Sumseltoto Privacy Policy

Sumseltoto ("the Company", "we", "us", or "our") operates the online gaming and sports betting platform accessible at sumseltoto.cam. As part of delivering our services to members — including registration, identity verification, payment processing, and customer support — we collect, process, and store certain personal data.

This Privacy Policy explains the nature of that data, the purposes for which it is processed, the legal bases on which we rely, the parties with whom it may be shared, how long it is retained, and the rights available to you as a data subject. We are committed to handling your personal information with transparency, care, and in accordance with internationally recognised data protection standards.

This Policy applies to all current and former registered members of Sumseltoto, as well as to visitors to our website who have not yet registered an account. It should be read alongside our Terms & Conditions and Responsible Gambling Policy, both of which are incorporated by reference into our overall membership agreement.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

We collect personal data across several categories, each serving a specific operational or compliance purpose. The specific data collected from any individual member may vary depending on the features they use and the stage of their account lifecycle.

3.1 Identity & Contact Information

• Full legal name (as it appears on a government-issued identity document);
• Date of birth;
• Residential address (including postcode, city — e.g., Kuala Lumpur, Petaling Jaya, Shah Alam, Penang, Johor Bahru);
• Email address and telephone number;
• Government-issued ID number (from MyKad, Driver's License, or Passport), collected during KYC.

3.2 Financial & Transaction Data

• Deposit and withdrawal amounts and timestamps;
• Payment method identifiers (e.g., partial account numbers, e-wallet handles for Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, DuitNow, FPX);
• Cryptocurrency wallet addresses where used;
• Account balance history and bonus credit records.

3.3 Gaming & Betting Activity

• Bet history, wager amounts, game session durations, and outcomes;
• Preferred game categories and sports markets (e.g., Liga Super Malaysia, EPL, UFC);
• Bonus utilisation and wagering requirement progress;
• Responsible gambling settings applied to your account (deposit limits, session reminders, self-exclusion status).

3.4 Technical & Device Data

• IP address and approximate geolocation derived from IP;
• Device type, operating system version, and browser type;
• Session login and logout timestamps;
• Cookie identifiers and analytics event data.

3.5 Communications Data

• Live chat transcripts and support ticket correspondence;
• Email communications with our support or compliance teams;
• Survey responses and feedback submissions where voluntarily provided.

Sumseltoto collects personal data through the following channels:

• Direct Submission: Information you actively provide during account registration, identity verification (KYC), deposit or withdrawal requests, contact form submissions, and live chat conversations;
• Automated Collection: Technical data collected automatically when you access the Platform, including device identifiers, IP addresses, and session activity logs gathered via cookies and similar technologies;
• Third-Party Sources: Data received from our licensed payment processing partners for the purpose of verifying transaction authenticity (e.g., confirming that a DuitNow or FPX transfer originated from an account in your name); identity verification service providers used during KYC; and fraud prevention databases where legally permissible;
• Inferred Data: Preferences, behaviour patterns, and risk profiles derived from your gaming activity and account usage, used for responsible gambling monitoring and personalised communication.

We process your personal data for the following defined purposes. We do not use your data for any purpose not listed here without first obtaining your explicit consent or updating this Policy.

All processing of personal data by Sumseltoto is conducted under one or more of the following recognised legal bases:

• Contractual Necessity: Processing required to provide the services you have signed up for — including account maintenance, payment processing, and game delivery — is necessary for the performance of our contract with you;
• Legal Obligation: We are required to collect and retain certain categories of data (identity, transaction records) under applicable international licensing conditions, anti-money laundering regulations, and responsible gambling frameworks. This processing is non-optional;
• Legitimate Interests: Processing for fraud detection, platform security, responsible gambling monitoring, and aggregated analytics is carried out on the basis of our legitimate interests as an operator, provided those interests are not overridden by your fundamental rights;
• Consent: Where we wish to send marketing communications, use non-essential cookies, or process data for purposes beyond those described above, we will seek your explicit, freely given consent and will honour any withdrawal of that consent promptly.

Sumseltoto does not sell, rent, or trade your personal data. We share data only in the specific circumstances described below, and only with parties who are bound by contractual obligations to handle your data securely and in accordance with applicable law.

7.1 Payment Processors

To facilitate deposits and withdrawals via Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, DuitNow, FPX, and cryptocurrency networks, we share necessary financial and identity data with our licensed payment processing partners. These partners operate under their own data protection frameworks and are selected on the basis of their security credentials.

7.2 Identity Verification Services

We engage accredited third-party KYC service providers to assist in verifying identity documents and confirming member ages. These providers access only the specific documents and fields required for verification and are prohibited from using your data for any other purpose.

