Privacy Policy

1. Introduction

This Privacy Policy ("Policy") describes how sangtoto ("sangtoto", "we", "us", "our"), the operator of the online gaming platform accessible athttps://sangtoto.cam, collects, uses, stores, discloses, and protects the personal information of individuals ("you", "User", "Player") who register for or otherwise use our platform and services.

sangtoto is committed to handling personal data responsibly and in compliance with applicable data protection legislation. By registering an account or using the sangtoto platform, you acknowledge that you have read and understood this Policy and consent to the collection and use of your personal data as described herein.

This Policy should be read alongside our Terms & Conditions, which govern your use of the platform. Defined terms used but not defined in this Policy have the meanings assigned to them in the Terms & Conditions.

2. Definitions

In this Policy, the following terms carry the meanings set out below:

• "Personal Data" — any information relating to an identified or identifiable natural person, including name, identification number, contact details, financial information, and online identifiers.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, use, disclosure, erasure, or destruction.
• "Data Controller" — sangtoto, in its capacity as the entity that determines the purposes and means of Processing your Personal Data.
• "Data Processor" — a third party that Processes Personal Data on behalf of sangtoto under a written data-processing agreement.
• "KYC" — Know Your Customer; the verification process by which sangtoto confirms the identity, age, and residential details of a Player.
• "Sensitive Data" — a subset of Personal Data that warants enhanced protection, including government-issued identification numbers, financial account details, and identity documents.
• "Cookie" — a small text file placed on a User's device by the sangtoto platform for functional, analytical, or preference-related purposes.

3. Data We Collect

3.1 Registration Data

When you create a sangtoto account, we collect the information you provide during registration, including your full legal name, date of birth, residential address (including city — such as Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, or Shah Alam), email address, mobile phone number, and preferred currency (MYR).

3.2 Identity Verification Data

As part of our mandatory KYC process, we collect copies of government-issued identity documents (such as your Malaysian MyKad or passport), a current proof of residential address, and — where applicable — evidence of ownership of the payment method you use. This data is processed and stored under enhanced security controls.

3.3 Financial and Transaction Data

We collect records of all financial transactions conducted through the platform, including deposit amounts, withdrawal requests, payment method identifiers (e.g., last four digits of a bank account number, e-wallet reference, DuitNow or FPX transaction reference), and transaction timestamps. This data is retained for audit and regulatory compliance purposes.

3.4 Usage and Activity Data

We automatically collect information about your use of the platform, including login timestamps, session duration, pages visited, game activity, betting history, and device and browser information. This data supports fraud detection, platform optimisation, and responsible gambling monitoring.

3.5 Communication Data

We retain records of communications between you and the sangtoto support team, including live chat transcripts and email correspondence. These records are used for quality assurance, dispute resolution, and compliance purposes.

3.6 Technical Data

We collect technical information including IP address, device type, operating system, browser type, and referring URL. This data is used to maintain platform security, detect fraudulent access, and improve service delivery across devices commonly used by Malaysian players.

4. How We Use Your Personal Data

sangtoto processes your personal data for the following purposes:

• Account Management: To create, maintain, verify, and administer your player account, including processing changes to your registration details and managing account closures.
• Payment Processing: To facilitate deposits and withdrawals via Malaysian payment methods including Touch'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank, RHB Bank, and USDT TRC20, and to maintain accurate financial records in MYR.
• Identity Verification: To fulfil our KYC obligations, confirm your eligibility to use the platform (including age verification for the 21+ requirement), and prevent identity fraud.
• Regulatory Compliance: To meet obligations imposed by applicable gaming regulations, anti-money laundering legislation, and financial crime prevention requirements.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent transactions, multiple account violations, unauthorised access, and other security threats.
• Service Improvement: To analyse usage patterns, troubleshoot technical issues, and develop enhancements to the platform experience.
• Responsible Gambling: To monitor play patterns and, where appropriate, provide responsible gambling prompts, enforce deposit limits, or act on self-exclusion requests.
• Customer Support: To respond to enquiries, resolve disputes, and maintain communication records in connection with your account.
• Marketing Communications: Where you have given explicit consent, to inform you of promotional offers and platform updates. You may withdraw this consent at any time by contacting our support team.

