Privacy Policy

1 Introduction

This Privacy Policy ("Policy") sets out the practices of Sritoto ("Sritoto", "we", "us", "our") with respect to the collection, use, storage, disclosure, and protection of personal data obtained from users ("Player", "User", "you") of the website located at sritoto.cam and all associated mobile and gaming services (the "Platform").

Sritoto takes data privacy seriously. We understand that our players — many of whom are based in Malaysia, including major population centres such as Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru, and Shah Alam — trust us with sensitive personal and financial information. We do not take that trust lightly. This Policy is designed to be transparent, readable, and actionable.

By registering an account or using any feature of the Sritoto Platform, you acknowledge that you have read and understood this Policy and that you consent to the collection and use of your personal data as described herein. If you do not agree with any aspect of this Policy, you should cease using the Platform and may request account closure and data deletion through our support team.

2 Definitions

For the purposes of this Privacy Policy, the following definitions shall apply:

• "Personal Data" means any information that identifies or can reasonably be used to identify a specific individual, including name, identification number, contact details, financial account information, and device identifiers.
• "Processing" means any operation performed on personal data, including collection, recording, storage, use, disclosure, transfer, and deletion.
• "Data Controller" means Sritoto in its capacity as the entity that determines the purposes and means of processing personal data collected through the Platform.
• "Third Party" means any entity other than the Player and Sritoto, including payment processors, technology service providers, identity verification providers, and fraud prevention partners.
• "Cookie" means a small data file placed on a Player's device by the Platform for purposes of session management, analytics, or feature personalisation.
• "KYC Data" means Know Your Customer documentation, including government-issued identification, proof of address, and payment method verification materials provided by a Player.

3 Data We Collect

Sritoto collects personal data through the following means: direct submission by the Player during registration and account management; automatic collection during Platform use; and receipt from authorised third-party service providers. The categories of data collected include:

Sritoto does not collect special category data (such as health or biometric information) except where voluntarily provided by a Player in the context of a responsible gambling or self-exclusion request.

4 Data Processing

Sritoto processes the personal data it collects for the following specific and legitimate purposes:

1. Account Registration and Management: To create, verify, and maintain your Player account, including processing your initial registration, verifying your identity through KYC, and managing your account preferences and responsible gambling settings.
2. Transaction Processing: To process deposits and withdrawals in MYR and other accepted currencies, to record transactional history for account statement purposes, and to manage chargebacks or payment disputes with third-party processors including FPX, DuitNow, and e-wallet providers.
3. Customer Support: To respond to support enquiries via live chat and email, to maintain records of previous interactions for service continuity, and to resolve disputes or complaints relating to game outcomes, payment processing, or account access.
4. Legal Compliance and Fraud Prevention: To meet obligations under Sritoto's international gaming licence, to conduct anti-money laundering (AML) screening, to detect and prevent fraudulent activity including multi-accounting and bonus abuse, and to respond to lawful requests from relevant authorities where required.
5. Platform Improvement and Analytics: To analyse aggregated and anonymised usage patterns in order to improve Platform performance, game selection, user interface, and feature development. Individual Player data is not published as part of this analytical work.
6. Responsible Gambling Monitoring: To identify patterns of play that may indicate problem gambling behaviour, to administer self-exclusion requests and cooling-off periods, and to comply with responsible gaming obligations under our licensing framework.
7. Marketing Communications (where consented): To send promotional emails, bonus notifications, or platform updates to Players who have opted in to marketing communications. Players may withdraw consent at any time by updating their notification preferences or contacting support.

5 Legal Basis for Processing

Sritoto processes personal data on the following legal grounds, consistent with internationally accepted data protection frameworks:

• Contractual Necessity: Processing required to perform the contractual obligations set out in our Terms and Conditions — including account management, payment processing, and game delivery.
• Legal Obligation: Processing required to comply with regulatory requirements under our gaming licence, including AML obligations, age verification requirements, and responses to lawful authority requests.
• Legitimate Interests: Processing carried out in Sritoto's legitimate interests as a licensed gaming operator — including fraud prevention, security monitoring, platform analytics, and responsible gambling programme administration — where such interests are not overridden by the Player's rights and interests.
• Consent: Processing for marketing communications and optional analytics cookies, where the Player has given explicit, freely given, and withdrawable consent.

6 Data Sharing & Disclosure

Sritoto does not sell, rent, or trade personal data to any third party for commercial gain. We may share data with the following categories of recipient in the circumstances described below:

1. Payment Processing Partners: Financial data necessary to process deposits and withdrawals is shared with our licensed payment gateway and processor partners, including FPX network participants (Maybank, CIMB, Public Bank, Hong Leong Bank), DuitNow, Touch 'n Go eWallet, Boost, GrabPay, and cryptocurrency processing services. Data shared is limited to the minimum required to complete the transaction.
2. Identity Verification Providers: KYC documentation may be shared with third-party identity verification services engaged by Sritoto to confirm document authenticity and Player identity. These providers are bound by confidentiality obligations and data processing agreements.
3. Fraud Prevention & AML Screening: Certain account and transaction data may be processed by third-party fraud prevention and AML screening tools to detect suspicious patterns consistent with financial crime or multi-accounting. Data is processed in accordance with applicable data protection agreements.
4. Technology Service Providers: Operational service providers — including hosting infrastructure, customer support platforms, and analytics tools — may process certain Player data in the course of providing services to Sritoto. All such providers are subject to contractual data protection obligations.
5. Regulatory and Law Enforcement Authorities: Sritoto may disclose personal data to relevant governmental or regulatory authorities, international law enforcement agencies, or our licensing body where required by law, court order, or to protect the rights, property, or safety of Sritoto, its Players, or the public.

In all cases of data sharing, Sritoto applies a data minimisation principle: only the information strictly necessary for the relevant purpose is shared, and recipients are obligated to maintain appropriate security and confidentiality standards.

7 Data Retention

Sritoto retains personal data for as long as necessary to fulfil the purposes for which it was collected, including the satisfaction of legal, regulatory, accounting, and reporting obligations. The following general retention guidelines apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification.

8 Security Measures

Sritoto implements a comprehensive set of technical and organisational security measures to protect personal data against unauthorised access, loss, destruction, or disclosure. These measures include:

• 256-bit Transport Layer Security (TLS/SSL) encryption for all data transmitted between the Player's browser and Sritoto servers
• Encryption of sensitive data fields at rest, including payment identifiers and KYC document content
• Role-based access controls limiting internal access to personal data to authorised personnel with a documented business need
• Regular security audits and penetration testing conducted by independent security professionals
• Multi-factor authentication requirements for internal administrative system access
• Automated monitoring systems designed to detect and alert on unusual access patterns or potential data breaches
• Incident response procedures enabling Sritoto to contain, assess, and notify affected parties of any confirmed data breach within a reasonable timeframe

9 Cookies & Tracking Technologies

The Sritoto Platform uses cookies and similar tracking technologies (such as web beacons and local storage) for the following purposes:

• Strictly Necessary Cookies: Required for the Platform to function, including maintaining your logged-in session, remembering language preferences, and enabling secure payment flows. These cannot be disabled without preventing core functionality.
• Functional Cookies: Used to remember your display preferences, game history, and last-visited sections to improve your experience on return visits. These may be disabled via browser settings without preventing core access.
• Analytics Cookies: Used by Sritoto's internal analytics system to understand aggregate Platform usage patterns — such as popular game categories and peak usage times — in order to improve the service. These are not used to build individual advertising profiles.

Sritoto does not use third-party behavioural advertising cookies or cross-site tracking technologies that would allow external parties to build profiles of your browsing behaviour across websites.

Players may manage cookie preferences through their browser settings. Note that disabling cookies may affect the functionality of certain Platform features. Browser-level cookie management instructions are available in your browser's help documentation.

10 User Rights

Players have the following rights with respect to their personal data held by Sritoto. To exercise any of these rights, contact our support team via live chat or email. We will acknowledge your request within 5 business days and respond substantively within 30 days, or inform you of any extension required for complex requests.

