Privacy Policy Dortuna – Malaysia Player Data Protection

1 Introduction and Scope of This Policy

Dortuna, operating through the dortuna.net platform, takes the responsibility of personal data protection very seriously. This Privacy Policy applies to all users who register an account, use our services, or simply browse the Dortuna website.

We comply with established data protection principles, including the requirements of Malaysia's Personal Data Protection Act 2010 (PDPA). This policy transparently explains who collects your data, why it is collected, how it is used, who it may be shared with, and what your rights are as a data subject.

If you have any questions about this policy or how we handle your data, dortuna's privacy team is available via live chat in our app or website.

2 Types of Personal Data We Collect

Dortuna collects personal data across several main categories. We only collect data that is genuinely necessary for the stated purposes:

3 How We Use Your Data

Every piece of data we collect has a clear and legitimate purpose. dortuna uses your personal information for the following purposes:

• Account management: Creating, verifying and managing your account on the dortuna platform, including the KYC process required to ensure legal compliance.
• Transaction processing: Processing all deposits and withdrawals securely, verifying your identity for each transaction and ensuring funds reach the correct destination.
• Platform security: Detecting and preventing fraud, money laundering and platform abuse, including monitoring for unusual activity patterns.
• Service communications: Sending important notifications about your account, transactions, security updates and policy changes that affect you.
• Responsible gaming: Monitoring gameplay patterns to identify players who may need support and providing appropriate self-control tools.
• Platform improvements: Analysing usage data in aggregate (not individually) to improve platform performance, interface design and the overall user experience.
• Legal compliance: Meeting the reporting and record-keeping requirements set by Malaysian law and relevant authorities.

We do not use your data for automated profiling that makes decisions with a significant impact on you without human involvement, except in fraud detection cases where a temporary action may be taken automatically and subsequently reviewed by our team.

4 Data Sharing With Third Parties

Dortuna does not sell your personal data. However, to deliver a complete service, we need to share certain data with specific parties under limited and controlled circumstances:

• Payment providers: Information required to process your deposits and withdrawals is shared with payment providers such as banks and e-wallet operators. This is necessary to carry out the transactions you request.
• Technical service providers: Companies that help us manage the platform's technical infrastructure, including cloud service providers and cybersecurity providers, may access certain data within the scope of their services. All such providers are bound by strict data protection agreements.
• Authorities: Dortuna will disclose data when required by law, court order, or direction from a lawful authority such as Bank Negara Malaysia or law enforcement agencies.
• Game providers: Game data required to operate game sessions is shared with the relevant game provider in a limited format that does not directly identify you to other parties.

5 Data Security & Protection

Dortuna continually invests in security infrastructure to ensure your personal data is protected at the highest level. Key security measures we implement include:

• Data encrypted at rest using AES-256 standard and in transit using TLS 1.3.
• Strict internal access controls — only staff who require access to specific data to perform their duties are permitted to do so.
• Round-the-clock 24/7 security monitoring by the dortuna cybersecurity team.
• Regular independent penetration testing to identify and close system vulnerabilities.
• Encrypted data backups are performed every 6 hours to separate locations to ensure data is not lost in the event of a system failure.
• Two-factor authentication (2FA) is available and encouraged for all user accounts.

While no system can guarantee absolute security, dortuna takes all reasonable steps in line with industry standards to protect your data. In the event of any security incident involving your personal data, we will notify you within 72 hours and take immediate remedial action.

6 Cookies, Analytics and Tracking Technologies

The dortuna platform uses cookies and similar tracking technologies to enhance the user experience and ensure account security. The following are the categories of cookies we use:

• Essential cookies: Required for core platform functions such as login sessions and security. These cookies cannot be disabled without affecting the platform's ability to function.
• Performance cookies: Used to analyze how users interact with the platform for technical improvement purposes. Data collected is in aggregate format and does not identify individuals.
• Preference cookies: Saving your preferences such as language and display settings to ensure a more comfortable experience on your next visit.
• Security cookies: Helping the dortuna system identify suspicious sessions, unauthorised login attempts and fraudulent activity patterns.

You can manage or delete cookies through your browser settings. Please note that disabling certain cookies may affect the functionality and security of your account on the Dortuna platform.

7 Your Rights as a Data Subject

As a dortuna user, you have important rights under applicable data protection law. These rights can be exercised at any time by contacting our team:

8 Data Retention Period

Dortuna does not retain your personal data longer than necessary. Retention periods depend on the type of data and the purpose of its use:

• Active account data: Retained for as long as your account is active with Dortuna.
• Data after account closure: After account closure, basic data is retained for 7 years to comply with Malaysia's legal requirements on financial record-keeping and anti-money laundering.
• Transaction data: Retained for 7 years in accordance with Malaysian financial regulatory requirements.
• Log and security data: Access and security logs are retained for 12 months for forensic and investigation purposes when required.
• Support communication data: Support chat and email records are retained for 3 years for service quality and dispute resolution purposes.

Once the retention period expires, your data is securely deleted using methods that ensure it cannot be recovered by any party.

9 Child Protection

The dortuna platform is strictly for users aged 21 and above. We do not knowingly collect personal information from underage individuals. Our KYC process is designed to detect and prevent registration by individuals who do not meet the age requirement.

If dortuna discovers that personal information of an underage individual has been collected unintentionally, we will take immediate action to delete that information and close the account in question. Parents or guardians who believe their child may have registered on the dortuna platform are encouraged to contact us immediately through our support channels.

10 Contact Us & Policy Amendments

If you have any questions, concerns, or wish to exercise any of the rights outlined in this Privacy Policy, please contact dortuna's privacy team via:

• Live chat in the dortuna app or website (available 24/7)
• Email: [email protected] (response within 1–3 business days)

Dortuna reserves the right to update this Privacy Policy from time to time to reflect changes in law, technology, or our operational practices. Any material amendments will be communicated to you via in-app notification or email at least 14 days before taking effect. Continued use of the Dortuna platform after amendments take effect constitutes acceptance of the updated policy.