5. Legal Basis for Processing

sangtoto processes personal data under one or more of the following lawful bases:

• Contractual Necessity: Processing required to perform the contract between you and sangtoto, including account registration, payment processing, and service delivery.
• Legal Obligation: Processing required to comply with applicable laws and regulatory requirements, including KYC, anti-money laundering, and responsible gambling obligations.
• Legitimate Interests: Processing carried out in pursuit of sangtoto's legitimate business interests — such as fraud prevention, platform security, and service improvement — where those interests are not overridden by your rights and freedoms.
• Consent: Processing carried out on the basis of your freely given, specific, informed, and unambiguous consent, such as for direct marketing communications. Consent may be withdrawn at any time without prejudice to the lawfulness of processing carried out prior to withdrawal.

6. Data Sharing & Disclosure

6.1 Service Providers

We share personal data with third-party service providers who perform functions on our behalf, including payment processing partners, identity verification providers, fraud detection services, IT infrastructure suppliers, and customer support platforms. All such providers are contractually obligated to process personal data only for specified purposes and in accordance with applicable data protection standards.

6.2 Regulatory and Law Enforcement Authorities

We may disclose personal data to regulatory bodies, gaming authorities, financial intelligence units, or law enforcement agencies where required by applicable law or in response to a lawful request. We will notify affected Players of such disclosures where legally permissible to do so.

6.3 Corporate Transactions

In the event of a merger, acquisition, or sale of all or part of sangtoto's business, personal data held by us may be transferred to the relevant acquirer as part of that transaction. Affected Players will be notified prior to any such transfer taking place and will retain the rights described in Section 10of this Policy.

6.4 No Sale of Personal Data

sangtoto does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. Any sharing of data is limited to operational necessity or legal obligation.

7. Data Retention Periods

sangtoto retains personal data for as long as is necessary for the purposes described in this Policy, subject to any longer retention periods required by applicable law or regulatory guidance. Our standard retention periods are as follows:

• Account and KYC records: Retained for a minimum of 5 years from the date of account closure, in accordance with anti-money laundering regulatory requirements.
• Financial transaction records: Retained for a minimum of 7 years from the date of the relevant transaction for audit and compliance purposes.
• Communication records (live chat, email): Retained for3 years from the date of the interaction, unless the record relates to an ongoing dispute or investigation.
• Platform usage and activity data: Retained for up to 2 years from the date of generation for analytics and responsible gambling monitoring purposes.
• Marketing consent records: Retained for the duration of the consent, plus a period of 1 year following withdrawal to demonstrate compliance.

Where data is no longer required for any of the above purposes and no legal obligation to retain it applies, it will be securely deleted or irreversibly anonymised.

8. Data Security

sangtoto implements a range of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your browser or device and the sangtoto platform.
• Encrypted storage of sensitive personal data including identity documents and financial information at rest.
• Role-based access controls limiting internal access to personal data to authorised personnel with a demonstrated need to know.
• Regular internal security audits, vulnerability assessments, and penetration testing.
• Mandatory two-factor authentication options for player account access.
• Secure, access-controlled data centres with environmental and physical security controls.

Notwithstanding these measures, no internet transmission or electronic storage system can be guaranteed to be completely secure. We encourage Players to use strong, unique passwords and to enable two-factor authentication on their sangtoto account.

9. Cookies & Tracking Technologies

9.1 Use of Cookies

The sangtoto platform uses cookies and similar tracking technologies to support platform functionality, remember your preferences, maintain session state, and gather aggregate analytics data. Cookies do not personally identify you unless combined with other information we hold about your account.

