Privacy Policy

This Privacy Policy ("Policy") is issued by Kudustoto ("we", "us", "our") in respect of the website at kudustoto.cam and all associated services, mobile interfaces, and applications (collectively, the "Platform"). It describes how Kudustoto collects, uses, stores, discloses, and otherwise processes the personal data of individuals who register for or interact with the Platform ("Users", "Members", "you").

Kudustoto is committed to handling personal data responsibly and in compliance with applicable data protection legislation and international best-practice standards. We recognise that our Members in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and across Malaysia trust us with sensitive personal information, and we take that responsibility seriously.

By registering an account, making a deposit, or otherwise using the Platform, you acknowledge that you have read and understood this Policy and that you consent to the processing of your personal data as described herein. This Policy should be read alongside our Terms & Conditions, which govern your use of the Platform more broadly.

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

• "Controller" means Kudustoto in its capacity as the entity that determines the purposes and means of processing personal data collected through the Platform.
• "Personal Data" means any information that relates to an identified or identifiable natural person — including name, email address, phone number, payment details, device identifiers, and IP address.
• "Processing" means any operation or set of operations performed on Personal Data, including collection, recording, storage, use, disclosure, alteration, retrieval, and deletion.
• "Processor" means any third-party service provider engaged by Kudustoto to process Personal Data on its behalf and under its instructions.
• "Sensitive Personal Data" means a category of data warranting heightened protection — including identity document numbers (e.g. MyKad), financial account details, and biometric information.
• "Cookies" means small text files stored on your device by the Platform to enable functionality, personalisation, analytics, and security features.
• "KYC Data" means identity verification documents and information — including copies of your MyKad or passport — collected for the purpose of Know Your Customer compliance.

Kudustoto collects personal data from Members in several ways — directly from you when you register or interact with the Platform, automatically through your use of the Platform, and occasionally from third-party verification or payment providers. The categories of data we collect are set out below.

3.1 Registration & Account Data

When you create a Kudustoto account, we collect the information you provide, which typically includes:

• Full legal name as it appears on your identity document
• Date of birth (used to verify you are 21 years of age or older)
• Email address and Malaysian mobile telephone number
• Preferred username and password (stored in hashed form — never in plain text)
• Residential address (required for KYC and regulatory compliance)

3.2 KYC & Identity Verification Data

Before you may make your first withdrawal, Kudustoto requires completion of a KYC process. This involves collecting:

• A copy of your Malaysian identity card (MyKad) — front and back
• A recent selfie photograph for liveness verification purposes
• Proof of address documentation where required by our compliance team

3.3 Financial & Transaction Data

To process deposits and withdrawals, we collect transaction-related data, including:

• Deposit and withdrawal amounts, timestamps, and payment method used
• E-wallet identifiers for Touch 'n Go eWallet, Boost, and GrabPay transactions
• Bank account numbers for Maybank, CIMB, Public Bank, Hong Leong, and other FPX-supported banks
• Cryptocurrency wallet addresses for BTC, ETH, USDT, and LTC transactions
• Transaction reference numbers and payment gateway response data

3.4 Usage & Technical Data

When you use the Platform, we automatically collect certain technical and behavioural data, including:

• IP address and approximate geographic location
• Device type, operating system version, and browser type
• Session duration, pages visited, and features interacted with
• Betting history, game activity, and wagering patterns
• Error logs and crash reports used for platform debugging and improvement

Kudustoto processes personal data for the following purposes:

• Account Management: Creating, maintaining, and operating your Kudustoto account, including verifying your identity and managing your balance.
• Payment Processing: Facilitating deposits and withdrawals via approved Malaysian payment methods including Touch 'n Go eWallet, DuitNow, FPX, and cryptocurrency channels.
• KYC & Regulatory Compliance: Verifying that you meet the minimum age requirement of 21 years, confirming your identity in accordance with anti-money-laundering obligations, and maintaining records as required by applicable regulations.
• Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent transactions, account takeovers, money laundering, and other prohibited activities on the Platform.
• Responsible Gambling: Monitoring betting patterns to identify signs of problem gambling, enabling the effective operation of deposit limits, self-exclusion, and other responsible gambling tools.
• Customer Support: Responding to enquiries, resolving disputes, and providing technical assistance to Members via live chat and email.
• Platform Improvement: Analysing aggregated usage data to improve the Platform's features, performance, reliability, and user experience.
• Marketing Communications: Sending promotional offers, bonus notifications, and loyalty programme updates to Members who have opted in to receive such communications. You may unsubscribe at any time.
• Legal Obligations: Complying with applicable laws, court orders, and requests from regulatory authorities.

Kudustoto relies on the following legal bases to process your personal data:

• Contract Performance: Processing necessary to fulfil our contractual obligations to you — including operating your account, processing your bets, and handling deposits and withdrawals.
• Legal Obligation: Processing required to comply with applicable laws — including KYC and anti-money-laundering regulatory requirements.
• Legitimate Interests: Processing carried out for our legitimate business interests — including fraud prevention, platform security, and improvement of the Platform — where those interests are not overridden by your privacy rights.
• Consent: Processing carried out on the basis of your explicit consent — including the sending of marketing communications and certain optional analytics. You may withdraw consent at any time.

Kudustoto does not sell, rent, or trade your personal data. We share personal data with third parties only to the extent strictly necessary for the purposes described in this Policy, and only with parties who are contractually bound to maintain appropriate data security standards.

Categories of recipients with whom we may share personal data include:

• Payment Service Providers: Including Touch 'n Go eWallet, DuitNow, FPX-connected banks (Maybank, CIMB, Public Bank, Hong Leong), Boost, GrabPay, and cryptocurrency processing partners — solely for the purpose of processing your transactions.
• KYC & Identity Verification Providers: Third-party identity verification services engaged to process MyKad and other identity document checks required for regulatory compliance.
• Cloud Hosting & Infrastructure Providers: Server, database, and cloud infrastructure providers who process data on our behalf and under our instructions.
• Analytics Providers: Providers of anonymised or aggregated platform analytics used to improve Platform performance, where data is de-identified before sharing.
• Regulatory & Law Enforcement Authorities: Where we are legally obligated to disclose personal data in response to valid regulatory requests, court orders, or government investigations.
• Professional Advisers: Lawyers, auditors, and compliance consultants engaged by Kudustoto on a confidential basis.

Kudustoto operates internationally and some of our service providers and infrastructure partners may process personal data in countries outside Malaysia. Where personal data is transferred outside Malaysia, Kudustoto ensures that appropriate safeguards are in place to protect the data — including contractual clauses with Processors that impose data protection obligations equivalent to those we apply domestically.

By using the Platform, you consent to your personal data being transferred to and processed in countries outside your country of residence where such transfers are necessary to provide the Services, subject at all times to the protections described in this Policy.

Kudustoto uses cookies and similar tracking technologies to operate and improve the Platform. The categories of cookies we use are as follows:

• Strictly Necessary Cookies: Essential for the Platform to function — including session authentication, security tokens, and load balancing. These cannot be disabled.
• Functional Cookies: Enable enhanced functionality and personalisation — including remembering your language preferences and login state between sessions.
• Analytics Cookies: Used to collect aggregated, anonymised data about how Members use the Platform — including page visit frequencies and feature usage — to guide Platform improvements.
• Security Cookies: Support fraud detection and prevention measures, including device fingerprinting used to identify suspicious account access patterns.

Most browsers allow you to control cookies through their settings. However, disabling certain cookies may affect the functionality of the Platform and prevent you from accessing some features. Continued use of the Platform following your acknowledgment of this Policy constitutes consent to our use of cookies as described above.

