sdtoto is committed to protecting the personal data of every player on our platform. This Privacy Policy explains exactly what information we collect, why we collect it, how we use it, and the rights you hold over your own data.
Six core privacy commitments that define how sdtoto handles your personal information. The full legal detail is in the sections below.
Every byte of data transmitted between your device and sdtoto servers is protected by bank-grade 256-bit SSL/TLS encryption. Your login credentials, payment details, and personal information are never transmitted in plain text.
sdtoto does not sell, rent, or trade your personal information to third-party marketers or data brokers under any circumstances. Your data is used solely to operate your account, process payments, and improve your experience on the platform.
You have the right to access, correct, port, restrict, and request deletion of your personal data at any time. Submit a data request to our support team and we will action it within 30 days in accordance with applicable data protection standards.
Player data is stored on dedicated, access-controlled servers with role-based permissions. Only authorised personnel with a legitimate operational need can access identifiable player records, and all access is logged and audited.
We use cookies only for essential platform functionality, session management, fraud prevention, and anonymised analytics. We do not use third-party advertising cookies. You can manage cookie preferences from your browser settings at any time.
We do not hold your data indefinitely. Retention periods are defined by regulatory requirements (KYC and AML obligations typically require 5–7 years post-account closure) and are clearly outlined in Section 9 of this Policy.
This Privacy Policy (hereinafter "the Policy") describes the manner in which sdtoto (hereinafter "the Company", "we", "us", or "our"), the operator of the online gaming and sports betting platform accessible at https://sdtoto.lat (the "Platform"), collects, uses, processes, stores, shares, and protects the personal data of individuals who access or use the Platform (hereinafter "you", "your", or "the Player").
sdtoto is committed to handling personal data responsibly, transparently, and in compliance with applicable international data protection standards. This Policy forms an integral part of the sdtoto Terms & Conditions and is incorporated by reference therein. By registering an account on the Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.
This Policy applies to all personal data collected through the Platform, our mobile interfaces, live chat support interactions, email correspondence, and any other channel through which you communicate with sdtoto. It does not apply to third-party websites or services that may be linked to or from the Platform.
Scope: This Policy applies to all players on the sdtoto Platform, including those accessing the service from Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and all other locations in Malaysia and internationally. The English-language version of this Policy is the authoritative version in all cases.
For the purposes of this Privacy Policy, the following terms shall have the meanings assigned below:
| Term | Meaning |
|---|---|
| "Personal Data" | Any information relating to an identified or identifiable natural person, including names, identification numbers, location data, online identifiers, or factors specific to the physical, economic, or social identity of that person. |
| "Processing" | Any operation performed on personal data, whether by automated or manual means, including collection, recording, storage, adaptation, retrieval, disclosure, erasure, or destruction. |
| "Data Controller" | sdtoto, as the entity that determines the purposes and means of processing personal data collected through the Platform. |
| "Data Processor" | A third party that processes personal data on behalf of sdtoto under a binding contractual agreement (e.g., payment processors, KYC verification providers, cloud hosting providers). |
| "Consent" | A freely given, specific, informed, and unambiguous indication of the data subject's agreement to the processing of their personal data for a stated purpose. |
| "KYC" | Know Your Customer — the identity verification process used to confirm a player's identity in compliance with anti-money-laundering (AML) regulatory requirements. |
| "Cookie" | A small text file placed on a user's device by the Platform for the purposes of session management, functionality, and analytics. |
sdtoto collects personal data across several categories, depending on the nature of your interaction with the Platform. The categories of data we may collect are set out below:
Payment Security: sdtoto does not store full card numbers or CVV codes on our servers. Payment card data is handled exclusively by PCI-DSS-compliant payment processing partners.
sdtoto collects personal data through the following primary channels:
sdtoto processes your personal data for the following specific purposes. Where processing is not strictly necessary for the operation of your account, we will seek your explicit consent before proceeding.
| Purpose | Data Used | Necessity |
|---|---|---|
| Account registration and management | Identity, contact, account data | Contractual necessity |
| KYC identity verification | Identity documents, financial data | Legal obligation (AML compliance) |
| Processing deposits and withdrawals | Financial and payment data | Contractual necessity |
| Fraud prevention and security monitoring | Technical data, gameplay logs, payment data | Legitimate interest |
| Responsible gambling monitoring | Gameplay data, account settings | Legal obligation / legitimate interest |
| Customer support provision | Communications data, account data | Contractual necessity |
| Platform analytics and improvement | Anonymised technical and gameplay data | Legitimate interest |
| Personalised promotional communications | Identity, contact, gameplay preferences | Consent (opt-in required) |
| Regulatory reporting and record-keeping | Identity, financial, account data | Legal obligation |
sdtoto processes personal data on one or more of the following lawful bases, depending on the specific processing activity in question:
sdtoto does not sell your personal data. We may share your data with carefully selected third parties only in the following circumstances and only to the extent necessary for the stated purpose:
We engage third-party service providers to assist in operating the Platform. These include payment processors (handling transactions via FPX, DuitNow, Touch 'n Go eWallet, and bank transfers), KYC verification providers, cloud infrastructure providers, live chat and customer support software providers, and fraud detection services. All such providers are bound by contractual data processing agreements that restrict their use of your data to the specific services they provide for sdtoto.
