Privacy Policy

This Privacy Policy ("Policy") is issued by Sumbartoto ("we", "us", "our", "the Company"), the operator of the online gaming platform accessible at sumbartoto.cam ("Platform"). It describes how we collect, use, store, share, and protect the personal data of individuals ("Users", "you") who access or use any service offered through the Platform.

This Policy applies to all personal data collected through the Platform, including during the account registration process, identity verification (KYC), deposit and withdrawal transactions, customer support interactions, and general browsing activity on sumbartoto.cam.

By using the Platform, you acknowledge that you have read and understood this Policy. If you do not agree with any part of this Policy, you should discontinue use of the Platform immediately. This Policy is to be read alongside our Terms & Conditions, which govern the broader relationship between you and sumbartoto.

The following terms carry the meanings set out below throughout this Policy:

• "Personal Data" — any information relating to an identified or identifiable natural person, including but not limited to name, identification number, location data, online identifiers, and factors specific to the physical, economic, or social identity of that person.
• "Processing" — any operation performed on personal data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, or deletion.
• "Data Controller" — Sumbartoto, in its capacity as the entity that determines the purposes and means of processing personal data collected through the Platform.
• "Data Processor" — any third party that processes personal data on behalf of sumbartoto, acting under written instruction and subject to equivalent data protection obligations.
• "KYC" — Know Your Customer; the identity and document verification process conducted upon account registration or at the point of a withdrawal or compliance review.
• "Consent" — a freely given, specific, informed, and unambiguous indication of the User's agreement to the processing of their personal data for a stated purpose.

Sumbartoto collects personal data across several categories depending on the nature of your interaction with the Platform. The table below summarises the categories of data we process:

We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, genetic data, or biometric data unless required to do so by applicable law in connection with anti-money laundering (AML) obligations.

Sumbartoto collects personal data through the following means:

1. Direct interactions — information you provide when registering an account, completing KYC, making deposits or withdrawals, contacting support, or updating your account settings.
2. Automated technologies — technical and behavioural data collected automatically when you access or interact with the Platform, including through cookies, server logs, and session tracking systems.
3. Third-party payment providers — transaction confirmation data received from payment processors including FPX, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, and cryptocurrency network confirmations.
4. Identity verification providers — data returned from third-party KYC and AML screening services where used to verify your identity or assess financial crime risk.
5. Fraud and security systems — signals from fraud detection and device fingerprinting technologies used to protect the security of the Platform and its users.

Sumbartoto processes personal data only where there is a lawful basis for doing so. The lawful bases we rely upon are as follows:

• Contractual necessity — processing required to perform our obligations under the Terms & Conditions agreement with you, including account administration, payment processing, and game delivery.
• Legal obligation — processing required to comply with applicable law, including AML/CFT obligations, age verification, record-keeping requirements under our international gaming licence, and any lawful order from a regulatory or law enforcement authority.
• Legitimate interests — processing for the purposes of fraud prevention, platform security, responsible gambling monitoring, and the improvement of our services, where such interests are not overridden by your rights and interests.
• Consent — processing for which you have provided specific, informed consent, such as receiving optional marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Sumbartoto uses your personal data for the following purposes:

• Creating and administering your registered account on the Platform;
• Processing deposit transactions and withdrawal requests, including verification of payment method ownership;
• Conducting KYC identity verification and ongoing AML/CFT screening as required under our licence obligations;
• Delivering, maintaining, and improving the gaming services available on the Platform;
• Providing customer support via live chat and email;
• Detecting and preventing fraud, collusion, bonus abuse, and other prohibited activities;
• Monitoring compliance with our Terms & Conditions and this Privacy Policy;
• Operating responsible gambling tools including deposit limits, loss limits, cool-off periods, and self-exclusion programmes;
• Sending transactional communications related to your account (e.g., deposit confirmations, withdrawal notifications, security alerts);
• Sending promotional communications where you have opted in or where permitted under applicable law;
• Analysing Platform usage to improve user experience, game selection, and operational performance;
• Complying with any lawful request from a regulatory authority or law enforcement body.

Sumbartoto does not sell or otherwise transfer your personal data to third parties for their own commercial purposes. We may share your personal data with third parties only in the following circumstances:

• Payment processors and financial institutions — to facilitate deposit and withdrawal transactions via FPX, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, and cryptocurrency networks. These parties act as independent data controllers for their own processing operations.
• Identity verification and KYC providers — third-party services engaged to verify user identities and conduct AML screening in accordance with our licensing obligations.
• IT and cloud infrastructure providers — technical service providers who host Platform data under contractual obligations equivalent to those in this Policy, including data security and confidentiality obligations.
• Game providers — certified game providers whose titles are hosted on the Platform may receive anonymised or pseudonymised gameplay data for technical integration and RTP verification purposes.
• Fraud prevention and security services — specialist providers engaged to detect fraud, unauthorised access, and other security threats.
• Regulatory and law enforcement authorities — sumbartoto will disclose personal data to competent authorities where required to do so by law, court order, or the binding direction of our licensing regulator.

All third-party data processors engaged by sumbartoto are bound by contractual data processing agreements that require them to process personal data only for the specified purpose, to apply appropriate security measures, and to comply with applicable data protection standards.

