Privacy Policy — Sumtoto

This Privacy Policy ("Policy") is published by the operator of the sumtoto platform ("sumtoto", "we", "us", "our"), accessible at sumtoto.lat. It governs the collection, use, storage, disclosure, and protection of personal data belonging to all registered users and visitors ("you", "User", "Player") of the platform.

sumtoto operates under an international gaming licence (Curacao jurisdiction). While the platform serves players across Malaysia — including Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and beyond — we recognise and respect the data protection expectations of our users wherever they are located.

By registering an Account on sumtoto or by continuing to use the platform, you acknowledge that you have read, understood, and agree to the data practices described in this Policy. If you do not agree to any part of this Policy, you should cease using the platform and may close your Account by contacting our support team.

For the purposes of this Policy, the following terms carry the meanings set out below:

• "Account" — the registered user profile created by a Player on sumtoto.lat.
• "Controller" — sumtoto, as the entity that determines the purposes and means of processing your personal data.
• "Cookies" — small text files placed on your device by the platform to facilitate session management, analytics, and personalisation.
• "KYC" — Know Your Customer, the identity and age verification process required before a Player may withdraw funds.
• "Personal Data" — any information that identifies or could reasonably be used to identify a living individual, including name, email address, phone number, payment details, and device identifiers.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, use, disclosure, or deletion.
• "Processor" — any third-party service provider that processes Personal Data on behalf of sumtoto in accordance with its instructions.
• "Sensitive Data" — a special category of Personal Data that warants heightened protection, including data relating to health conditions relevant to responsible gambling assessments.

sumtoto collects the following categories of Personal Data from Users. We collect only what is necessary for the stated purposes and do not collect data gratuitously.

sumtoto collects Personal Data through the following channels:

• Direct provision by you — when you register an Account, complete KYC verification, make a deposit or withdrawal, contact our support team, or respond to a survey.
• Automated technical means — when you browse or interact with the platform, our servers and analytics tools automatically record Technical Data and Usage Data as described in Section 3.
• Third-party payment processors — when you make a deposit or request a withdrawal via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX (Maybank, CIMB, Public Bank, Hong Leong), or USDT TRC20, the relevant payment processor may share transaction confirmation data with us for reconciliation purposes.
• KYC verification providers — identity verification services may provide us with a verification outcome and document authenticity assessment to assist with our age and identity confirmation obligations.
• Cookies and similar technologies — as described further in Section 10 of this Policy.

sumtoto processes your Personal Data on the following legal grounds, depending on the specific purpose:

• Contractual necessity — processing required to operate your Account, fulfil deposit and withdrawal transactions, and provide the gaming services you have requested.
• Legal obligation — processing required to comply with our obligations under our gaming licence, including KYC, anti-money laundering (AML) checks, and responsible gambling duties.
• Legitimate interests — processing necessary for fraud prevention, platform security, abuse detection, and improving our services, where these interests are not overridden by your privacy rights.
• Consent — processing for direct marketing purposes, where you have expressly opted in. You may withdraw this consent at any time by updating your Account preferences or contacting support.

Your Personal Data is used strictly for the following purposes:

• To create, maintain, and administer your sumtoto Account;
• To verify your identity and confirm that you meet the minimum age requirement of21 years;
• To process deposit and withdrawal transactions via your chosen payment methods, including Malaysian e-wallets and FPX banking channels;
• To detect, investigate, and prevent fraudulent activity, unauthorised account access, and money laundering;
• To comply with the responsible gambling obligations imposed by our gaming licence, including monitoring for signs of problem gambling behaviour and applying limits where appropriate;
• To respond to your support enquiries, complaints, and dispute submissions;
• To send you account-related notifications, such as security alerts, transaction confirmations, and policy updates — these are non-optional operational communications;
• To send promotional offers, bonus announcements, and personalised recommendations — only if you have opted in to marketing communications;
• To improve platform functionality, game performance, and user experience through analysis of aggregated Usage Data;
• To comply with applicable legal requirements, regulatory requests, or court orders.

sumtoto shares your Personal Data only in the circumstances described below, and only to the minimum extent necessary:

7.1 Authorised Service Providers (Processors)

We engage third-party service providers who act as data Processors on our behalf, operating under binding data processing agreements that prohibit them from using your data for their own purposes. These providers include:

• Payment processors — handling transactions via Touch 'n Go, Boost, GrabPay, DuitNow, FPX, and cryptocurrency networks;
• KYC verification providers — performing identity and age verification services;
• Platform hosting and cloud infrastructure providers — storing and serving the platform;
• Customer support tools — managing live chat and email correspondence;
• Analytics providers — providing aggregated platform usage insights.

7.2 Legal and Regulatory Disclosure

We may disclose Personal Data to competent authorities, courts, regulators, or law enforcement agencies where we are legally required to do so, or where disclosure is necessary to protect the rights, property, or safety of sumtoto, its users, or the public.

7.3 Business Transfers

In the event of a merger, acquisition, sale of business assets, or restructuring involving sumtoto, your Personal Data may be transferred to the relevant successor entity. You will be notified of any such transfer via email or a prominent platform notice in advance.

As sumtoto operates under an international gaming licence, your Personal Data may be stored or processed in countries outside Malaysia. When transfering data internationally, sumtoto implements appropriate safeguards to protect your data, including:

• Binding contractual clauses with data processors that impose data protection standards equivalent to international best practice;
• Technical security measures including end-to-end encryption for data in transit and at rest;
• Access controls limiting data access to authorised personnel only.

