Privacy Policy

Sakutoto ("Company", "we", "us", "our") is committed to protecting the privacy and personal data of all individuals who access or use the Sakutoto online gaming platform, including its website, mobile applications, games, sportsbook, and all associated services (collectively, the "Platform").

This Privacy Policy ("Policy") sets out the basis on which we collect, process, store, share, and protect personal data relating to our users ("you", "your"), in accordance with applicable data protection legislation. This Policy applies to all registered account holders, visitors to the Platform, and any individual who interacts with Sakutoto through any channel, including live chat and email correspondence.

By creating an account on, or continuing to use, the Sakutoto Platform, you acknowledge that you have read, understood, and consent to the data practices described in this Policy. This Policy should be read in conjunction with our Terms & Conditions and our Responsible Gambling Policy, both of which are incorporated herein by reference.

For the purposes of this Privacy Policy, the following definitions apply:

Sakutoto collects personal data that is necessary and proportionate to the delivery of our services, the fulfilment of our regulatory obligations, and the protection of the Platform and its users. The categories of personal data we collect include:

Identity & Contact Data

• Full legal name as it appears on your government-issued identification;
• Date of birth (used for mandatory age verification — users must be 21 or above);
• Malaysian IC number (MyKad), passport number, or other national identification number;
• Residential address in Malaysia (or other jurisdiction of residence);
• Email address and mobile telephone number.

Financial & Transaction Data

• Deposit and withdrawal transaction records, including amounts, timestamps, and payment method references;
• E-wallet identifiers associated with Touch 'n Go eWallet, Boost, GrabPay, or other supported Malaysian payment services;
• Bank account details where FPX, Maybank2u, CIMB Clicks, Public Bank, or Hong Leong Connect transfers are used;
• DuitNow reference identifiers and FPX transaction IDs;
• Account wallet balance history and bonus redemption records.

Gaming & Behavioural Data

• Game session records including wagers placed, outcomes, game titles accessed, and session durations;
• Sportsbook betting history, including markets selected, odds accepted, and settlement records;
• Responsible gambling tool activations, including self-exclusion requests and deposit limit settings;
• Bonus and promotion participation history.

Technical & Device Data

• IP address and approximate geolocation derived from IP;
• Device type, operating system, browser type, and version;
• Unique device identifiers and advertising identifiers where applicable;
• Login timestamps, session duration, and navigation path data.

Communications Data

• Records of live chat conversations with our Kuala Lumpur-based support team;
• Email correspondence with Sakutoto, including support queries and complaint submissions;
• Survey responses and voluntary feedback submissions.

We collect personal data through the following channels and mechanisms:

• Direct submission: Data you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting support, or participating in promotions;
• Automated technical collection: Data collected passively as you use the Platform, including via cookies, web beacons, server logs, and analytics scripts;
• Payment service providers: Transaction data received from our integrated Malaysian payment partners, including DuitNow, FPX, and supported e-wallets, as necessary to process and reconcile transactions;
• Identity verification providers: KYC data returned from third-party identity verification services used to confirm your identity and age;
• Fraud prevention and compliance services: Risk signals and device fingerprint data provided by fraud detection partners to protect the Platform from abuse.

Sakutoto processes your personal data for the following purposes:

Sakutoto processes personal data on the following legal bases, as appropriate to each processing activity:

• Contractual necessity: Processing required to provide the services you have registered for, including account creation, payment processing, and game access;
• Legal obligation: Processing required to comply with applicable law, including KYC, AML, CTF, and licensing requirements imposed on Sakutoto as an operator;
• Legitimate interests: Processing for fraud prevention, platform security, responsible gambling monitoring, and service improvement, where our interests do not override your fundamental rights and freedoms;
• Consent: Processing for optional marketing communications, certain cookie categories, and any other processing activities where we have sought and obtained your explicit consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

We may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• Payment service providers: Malaysian payment processors and e-wallet operators (including DuitNow, FPX, Touch 'n Go eWallet, Maybank2u, CIMB Clicks, Public Bank, and Hong Leong Connect) to process your transactions;
• Identity verification providers: Third-party KYC and age verification services used to confirm your identity and satisfy our licensing obligations;
• Game content providers: Licensed casino game studios who supply games on the Platform and who may receive anonymised session data for RTP verification and technical support purposes;
• Fraud detection and security services: Third-party providers who assist in identifying and preventing fraudulent activity, multi-accounting, and financial crime on the Platform;
• Regulatory and law enforcement authorities: Where Sakutoto is legally required or compelled to disclose data under applicable law, licensing conditions, court order, or lawful request from a competent authority;
• Professional advisors: Legal counsel, auditors, and compliance consultants, where necessary and subject to professional confidentiality obligations;
• Corporate successors: In the event of a merger, acquisition, restructuring, or sale of the Company, your personal data may be transferred to the successor entity, subject to equivalent data protection standards.

