These six principles form the foundation of how Sungaitoto handles every piece of personal data — from the moment you register to long after your last session.
Data is collected for specific, legitimate purposes and never used beyond those stated intentions.
We collect only what is genuinely necessary to operate your account and comply with legal obligations.
All stored and transmitted data is protected using industry-standard 256-bit SSL encryption.
Your personal information is never sold, rented or traded to third-party marketers or data brokers.
You may access, correct, port or request deletion of your personal data at any time via support.
We tell you exactly what we collect, who we share it with, and how long we retain it — no small print surprises.
This Privacy Policy ("Policy") is issued by Sungaitoto ("we", "us", "our", "the Platform"), the operator of the online betting and casino platform accessible at sungaitoto.click ("the Website"). This Policy governs the collection, processing, storage, disclosure and protection of personal data relating to registered users ("User", "you") and visitors to the Website.
By creating an account on, or accessing, the Website, you acknowledge that you have read and understood this Policy. This Policy forms part of, and should be read in conjunction with, our Terms & Conditions and our Responsible Gambling Policy.
Sungaitoto takes the privacy of Malaysian players seriously. Whether you are based in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam or anywhere else across Malaysia, your personal data is handled with the same level of care, security and transparency described in this Policy.
Summary: We collect only the data we genuinely need to operate your account, comply with legal obligations, and improve our services. We do not sell your data. You have the right to access, correct and delete your personal information at any time. The Platform is strictly for users aged 21 years and above.
In this Policy, the following terms have the meanings set out below unless the context otherwise requires:
Sungaitoto collects Personal Data across several categories depending on the nature of your interaction with the Platform:
| Category | Examples | When Collected |
|---|---|---|
| Identity Data | Full legal name, date of birth, nationality, gender, government-issued ID number (MyKad / Passport) | Registration & KYC verification |
| Contact Data | Email address, mobile phone number, residential address | Registration & account management |
| Financial Data | Bank account details, e-wallet identifiers (Boost, Touch 'n Go eWallet, GrabPay, Maybank, CIMB, DuitNow FPX), transaction history, deposit and withdrawal records | Payment processing & AML compliance |
| Usage Data | Login timestamps, session duration, pages visited, games played, betting history, wagering amounts, win/loss records | Ongoing platform use |
| Technical Data | IP address, device type, operating system, browser type and version, time zone, device identifiers | Every website visit |
| Communications Data | Live chat transcripts, support email correspondence, feedback submitted | Interactions with support team |
| Responsible Gambling Data | Self-exclusion status, deposit limit settings, session time limit preferences | When tools are activated |
Note: We do not collect payment card numbers directly. All card and e-wallet transactions are processed through certified payment gateway partners who maintain their own PCI-DSS compliant security frameworks. Sungaitoto receives only transaction reference identifiers and status confirmations.
Sungaitoto collects Personal Data through the following channels:
The majority of your Personal Data is provided directly by you when you: register an account; complete the KYC verification process; make a deposit or request a withdrawal; contact our support team via live chat, email or WhatsApp; participate in promotions or surveys; or update your account profile settings.
When you access the Website, certain Technical Data is collected automatically by our servers and tracking technologies, including your IP address, device type, browser configuration, referring URL, and clickstream data. This collection occurs regardless of whether you are logged into an account.
We may receive Personal Data about you from trusted third-party sources in limited circumstances, including: identity verification service providers used during KYC processing; payment processing partners (transaction status data only); fraud prevention and anti-money laundering screening services; and publicly available sources where relevant to compliance obligations.
Sungaitoto processes Personal Data on the following legal bases, which are assessed individually for each processing activity:
Sungaitoto processes your Personal Data for the following purposes:
Sungaitoto does not sell, rent or trade your Personal Data to any third party for commercial purposes. We share Personal Data only in the following limited circumstances:
We engage trusted third-party service providers who process Personal Data on our behalf and under our instruction, under strict contractual data protection obligations. These include: payment gateway and e-wallet processing partners; identity verification and KYC service providers; fraud detection and AML screening services; cloud hosting and data storage providers; customer support platform providers; and marketing communication platforms (where consent to marketing is given).
We may disclose Personal Data to governmental or regulatory authorities, law enforcement agencies, or courts where we are legally required to do so, or where we reasonably believe disclosure is necessary to prevent fraud, protect the rights or safety of individuals, or comply with a legal obligation. Such disclosures are made only to the minimum extent required.
In the event of a merger, acquisition, restructuring, or sale of all or part of our business, Personal Data held by us may be transferred to the acquiring entity. Any such transfer will be subject to the same privacy obligations described in this Policy, and affected Users will be notified as required by applicable law.
Outside the circumstances described above, we will not disclose your Personal Data to any third party without your prior explicit consent.
