Privacy Policy

1. Introduction

Kupangtoto ("we", "us", "the Platform") operates the online gaming and sports betting platform accessible at https://kupangtoto.cam. As the data controller of personal information collected through this Platform, Kupangtoto takes its obligations regarding data privacy seriously.

This Privacy Policy ("Policy") describes the types of personal information we collect from players and visitors, the purposes for which that information is used, the conditions under which it may be shared, and the rights available to individuals whose data we process. By registering an account or using any part of the Kupangtoto platform, you acknowledge that you have read and understood this Policy.

This Policy should be read alongside our Terms & Conditions and our Responsible Gambling policy, both of which contain additional obligations and rights relevant to your use of Kupangtoto.

2. Definitions

• "Personal Data" means any information that identifies or can reasonably be used to identify a natural person, directly or indirectly.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, transfer, or deletion.
• "Data Controller" means Kupangtoto, the entity that determines the purposes and means of processing personal data.
• "Data Processor" means a third party that processes personal data on behalf of Kupangtoto, such as payment providers or identity verification services.
• "KYC" means Know Your Customer — the identity and age verification process conducted to confirm a player's identity and eligibility.
• "Cookies" means small text files placed on your device by the Platform to facilitate session management and, where consented, analytics.
• "Player" means any natural person who has registered or is in the process of registering an account with Kupangtoto.

3. Data We Collect

3.1 Registration Data

When you create a Kupangtoto account, we collect your full legal name, date of birth, email address, phone number, and chosen username. This information is mandatory for account creation and cannot be omitted.

3.2 Identity Verification (KYC) Data

To comply with age verification and anti-money-laundering obligations, we may request copies of government-issued identification (such as a Malaysian MyKad or passport), proof of current address, and evidence of payment methods used. These documents are processed securely and retained only for as long as legally required.

3.3 Financial & Transaction Data

We record deposit and withdrawal transactions, the payment methods used (including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, and other supported methods), transaction amounts in MYR or equivalent, and timestamps. We do not store complete bank card numbers; truncated references are retained for reconciliation purposes only.

3.4 Technical & Device Data

When you access the Platform, we automatically collect your IP address, browser type and version, operating system, device identifiers, referring URL, and session duration. This data is used for security monitoring, fraud detection, and platform performance optimisation.

3.5 Communications Data

If you contact our support team via live chat, email, or any other channel, we retain records of those communications, including the content of your messages and any attachments provided.

3.6 Gaming & Betting Activity

We maintain records of wagers placed, games played, bonus usage, and account activity logs. This data is used for dispute resolution, responsible gambling monitoring, and regulatory compliance.

4. Purpose of Data Processing

Kupangtoto processes personal data for the following defined purposes:

1. Account management: Creating, maintaining, and securing your player account throughout its lifetime.
2. Age and identity verification: Confirming that you are aged 21 or above and are who you claim to be, as required prior to processing withdrawals and as part of ongoing KYC obligations.
3. Payment processing: Facilitating deposits and withdrawals via supported Malaysian payment methods and ensuring funds are routed to accounts held in your name.
4. Fraud and security monitoring: Detecting and preventing unauthorised access, bonus abuse, money laundering, collusion, and other prohibited conduct.
5. Customer support: Resolving account queries, disputes, technical issues, and responsible gambling requests in a timely manner.
6. Legal and regulatory compliance: Meeting obligations imposed by applicable anti-money-laundering regulations, record-keeping requirements, and any other statutory obligations applicable to Kupangtoto's operational jurisdiction.
7. Responsible gambling: Monitoring gaming patterns to identify potential problem gambling behaviour and facilitating the application of player-requested controls such as deposit limits and self-exclusion.
8. Platform improvement: Analysing aggregated, anonymised usage data to improve navigation, game performance, and the overall player experience across mobile and desktop interfaces.

5. Legal Basis for Processing

Kupangtoto processes personal data on one or more of the following legal grounds, depending on the nature of the processing activity:

• Contractual necessity: Processing required to provide the gaming services you have requested and to fulfil the obligations set out in our Terms & Conditions.
• Legitimate interests: Processing necessary for fraud prevention, security monitoring, and platform integrity, where such interests are not overridden by your fundamental rights.
• Legal obligation: Processing required to comply with applicable law, including age verification and anti-money-laundering requirements.
• Consent: Where we rely on consent (e.g., for optional marketing communications or non-essential analytics cookies), you may withdraw that consent at any time without affecting the lawfulness of prior processing.

6. Data Sharing and Disclosure

6.1 Payment Processors

We share transactional data with payment service providers necessary to process deposits and withdrawals, including but not limited to the operators of Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, and USDT TRC20 network processors. These providers receive only the data necessary to complete the specific transaction.