Sakutoto retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and our licensing obligations. The following general retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our internal data lifecycle management procedures.

Sakutoto uses cookies and similar tracking technologies on the Platform to support core functionality, improve user experience, and gather aggregated analytics data. The categories of cookies we use are as follows:

• Strictly Necessary Cookies: Essential for the Platform to function correctly. These include session authentication cookies, login state management, and security tokens. These cookies cannot be disabled without impairing core Platform functionality;
• Functional Cookies: Used to remember your preferences, such as language settings, display configurations, and responsible gambling tool settings you have activated;
• Analytics Cookies: Used to collect aggregated, anonymised data about how users interact with the Platform — including page visits, session duration, and navigation paths — to help us improve the service;
• Marketing Cookies: Used, with your prior consent, to deliver relevant promotional content and measure the effectiveness of our marketing communications. You may opt out of marketing cookies at any time through your browser settings or our cookie management tool.

Sakutoto implements a layered set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Key security controls in place include:

• 256-bit SSL/TLS encryption across all data transmitted between your device and the Sakutoto Platform;
• Encryption at rest for all sensitive personal and financial data stored on our servers;
• Two-factor authentication (2FA) available on all user accounts and enforced on all internal administrative systems;
• Role-based access controls ensuring that Sakutoto staff can only access personal data to the extent necessary for their specific function;
• Continuous transaction monitoring to detect and respond to anomalous account activity in real time;
• Regular penetration testing and security audits conducted by independent third-party security specialists;
• Incident response procedures that require notification of affected users and relevant authorities in the event of a confirmed data breach within the timeframes mandated by applicable law.

While Sakutoto takes all reasonable precautions, no online system can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for notifying us immediately if you suspect any unauthorised access to your account.

Subject to applicable data protection law and any overriding legal or regulatory obligations, you hold the following rights in relation to your personal data held by Sakutoto:

To exercise any of the above rights, please contact our Data Protection team using the details provided in Section 16. We will respond to verified requests within 30 days. Where a request is complex or involves a high volume of data, we may extend this period by a further 60 days, with prior notification to you.

Please note that certain rights may be limited or overridden where Sakutoto has a legal obligation to retain or process data — for example, financial transaction records and KYC documents subject to AML retention requirements.

Sakutoto applies mandatory age verification as part of the account registration and KYC process. Any account found to have been created by or on behalf of an individual under the age of 21 will be suspended immediately, all associated data will be reviewed in accordance with our legal obligations, and the matter may be referred to the appropriate authorities.

If you are a parent or guardian and believe that a minor has accessed the Platform or submitted personal data to us, please contact our support team immediately via live chat or at the email address in Section 16. We will investigate and take appropriate action without undue delay.

The Sakutoto Platform integrates with a number of carefully selected third-party service providers to deliver its core functionality. These include licensed game studios, payment processing partners, fraud prevention services, and analytics providers. Where these providers process personal data on our behalf, they do so as data processors acting under our instructions and subject to contractual data protection obligations consistent with applicable law.

The Platform does not contain links to external third-party websites. However, if you access our payment partners' platforms directly (for example, your Maybank2u or Touch 'n Go eWallet account to confirm a transaction), those platforms are governed by their own independent privacy policies, over which Sakutoto has no control and for which we accept no responsibility.

In certain operational circumstances, your personal data may be transferred to, or processed by, systems or personnel located outside of Malaysia. This may occur in connection with our gaming licence jurisdiction's regulatory requirements, cloud infrastructure providers, or third-party service partners whose processing facilities are located in other countries.

Where such transfers occur, Sakutoto ensures that appropriate safeguards are in place to protect your personal data to a standard equivalent to that afforded under applicable Malaysian data protection law, including through the use of contractual data protection clauses with relevant third-party recipients.

Sakutoto reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or our Platform's functionality. When material changes are made, we will notify registered users via email or in-platform notification at least seven (7) days prior to the updated Policy taking effect, where practicable.

The effective date of the current version of this Policy is displayed at the top of this page. Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Policy. If you do not agree with the updated terms, you may request account closure as described in our Terms & Conditions.

We recommend reviewing this Policy periodically. The current version is always available at sakutoto.cam/privacy-policy.

For any questions, concerns, or formal requests relating to this Privacy Policy or the processing of your personal data, please contact the Sakutoto Data Protection team through the following channels:

We aim to acknowledge all privacy-related requests within 2 business days and to provide a substantive response within 30 calendar days of receiving a verified request. For complex or high-volume requests, we may require up to 90 days in total, with prior notice provided to you.

Where you believe that your data protection rights have not been respected, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction.