Please read this Privacy Policy carefully before creating a Sengtoto account or providing personal information. By using the Sengtoto platform, you acknowledge that you have read and understood how your data is handled as described in this document.
1.Introduction
This Privacy Policy governs the collection, use, disclosure and management of personal data by Sengtoto in connection with the website sengtoto.cam, the associated mobile experience, sports betting markets, live casino products, slot games, player wallet functions and related support services (together, the "Services").
Sengtoto provides Services primarily to players located in Malaysia and applies responsible data-handling practices consistent with the principles underlying the Personal Data Protection Act 2010 (PDPA) of Malaysia and widely recognised international privacy standards. References in this policy to Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam or other Malaysian cities and to payment methods such as FPX, DuitNow and Touch 'n Go eWallet reflect the local operating context of this platform.
If you disagree with any part of this policy, you should not register an account or submit personal information through the Sengtoto platform.
2.Definitions
- Personal Data means any information relating to an identified or identifiable individual, including name, identity document number, contact details, financial information, device identifiers and behavioural data.
- Processing means any operation performed on personal data, including collection, recording, storage, use, disclosure, erasure or destruction.
- Data Subject means the individual to whom personal data relates — in this context, the Sengtoto account holder or visitor.
- Third Party means any entity other than the data subject and Sengtoto, including payment processors, game studios and analytics providers.
- KYC means Know Your Customer — the identity and age verification processes applied at registration, before withdrawals or at any point required for security and compliance.
3.Data We Collect
3.1 Registration and Identity Data
When you create a Sengtoto account, we collect your full legal name, date of birth, MyKad or passport number, residential address, email address and mobile number. This information is required to verify your identity, confirm that you meet the 21-and-above age requirement and establish your account in compliance with our obligations.
3.2 Financial and Payment Data
To process deposits and withdrawals in Malaysian Ringgit (MYR), we collect payment method identifiers associated with your registered FPX, DuitNow, Touch 'n Go eWallet, Boost, Maybank, CIMB, Public Bank or Hong Leong accounts. Full card numbers and full bank credentials are not stored by Sengtoto — payment authentication is handled by the respective licensed payment provider.
3.3 Transactional and Gambling Activity Data
We maintain records of deposits, withdrawals, wager amounts, games played, bet selections (including sports markets such as Liga Super Malaysia, EPL and UFC), session durations, win and loss figures, bonus claims and account balance movements. These records are necessary for account management, dispute resolution and responsible gambling monitoring.
3.4 Device and Technical Data
When you access Sengtoto, we automatically collect IP address, device type, operating system, browser version, screen resolution, referring URL and pages visited. This data supports platform security, fraud detection and service improvement.
3.5 Communications Data
Records of live chat conversations, support emails, feedback submissions and any communications you initiate with Sengtoto are retained to resolve queries, improve service quality and maintain an accurate account history.
3.6 Voluntary Data
Preference settings, marketing opt-in choices, survey responses and responsible gambling limit requests that you provide voluntarily are recorded against your account profile and used to personalise your experience where applicable.
4.How We Collect Personal Data
Sengtoto collects personal data through the following channels:
- Direct submission — registration forms, KYC document uploads, support contacts and preference settings completed by you;
- Automated technical means — server logs, session cookies, browser fingerprinting and analytics tools that record device and interaction data when you use the Services;
- Payment processors — transaction confirmation references and payment status updates received from FPX, DuitNow and connected Malaysian banking channels;
- Identity verification providers — confirmation responses from third-party KYC services used to authenticate identity documents;
- Fraud and security partners — risk signals and device reputation data from security technology providers used to protect accounts and detect abuse.
5.Purposes and Legal Basis for Processing
The table below summarises the primary purposes for which Sengtoto processes personal data and the corresponding justification for doing so.
| Purpose |
Data Used |
Justification |
| Account registration and identity verification |
Identity, contact, KYC documents |
Performance of the player agreement; legal obligation |
| Processing MYR deposits and withdrawals |
Payment identifiers, transaction records |
Performance of the player agreement |
| Fraud prevention and account security |
Device data, IP address, transaction patterns |
Legitimate interest in protecting players and the platform |
| Responsible gambling monitoring and intervention |
Gambling activity, session data, limit settings |
Legal obligation; legitimate interest in player welfare |
| Customer support and dispute resolution |
Communications, account and transaction history |
Performance of the player agreement |
| Legal and regulatory compliance |
Identity, financial and activity records |
Legal obligation |
| Service improvement and analytics |
Device and behavioural data (aggregated or pseudonymised) |
Legitimate interest in improving the platform |
| Marketing communications (where consented) |
Contact details, preference settings |
Consent (withdrawable at any time) |
6.Data Sharing and Disclosure
Sengtoto does not sell, rent or trade personal data. We share information only where necessary and only with recipients bound by appropriate confidentiality or data-processing obligations. Recipients may include:
- Licensed payment processors — FPX gateway operators, DuitNow service providers, Touch 'n Go eWallet, Boost and connected Malaysian banking institutions, solely to execute and confirm financial transactions;
- Identity verification partners — third-party KYC providers engaged to authenticate identity documents and confirm age eligibility;
- Certified game studios — game providers such as Evolution Gaming, PG Soft, Pragmatic Play and Microgaming, who receive session tokens necessary to deliver game content but do not receive broader personal data;
- Infrastructure and security providers — cloud hosting, content-delivery, fraud-detection and cybersecurity service providers operating under strict data-processing agreements;
- Professional advisers — legal counsel, auditors and compliance consultants engaged under obligations of professional confidentiality;
- Law enforcement or regulatory authorities — where disclosure is required by applicable Malaysian law, court order, or a lawful request from a competent authority.
