Suntoto Privacy Policy — How We Handle Your Personal Data

This Privacy Policy ("Policy") issued by Suntoto ("we", "us", "our", "Suntoto") and applies to all personal data collected, processed, stored, and shared by Suntoto in connection with the operation of the online gaming platform accessible at https://suntoto.cam ("Platform") and all associated services ("Services").

We are committed to protecting the privacy and personal data of all individuals who interact with the Suntoto Platform, including registered account holders ("Players"), visitors to our website, and individuals who contact our support team. This Policy explains what personal data we collect from you, why we collect it, how we use it, with whom we may share it, and what rights you have in relation to your data.

By accessing the Platform, registering an Account, or using any of our Services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, you should not access or use the Platform.

This Policy should be read in conjunction with our Terms & Conditions, which govern your overall use of the Platform and are incorporated herein by reference. This Policy may be updated from time to time; the most current version will always be available on this page with the date of the most recent revision noted at the top.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person. An identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, or one or more factors specific to that person.
• "Processing" means any operation or set of operations performed on personal data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, transmission, dissemination, restriction, erasure, or destruction.
• "Data Controller" means Suntoto, which determines the purposes and means of the processing of personal data collected through the Platform.
• "Data Subject" means the individual to whom the personal data relates — in most cases, a registered Player or website visitor.
• "Third Party" means any natural or legal person, public authority, agency, or body other than the Data Subject, Suntoto, and persons who, under the direct authority of Suntoto, are authorised to process personal data.
• "KYC Data" means identity verification documentation collected from Players as part of the Know Your Customer process, including but not limited to government-issued identity documents, proof of address, and selfie photographs.
• "Cookies" means small text files placed on your device by the Platform to store information about your browsing session, preferences, and activity.

The categories of personal data we collect from you depend on how you interact with the Platform. The following table summarises the key categories of data collected:

Suntoto collects personal data through the following channels and mechanisms:

1. Direct Collection. Data you provide directly to us when you register an Account, complete KYC verification, make a deposit or withdrawal, contact our support team, participate in a promotion, or respond to a survey.
2. Automated Technical Collection. Data collected automatically when you access the Platform, including your IP address, device identifiers, browser information, and session activity data. This data is collected through server logs, cookies, and similar tracking technologies.
3. Payment Processor Data. When you make a deposit or request a withdrawal via supported payment methods — including Touch'n Go eWallet, Boost, GrabPay, DuitNow, FPX (Maybank, CIMB, Public Bank, Hong Leong Bank), 7-Eleven Cliq, or cryptocurrency channels — transaction confirmation and payment reference data may be received from the relevant payment processor.
4. Identity Verification Partners. Where Suntoto engages third-party KYC or AML screening services to assist with identity verification or regulatory compliance checks, we may receive identity confirmation data from such partners.
5. Third-Party Referals. If you arrive at the Platform via a referral link or affiliate partner, we may receive basic referal attribution data such as the referral source identifier.

Suntoto processes your personal data for the following purposes:

• Account Management: To create, manage, and maintain your Suntoto Account, including verifying your identity, authenticating your login, and enabling access to Platform Services.
• Service Delivery: To provide the sports betting, casino gaming, live dealer, and other gaming services available on the Platform, including processing bets, crediting winnings, and maintaining accurate account balances.
• Financial Transactions: To process deposits and withdrawals via your chosen payment method, to verify payment method ownership, and to maintain accurate financial records for each Account.
• KYC and AML Compliance: To verify your identity and age in accordance with applicable Know Your Customer requirements, and to screen transactions and account activity for anti-money laundering (AML) compliance purposes.
• Responsible Gambling: To implement and enforce responsible gambling tools and restrictions you have requested, including deposit limits, session controls, and self-exclusion periods.
• Customer Support: To respond to your enquiries, resolve complaints, and provide assistance via live chat, email, and other support channels.
• Platform Security: To detect, investigate, and prevent fraudulent activity, unauthorised access, multi-account violations, bonus abuse, and other forms of prohibited conduct on the Platform.
• Legal Compliance: To fulfil our obligations under applicable laws and regulations, including retaining financial transaction records for the period required by relevant regulatory requirements.
• Platform Improvement: To analyse usage patterns, identify technical issues, and improve the functionality, performance, and user experience of the Platform.
• Communications: To send you account-related notifications, security alerts, transaction confirmations, and, where you have provided consent, promotional communications regarding bonuses and special offers.

Suntoto processes your personal data on the following legal bases:

• Contractual Necessity: Processing required to fulfil the agreement between you and Suntoto, as set out in the Terms & Conditions. This includes Account management, transaction processing, and Service delivery.
• Legal Obligation: Processing required to comply with applicable legal and regulatory requirements, including KYC identity verification, AML screening, financial record retention, and responsible gambling enforcement.
• Legitimate Interests: Processing undertaken in furtherance of Suntoto's legitimate business interests, including fraud prevention, platform security, abuse detection, and improving the quality of our Services. In each case, we have assessed that our legitimate interests do not override the rights and interests of the individuals whose data we process.
• Consent: Where we rely on your consent as the legal basis for processing — for example, in relation to optional marketing communications — we will make this clear at the point of collection and will provide a straightforward mechanism for withdrawing consent at any time.