9.2 Types of Cookies Used

• Essential Cookies: Required for the platform to function correctly, including maintaining your logged-in session and processing payments. These cannot be disabled without impairing platform functionality.
• Analytical Cookies: Used to understand how Players interact with the platform — pages visited, session length, and error events — to inform improvements to our service.
• Preference Cookies: Used to remember your language, display, and notification settings between sessions.
• Security Cookies: Used to support fraud prevention and to detect and respond to suspicious access attempts.

9.3 Managing Cookies

You may manage or disable non-essential cookies through your browser settings. Note that disabling essential cookies may significantly impair your ability to use the sangtoto platform. Full cookie management information is available via the cookie preference centre on the platform.

10. Your Data Rights

Subject to applicable law and any limitations imposed by our regulatory obligations, you hold the following rights in respect of your personal data processed by sangtoto:

• Right of Access: You may request a copy of the personal data we hold about you, together with information about the purposes for which it is processed and the third parties to whom it has been disclosed.
• Right to Rectification: You may request the correction of inaccurate or incomplete personal data. You may also update certain registration details directly through your account settings.
• Right to Erasure: You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (and no other lawful basis applies), or where the processing is unlawful. This right is subject to any legal retention obligations that require us to keep certain records.
• Right to Restriction: You may request that we restrict Processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or where Processing is unlawful but you do not want the data erased.
• Right to Data Portability: Where Processing is based on your consent or on a contract, you may request a structured, machine-readable copy of the personal data you have provided to us, for the purpose of transfering it to another service provider.
• Right to Object: You may object to Processing carried out on the basis of our legitimate interests. We will cease Processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to Withdraw Consent: Where Processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of Processing carried out prior to the withdrawal.

To exercise any of the above rights, please contact our support team via live chat or at the email address stated in Section 14 of this Policy. We will acknowledge your request within 5 working days and respond substantively within 30 calendar days. Where a request is complex or numerous, we may extend this period by a further 30 days with prior notification.

11. International Data Transfers

sangtoto may transfer personal data to, or Process personal data in, jurisdictions outside Malaysia in connection with the provision of platform services — for example, where service providers operate internationally. In such cases, we take appropriate steps to ensure that the transfer is subject to adequate safeguards, such as standard contractual clauses or equivalent contractual protections, to ensure that your personal data continues to receive a level of protection consistent with applicable data protection standards.

By using the sangtoto platform, you acknowledge that your personal data may be transferred and processed outside your country of residence in the manner described above.

12. Minors

The sangtoto platform is strictly intended for adults aged 21 years and above. We do not knowingly collect, store, or process personal data from individuals under the age of 21. Registration on the platform constitutes a representation and warranty that the registrant is aged 21 or over. Where sangtoto becomes aware or has reasonable grounds to suspect that personal data has been submitted by or on behalf of an individual under 21, we will promptly suspend the relevant account, delete the associated personal data, and take any further action required under applicable law.

13. Amendments to This Policy

sangtoto reserves the right to update or amend this Privacy Policy from time to time in response to changes in applicable law, regulatory guidance, business practices, or platform functionality. When material changes are made, we will notify registered Players via the platform or by email to the registered account address prior to the changes taking effect. The effective date at the top of this Policy will be updated to reflect the date of the most recent revision.

Your continued use of the sangtoto platform following the effective date of any amended Policy constitutes your acceptance of the updated terms. We encourage you to review this Policy periodically to remain informed about how we handle your personal data.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the manner in which sangtoto processes your personal data, please contact us through one of the following channels:

• Live Chat: Available 24 hours a day, 7 days a week, directly on the sangtoto platform. Peak staffing hours are 10:00 AM to 2:00 AM MYT.
• Email: [email protected] — this address is displayed as plain text and is not a clickable link.

When contacting us regarding a data rights request or privacy concern, please include your registered username and a clear description of your request so that we can direct it to the appropriate team without delay. We treat all privacy enquiries with priority and handle them in strict confidence.