When you play games on the Platform, certain anonymised session data (such as bet amounts and game outcomes) may be transmitted to the relevant game provider's servers for the purposes of game execution and RNG certification compliance. No identifiable personal data beyond a pseudonymous player identifier is shared with game providers.
sdtoto may disclose personal data to regulatory bodies, law enforcement agencies, or other competent authorities where required by law, court order, or regulatory directive. We will disclose the minimum amount of data necessary to satisfy the legal requirement and will inform you of such disclosures where legally permitted to do so.
In the event of a merger, acquisition, restructuring, or sale of all or part of the Company's assets, your personal data may be transferred to the successor entity as part of that transaction. You will be notified of any such transfer and the Privacy Policy of the successor entity will be made available to you.
Our Commitment: sdtoto will never sell, rent, or disclose your personal data to third-party advertising networks, data brokers, or marketing aggregators. Your data is used exclusively to operate, secure, and improve your experience on the Platform.
sdtoto uses cookies and similar tracking technologies (such as local storage and session tokens) to provide and improve the Platform. The types of cookies we use are as follows:
| Cookie Type | Purpose | Duration |
|---|---|---|
| Essential / Session | Required for platform login, session maintenance, and secure navigation. Cannot be disabled without breaking core functionality. | Session / 24 hours |
| Functional | Remembers your preferences (language, display settings) and improves usability on return visits. | Up to 1 year |
| Security / Fraud Prevention | Used to detect and prevent fraudulent logins, bot activity, and account takeover attempts. | Up to 90 days |
| Analytics (Anonymised) | Collects anonymised data on how players use the Platform to help us identify performance issues and improve features. No individually identifiable data is collected. | Up to 13 months |
sdtoto does not use third-party advertising cookies or cross-site tracking technologies. You may manage or disable non-essential cookies through your browser settings at any time. Note that disabling essential cookies will impair the functionality of the Platform and may prevent login.
sdtoto retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply:
Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that makes re-identification impossible.
sdtoto implements comprehensive technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security infrastructure includes:
While we implement all reasonable security measures, no system is entirely immune from risk. You are responsible for maintaining the security of your own account credentials and for notifying us immediately if you suspect unauthorised access.
Subject to applicable law, you hold the following rights in relation to the personal data that sdtoto processes about you. To exercise any of these rights, contact our Data Privacy team at [email protected] with "Data Rights Request" in the subject line. We will respond within 30 calendar days.
Request a copy of all personal data we hold about you (a Subject Access Request).
Request correction of inaccurate or incomplete personal data we hold about you.
Request deletion of your personal data where processing is no longer necessary or lawful, subject to our legal retention obligations.
Request that we limit processing of your data in certain circumstances (e.g., while accuracy is contested).
Receive your personal data in a structured, commonly used, machine-readable format for transfer to another provider.
Object to processing carried out on the basis of legitimate interests, including direct marketing and profiling.
Identity Verification: For security purposes, we may ask you to verify your identity before actioning a data rights request. This is to prevent unauthorised access to another individual's data. We will not charge a fee for standard requests unless they are manifestly unfounded or excessive.
In the course of operating the Platform, certain personal data may be transferred to and processed by service providers located outside Malaysia. Such transfers are necessary for the operation of cloud infrastructure, KYC verification services, payment processing, and game content delivery networks.
When transferring personal data internationally, sdtoto takes all reasonable steps to ensure that appropriate safeguards are in place to protect the data to a standard equivalent to that required under applicable data protection law. These safeguards may include contractual clauses in agreements with Data Processors, adequacy assessments of the receiving jurisdiction, and technical security measures applied to data in transit.
By using the Platform and accepting this Privacy Policy, you acknowledge and consent to the international transfer of your personal data in accordance with the safeguards described above.
The sdtoto Platform is strictly for use by individuals aged 21 years and over. We do not knowingly collect personal data from individuals under the age of 21. All account registrations are subject to age verification, and KYC procedures include confirmation of date of birth against official identity documents.
If we become aware that personal data has been collected from an individual who is under 21 years of age, we will take immediate steps to close the account, delete all associated personal data, and refund any deposits made to the original payment method in accordance with our Terms & Conditions.
If you are a parent or guardian and believe that your child may have registered an account on sdtoto, please contact our support team immediately at [email protected] so that we can investigate and take the appropriate action without delay.
sdtoto reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or regulatory requirements. The current version of this Policy, including the effective date, will always be accessible at https://sdtoto.lat/privacy-policy.
Where amendments are material — meaning they significantly affect how we use your data or reduce your rights in any way — we will provide advance notice via the email address registered to your account or via an in-platform notification, no less than fourteen (14) days prior to the effective date of the change.
Your continued use of the Platform after the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. If you do not agree with the revised Policy, you should cease using the Platform and contact us to close your account.
If you have any questions, concerns, or requests relating to this Privacy Policy or the manner in which sdtoto processes your personal data, please contact our Data Privacy team through the following channels:
We aim to acknowledge all privacy-related enquiries within two (2) working days and to provide a substantive response within thirty (30) calendar days. Complex data rights requests may take longer, in which case we will notify you of the extended timeline.
Response Commitment: Every privacy enquiry submitted to sdtoto is reviewed by a member of our operations team — not an automated system. We treat data rights requests with the seriousness they deserve and aim to resolve all matters fairly, promptly, and transparently.
You now know exactly how sdtoto handles your personal data. We built our privacy practices around one principle: your information is yours. Play live dealer tables, bet on EPL and Liga Super Malaysia, and deposit in MYR — all with the assurance that your data is in safe hands.
For players aged 21 and above only. Please gamble responsibly.