Your personal data belongs to you. This Privacy Policy explains exactly what information Sastoto collects, how we use it, who we share it with, how long we retain it, and what rights you hold over that data — in plain, accessible English suited for Malaysian players.
Six core commitments that define how Sastoto handles your personal information.
We collect only the personal information required to operate your account, process your transactions, comply with KYC obligations, and deliver our services. We do not collect data speculatively or without clear purpose.
All personal data stored on Sastoto's systems is protected using AES-256 encryption. Data in transit is secured via TLS 1.3 protocols. Unauthorised access to your information is prevented at every layer of our infrastructure.
Sastoto does not sell, rent, or trade personal data to third parties for commercial purposes. Data is shared only with service providers essential to platform operation, and under strict contractual data protection obligations.
At any time you may request access to, correction of, or deletion of your personal data held by Sastoto. Requests are processed within 30 days of receipt. Some data may be retained where required by our licensing obligations.
We use essential cookies to keep the Platform running securely, and optional analytics cookies to improve user experience. No third-party advertising cookies are placed without your knowledge. Cookie preferences can be managed in your account settings.
Personal data is retained only for as long as necessary — account data for the duration of your membership plus a standard retention window of up to five years in line with international licensing requirements. After that, data is securely deleted.
This Privacy Policy (the "Policy") sets out how Sastoto (the "Company", "We", "Us", or "Our"), operator of the online gaming platform accessible at sastoto.cam, collects, uses, stores, shares, and protects personal data belonging to registered users and visitors (collectively, "You", "User", or "Data Subject").
Sastoto is committed to processing personal data responsibly, transparently, and in accordance with internationally recognised data protection principles consistent with our licensing obligations under the Curacao gaming jurisdiction. This Policy applies to all personal data processed in connection with your use of the Sastoto Platform, including data collected via account registration, financial transactions, customer support interactions, and Platform usage analytics.
By registering an account or continuing to use the Sastoto Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein.
The following definitions apply throughout this Privacy Policy:
| Term | Meaning |
|---|---|
| "Personal Data" | Any information relating to an identified or identifiable natural person, including but not limited to name, email address, date of birth, payment details, IP address, and device identifiers. |
| "Processing" | Any operation performed on Personal Data, whether automated or manual — including collection, recording, storage, use, disclosure, erasure, or destruction. |
| "Data Controller" | Sastoto, as the entity that determines the purposes and means of processing Personal Data collected through the Platform. |
| "Data Processor" | A third-party service provider that processes Personal Data on behalf of Sastoto, pursuant to written contractual instructions. |
| "Consent" | A freely given, specific, informed, and unambiguous indication of agreement to the processing of Personal Data for a stated purpose. |
| "KYC Data" | Identity verification documents and associated personal information collected to satisfy Know Your Customer obligations under our licensing requirements. |
Depending on how you interact with the Sastoto Platform, we may collect the following categories of Personal Data:
3.1 Account Registration Data
3.2 Identity Verification (KYC) Data
3.3 Financial & Transaction Data
3.4 Platform Usage Data
3.5 Communications Data
Sastoto collects personal data through the following channels and mechanisms:
Sastoto processes personal data only for specified, legitimate purposes. The following table sets out the primary purposes and the legal basis applied to each:
| Purpose | Legal Basis |
|---|---|
| Account creation and management | Performance of contract — necessary to provide the service you have registered for. |
| Processing deposits and withdrawals in MYR | Performance of contract — necessary to execute financial transactions. |
| KYC identity and age verification (21+) | Legal obligation — required under our licensing conditions and responsible gambling commitments. |
| Fraud prevention and anti-money laundering screening | Legitimate interest — protecting the Platform, all users, and the financial system from abuse. |
| Customer support and dispute resolution | Performance of contract and legitimate interest. |
| Sending promotional communications and offers | Consent — you may opt out at any time via account settings or by contacting support. |
| Platform analytics and performance improvement | Legitimate interest — improving service quality and user experience. |
| Responsible gambling monitoring and intervention | Legal obligation and legitimate interest — protecting player wellbeing. |
Sastoto does not sell, rent, or otherwise trade your personal data to third parties for commercial purposes. Data may be shared in the following limited and controlled circumstances:
Personal data is retained by Sastoto only for as long as is necessary to fulfil the purposes for which it was collected, or as required by our licensing obligations and applicable law. The following general retention framework applies:
| Data Category | Retention Period |
|---|---|
| Account registration and profile data | Duration of account + 5 years after closure |
| KYC and identity verification documents | Duration of account + 5 years after closure |
| Financial transaction records | Duration of account + 5 years (AML compliance) |
| Gaming activity and wagering logs | Duration of account + 3 years after closure |
| Customer support communications | 3 years from date of communication |
| Analytics and usage data (aggregated) | Up to 2 years; anonymised thereafter |
| Marketing consent and preference records | Until consent is withdrawn, plus 1 year |
Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with any individual. Requests for early deletion are addressed under Section 8 (Your Rights) below, subject to any overriding legal retention obligations.