7.1 No Sale of Personal Data. Suntoto does not sell, rent, or trade your personal data to any third party for commercial purposes. This commitment is absolute and applies regardless of the nature of the third party or the type of data in question.

7.2 Service Providers. We may share personal data with carefully selected third-party service providers who assist us in operating the Platform and delivering our Services. These providers include:

• Payment processors and financial institutions (including those facilitating Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, and Hong Leong Bank transactions);
• Identity verification and KYC service providers;
• AML and fraud screening technology providers;
• Cloud infrastructure and hosting service providers;
• Customer support platform providers;
• Analytics and platform performance monitoring providers;
• Game technology providers and licensed game studios.

All third-party service providers are required to process personal data in accordance with our instructions and applicable data protection standards. They are prohibited from using your personal data for any purpose other than the specific service they are providing to Suntoto.

7.3 Legal Disclosures. We may disclose personal data where required to do so by applicable law, court order, regulatory authority, or government agency. In such cases, we will disclose only the minimum information necessary to satisfy the legal requirement and will notify you of such disclosure to the extent permitted by applicable law.

7.4 Business Transfers. In the event of a merger, acquisition, restructuring, or sale of all or substantially all of Suntoto's assets, personal data held by Suntoto may be transferred to the acquiring entity as part of the transaction. We will provide notice of any such transfer and any material changes to the applicable privacy terms that result from it.

8.1 Retention Principle. Suntoto retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal or regulatory obligations. We apply a data minimisation approach: once data is no longer needed for the purpose for which it was collected and is not required to be retained under any applicable regulatory obligation, it is securely deleted or anonymised.

8.2 Active Account Data. While your Account remains active, we retain all personal data associated with your Account to enable the ongoing provision of our Services, including transaction history, gameplay records, and communication logs.

8.3 Post-Closure Retention. Following the closure of your Account — whether voluntary or at Suntoto's initiative — we are required by applicable financial regulations and AML obligations to retain certain categories of personal data for a minimum period. In most cases, this retention period is five (5) years from the date of Account closure, consistent with standard financial record-keeping requirements.

8.4 KYC Document Retention. Identity verification documents submitted for KYC purposes are retained for the duration of your active Account and for the post-closure period described above, in compliance with applicable AML and counter-terrorism financing regulations.

8.5 Marketing Data. Where you have provided consent for marketing communications, your marketing preference data is retained until such time as you withdraw your consent or until three (3) years after your last interaction with our Platform, whichever occurs first.

9.1 Technical Safeguards. Suntoto implements industry-standard technical security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Transport Layer Security (TLS/SSL) encryption for all data transmitted between your device and the Platform;
• Encryption of sensitive data at rest, including financial information and KYC documents;
• Access controls limiting employee access to personal data to those who have a legitimate need to process it for the purposes described in this Policy;
• Regular third-party security audits and penetration testing of the Platform's infrastructure;
• Intrusion detection and monitoring systems to identify and respond to potential security incidents.

9.2 Organisational Safeguards. In addition to technical measures, Suntoto maintains organisational safeguards including staff training on data protection obligations, confidentiality obligations for all personnel with access to personal data, and internal data handling policies aligned with this Privacy Policy.

9.3 Your Responsibilities. The security of your Account also depends on the security practices you maintain on your own devices. You are responsible for: keeping your Account login credentials confidential, using a strong and unique password for your Suntoto Account, enabling two-factor authentication where available, and logging out of your Account when using shared or public devices.

9.4 Security Incidents. In the event of a data security incident that affects your personal data, Suntoto will notify affected individuals in accordance with applicable notification requirements and will take immediate steps to mitigate the impact of the incident.

10.1 What Are Cookies. Cookies are small text files placed on your device when you visit a website. They enable the website to recognise your device, remember your preferences, and collect information about how you interact with the site. Suntoto uses cookies and similar tracking technologies (such as web beacons and session storage) on the Platform.

10.2 Types of Cookies We Use.

• Strictly Necessary Cookies: Essential for the Platform to function correctly. These include session authentication cookies, security tokens, and load-balancing cookies. These cannot be disabled without impairing your use of the Platform.
• Functional Cookies: Store your preferences to improve your experience, such as language settings, preferred payment method, and session display preferences.
• Performance and Analytics Cookies: Collect aggregated, anonymised data about how visitors use the Platform — for example, which pages are visited most frequently and whether any error messages are encountered. This data helps us improve the Platform.
• Security Cookies: Used to detect and prevent fraudulent activity, multi-account abuse, and other prohibited conduct, by linking device fingerprint data to Account activity patterns.

10.3 Managing Cookies. Most web browsers allow you to control cookies through their settings — including options to delete existing cookies or prevent the placement of new cookies. Please note that disabling strictly necessary cookies will impair the functionality of the Platform. Suntoto does not currently respond to Do Not Track (DNT) signals from browsers.

Subject to applicable data protection law, you have the following rights in relation to your personal data held by Suntoto. To exercise any of these rights, please contact our support team using the contact details set out in Section 15.