This Privacy Policy describes how Kastatoto collects, processes, stores, and protects the personal data of all registered players and website visitors. We take data privacy seriously — your information is handled with the same care and security standards we apply to every aspect of our platform.
Kastatoto ("we", "us", "our", "the Company") operates the online gaming and sports betting platform accessible at kastatoto.cam. As a platform serving players across Malaysia — including Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and all other states and territories — we are committed to handling personal data with transparency, integrity, and in compliance with applicable data protection legislation.
This Privacy Policy ("Policy") sets out the categories of personal data we collect, the purposes for which it is processed, the legal grounds on which processing is based, and the rights available to you as a data subject. This Policy applies to:
Your Consent: By creating an account on Kastatoto, depositing funds, or continuing to use our platform after being notified of updates to this Policy, you confirm that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. You may withdraw consent at any time, subject to the limitations described in Section 11(Your Rights).
This Policy should be read alongside our Terms & Conditions, which together constitute the full legal framework governing your use of the Kastatoto platform.
The following terms used in this Policy carry the meanings assigned below:
| Term | Meaning |
|---|---|
| Personal Data | Any information that identifies or can be used to identify a living individual, including name, identification number, contact details, device identifiers, and financial information. |
| Processing | Any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction. |
| Data Controller | Kastatoto, the entity that determines the purposes and means of processing personal data collected via the Platform. |
| Data Processor | Third-party service providers who process personal data on behalf of Kastatoto under written data processing agreements, including payment processors, KYC verification providers, and analytics platforms. |
| Data Subject | The identified or identifiable natural person to whom the personal data relates — in this context, you the player or visitor. |
| Cookies | Small text files stored on a user's device by a website to enable functionality, performance monitoring, and behavioural analytics. |
| KYC | Know Your Customer — the identity verification process conducted to confirm a player's identity, age, and eligibility in accordance with anti-money laundering and platform access requirements. |
Kastatoto collects personal data across several categories, depending on the nature of your interaction with the platform. The table below summarises what we collect and in what context:
| Category | Specific Data Points |
|---|---|
| Identity Data | Full legal name, date of birth, nationality, government-issued ID number (NRIC / Passport number), and copies of identity documents submitted during KYC. |
| Contact Data | Email address, mobile phone number, and residential address (including city and postcode, e.g., Kuala Lumpur 50000, Penang 1050). |
| Financial Data | Deposit and withdrawal transaction records (amounts, timestamps, methods), payment channel identifiers (e.g., registered DuitNow number, FPX bank name), and account balance history. We do not store full bank account numbers or e-wallet PINs. |
| Account & Gaming Data | Username, account creation date, login history, wagering history (games played, bet amounts, outcomes), bonus uptake records, and VIP tier status. |
| Technical Data | IP address, device type and operating system, browser type and version, session duration, clickstream data, and referal source. |
| Communications Data | Records of live chat conversations, email support interactions, and any other written communications submitted to Kastatoto. |
| Marketing Preferences | Your stated preferences regarding promotional communications, opted-in bonus offers, and notification settings. |
We collect personal data through the following channels and mechanisms:
Kastatoto processes personal data only for specified, explicit, and legitimate purposes. The primary purposes for which we process your data are described below:
Kastatoto relies on the following legal bases for the processing of personal data, as applicable to each processing activity:
Where Kastatoto relies on legitimate interests as a legal basis, we conduct a balancing test to ensure our interests do not unduly override the privacy rights of data subjects. Players may request further information about specific legitimate interest assessments by contacting our support team.
Kastatoto does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. We share personal data only in the circumstances described below, and only to the extent necessary for the stated purpose:
All third-party data processors engaged by Kastatoto are subject to written data processing agreements that impose obligations consistent with applicable data protection law. We conduct due diligence on all significant data processing partners.
The Kastatoto platform uses cookies and similar tracking technologies to ensure functional performance, improve the user experience, and — where consent has been obtained — to analyse platform usage patterns. Cookies are categorised as follows:
You may manage your cookie preferences via your browser settings. Most modern browsers allow you to block or delete cookies. Please note that blocking essential cookies will impair the functionality of the Platform.