Depending on your jurisdiction and the legal basis under which your data is processed, you may hold some or all of the following rights with respect to your personal data held by Sastoto:
Request a copy of all personal data we hold about you, along with information about how it is being used.
Request correction of any inaccurate or incomplete personal data held in your Sastoto account.
Request deletion of your personal data, subject to our legal retention obligations and licensing requirements.
Request that we limit how we process your personal data in certain circumstances, such as during a dispute investigation.
Object to processing based on legitimate interest, including profiling for direct marketing or analytics purposes.
Receive your personal data in a structured, machine-readable format for transfer to another service provider.
To exercise any of these rights, please submit a written request to [email protected] with the subject line "Data Rights Request — [Your Username]". Requests are acknowledged within 5 business days and fulfilled within 30 days. We may require identity verification before processing your request.
Sastoto uses cookies and similar tracking technologies to maintain Platform functionality, enhance your user experience, and analyse aggregate usage patterns. The following cookie categories are used:
Sastoto does not use third-party advertising or retargeting cookies. You can manage your cookie preferences through your browser settings or via the Platform's cookie preference centre. Note that disabling strictly necessary cookies will prevent Platform access.
Sastoto implements a comprehensive suite of technical and organisational security measures designed to protect personal data against unauthorised access, accidental loss, destruction, and misuse:
While we take all reasonable steps to protect your personal data, no internet-based system is completely immune to security risks. You are responsible for keeping your Sastoto account credentials confidential and notifying us immediately at [email protected] if you suspect unauthorised access to your account.
The Sastoto Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect, store, or process personal data from individuals under the age of 21.
All registrations are subject to age verification through our KYC process. Where we have reason to believe that personal data has been submitted by a person under 21, we will immediately suspend the relevant account, reverse any financial transactions where possible, and permanently delete all associated personal data.
As an internationally operated platform, Sastoto may transfer personal data to servers and service providers located outside Malaysia. Such transfers occur only where necessary to deliver the Platform's services and are subject to the following safeguards:
Where personal data is transferred internationally, we take reasonable steps to ensure that the receiving jurisdiction applies an adequate level of data protection. We do not transfer data to jurisdictions that lack reasonable data protection infrastructure.
Sastoto reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, operational requirements, legal obligations, or regulatory guidance.
Where amendments are material — meaning they affect the nature of data collected, the purposes of processing, or your rights — we will notify registered users via the email address associated with their account at least fourteen (14) days before the updated Policy takes effect, or by displaying a prominent notice on the Platform.
The date of the most recent revision is displayed at the top of this document. Continued use of the Sastoto Platform following the effective date of any amended Policy constitutes your acceptance of the revised terms. If you do not accept the revised Policy, you may close your account and request deletion of your data as described in Section 8.
For any queries, requests, or complaints relating to this Privacy Policy or the handling of your personal data, please contact the Sastoto Data Protection team:
If you are not satisfied with our response to a data protection complaint, you may have the right to escalate the matter to a relevant supervisory authority. For Malaysian users, the Personal Data Protection Department (Jabatan Perlindungan Data Peribadi) oversees complaints relating to the Personal Data Protection Act 2010.
Any questions about how we handle your data? Our team is available 24/7. For players aged 21 and above only.