SultanToto Privacy Policy — How We Handle Your Personal Data
Your privacy matters to us. This Privacy Policy explains what personal data SultanToto collects, why we collect it, how we use and protect it, and what rights you hold over your own information as a player on our platform.
What We Promise About Your Data
These cards summarise our core data privacy commitments. They complement — and do not replace — the full Privacy Policy set out below. Please read every section carefully.
Data Minimisation
We collect only the personal data that is strictly necessary to operate your account, verify your identity, process payments, and comply with our licensing obligations. Nothing more.
No Data Sales
SultanToto does not sell, rent, or trade your personal data to third-party advertisers or data brokers under any circumstances. Your data is used exclusively to operate and improve our platform.
Secure Storage
All personal data and financial information is stored on encrypted servers with access controls, regular security audits, and 256-bit SSL protection across all data in transit.
Your Data Rights
You have the right to access, correct, and request deletion of your personal data at any time by contacting our support team. We respond to data subject requests within a reasonable timeframe.
Transparent Cookie Use
We use cookies and similar tracking technologies to operate the platform, maintain your session, and understand aggregate usage patterns. We do not use cookies for third-party ad targeting.
Licensing Compliance
Our data handling practices are governed by the requirements of our international gaming licence, which mandates KYC, AML record-keeping, and responsible data governance standards.
Introduction
This Privacy Policy ("Policy") is issued by SultanToto ("we", "us", "the Operator", "the Platform") and applies to all personal data collected from individuals ("you", "the Player", "the User") who access or use the SultanToto website at https://sultantoto.cam and all associated services, including account registration, betting, live casino, payment processing, and customer support.
SultanToto is committed to protecting the privacy and security of your personal information in accordance with the data protection requirements applicable under our international operating licence. This Policy explains what personal data we collect, the purposes for which it is processed, the conditions under which it may be shared, and the rights available to you in relation to your personal data.
By registering an Account or using any part of the SultanToto Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. This Policy should be read in conjunction with our Terms & Conditions.
This Privacy Policy was last updated on 1 January 2026. We will post any future amendments on this page with an updated effective date.
Definitions
For the purposes of this Privacy Policy, the following terms have the meanings set out below:
| Term | Meaning |
|---|---|
| "Personal Data" | Any information relating to an identified or identifiable natural person, including name, identity document number, contact details, financial data, and device identifiers. |
| "Processing" | Any operation performed on personal data, including collection, storage, use, disclosure, erasure, or destruction. |
| "Data Controller" | SultanToto, as the entity that determines the purposes and means of processing your personal data. |
| "Data Processor" | A third party that processes personal data on behalf of SultanToto, such as payment service providers and identity verification services. |
| "KYC" | Know Your Customer — the identity verification process required by our licensing obligations before processing withdrawals. |
| "Cookies" | Small data files placed on your device by a website to store session information, preferences, and usage data. |
| "Platform" / "Website" | The SultanToto website at https://sultantoto.cam and all associated pages, services, and applications. |
Data We Collect
SultanToto collects and processes the following categories of personal data, depending on your interaction with the Platform:
3.1 Registration and Identity Data
- Full legal name as it appears on your government-issued identification document.
- Date of birth (to verify you are aged 21 or above).
- Malaysian IC (MyKad) number or passport number.
- Residential address, including city (e.g., Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam).
- Email address and contact phone number.
- Username and encrypted password hash.
3.2 Financial and Payment Data
- Details of the payment methods used for deposits and withdrawals — including e-wallet identifiers (e.g., Touch 'n Go eWallet registered phone number, Boost account), bank account numbers (Maybank, CIMB, Public Bank, RHB, Hong Leong), DuitNow IDs, FPX reference data, and cryptocurrency wallet addresses (BTC, USDT).
- Transaction history, including deposit amounts, withdrawal requests, and processed payout records.
- Source of funds documentation where requested as part of enhanced due diligence.
3.3 KYC and Verification Documents
- Photographs or scans of your Malaysian IC (MyKad), passport, or other government-issued identity documents.
- Proof of address documentation (e.g., utility bills, bank statements).
- Selfies or liveness check images where requested for enhanced verification.
3.4 Betting and Gaming Activity Data
- Wager history, game session records, sports betting selections, and outcomes.
- Bonus and promotion redemption history.
- Game preferences, session durations, and account activity logs.
3.5 Technical and Device Data
- IP address and approximate geographic location.
- Device type, operating system, browser type and version.
- Session timestamps, pages visited, and click-stream data.
- Cookie identifiers and similar tracking data (see Section 11).
3.6 Communications Data
- Content of communications with our customer support team, including live chat transcripts and support email correspondence.
- Survey responses, feedback submissions, and dispute correspondence.