Kastatoto retains personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply as general guide:
Following the expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be attributed to an identifiable individual.
Kastatoto implements a layered approach to data security, applying technical and organisational measures proportionate to the sensitivity of the data processed and the risks identified. Our key security controls include:
While Kastatoto implements robust security controls, no internet-based system can guarantee absolute security. You are also responsible for maintaining the security of your own account credentials. Do not share your Kastatoto password with any third party. If you suspect unauthorised access to your account, contact our support team immediately via live chat.
As a data subject, you hold the following rights with respect to your personal data held by Kastatoto. These rights may be exercised by submitting a written request to our support team, subject to identity verification:
Kastatoto will respond to all verified data subject requests within thirty (30) days. Requests that are complex or numerous may be extended by a further thirty (30) days, with written notification of the extension and reasons provided to the requesting individual.
The Kastatoto platform is strictly intended for adults aged twenty-one (21) years and above. We do not knowingly collect, process, or store personal data belonging to persons under the age of 21.
Kastatoto enforces age compliance through mandatory KYC identity verification. All players are required to verify their date of birth using a government-issued identification document before withdrawal requests are processed. Accounts found to belong to individuals under 21 will be immediately suspended, all associated wagers voided, and any deposits returned to the originating payment method, net of any bonus credits claimed.
If you become aware that a person under 21 has accessed the Kastatoto platform, please notify us immediately at the contact details provided in Section 15.
Given the international nature of online gaming operations, certain personal data processed by Kastatoto may be transferred to and processed in countries outside of Malaysia. Such transfers may occur in connection with cloud hosting infrastructure, KYC verification services, fraud detection systems, or game studio analytics.
Where personal data is transferred outside of Malaysia to countries that do not offer an equivalent level of data protection, Kastatoto implements appropriate safeguards to protect the data, including:
Kastatoto reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or platform features. Material changes to this Policy — specifically those that affect how your personal data is used or your rights as a data subject — will be communicated to registered players via email or in-platform notification at least fourteen (14) days prior to the revised Policy taking effect.
The most current version of this Privacy Policy is always accessible at kastatoto.cam/privacy-policy. The "Last Updated" date shown at the top of this document reflects the date of the most recent revision. Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Policy.
If you disagree with any material amendment to this Policy, you have the right to close your account prior to the effective date of the change and to request the deletion of your personal data, subject to applicable retention obligations as described in Section 9.
For all privacy-related enquiries, data subject rights requests, or concerns about how Kastatoto processes your personal data, please contact us through the following channels:
We serve players across all regions of Malaysia including Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, and Shah Alam. All privacy enquiries are handled by our dedicated player welfare and compliance team, with a commitment to responding within ten (10) business days formal data subject requests.
Six principles that guide how Kastatoto handles your personal data — day one and always.
Every interaction between your device and the Kastatoto platform — from login to payment processing — is protected by industry-standard 256-bit SSL/TLS encryption. Your data in transit is never exposed.
Kastatoto does not sell, rent, or trade your personal data to any third party for commercial purposes. Data sharing is limited strictly to payment processing, KYC compliance, and fraud prevention partners under binding confidentiality agreements.
You have the right to access, correct, delete, restrict, and port your personal data. All requests are handled within 30 days and verified to your identity before any action is taken.
We collect only the personal data necessary for the specific purpose stated — account management, transaction processing, KYC, and responsible gambling compliance. We do not collect data speculatively or for undefined future uses.
Personal data is not kept indefinitely. Each category of data has a defined retention period — ranging from 12 months for technical logs to 5 years for KYC and transaction records under AML obligations. Data is securely deleted after this period.
Kastatoto maintains a documented incident response procedure for data breaches. In any scenario involving a high risk to player rights, affected players will be notified promptly and relevant regulatory authorities informed in accordance with applicable law.