Privacy Policy

Introduction

This Privacy Policy (hereinafter referred to as "the Policy" or "this Policy") is published by Suburtoto, the operator of the online gaming and sports betting platform accessible at suburtoto.cam (hereinafter referred to as "the Platform" or "the Website"). Throughout this Policy, "we", "us", "our", and "the Company" refer to Suburtoto. "You", "your", and "the Player" refer to any individual who accesses, registers on, or uses the Platform.

This Policy describes how Suburtoto collects, uses, stores, shares, and protects personal data in connection with the operation of the Platform and delivery of our services to Malaysian players and other users. It is intended to be read in conjunction with our Terms & Conditions, which are incorporated herein by reference.

By creating an account on the Platform, making a deposit, placing a wager, or otherwise using our services, you acknowledge that you have read this Policy, understand its contents, and consent to the collection and processing of your personal data as described herein. If you do not agree with any aspect of this Policy, please discontinue use of the Platform and close your account.

Definitions

For the purposes of this Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person. This includes your name, identification number, contact details, financial information, and device identifiers where these can be linked back to you individually.
• "Processing" means any operation performed on personal data — including collection, recording, storage, adaptation, retrieval, disclosure, and deletion.
• "Data Controller" means Suburtoto, which determines the purposes and means of processing personal data collected through the Platform.
• "Data Processor" means any third party that processes personal data on behalf of Suburtoto under a data processing agreement — for example, payment processors such as those facilitating Touch 'n Go eWallet, Boost, GrabPay, DuitNow, or FPX transactions.
• "Consent" means a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your personal data for a stated purpose.
• "Sensitive Personal Data" means personal data revealing racial or ethnic origin, political opinions, religious beliefs, health or financial information, or biometric data — categories that attract heightened protection obligations.
• "KYC" means Know Your Customer — the identity and address verification process mandated for all players prior to their first withdrawal from the Platform.

Personal Data We Collect

Suburtoto collects personal data across several categories, depending on how you interact with the Platform. The table below summarises the principal data types collected, together with the context in which each is gathered.

We do not knowingly collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, or health information unless specifically required to fulfil a regulatory obligation — for example, collecting information relevant to responsible gambling interventions.

How We Collect Personal Data

4.1 Directly from You

The majority of the personal data we hold is provided directly by you in the course of using our Platform — when you complete the registration form, submit KYC documentation, make a deposit or withdrawal request, contact our customer support team, or update your account preferences. We collect only what you choose to provide.

4.2 Automatically During Platform Use

Technical data — including IP addresses, device identifiers, browser type, operating system version, and session activity — is collected automatically when you access the Platform. This data is used for security monitoring, fraud detection, platform performance optimisation, and compliance purposes. It is not used to build advertising profiles.

4.3 From Payment Processors

When you make a deposit or withdrawal using Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, or any other supported Malaysian payment method, our payment processing partners share limited transaction-level data with us to confirm payment status and facilitate account crediting. Full payment credentials are not transmitted to or stored by Suburtoto — they remain with the payment provider.

4.4 From Third-Party Verification Services

For KYC and age-verification purposes, we may engage third-party identity verification services. These services compare the documents you submit against authoritative records and return a verification outcome to us. The identity verification provider operates under its own privacy obligations and is contractually bound to process your data only for verification purposes.

Purposes of Data Processing

Suburtoto processes your personal data for the following specific, documented purposes:

• Account Creation and Management — establishing your account, maintaining your profile, and enabling you to access and use all Platform features.
• Identity Verification (KYC) — confirming your identity, age (21+ requirement), and residential address in compliance with our operational obligations.
• Payment Processing — facilitating deposits and withdrawals via supported Malaysian payment methods, and maintaining accurate financial records of all transactions.
• Fraud and Money Laundering Prevention — monitoring transactions and account activity for indicators of fraudulent conduct, unauthorised access, or money laundering and reporting to relevant authorities where legally required.
• Customer Support — responding to your queries, resolving disputes, and maintaining records of support interactions for quality assurance purposes.
• Responsible Gambling — monitoring account activity to identify indicators of potentially problematic gambling behaviour, enforcing self-exclusion and deposit limit requests, and making appropriate interventions where welfare concerns arise.
• Platform Security and Integrity — detecting and preventing unauthorised access, bot activity, account takeovers, and other security threats to the Platform and its users.
• Legal and Regulatory Compliance — meeting record-keeping, reporting, and investigation obligations imposed by applicable laws and regulations.
• Marketing Communications — sending you promotional offers, bonuses, and news about the Platform where you have expressly consented to receive such communications. You may withdraw this consent at any time.
• Platform Improvement — analysing aggregated and anonymised usage data to improve the performance, design, and features of the Platform.