Kudustoto retains personal data for as long as is necessary to fulfil the purposes for which it was collected, taking into account applicable legal, regulatory, and operational requirements. The following indicative retention periods apply:

• Account and Identity Data: Retained for the duration of your active membership and for a minimum of five (5) years following account closure, to comply with anti-money-laundering record-keeping obligations.
• Transaction and Financial Data: Retained for a minimum of seven (7) years from the date of the transaction, consistent with financial record-keeping standards.
• KYC Documents: Retained for a minimum of five (5) years from account closure or the date of the last transaction, whichever is later.
• Support Communications: Retained for three (3) years from the date of the last communication, for dispute resolution purposes.
• Marketing Preferences: Retained until you withdraw consent or unsubscribe, after which your preference to opt out will be maintained indefinitely to prevent re-contact.

Kudustoto implements a comprehensive set of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, or alteration. These measures include:

• End-to-end TLS 1.3 encryption for all data transmitted between your device and the Platform
• AES-256 encryption for personal data and financial records stored at rest
• Password hashing using industry-standard bcrypt or Argon2 algorithms — passwords are never stored in plain text
• Multi-factor authentication (MFA) options for account access
• Real-time intrusion detection and anomaly monitoring systems
• Strict role-based access controls limiting internal staff access to personal data on a need-to-know basis
• Regular third-party penetration testing and security audits
• Segregated storage environments for KYC documents separate from general operational data

Despite these measures, no security system is impenetrable. In the event of a data breach that is likely to result in a risk to your rights and freedoms, Kudustoto will notify affected Members and, where required by law, the relevant regulatory authority, within the timeframes prescribed by applicable data breach notification obligations.

Subject to applicable data protection law, you hold the following rights in respect of your personal data held by Kudustoto. To exercise any of these rights, please contact our support team at [email protected] or via the 24/7 live chat on the Platform.

The Kudustoto Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. If you are under 21, you are not permitted to register, use, or access the Platform in any capacity.

If Kudustoto becomes aware that personal data has been collected from an individual under 21 without verified parental or guardian consent — or in circumstances where such consent is irrelevant because of the nature of the Platform — we will take immediate steps to delete that data and close the associated account.

Parents or guardians who believe that a minor may have registered on the Platform or provided personal data without their knowledge are encouraged to contact our support team immediately at [email protected].

The Platform may integrate with or reference third-party services — including payment gateways for Touch 'n Go eWallet, Maybank2u, CIMB Clicks, DuitNow, and cryptocurrency processors — that operate under their own privacy policies. Kudustoto is not responsible for the data practices of these third parties.

When you use a third-party payment method to deposit or withdraw funds, that provider may collect and process your data in accordance with their own terms and privacy policy. We recommend reviewing the privacy policy of any payment provider you use in connection with your Kudustoto account.

Kudustoto does not include third-party advertising or external links on the Platform that would result in your personal data being collected by unrelated third parties for advertising purposes.

Kudustoto reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or operational requirements. Where any amendment is material — meaning it substantially changes your rights or how we handle your data — we will provide advance notice via email to your registered address or by prominently displaying a notice on the Platform.

The effective date of the current version of this Policy is displayed at the top of this page. We recommend reviewing this Policy periodically to stay informed of how we protect your personal data. Your continued use of the Platform following the publication of any amendment constitutes your acceptance of the updated Policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or Kudustoto's handling of your personal data, please contact our Data Privacy team through any of the following channels:

• Live Chat: Available 24/7 on kudustoto.cam — average response time under 2 minutes. Suitable for general enquiries and to submit rights requests.
• Email: [email protected] — for formal privacy enquiries, please use the subject line "Privacy Policy — Data Request" or "Privacy Policy — Formal Complaint" as appropriate.

We aim to acknowledge all privacy-related communications within 48 hours and to provide a substantive response within 30 calendar days. If you are not satisfied with our response, you may have the right to lodge a complaint with the relevant data protection authority in your jurisdiction.