Privacy Policy

This Privacy Policy (hereinafter referred to as "the Policy", "this Policy", or "Privacy Policy") is published by Unsurtoto (hereinafter "we", "us", "our", or "the Platform") and governs the collection, use, storage, disclosure, and protection of personal data belonging to users (hereinafter "you", "User", or "Player") of the online sports betting and casino services accessible at unsurtoto.cam (the "Website"), including any associated mobile applications or digital services.

Unsurtoto operates under international licensing and serves players across Malaysia, including Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and Bangsar, among other regions. We recognise that our Malaysian users place significant trust in us when they share their personal information, and we take that responsibility seriously.

This Policy should be read alongside our Terms & Conditions, which together constitute the complete legal framework governing your relationship with unsurtoto.

For the purposes of this Policy, the following terms carry the meanings set out below:

Unsurtoto collects Personal Data across three broad categories: information you provide directly, information generated by your use of the Platform, and information obtained from third-party sources as part of our KYC and fraud prevention obligations.

Information you provide directly:

• Full legal name as it appears on your government-issued identification document (Malaysian MyKad, passport, or equivalent).
• Date of birth — used to verify that you meet the 21+ age requirement.
• Residential address, including city (e.g., Kuala Lumpur, Petaling Jaya, Johor Bahru) and postcode.
• Email address and mobile phone number used for account communications and security verification.
• Copies of identity documents submitted during the KYC verification process.
• Payment method details, including screenshots or statements from Malaysian payment channels (e.g., Maybank2u, CIMB Clicks, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX).
• Cryptocurrency wallet addresses, where applicable.
• Communications and correspondence submitted to our customer support team via live chat or email.

Information generated automatically:

• IP address, device type, operating system, and browser version.
• Geolocation data (country and city level) derived from your IP address.
• Betting history, wager amounts, game sessions, login timestamps, and transaction records.
• Session duration, pages visited, and click-stream data on the Website.
• Device fingerprint data used for fraud detection and security purposes.

Information from third parties:

• Identity verification results from licensed KYC service providers.
• Fraud screening results from payment processors and anti-fraud platforms.
• AML screening data from sanctions list checking services.

Unsurtoto collects Personal Data through the following mechanisms:

• Account registration forms: When you create an unsurtoto account, you provide your basic personal details and contact information.
• KYC submission process: During identity verification, you upload government-issued documents and payment method evidence.
• Platform usage: Our servers automatically log technical and behavioural data each time you access and interact with the Website.
• Cookies and tracking technologies: Session cookies, analytics tools, and fraud-detection pixels collect device and behavioural data as described in Section 9 of this Policy.
• Customer support interactions: When you contact our support team via live chat, we record the content of those communications for quality assurance, security, and dispute resolution purposes.
• Payment processing: Transaction data is recorded automatically when deposits and withdrawals are processed through Malaysian payment partners.

Unsurtoto processes Personal Data for the following purposes:

Unsurtoto processes your Personal Data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing required to perform our obligations to you under the Terms & Conditions — including account management, payment processing, and service delivery.
• Legal obligation: Processing required to comply with KYC, AML, and other applicable regulatory requirements under our international operating licence.
• Legitimate interests: Processing carried out for our legitimate business interests — including fraud prevention, platform security, and service improvement — where those interests are not overridden by your rights and freedoms.
• Consent: Processing for marketing communications and certain non-essential cookies, where you have provided clear and freely given consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Unsurtoto does not sell or rent your Personal Data to third parties. We may share your data with the following categories of recipients, strictly to the extent necessary and under appropriate contractual protections:

• Payment service providers: Processing entities facilitating your deposits and withdrawals, including Malaysian e-wallet and banking partners. These entities receive only the transaction data necessary to execute your payment.
• KYC and identity verification providers: Licensed service providers that verify your identity, age, and document authenticity as part of our regulatory compliance obligations.
• AML and fraud detection services: Third-party platforms that screen transactions and account activity for suspicious patterns and sanctions list matches.
• Game content providers: Software studios whose games are integrated on the Platform may receive anonymised session data for the purpose of game performance monitoring. No personally identifiable data is shared for this purpose.
• Regulatory and law enforcement authorities: Where required by applicable law or lawful order, we may disclose Personal Data to competent authorities. We will endeavour to notify you of such disclosure unless legally prohibited from doing so.
• Corporate transactions: In the event of a merger, acquisition, or business restructuring, your Personal Data may be transferred to the successor entity, subject to equivalent privacy protections.