Legal Bases for Processing

Suburtoto processes personal data on the basis of one or more of the following legal grounds, depending on the specific processing activity in question:

• Contractual Necessity — processing that is necessary to fulfil our obligations to you under the Terms & Conditions you accepted on registration. This covers account management, payment processing, and service delivery.
• Legitimate Interests — processing activities where we have a genuine business need that is not overridden by your rights and interests. This covers fraud prevention, security monitoring, and platform improvement through aggregated analytics.
• Legal Obligation — processing required to comply with applicable legal requirements, including identity verification, anti-money laundering reporting, and record retention obligations.
• Consent — processing for marketing communications, which is conducted only where you have given specific, freely revocable consent. You may withdraw marketing consent at any time by contacting our support team or updating your account preferences.

Data Sharing & Third Parties

7.1 Payment Processors

We share the minimum transaction-relevant data with payment service providers — including those facilitating Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and supported cryptocurrency channels — solely to complete payment instructions. All payment partners are contractually bound to use this data only for payment processing and fraud prevention.

7.2 Identity Verification Partners

Identity document data submitted for KYC purposes is shared with our third-party verification provider. This provider operates under strict data processing obligations and is not permitted to use your data for any purpose other than producing a verification outcome for Suburtoto.

7.3 Game and Technology Providers

Certain technical identifiers — such as anonymised player session tokens — are shared with our licensed game providers to facilitate gameplay and resolve disputes. These providers do not receive your full identity information.

7.4 Legal and Regulatory Authorities

Suburtoto may disclose personal data to competent regulatory authorities, law enforcement agencies, or courts of competent jurisdiction where we are legally compelled to do so, or where we reasonably believe that disclosure is necessary to prevent serious harm, criminal activity, or fraud.

7.5 No Sale of Data

Suburtoto does not sell, rent, licence, or otherwise transfer your personal data to any third party for commercial marketing purposes. This is an absolute policy and is not subject to any exceptions.

Cookies & Tracking Technologies

8.1 What Cookies We Use

The Suburtoto Platform uses cookies and similar tracking technologies to operate and improve the Platform. The categories of cookies in use are as follows:

• Strictly Necessary Cookies — essential for Platform functionality, including session management, login persistence, and security token verification. These cannot be disabled without impairing your ability to use the Platform.
• Functional Cookies — used to remember your preferences, such as language settings, preferred payment method, and game display configurations.
• Performance and Analytics Cookies — used to collect aggregated, anonymised data about how players navigate the Platform. This helps us identify performance bottlenecks and improve user experience.
• Security Cookies — used to detect and prevent fraudulent activity, including bot behaviour and account takeover attempts.

8.2 Managing Cookie Preferences

You may manage non-essential cookie preferences through your browser settings. Most modern browsers — including those commonly used by Malaysian players on mobile and desktop — allow you to view, block, or delete cookies. Please note that disabling strictly necessary cookies will affect Platform functionality.

8.3 Third-Party Tracking

Suburtoto does not deploy third-party advertising trackers or cross-site tracking technologies on the Platform. Analytics data is collected through first-party tools only and is not shared with advertising networks.

Data Security

Suburtoto implements technical and organisational security measures appropriate to the sensitivity of the personal data we process. These measures include, but are not limited to:

• 256-bit SSL/TLS encryption on all data transmissions between user devices and Platform servers.
• Encryption of sensitive data fields — including financial and identity information — at rest in our databases.
• Role-based access controls limiting internal staff access to personal data on a strict need-to-know basis.
• Multi-factor authentication requirements for all staff with access to production systems and player data.
• Regular security audits, penetration testing, and vulnerability assessments by qualified information security personnel.
• Documented incident response procedures requiring prompt notification of any data breach to affected parties and relevant authorities in accordance with applicable law.

While Suburtoto takes data security seriously and invests significantly in protective measures, no system is entirely immune to risk. In the event of a security incident that affects your personal data, we will notify you in accordance with our legal obligations and take all reasonable steps to mitigate the impact.

Data Retention Periods

Suburtoto retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The principal retention periods applicable to our data categories are as follows:

• Account and Identity Data — retained for the duration of the active account relationship and for a period of five (5) years following permanent account closure, to satisfy anti-money laundering, fraud investigation, and regulatory record-keeping requirements.
• Financial Transaction Records — retained for a minimum of five (5) years from the date of the transaction, consistent with standard financial record-keeping obligations applicable to payment service operations.
• KYC Documentation — retained for five (5) years following account closure or the completion of the most recent identity verification exercise, whichever is later.
• Customer Support Records — retained for three (3) years from the date of the last interaction, to facilitate dispute resolution and quality monitoring.
• Technical and Session Data — retained for twelve (12) months from the date of collection, after which it is deleted or anonymised.
• Marketing Preferences — opt-in consent records are retained for the duration of the marketing relationship. Following opt-out, suppression records are maintained to prevent erroneous re-contact.

On expiry of the applicable retention period, personal data is securely deleted or permanently anonymised in accordance with our data disposal procedures.

Your Rights as a Data Subject

As an individual whose personal data is processed by Suburtoto, you hold the following rights. These rights are genuine and exercisable — not merely stated in policy language. To exercise any of these rights, please contact our support team via the details provided in Section 14.

Suburtoto will not charge a fee for responding to rights requests in ordinary circumstances. Where a request is manifestly unfounded or excessive — particularly if repetitive — a reasonable administrative fee may be charged or the request declined, with written reasons provided. All rights requests will be verified before action is taken to protect against unauthorised third-party access to your data.

Children, Minors & the 21+ Requirement

The Suburtoto Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect personal data from individuals below this age. Registration requires confirmation of age at the point of account creation, and all accounts are subject to identity and age verification through our KYC process.

If Suburtoto becomes aware that personal data has been collected from an individual below the age of 21 — whether as a result of identity verification, a third-party report, or internal review — the account in question will be immediately suspended. Any funds deposited will be returned to the verified payment source following investigation, and all personal data associated with the underage account will be deleted in accordance with our data retention procedures, subject to any overriding legal obligation to retain records of the incident.

Parents and guardians who believe a minor may have created an account on the Platform are encouraged to contact our support team at [email protected] immediately. We will treat such reports with priority and full confidentiality.

Amendments to This Policy

Suburtoto reserves the right to update or amend this Privacy Policy at any time. Material changes — those that significantly affect the rights of Players or the nature of data processing activities — will be communicated to registered players via email prior to the change taking effect, and a prominent notice will be displayed on the Platform.

Non-material updates, such as typographical corrections, clarifications that do not alter substance, or legislative reference updates, may be made without advance notice. The "Last updated" date displayed at the top of this Policy will be revised on each amendment.

Your continued use of the Platform following the effective date of any updated version of this Policy constitutes your acceptance of the revised terms. If you do not accept material changes to this Policy, you should close your account and withdraw any remaining balance prior to the effective date of the update.

Contact Us

For any queries relating to this Privacy Policy, to exercise any of your data subject rights, or to report a privacy concern, please contact Suburtoto through the following channels:

• Email: [email protected] — please use the subject line "Privacy Request" or "Data Rights Request" for prompt routing to our data protection team.
• Live Chat: Available 24 hours a day, 7 days a week via the Live Chat feature on the Platform — staffed by English-speaking agents operating on Malaysian time (GMT+8).
• Response Time: Privacy and data rights queries are treated as priority correspondence. We aim to provide an initial acknowledgement within one (1) business day and a substantive response within thirty (30) days, in accordance with applicable law.

Suburtoto serves players across Malaysia, including Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru, Shah Alam, and beyond. Our support team is fully conversant with the data rights and privacy expectations of Malaysian players and will handle all privacy correspondence with appropriate care and confidentiality.