Any third party receiving personal data is required to process it only for the specific purpose for which it was shared and to maintain appropriate technical and organisational security measures.
7.Cookies and Tracking Technologies
Sengtoto uses cookies and similar tracking technologies to maintain authenticated sessions, remember preferences, detect suspicious activity and gather aggregate analytics about platform usage. Cookie categories include:
- Strictly necessary cookies — required for login sessions, security tokens and core platform functions. These cannot be disabled without impairing the Service.
- Functional cookies — store display preferences, language settings and responsible gambling limit configurations between visits.
- Analytics cookies — collect anonymised or pseudonymised behavioural data used to understand how players navigate the platform and identify areas for improvement.
- Security cookies — assist in detecting fraud, bot activity and credential abuse by building a fingerprint of expected device and behaviour patterns.
You may manage non-essential cookie preferences through your browser settings. Disabling strictly necessary cookies will prevent normal use of the Sengtoto platform.
Note: Sengtoto does not deploy third-party advertising cookies or cross-site behavioural targeting technologies that share your data with advertising networks.
8.International Data Transfers
Sengtoto's primary operations and player-facing infrastructure are oriented toward Malaysian users, and data is processed in environments selected for their security standards. Where technical service providers operate infrastructure outside Malaysia, Sengtoto takes steps to ensure that transferred personal data receives a level of protection consistent with the principles of the Malaysian PDPA and that appropriate contractual safeguards are in place before any transfer occurs.
Cross-border transfers are limited to circumstances where they are necessary to deliver the Services or to comply with legal obligations, and are never made for the purpose of circumventing applicable data protection requirements.
9.Retention Periods
Personal data is kept for no longer than necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law. General retention guidelines are as follows:
- Account and identity records — retained for the duration of the account relationship and for a further period following closure as required by anti-money-laundering, financial record-keeping and responsible gambling obligations;
- Transaction and gambling activity records — retained to support dispute resolution, regulatory compliance and responsible gambling review for the applicable statutory period;
- Support and communications records — retained for a reasonable period after resolution of the relevant query or dispute;
- Security and fraud-detection logs — retained for the period necessary to investigate, action and close security incidents;
- Marketing preference records — retained until consent is withdrawn or the account is closed, whichever is earlier.
When retention is no longer justified, personal data is securely deleted or anonymised so that it can no longer be linked to an identifiable individual.
10.User Rights
Subject to applicable law and certain limitations necessary to protect the rights of others or fulfil legal obligations, you have the following rights in relation to your personal data held by Sengtoto:
- Right of access — to request a copy of the personal data we hold about you and information about how it is used;
- Right to correction — to request that inaccurate or incomplete personal data be corrected or updated;
- Right to erasure — to request deletion of personal data where it is no longer necessary for the purposes it was collected and where no overriding legal obligation requires retention;
- Right to restrict processing — to request that we limit how your data is used while a correction or objection is under review;
- Right to withdraw consent — where processing is based on your consent (for example, marketing emails), to withdraw that consent at any time without affecting the lawfulness of prior processing;
- Right to complain — to raise a concern with Sengtoto's support team or, where applicable, with a relevant data protection authority.
To exercise any of the above rights, please contact our support team through 24/7 Live Chat or by email at [email protected]. We will respond within a reasonable timeframe and may need to verify your identity before processing a request.
Please note: Certain rights may be limited where deletion or restriction would conflict with a legal retention obligation, an active fraud investigation or a responsible gambling self-exclusion record that must be preserved to protect your interests.
11.Children and Age Verification
Sengtoto's Services are strictly intended for individuals aged 21 and above. We do not knowingly collect or process personal data belonging to persons under this age. Age verification is conducted as part of the registration and KYC process, and any account found to belong to an underage individual will be suspended immediately pending review.
If you believe that a minor has provided personal data to Sengtoto without appropriate consent, please contact our support team immediately so the matter can be reviewed and the relevant data handled appropriately.
12.Security Measures
Sengtoto applies technical and organisational security measures proportionate to the risk associated with processing personal data. Measures in use include:
- SSL-256 encryption for all data transmitted between your device and Sengtoto servers;
- Access controls and role-based permissions restricting staff access to personal data on a need-to-know basis;
- Multi-factor authentication requirements for administrative access to systems containing personal data;
- Automated monitoring for anomalous login attempts, payment irregularities and account-takeover indicators;
- Regular security assessments and infrastructure vulnerability reviews;
- Contractual requirements for all third-party processors to maintain equivalent security standards.
While Sengtoto takes reasonable precautions, no system can guarantee complete security. You are responsible for maintaining the confidentiality of your own login credentials and for notifying support promptly if you suspect unauthorised access to your account.
13.Policy Amendments
Sengtoto may update this Privacy Policy from time to time to reflect changes to the Services, applicable legal requirements or our data-handling practices. When a material change is made, the revised policy will be published on this page with an updated effective date. Where practical, we will provide notice through your registered contact details before significant changes take effect.
Continued use of the Sengtoto platform after the revised effective date constitutes your acceptance of the updated Privacy Policy. We encourage you to review this page periodically. If you do not agree with an update, you should contact support to discuss your options, which may include account closure.
14.Contact Us
If you have a question, concern or request relating to this Privacy Policy or the way Sengtoto handles your personal data, please reach out through one of the channels below. Please include your account identifier and a clear description of your request so we can respond efficiently.
Customer Support: 24/7 Live Chat (available on the Sengtoto platform)
Email: [email protected]
We aim to acknowledge data-related requests promptly and to provide a substantive response within a reasonable timeframe. Identity verification may be required before certain requests can be actioned to ensure data is disclosed only to the correct account holder.