How We Collect Data
We collect personal data through the following channels:
- Directly from you — when you register an account, complete KYC verification, make a deposit or withdrawal, contact support, or respond to a survey.
- Automatically — when you use the Platform, through cookies, server logs, and analytics tools that record your device information, browsing behaviour, and session activity.
- From third-party verification services — identity verification providers and fraud detection services used as part of our KYC and AML compliance process.
- From payment service providers — when you transact via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, or other payment partners, those providers may share transaction confirmation data with us.
Purpose of Processing
SultanToto processes your personal data for the following purposes:
| Purpose | Description |
|---|---|
| Account Management | Creating, maintaining, and securing your registered account on the SultanToto Platform. |
| Identity Verification (KYC) | Confirming that you are who you say you are, that you are at least 21 years old, and that your account complies with our licensing obligations. |
| Payment Processing | Processing deposits and withdrawals via Malaysian payment methods (Touch 'n Go, DuitNow, FPX, Maybank, CIMB, etc.) and cryptocurrency channels. |
| AML Compliance | Detecting, investigating, and reporting suspicious financial activity as required by our licensing authority's anti-money laundering obligations. |
| Responsible Gambling | Monitoring account activity to identify problem gambling indicators and to apply player-protection measures such as deposit limits and self-exclusion. |
| Customer Support | Responding to your enquiries, resolving disputes, and providing technical assistance. |
| Platform Security | Detecting and preventing fraud, collusion, bot usage, multiple account abuse, and other prohibited conduct. |
| Service Improvement | Analysing aggregate usage data to improve the Platform's performance, game selection, and user experience. |
| Legal Compliance | Meeting obligations imposed by our operating licence, applicable laws, court orders, or regulatory bodies. |
Legal Basis for Processing
SultanToto processes your personal data under the following legal bases, as applicable to each processing activity:
- Contractual Necessity: Processing required to perform the contract between you and SultanToto — including account creation, deposits, withdrawals, and game participation.
- Legal Obligation: Processing required to comply with our licensing authority's KYC, AML, and responsible gambling mandates.
- Legitimate Interests: Processing carried out in pursuit of SultanToto's legitimate business interests, including fraud prevention, platform security, and service improvement — where those interests are not overridden by your privacy rights.
- Consent: Where we rely on your consent — for example, for certain optional communications — you have the right to withdraw that consent at any time by contacting our support team.
Data Sharing & Disclosure
SultanToto does not sell, rent, or trade your personal data. We may share your personal data with third parties only in the following circumstances:
- Payment Service Providers: We share the minimum necessary payment data with our Malaysian payment partners (including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and banking partners including Maybank, CIMB, Public Bank, RHB, and Hong Leong) to process your deposits and withdrawals.
- Identity Verification Providers: We engage third-party KYC and identity verification services to process your identity documents. These providers act as Data Processors under contractual obligations consistent with this Policy.
- Fraud and Security Services: We share relevant data with fraud detection and cybersecurity providers to identify and prevent prohibited conduct on the Platform.
- Game Technology Providers: Aggregate and anonymised game activity data may be shared with our licensed game studio partners for technical and compliance purposes. We do not share individual player identities with game studios without necessity.
- Regulatory and Law Enforcement Authorities: We will disclose personal data where required by our licensing authority, a court order, or a legitimate law enforcement request. We will notify you of such disclosures where legally permitted.
- Professional Advisers: Legal, compliance, and financial advisers engaged by SultanToto may have access to personal data on a strictly need-to-know basis, subject to professional confidentiality obligations.
SultanToto strictly prohibits the sale or commercial transfer of player personal data to advertising networks, data brokers, or any third party for marketing purposes not directly related to the operation of your SultanToto account.
International Data Transfers
As an international online gaming platform operating under an offshore licence, SultanToto and some of its third-party service providers may store or process personal data in jurisdictions outside Malaysia. When we transfer personal data internationally, we take reasonable steps to ensure that the recipient provides an adequate level of data protection, including through contractual arrangements with our Data Processors.
Malaysian players should be aware that data protection standards vary by jurisdiction. By using the SultanToto Platform, you acknowledge and consent to the transfer, storage, and processing of your personal data in jurisdictions outside Malaysia as described in this Policy.
Data Retention
SultanToto retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, including:
- Active Accounts: For the duration of your active account relationship with SultanToto.
- Post-Closure Retention: Following account closure, SultanToto retains personal data for a minimum period of five (5) years to comply with AML record-keeping obligations under our licensing requirements.
- Transaction Records: Financial transaction records are retained for at least five (5) years from the date of the transaction.
- KYC Documents: Identity verification documents are retained for at least five (5) years following the end of the customer relationship.
- Communications: Customer support communications are retained for a minimum of two (2) years.
Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our data destruction procedures.
Data Security
SultanToto implements appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. These measures include:
- 256-bit SSL/TLS encryption for all data transmitted between your device and our Platform.