1. Right of Access: You may request a copy of the personal data Sritoto holds about you, along with information about how it is processed, who it has been shared with, and the period for which it is retained.
2. Right to Rectification: If any personal data held about you is inaccurate or incomplete, you have the right to request its correction. We will action corrections within a reasonable timeframe and notify relevant third parties where necessary.
3. Right to Erasure ("Right to be Forgotten"): You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (for consent-based processing), or where you object to processing and there are no overriding legitimate grounds. Note that we may be unable to delete certain data where we have a legal or regulatory obligation to retain it.
4. Right to Restriction of Processing: You may request that we restrict how we process your data in certain circumstances — for example, while we investigate a rectification request, or where you have objected to processing pending determination of overriding legitimate grounds.
5. Right to Data Portability: Where processing is carried out by automated means on the basis of your consent or contractual necessity, you may request receipt of your personal data in a structured, commonly used, machine-readable format.
6. Right to Object: You have the right to object to processing based on legitimate interests, including profiling. You may also object to receiving marketing communications at any time by updating your account preferences or contacting support.
7. Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To submit a data rights request, please contact support via live chat (available 24/7) or by emailing [email protected]. We may need to verify your identity before actioning any request relating to personal data.

11 Minors & Age Policy

The Sritoto Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect personal data from anyone under the age of 21. Age verification is a mandatory step in the Sritoto registration and KYC process, and access to all gaming products is contingent on the successful completion of that verification.

If Sritoto becomes aware that personal data has been collected from an individual under the age of 21, we will take immediate steps to delete that data and permanently close the associated account. Any balances, deposits, or winnings associated with an underage account will be forfeited in accordance with our Terms and Conditions.

If you believe that a minor may have accessed the Sritoto Platform and submitted personal data, please contact our support team immediately so that we can investigate and take appropriate action without delay.

12 International Data Transfers

Sritoto operates under international gaming licensing and uses technology infrastructure and service providers that may process personal data in jurisdictions outside Malaysia. Where such international transfers occur, Sritoto takes steps to ensure that appropriate safeguards are in place, including:

• Contractual data processing agreements incorporating standard data protection clauses with all third-party recipients
• Selection of service providers that operate data centres in jurisdictions with adequate data protection frameworks or that have adopted equivalent internal standards
• Ongoing due diligence on the data protection practices of third-party processors engaged by Sritoto

By using the Sritoto Platform, Malaysian players acknowledge that their data may be processed outside Malaysia in the course of normal Platform operations.

13 Third-Party Links & Services

The Sritoto Platform does not contain links to third-party websites for the purpose of this Privacy Policy. The payment methods integrated into the Platform — including Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and others — operate through their own independent privacy policies which govern the processing of data on their respective platforms. Sritoto is not responsible for the data practices of these independent services.

Players are encouraged to review the privacy policies of any external payment service they use in connection with their Sritoto account. Sritoto only receives the transactional information necessary to credit or process a withdrawal, and does not receive access to the Player's full financial account credentials.

14 Changes to This Privacy Policy

Sritoto reserves the right to update this Privacy Policy at any time. Material changes — particularly those that affect how we use or share personal data, or that affect Player rights — will be communicated to registered Players via their registered email address or through a prominent notice on the Platform prior to the change taking effect.

The date of the most recent revision is displayed at the top of this page. Continued use of the Platform following any update to this Policy constitutes acceptance of the revised terms. Players who do not accept a material change to the Policy may request account closure and data deletion by contacting support.

15 Contact Us

For questions, concerns, or requests relating to this Privacy Policy or the personal data Sritoto holds about you, please contact us through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week via the support icon on the Platform — the fastest route for urgent data enquiries
• Email: [email protected] (please copy the address manually — this is plain text and not a clickable link)
• Response Commitment: Data rights requests are acknowledged within 5 business days and resolved within 30 calendar days. Complex requests may require an extension, for which Players will be notified.

For further information about our Terms of Service, please refer to our Terms & Conditions page. For information about our responsible gaming programme, visit our Responsible Gambling page.