By using the sumtoto platform, you acknowledge that your Personal Data may be transferred and processed outside Malaysia in accordance with the safeguards described in this section.

sumtoto retains your Personal Data for as long as necessary to fulfil the purposes outlined in this Policy, and in any event for the minimum periods required by applicable law or our gaming licence conditions. The following retention guidelines apply:

• Account and Identity Data — retained for the duration of your Account and for a minimum of five (5) years following account closure, to comply with anti-money laundering and licensing audit requirements.
• Financial and Transaction Data — retained for a minimum of seven (7) years in accordance with financial record-keeping obligations.
• KYC Documents — retained for a minimum of five (5) years following account closure or the completion of the relevant transaction.
• Communications Data — support correspondence is retained for three (3) years for quality assurance and dispute resolution purposes.
• Marketing Preferences — retained until you withdraw consent, at which point marketing activities cease within30 days.

Upon expiry of the applicable retention period, your Personal Data is securely deleted or anonymised. Anonymised, aggregated data may be retained indefinitely for statistical and platform improvement purposes.

sumtoto uses cookies and similar tracking technologies to operate the platform, maintain your logged-in session, and understand how users interact with the site. The categories of cookies we use are as follows:

Most web browsers allow you to manage cookie settings through your browser's privacy or settings menu. Please note that disabling strictly necessary cookies will impair your ability to use the sumtoto platform. Disabling other cookie categories will not prevent access to the platform but may reduce the quality of your experience.

sumtoto implements a comprehensive set of technical and organisational measures to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and our servers;
• Encryption at rest for sensitive Personal Data stored on our infrastructure;
• Multi-factor authentication available to all registered users for Account login;
• Role-based access controls limiting internal staff access to Personal Data on a strict need-to-know basis;
• Regular security audits and penetration testing of platform infrastructure;
• Incident response procedures for detecting, containing, and reporting any data security breach in a timely manner.

In the event of a data security breach that is likely to result in a risk to your rights and freedoms, sumtoto will notify affected Users without undue delay and will take all reasonably practicable steps to contain and remediate the breach.

As a data subject, you hold the following rights with respect to your Personal Data held by sumtoto. To exercise any of these rights, please contact our support team via live chat or email at the address provided in Section 16.

• Right of Access — you may request a copy of all Personal Data we hold about you, along with information about how it is processed.
• Right to Rectification — if any Personal Data we hold about you is inaccurate or incomplete, you may request that it be corrected.
• Right to Erasure — subject to our legal retention obligations (see Section 9), you may request the deletion of your Personal Data.
• Right to Restriction of Processing — in certain circumstances, you may request that we limit how we process your data while a dispute or correction request is pending.
• Right to Data Portability — you may request a copy of your Personal Data in a structured, machine-readable format.
• Right to Object — you may object to processing carried out on the basis of our legitimate interests, including direct marketing.
• Right to Withdraw Consent — where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without penalty.

We will respond to all valid data rights requests within thirty (30) calendar days of receipt. Where a request is complex or relates to a large volume of data, we may extend this period by a further sixty (60) days, in which case we will notify you of the extension and the reason for it.

The sumtoto platform is strictly intended for individuals aged21 years and above. We do not knowingly collect, process, or retain Personal Data from any person under the age of 21. Registration by underage individuals is expressly prohibited and constitutes a breach of our Terms and Conditions.

All Accounts are subject to mandatory KYC age verification before withdrawals are processed. Where sumtoto has reasonable grounds to believe that a User may be under 21 years of age, the Account will be suspended pending age verification. If the User is confirmed to be underage, the Account will be permanently closed, all data will be securely deleted except as required by law, and any deposited funds will be returned less any applicable processing costs.

If you believe that a person under 21 has registered an Account on sumtoto, please contact our support team immediately at [email protected] (plain text reference — not a link) so that we may investigate and take appropriate action.

The sumtoto platform may contain references to third-party payment providers (such as Touch 'n Go eWallet, Boost, GrabPay, and Maybank's FPX service) for the purpose of completing transactions. When you interact with a third-party payment provider's interface, their own privacy policy governs the handling of your data during that interaction — not this Policy.

sumtoto is not responsible for the privacy practices of third-party services. We recommend reviewing the privacy policies of any third-party service you use in connection with your sumtoto Account. Our platform does not embed third-party advertising networks, social media tracking pixels, or external analytics services that share your data with unrelated companies.

sumtoto reserves the right to update this Privacy Policy at any time. Material changes — defined as changes that significantly alter how we collect, use, or share your Personal Data — will be communicated to registered Users by email and via a prominent notice on the platform, not less than fourteen (14) days before the changes take effect.

Non-material changes (such as corrections of typographical errors, clarifications that do not alter the substance of our data practices, or updates to contact information) may be made without advance notice, with the updated Policy taking effect upon publication on this page.

The "Last Updated" date shown at the top of this Policy will always reflect the date of the most recent revision. Your continued use of the sumtoto platform following the effective date of any revision constitutes your acceptance of the updated Policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your Personal Data, please reach out to us through the following channels:

• Live Chat: Available 24/7 through the sumtoto platform dashboard — the fastest way to reach our support team.
• Email (plain text — not a link): [email protected]

Our support team serves players across Malaysia — from Kuala Lumpur and Bangsar to Penang, Johor Bahru, Petaling Jaya, Shah Alam, and beyond — and is available at all hours.

For data rights requests (access, rectification, erasure, portability), please contact us via email with the subject line "Data Rights Request" and include your registered Account email address and brief description of your request. We will acknowledge receipt within 48 hours and respond in full within 30 calendar days.

This Policy is provided in English as the primary language of the sumtoto platform. In the event of any translation or interpretation issue, the English version of this Policy shall prevail.