- Encryption of sensitive personal data and financial information at rest.
- Role-based access controls ensuring that employees access only the data necessary for their function.
- Regular security audits and vulnerability assessments of our infrastructure.
- Two-factor authentication (2FA) available to all players for account login protection.
- Monitoring and intrusion detection systems to identify and respond to potential security incidents.
Notwithstanding these measures, no internet transmission or electronic storage system is completely secure. In the event of a data breach that materially affects your personal data, SultanToto will notify you as required by applicable obligations under our licensing framework.
Cookies & Tracking Technologies
SultanToto uses cookies and similar tracking technologies (including web beacons and local storage objects) to operate the Platform and improve your experience. The following categories of cookies are used:
| Cookie Type | Purpose |
|---|---|
| Strictly Necessary | Required for the Platform to function. Includes session authentication, security tokens, and login state management. Cannot be disabled without affecting Platform functionality. |
| Functional | Stores your preferences such as language settings, display preferences, and last-visited game categories to personalise your experience. |
| Analytics | Collects aggregate, anonymised data about how players use the Platform — including pages visited, session duration, and error occurrences — to help us improve performance and usability. |
| Security | Used to detect and prevent fraudulent activity, multiple account creation, and bot traffic by identifying patterns in device and session data. |
SultanToto does not use cookies for third-party behavioural advertising. Most web browsers allow you to control cookie settings through your browser preferences. Disabling strictly necessary cookies may impair Platform functionality, including your ability to log in and maintain a session.
Your Data Rights
Subject to applicable law and our licensing obligations, you have the following rights in relation to your personal data held by SultanToto:
Right of Access
You may request a copy of the personal data we hold about you and information about how it is processed.
Right to Rectification
You may request correction of inaccurate or incomplete personal data held about you.
Right to Erasure
You may request deletion of your personal data where it is no longer necessary, subject to our legal retention obligations.
Right to Restriction
You may request that we restrict the processing of your personal data in certain circumstances, such as while a rectification request is pending.
Right to Portability
Where technically feasible, you may request a copy of your personal data in a structured, machine-readable format.
Right to Object
You may object to processing carried out on the basis of legitimate interests, including profiling for fraud prevention purposes.
To exercise any of the above rights, please contact SultanToto's support team via live chat or the support email address listed in Section 15. We will respond to all data subject requests within a reasonable timeframe, and in any case within thirty (30) days of receipt. Certain requests may be subject to identity verification before they can be processed.
Please note that our AML and licensing obligations require us to retain certain categories of personal data (particularly KYC documents and transaction records) for a minimum of five years following the end of the account relationship, even where an erasure request is made. We will inform you if a retention obligation prevents full compliance with your request.
Minors — 21+ Policy
SultanToto's services are strictly intended for individuals aged 21 and above. We do not knowingly collect, store, or process personal data from individuals under the age of 21. Identity verification is a mandatory step of the registration and withdrawal process specifically to enforce this age requirement.
If SultanToto discovers or is notified that personal data has been collected from an individual under the age of 21, we will immediately suspend the associated account, delete the data where legally permissible, and return any deposits following satisfactory identification of the account holder.
Parents and guardians who believe that a minor may have registered on SultanToto should contact our support team immediately via live chat or the support email address in Section 15.
Policy Amendments
SultanToto reserves the right to update or amend this Privacy Policy at any time. The revised Policy will be posted on this page with an updated effective date. Where amendments are material — for example, a change to the categories of data collected or a new data sharing arrangement — we will endeavour to notify registered players by email or via a prominent Platform notice.
Your continued use of the SultanToto Platform following the posting of an amended Privacy Policy constitutes your acceptance of the revised terms. We encourage you to review this Policy periodically to remain informed of how we protect your personal data.
Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact SultanToto through the following channels. We are committed to addressing all privacy-related enquiries promptly and transparently.
- Live Chat: Available 24/7 directly through the Platform. Average first response under 2 minutes. The fastest channel for urgent data concerns.
- Support Email: [email protected] — for written data subject requests, correction requests, and detailed privacy enquiries. (Plain text only — not a clickable link.)
- Languages: Our support team can assist in English, Bahasa Malaysia, and Mandarin.
For account closure or self-exclusion requests — which are related to but distinct from data subject requests — please also contact our support team directly. Self-exclusion information is also available on our Responsible Gambling page.
For questions about the legal terms governing your use of the Platform, please refer to our Terms & Conditions.
Comfortable with Our Privacy Practices?
Join SultanToto — Malaysia's Most Trusted Platform
Register today and experience fast withdrawals, 2,000+ games, and 24/7 support — all backed by our commitment to data privacy and player protection. Welcome bonus up to MYR 2,880. Min. deposit RM50. 21+ only. T&Cs apply.