Sungaitoto uses cookies and similar tracking technologies to operate the Website effectively and improve user experience. Cookies are small text files stored on your device when you visit the Website.
You may adjust your browser settings to refuse or delete cookies at any time. Please note that disabling essential cookies will prevent you from accessing certain features of the Platform, including account login. Instructions for managing cookies are available in the help documentation for all major browsers including Chrome, Firefox, Safari and Edge.
Third-Party Tracking: The Website does not embed third-party advertising trackers or social media pixels that transmit your activity data to external advertising networks without your knowledge.
Sungaitoto retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, and as required by applicable legal, regulatory, tax and accounting obligations. The following general retention periods apply:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account & Identity Data | Duration of account + 7 years post-closure | AML / regulatory obligation |
| Financial Transaction Records | 7 years from transaction date | Tax and AML compliance |
| KYC Documentation | 5 years from account closure or last transaction | Regulatory requirement |
| Responsible Gambling Records | Duration of exclusion + 5 years | Player protection obligation |
| Support Communications | 3 years from last interaction | Legitimate interest / dispute resolution |
| Technical / Usage Data | 13 months rolling | Performance analytics |
| Marketing Consent Records | Until consent withdrawn + 3 years | Demonstrating consent compliance |
Upon expiry of the applicable retention period, Personal Data is securely deleted or permanently anonymised. Where data is anonymised, it may be retained indefinitely for statistical and analytical purposes as it no longer constitutes Personal Data.
Sungaitoto implements a comprehensive set of technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, destruction, alteration or disclosure. These measures include:
Your role in data security: You are responsible for maintaining the confidentiality of your account login credentials. Never share your password with any third party. Sungaitoto will never ask for your password via email, live chat or telephone. If you suspect your account has been compromised, contact our support team immediately at [email protected].
The Sungaitoto Platform primarily processes Personal Data within Malaysia and its immediate operational infrastructure. In certain circumstances, data may be processed by third-party service providers whose systems are located in other jurisdictions — including cloud hosting providers and game software vendors operating internationally.
Where Personal Data is transferred outside Malaysia, Sungaitoto takes reasonable steps to ensure that equivalent levels of data protection are maintained, including through contractual obligations imposed on the receiving entity that reflect the protections described in this Policy.
By creating an account and using the Platform, you acknowledge the possibility of such transfers and their necessity for the provision of the Services described in our Terms and Conditions.
Subject to applicable law and any overriding legal obligations (such as AML record-keeping requirements), you have the following rights in relation to your Personal Data held by Sungaitoto:
To exercise any of these rights, please contact our Data Protection team via live chat or by emailing [email protected] with the subject line "Data Rights Request". We may ask you to verify your identity before processing any request. We will aim to respond within 30 calendar days of receiving a complete and verified request.
Sungaitoto's Platform and Services are strictly intended for individuals aged 21 years and above. We do not knowingly collect Personal Data from individuals under the age of 21.
If we discover or are notified that Personal Data has been collected from a person under the age of 21, we will immediately close the associated account, forfeit any balance in accordance with our Terms and Conditions, and securely delete all associated Personal Data to the extent permitted by our legal retention obligations.
We employ age verification as part of our registration and KYC processes to enforce this restriction. If you have reason to believe that a minor has registered an account on our Platform, please notify us immediately via our support channels.
The Website may contain references to or integrations with third-party payment services, including Boost eWallet, Touch 'n Go eWallet, GrabPay, Maybank, CIMB and other financial service providers. When you interact with these third-party payment services, you are subject to their respective privacy policies, which are separate from and independent of this Policy.
Sungaitoto is not responsible for the privacy practices, content or security of any third-party services accessed through or in connection with the Platform. We encourage you to review the privacy policies of all third-party services you use in connection with your Sungaitoto account, particularly your chosen payment provider.
Sungaitoto reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform functionality. Where material changes are made, we will notify registered Users by email or via an in-platform notification at least 7 days before the revised Policy takes effect.
For minor or non-material amendments, the updated Policy will be published on this page with a revised "Last Updated" date. Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Policy. It is your responsibility to review this page periodically.
If you disagree with any revision to this Policy, you should cease using the Platform and close your account before the revised Policy takes effect.
If you have any questions, concerns or requests relating to this Privacy Policy or the processing of your Personal Data, please contact us through the following channels:
For information about our responsible gambling tools and self-exclusion options, please visit our Responsible Gambling page. For full platform rules, please review our Terms & Conditions.
This Privacy Policy was last updated on 1 January 2026. The version published on this page supersedes all previous versions. Thank you for trusting Sungaitoto with your personal information — we take that responsibility seriously.
Our support team is available 24/7 to address any concerns about how your personal data is handled. You can also explore our FAQ for quick answers.