Sumbartoto uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files placed on your device when you access the Platform. We use the following categories of cookies:

• Strictly necessary cookies — essential for the Platform to function. These include session authentication, security tokens, and load-balancing cookies. They cannot be disabled without preventing core Platform functionality.
• Performance and analytics cookies — used to collect anonymised data about how users interact with the Platform, including page visit frequency, session duration, and error occurrence rates. This data helps us identify and fix technical issues and improve the user experience.
• Functional cookies — used to remember your preferences, such as language settings, previously accessed game categories, and responsible gambling tool configurations.
• Security cookies — used to detect and prevent fraudulent activity, including bot detection and session hijacking prevention.

You may control non-essential cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of specific Platform features. Sumbartoto does not use third-party advertising or behavioural tracking cookies.

Sumbartoto retains personal data for the minimum period necessary to fulfil the purposes for which it was collected and to comply with applicable legal and regulatory obligations. The following general retention periods apply:

• Account and identity data — retained for the duration of your account's existence and for a minimum of 5 years following account closure, in accordance with AML and licensing requirements.
• Financial transaction records — retained for a minimum of 5 years from the date of the transaction, in line with international financial record-keeping standards.
• Customer support communications — retained for 3 years from the date of the interaction.
• Technical and session logs — retained for up to 12 months for security and fraud prevention purposes.
• Responsible gambling records — retained for a minimum of 5 years to support ongoing safeguarding obligations.
• Marketing consent records — retained for the duration of the marketing relationship and for up to 3 years following opt-out, as evidence of consent management.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be associated with any individual.

Sumbartoto operates through infrastructure that may involve the transfer of personal data to countries outside Malaysia. Such transfers may occur in connection with our cloud hosting providers, KYC verification partners, or game providers who operate from other jurisdictions.

Where personal data is transferred outside the country of collection, sumbartoto takes appropriate safeguards to ensure that the data receives a level of protection equivalent to that required under applicable data protection standards. These safeguards include the use of contractual data processing agreements with receiving parties that impose obligations equivalent to those in this Policy.

As a user of the sumbartoto Platform, you have the following rights in relation to your personal data. To exercise any of these rights, please contact our support team as set out in Section 15 of this Policy.

Sumbartoto will respond to all legitimate data rights requests within 30 calendar days of receipt. Where a request is complex or high in volume, we may extend this period by a further 30 days with prior notification. We will not charge a fee for processing a rights request unless the request is manifestly unfounded or excessive.

Sumbartoto implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between the user's device and our servers;
• Encrypted storage of sensitive data including identity documents and financial records at rest;
• Role-based access controls that limit internal access to personal data on a strict need-to-know basis;
• Multi-factor authentication for internal administrative systems;
• Automated fraud detection and anomaly monitoring systems that flag unusual account activity in real time;
• Regular penetration testing and security audits conducted by independent third parties;
• Staff training on data protection obligations and security awareness;
• Documented incident response procedures in the event of a data security breach.

In the event of a data breach that is likely to result in a risk to your rights and interests, sumbartoto will notify affected users without undue delay and will take all reasonable steps to mitigate the impact of the breach. No data security system is completely impenetrable — we therefore also encourage you to use a strong, unique password for your sumbartoto account and to keep your login credentials confidential.

The sumbartoto Platform is strictly intended for persons aged 21 years and above. We do not knowingly collect or process personal data of individuals below the age of 21. Age verification is a mandatory step in the account registration process, and sumbartoto employs additional KYC checks to confirm user age at the point of withdrawal.

If we become aware that personal data has been collected from an individual under the age of 21 without proper verification, we will take immediate steps to close the associated account, delete all personal data relating to that individual, and where applicable, reverse any financial transactions.

If you believe that an underage individual has registered an account on the Platform, please contact our support team immediately so that we can investigate and take appropriate action.

Sumbartoto reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or our data processing practices. The current version of this Policy, together with the date of last update, is always accessible at sumbartoto.cam/privacy-policy.

Where amendments are material — meaning they significantly alter the nature, scope, or purpose of our data processing, or materially affect your rights — we will provide prior notice by email to your registered address or by on-Platform notification. Non-material amendments (such as clarifications of existing practice, typographical corrections, or formatting changes) will be published without prior individual notification.

Your continued use of the Platform following publication of an updated Policy constitutes your acknowledgement of the changes. If you do not accept an amendment, you should cease using the Platform and contact our support team to close your account in accordance with the Terms & Conditions.

For any questions, concerns, or requests relating to this Privacy Policy or the personal data we hold about you, please contact the sumbartoto Data Protection team through the following channels:

• Live Chat: Available 24/7 via the sumbartoto Platform. Select "Account & Privacy" as your inquiry category.
• Email (plain text — not a link): [email protected] — include "Privacy Request" in your subject line. Responses are provided within 4 business hours during standard operations.

When submitting a data rights request, please provide: your registered username or email address, the nature of your request (access, deletion, correction, etc.), and any supporting information that will help us locate your data efficiently. We may need to verify your identity before processing certain requests to protect against unauthorised disclosure.

If you are not satisfied with our handling of your personal data or our response to a rights request, you have the right to lodge a complaint with the appropriate supervisory authority in your jurisdiction. Sumbartoto is committed to working constructively with all regulators and to resolving data protection concerns promptly.

For responsible gambling support, data deletion in connection with self-exclusion, or removal from any marketing lists, our support team is available 24/7 and will action requests immediately upon verification.