7.3 Regulatory & Legal Disclosure

We may be required to disclose personal data to licensing authorities, law enforcement agencies, financial intelligence units, or courts of competent jurisdiction where we are legally compelled to do so. Such disclosures will be made only to the extent necessary to satisfy the legal obligation.

7.4 Fraud Prevention Networks

To protect members and the integrity of the Platform, we may share anonymised or pseudonymised risk indicators with industry-level fraud prevention services. No personally identifiable data is shared in this context without a specific legal basis.

The Sumseltoto Platform uses cookies and similar client-side storage technologies to support session management, security, platform functionality, and analytics. The following categories of cookies may be present on your device when you use our Platform:

You may adjust your cookie preferences at any time via your browser settings. Disabling essential cookies will impair the functionality of the Platform and may prevent you from logging in or processing transactions. Disabling optional cookies will not affect your ability to use core Platform features.

We retain personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by our licensing obligations and applicable law. The following retention periods apply as a general guide:

• Account Data (active accounts): Retained for the duration of the account and for a minimum of five years following account closure, in line with AML record-keeping requirements;
• KYC Documents: Retained for a minimum of five years from the date of submission or account closure, whichever is later;
• Transaction Records: Retained for a minimum of five years from the date of the transaction;
• Customer Support Communications: Retained for three years from the date of the final interaction;
• Marketing Consent Records: Retained for as long as consent is active, plus two years following withdrawal of consent;
• Session and Technical Logs: Retained for up to 12 months for security purposes, then purged or anonymised.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be attributed to any identifiable individual.

Sumseltoto employs a layered security framework to protect personal data against unauthorised access, loss, destruction, or alteration. Our technical and organisational security measures include:

• Transport Layer Security (TLS): All data transmitted between your browser and our servers is encrypted using industry-standard TLS 1.2 or higher;
• Data Encryption at Rest: Sensitive personal and financial data stored on our servers is encrypted using AES-256 encryption;
• Access Controls: Access to personal data is restricted to authorised personnel on a need-to-know basis, enforced through role-based access control and multi-factor authentication for all administrative systems;
• Penetration Testing: Our infrastructure undergoes regular security testing by independent specialists to identify and remediate vulnerabilities;
• Incident Response: We maintain a documented data breach response procedure. In the event of a security incident affecting your personal data, we will notify the relevant supervisory authority and, where required, affected members within the timeframes mandated by applicable law.

As a data subject, you have a number of rights in relation to your personal data held by Sumseltoto. We are committed to honouring these rights and will respond to verified requests within 30 days of receipt. In complex cases, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it.

To exercise any of the above rights, please contact our Data Protection team at the email address provided in Section 15. We may need to verify your identity before processing a request. We will never charge a fee for routine requests, though we reserve the right to charge a reasonable administrative fee for manifestly unfounded or excessive requests.

The Sumseltoto Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect personal data from anyone under the age of 21. The collection of such data would constitute a violation of our licensing conditions and is contrary to our core responsible gambling principles.

Age verification is a mandatory step before any withdrawal is processed, and we actively use third-party identity verification tools to cross-check declared ages against government-issued identity documents. Any account found to belong to a person under 21 will be immediately closed, all associated funds forfeited, and the matter reported to the relevant authorities where appropriate.

As an internationally operated platform, Sumseltoto may transfer personal data to and from locations outside Malaysia for the purposes of data hosting, processing, and service delivery. All such transfers are conducted under appropriate legal safeguards, including:

• Standard Contractual Clauses (SCCs) or equivalent contractual mechanisms binding the recipient to data protection standards equivalent to or exceeding those applicable to the original collection;
• Transfers only to jurisdictions with adequacy decisions or equivalent recognised data protection frameworks;
• Binding data processor agreements that specify the scope, purpose, and security requirements applicable to any transferred data.

By creating an account and using the Platform, you acknowledge that your data may be processed in countries outside Malaysia. We take all reasonable steps to ensure that such processing is conducted with the same level of care and protection as described in this Policy.

We may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, our services, or our operational structure. The version number and "Last Updated" date at the top of this page will always reflect the most current version.

Where changes are material — meaning they significantly affect your rights or the way your data is used — we will provide active notice to registered members via email or an in-platform notification prior to the amended Policy taking effect. For minor clarifications or formatting updates, we may update the Policy without providing individual notice, though the updated version will always be available on this page.

Your continued use of the Platform following the publication of an amended Privacy Policy constitutes your acceptance of the revised terms. If you do not accept the updated Policy, you should cease using the Platform and contact us to request account closure.

For any questions, concerns, or requests relating to this Privacy Policy or the personal data we hold about you, please contact our Data Protection team using the details below. We aim to acknowledge all privacy-related enquiries within 5 business days and to resolve substantive requests within 30 calendar days.