6.2 Identity Verification Providers

KYC documents and personal identification data may be shared with specialist third-party identity verification services engaged by Kupangtoto for the sole purpose of performing age and identity checks.

6.3 Regulatory and Law Enforcement Authorities

Kupangtoto may disclose personal data to competent regulatory bodies, law enforcement agencies, or courts where disclosure is required by applicable law, a valid legal order, or to protect the rights, property, or safety of Kupangtoto, its players, or the public.

6.4 No Sale of Personal Data

7. Data Retention

Kupangtoto retains personal data for as long as your account remains active and for a defined period thereafter as required by applicable law or legitimate operational need. General retention guidelines are as follows:

• Account and registration data: Retained for the duration of the account relationship and for a minimum of 5 years following account closure, in accordance with standard anti-money-laundering record-keeping requirements.
• Transaction records: Retained for a minimum of 5 years from the date of each transaction.
• KYC documentation: Retained for a minimum of 5 years from the date of verification or account closure, whichever is later.
• Support communications: Retained for 2 years from the date of the last interaction, unless longer retention is required for dispute resolution.
• Technical and session logs: Typically retained for 12 months for security and fraud detection purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification.

8. Data Security

Kupangtoto implements appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• TLS/SSL encryption for all data transmitted between your device and the Kupangtoto platform;
• Encrypted storage of sensitive data, including KYC documents and financial records;
• Role-based access controls that limit internal access to personal data on a strict need-to-know basis;
• Regular security assessments and monitoring of our infrastructure for vulnerabilities;
• Staff training on data protection obligations and handling procedures.

9. Cookies and Tracking Technologies

9.1 Strictly Necessary Cookies

Kupangtoto uses session cookies that are essential for the Platform to function. These cookies enable login persistence, secure session management, and fraud prevention checks. They do not require your consent and cannot be disabled without impairing core Platform functionality.

9.2 Analytics Cookies

Subject to your consent, Kupangtoto may use analytics cookies to collect aggregated, anonymised data about how players navigate the Platform. This information helps us improve mobile and desktop usability, game category layout, and payment flow design.

9.3 Managing Cookies

You can control and delete cookies through your web browser settings. Disabling non-essential cookies will not affect your ability to access your account or place wagers, but may limit the availability of certain personalisation features. Most browsers provide detailed guidance on cookie management in their help documentation.

10. International Data Transfers

As an offshore gaming platform serving Malaysian players, Kupangtoto may store and process personal data on servers located outside Malaysia. Where personal data is transferred to a jurisdiction that does not provide an equivalent level of data protection, Kupangtoto takes steps to ensure that appropriate safeguards are in place, such as contractual protections between Kupangtoto and the receiving entity.

By registering an account and using the Kupangtoto platform, you acknowledge that your personal data may be transferred to and processed in jurisdictions outside of Malaysia for the purposes described in this Policy.

11. Your Data Rights

Subject to applicable law and certain exceptions (such as where data must be retained for legal compliance), you have the following rights in respect of your personal data:

• Right of access: You may request a copy of the personal data Kupangtoto holds about you.
• Right of rectification: You may request correction of inaccurate or incomplete personal data.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to overriding legal obligations.
• Right to restrict processing: You may request that Kupangtoto limits how it uses your data in certain circumstances.
• Right to data portability: Where processing is based on consent or contractual necessity, you may request a copy of your data in a structured, machine-readable format.
• Right to object: You may object to processing based on legitimate interests, including profiling for fraud detection, subject to Kupangtoto demonstrating compelling legitimate grounds.
• Right to withdraw consent: Where processing relies on your consent, you may withdraw it at any time without affecting prior processing.

To exercise any of the above rights, please contact the Kupangtoto support team at the email address listed in Section 15 below. We will respond within 30 calendar days. We may request proof of identity before fulfilling a data rights request.

12. Minors

13. Third-Party Links

The Kupangtoto platform may contain references to third-party services such as payment providers. Once you navigate away from Kupangtoto to a third-party platform (for example, the Touch 'n Go eWallet app or your bank's online portal), this Policy no longer applies and you are subject to that third party's own privacy practices. Kupangtoto is not responsible for the content or data handling practices of third-party services.

14. Amendments to This Policy

Kupangtoto reserves the right to update or modify this Privacy Policy at any time. Material changes will be communicated to registered players via email notification or a prominent notice on the Platform. The "last updated" date at the top of this page reflects the date of the most recent revision.

Your continued use of the Kupangtoto platform following any published amendment constitutes your acknowledgement of the revised Policy. If you do not agree with the amended terms, you should cease using the Platform and request account closure.

15. Contact Us

If you have questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact the Kupangtoto Data Protection team using the details below. We are committed to addressing all enquiries promptly and fairly.