As unsurtoto operates under international licensing and utilises globally distributed service providers, your Personal Data may be transferred to and processed in jurisdictions outside of Malaysia. Such jurisdictions may not have data protection laws equivalent to those in Malaysia.

Where Personal Data is transferred internationally, unsurtoto implements appropriate safeguards to ensure that your data remains protected to a standard consistent with this Policy, including the use of:

• Contractual data protection clauses with recipient entities.
• Transfer to jurisdictions with recognised adequate data protection frameworks.
• Technical and organisational security measures applied at the receiving entity.

Unsurtoto uses cookies and similar tracking technologies on the Website. By continuing to use the Website with cookies enabled in your browser, you consent to the use of cookies as described in this section.

You may control or disable non-essential cookies through your browser settings. Note that disabling cookies may affect the functionality of certain Platform features. Detailed cookie management instructions are available in the help documentation for your browser.

Unsurtoto retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable laws and licensing obligations. The following retention periods apply:

• Account and transaction data: Retained for a minimum of five (5) years following account closure, in compliance with AML record-keeping requirements under our international licence.
• KYC documents: Retained for the duration of the account relationship and for five (5) years following account closure.
• Customer support records: Retained for three (3) years following the resolution of the relevant query or dispute.
• Marketing consent records: Retained until you withdraw consent, plus an additional two (2) years to maintain an auditable record of consent.
• Analytics data: Retained in anonymised or aggregated form for up to two (2) years.

Following the expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised in accordance with our data disposal procedures.

Unsurtoto implements a comprehensive range of technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• Transport Layer Security (TLS): All data transmitted between your device and our servers is encrypted using 256-bit SSL/TLS encryption.
• Encryption at rest: Sensitive data — including KYC documents, financial records, and authentication credentials — is encrypted in storage.
• Access controls: Access to Personal Data within our organisation is restricted to personnel whose roles require it, under a strict need-to-know basis enforced through role-based access controls.
• Two-factor authentication (2FA): Available to all account holders and required for all internal administrative access to systems handling Personal Data.
• Regular security audits: Our systems undergo periodic penetration testing and independent security assessments.
• Incident response: We maintain a documented data breach response procedure. In the event of a breach that poses a risk to your rights and freedoms, we will notify you and relevant authorities within the timeframes required by applicable law.

Subject to applicable law and our legitimate processing obligations, you have the following rights in respect of your Personal Data held by unsurtoto:

To exercise any of the above rights, please contact our support team via live chat or email (see Section 16). We will verify your identity before processing any data rights request to protect against fraudulent or unauthorised requests made on your behalf.

The unsurtoto Platform is strictly for adults aged 21 and above. We do not knowingly collect Personal Data from individuals under the age of 21. Age verification is a mandatory component of our KYC process, and any account found to be held by an individual under 21 years of age will be immediately and permanently closed.

The unsurtoto Website may reference third-party services — such as payment platforms (Maybank2u, CIMB Clicks, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX) and game content providers — in the course of delivering our services. These third-party services operate under their own privacy policies, which are independent of this Policy.

Unsurtoto is not responsible for the privacy practices or content of third-party services. We encourage you to review the privacy policies of any third-party service provider you interact with in connection with your use of unsurtoto.

Unsurtoto reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or Platform services. The revised Policy will be posted on this page with an updated effective date.

Where amendments are material — for example, where we introduce a new category of data collection or a new purpose for processing — we will provide notice to active account holders via email or on-platform notification prior to the changes taking effect. Your continued use of the Platform following the effective date of a revised Policy constitutes your acceptance of the updated terms.

If you have any questions or concerns regarding this Privacy Policy, wish to exercise your data rights, or wish to submit a complaint about how unsurtoto has handled your Personal Data, please contact us through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week, through the Platform. This is the fastest channel for account-specific queries and immediate assistance.
• Email (plain text — not a link): [email protected] — please include "Privacy Request" or "Data Rights" in the subject line for prioritised handling.

We aim to acknowledge all privacy-related requests within three (3) business days and to resolve them within fourteen (14) business days, or within the timeframe required by applicable law where it differs.