily collect and process certain categories of personal data as described in this Policy.
We are committed to processing personal data responsibly, transparently, and in accordance with applicable data protection principles. By registering an account with Batmantoto or by continuing to use our services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein.
Summary: We collect only what we need to operate your account, process transactions, and comply with our regulatory obligations. We do not sell your personal data to third parties. You have meaningful rights over your own data, and exercising them is straightforward.
For the purposes of this Policy, the following terms carry the meanings defined below:
Batmantoto collects the following categories of personal data in connection with the provision of its services:
| Data Category | Examples | Purpose |
|---|---|---|
| Identity Data | Full legal name, date of birth, MyKad number, passport number, selfie or ID photograph | Account registration, KYC verification, age verification |
| Contact Data | Email address, Malaysian mobile number, mailing address | Account communication, transaction alerts, support contact |
| Financial Data | Bank account details, e-wallet identifiers (Touch 'n Go, Boost, GrabPay), DuitNow account reference, transaction history | Processing deposits and withdrawals, fraud prevention, financial record-keeping |
| Technical Data | IP address, device type, operating system, browser type, session timestamps, login history | Security monitoring, fraud detection, platform performance optimisation |
| Usage Data | Pages visited, games played, bets placed, bonus activity, session duration, click-path data | Service improvement, responsible gambling monitoring, personalisation |
| Communications Data | Live chat transcripts, support ticket content, email correspondence | Customer support, dispute resolution, quality assurance |
| Marketing Preferences | Communication opt-in/opt-out status, promotion participation records | Sending promotional communications where consent has been given |
We do not collect or process special categories of personal data (such as health, racial, or political data) unless it is voluntarily disclosed by a Member in the context of a responsible gambling self-assessment or support request.
We collect personal data through the following channels and interactions:
Batmantoto processes your personal data for the following purposes:
Batmantoto processes your personal data under one or more of the following legal bases:
Processing required to perform the contract between you and Batmantoto — specifically, operating your account, processing transactions, and delivering our gaming services.
Processing required to comply with applicable laws and regulations, including KYC identity verification, AML screening, and age verification obligations imposed by our operating licence conditions.
Processing conducted for Batmantoto's legitimate business interests — including fraud detection, security monitoring, platform improvement, and responsible gambling compliance — provided that those interests are not overridden by your fundamental rights and freedoms.
Processing that relies on your specific, informed consent — primarily in respect of marketing communications and non-essential cookie placement. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.
Batmantoto does not sell your personal data to third parties. We share personal data only in the following controlled circumstances:
All third-party processors engaged by Batmantoto are subject to contractual data processing agreements that prohibit them from using Member data for any purpose other than delivering the contracted service.
Batmantoto retains personal data for as long as is necessary to fulfil the purposes for which it was collected, or for such longer periods as may be required by applicable law or regulatory obligation. The following indicative retention periods apply:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account & identity data | Duration of active account + 5 years post-closure | AML / regulatory obligation |
| Transaction records | 7 years from transaction date | Financial compliance |
| KYC documents | 5 years from account closure | Regulatory requirement |
| Customer support records | 3 years from last interaction | Dispute resolution / quality assurance |
| Marketing consent records | Until consent is withdrawn + 1 year | Consent audit trail |
| Technical / session logs | 12 months rolling | Security and fraud monitoring |
Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be attributed to an identifiable individual.
Batmantoto employs a multi-layered technical and organisational security framework to protect personal data against unauthorised access, disclosure, alteration, and destruction. Our security measures include:
In the event of a personal data breach that is likely to result in a high risk to Member rights and freedoms, Batmantoto will notify affected individuals without undue delay and in accordance with applicable data breach notification obligations.
Batmantoto uses cookies and similar tracking technologies to operate and improve the Platform. The following categories of cookies are used:
You may manage non-essential cookie preferences through your browser settings. Disabling all cookies may affect the functionality and security of certain Platform features. Our cookie preferences tool is accessible via your account settings once logged in.
Subject to applicable law and our regulatory obligations, you hold the following rights in relation to your personal data held by Batmantoto:
To exercise any of the above rights, please contact our Data Privacy team at [email protected] with the subject line "Data Rights Request". We will respond within 30 days of receipt. We may require identity verification before actioning your request.
Batmantoto's services are strictly intended for individuals aged 21 years and above. We do not knowingly collect personal data from persons under the age of 21. Age verification is a mandatory component of our KYC onboarding process, and account registration cannot be completed without passing this check.
If Batmantoto becomes aware that personal data has been collected from an individual under the age of 21, we will immediately suspend the relevant account, void any transactions or balances associated with that account, and delete all collected data in compliance with applicable law. Parents or guardians who believe a minor may have registered an account should contact us immediately at [email protected].
In the course of providing our services, personal data may be transferred to and processed in jurisdictions outside Malaysia, including countries where our licensed game studio partners, KYC providers, or payment infrastructure providers are incorporated or operate their systems. Such transfers may include countries in the Asia-Pacific region and beyond.
Where personal data is transferred internationally, Batmantoto takes steps to ensure that appropriate safeguards are in place to protect the data to a standard equivalent to that required in Malaysia. Such safeguards may include binding contractual clauses, data processing agreements, and verification of the recipient's data security standards. We do not transfer personal data to countries that do not provide an adequate level of data protection without implementing appropriate supplementary measures.
Batmantoto reserves the right to update or amend this Privacy Policy periodically to reflect changes in our data practices, applicable laws, or regulatory requirements. When material changes are made, we will notify registered Members via email to the address on file and/or through a prominent notice displayed on the Platform, providing a minimum of 14 days' advance notice before the revised Policy takes effect.
The date of the most recent revision is displayed at the top of this Policy. Your continued use of the Platform following the effective date of a revised Policy constitutes your acceptance of the updated terms. If you do not accept the revised Policy, you must close your account before the effective date.
Previous versions of this Privacy Policy are available upon request to [email protected].
If you have questions, concerns, or requests relating to this Privacy Policy or our data processing practices, please contact Batmantoto through the channels below:
[email protected] — Please include "Privacy Policy" or "Data Rights Request" in your subject line for prioritised handling.
Available 24 hours a day, 7 days a week via the live chat widget on the Platform. Our Malaysian support team responds within 2 minutes on average during peak hours (08:00–02:00 MYT). For data rights requests, please follow up via email to create a traceable record.
For matters related to our Terms of Use, please refer to our Terms & Conditions. For responsible gambling support, please visit our Responsible Gambling page.
These are the six key principles that guide how Batmantoto handles your personal information every single day.
All data transmitted between your device and our servers is protected with bank-grade TLS encryption. Your personal and financial information travels securely at all times.
Your personal information is never sold, rented, or traded to third-party advertisers or data brokers. Data sharing occurs only as required for service delivery or regulatory compliance.
Mandatory identity and 21+ age verification protects minors and ensures your account is secure. KYC documents are encrypted, access-controlled, and retained strictly per regulatory requirements.
Access, correct, delete, or export your data at any time. Withdraw marketing consent in one click through your account settings. We respond to data rights requests within 30 days.
We keep your data only as long as necessary — no indefinite storage. Retention schedules are tied to regulatory requirements, and data is securely deleted upon expiry.
Our infrastructure undergoes regular third-party penetration testing and security audits. Findings are actioned promptly to maintain the highest standards of platform security.
If you have questions about your data, want to exercise your privacy rights, or simply want to understand how we handle your information, our support team is available 24/7.
For players aged 21 and above only. Gambling involves financial risk. Play responsibly.