Asupantoto Privacy Policy

Asupantoto ("Company", "Platform", "we", "us", "our") is committed to protecting the privacy and personal data of all individuals who access or use the Asupantoto online gaming platform at asupantoto.cam ("Platform"), including registered players, visitors, and prospective customers (collectively, "Users", "you").

This Privacy Policy ("Policy") describes in detail how Asupantoto collects, uses, stores, discloses, and otherwise processes personal data in connection with the operation of the Platform. It also outlines the rights available to you in relation to your personal data and how those rights may be exercised.

This Policy applies to all personal data processed by Asupantoto, whether collected directly through the Platform, through our customer support channels, via third-party payment processors such as Touch 'n Go eWallet, Boost, DuitNow, and FPX, or through our marketing and communication activities.

By registering an Account or otherwise using the Platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you must discontinue use of the Platform.

The following terms, when used in this Policy, shall have the meanings ascribed to them below:

Asupantoto acts as the Data Controller for all personal data collected through the Platform and its associated services. As Data Controller, Asupantoto is responsible for determining the purposes for which your personal data is processed and for ensuring that such processing is carried out lawfully, fairly, and transparently.

Where Asupantoto engages third-party service providers to process personal data on its behalf — for example, payment processing partners such as Maybank, CIMB, Public Bank, or Hong Leong Bank operating through the FPX network, or e-wallet processors facilitating Touch 'n Go eWallet or GrabPay transactions — those parties act as Data Processors and are contractually bound to process personal data only on Asupantoto's instructions, in accordance with applicable data protection requirements.

For queries regarding Asupantoto's role as Data Controller, or to exercise your data subject rights, please refer to Section 18 (Contact & DPO) of this Policy.

Asupantoto collects and processes the following categories of personal data, depending on the nature of your interaction with the Platform:

Asupantoto does not intentionally collect sensitive personal data (such as racial or ethnic origin, religious beliefs, health information, or biometric data) unless strictly necessary for compliance with applicable regulatory obligations and with your explicit consent.

Asupantoto processes your personal data on one or more of the following legal grounds, depending on the specific processing activity:

• Contractual Necessity: Processing is necessary for the performance of the Account agreement between you and Asupantoto — including account registration, deposit processing, withdrawal fulfilment, and the provision of gaming services;
• Legal Obligation: Processing is required to comply with applicable legal and regulatory requirements, including anti-money laundering (AML) obligations, KYC verification requirements under our international licence, and obligations arising from court orders or lawful authority requests;
• Legitimate Interests: Processing is necessary for Asupantoto's legitimate business interests, including fraud prevention, platform security, responsible gambling programme management, and analytics-driven platform improvement — provided such interests are not overridden by your rights and freedoms;
• Consent: For certain processing activities, such as direct marketing communications and the use of non-essential cookies, we rely on your explicit consent, which you may withdraw at any time without detriment to your Account status.

Asupantoto processes your personal data for the following specific purposes:

1. Account Creation and Management: To register, maintain, and administer your Account, including authentication, password reset, and tier status management under the VIP loyalty programme;
2. Service Delivery: To provide access to all gaming services on the Platform, process bets and wagers, deliver game outcomes, and facilitate participation in promotions;
3. Payment Processing: To execute deposit and withdrawal transactions via your selected payment method, including reconciliation of transactions and resolution of payment disputes;
4. Identity Verification and KYC: To verify your identity and age (21+ requirement) in accordance with our international licence obligations and AML compliance framework;
5. Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, money laundering, collusion, and other prohibited conduct on the Platform;
6. Responsible Gambling: To monitor your gambling behaviour patterns, apply deposit limits and self-exclusion measures where applicable, and comply with responsible gambling obligations;
7. Customer Support: To handle enquiries, complaints, disputes, and support requests received via live chat, email, WhatsApp, or WeChat;
8. Legal and Regulatory Compliance: To meet obligations imposed by our international licence, applicable AML regulations, and any lawful order from a court or governmental authority;
9. Platform Improvement and Analytics: To analyse usage patterns, performance metrics, and game preferences in aggregate to improve the Platform's features, stability, and user experience;
10. Marketing Communications: Where you have provided consent, to send you promotional offers, bonus notifications, and event announcements relevant to your interests and play history.

Asupantoto does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. Personal data may be disclosed to the following categories of recipients only where strictly necessary and under appropriate safeguards:

• Payment Service Providers: Processors facilitating MYR transactions, including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX gateway operators, and banking partners including Maybank, CIMB, Public Bank, and Hong Leong Bank, solely for the purpose of processing your transactions;
• KYC and Identity Verification Providers: Third-party services engaged to verify identity documents and cross-reference against applicable watchlists in fulfilment of AML and licence compliance obligations;
• Fraud Detection and Security Providers: Specialist services that assist in real-time transaction monitoring, device fingerprinting, and pattern-based fraud detection;
• Licensing and Regulatory Authorities: Governing bodies under whose international licence Asupantoto operates, where disclosure is required for regulatory reporting, audits, or investigations;
• Legal and Law Enforcement Authorities: Courts, law enforcement agencies, or government bodies where disclosure is required by a lawful court order, legal process, or applicable regulation;
• Corporate Successors: In the event of a merger, acquisition, or transfer of business assets, personal data may be transferred to the acquiring entity under equivalent data protection safeguards, with prior notification to affected users where practicable.

Given the international nature of Asupantoto's operations and the global technology infrastructure upon which the Platform relies, your personal data may be transferred to, stored in, and processed in jurisdictions outside of Malaysia. This may include jurisdictions in Southeast Asia, Eastern Europe, or other regions where Asupantoto's technology partners or service providers maintain infrastructure.

Where personal data is transferred internationally, Asupantoto ensures that appropriate safeguards are in place, including:

• Contractual data processing agreements incorporating standard data protection clauses with all international recipients;
• Transfer to jurisdictions that maintain adequate data protection standards as assessed under applicable frameworks;
• Technical and organisational security measures commensurate with the sensitivity of the data transferred.

If you would like further information about the specific safeguards applied to any international transfer of your personal data, please contact us at the details provided in Section 18.

Asupantoto retains personal data only for as long as necessary to fulfil the purposes for which it was collected, subject to the following minimum retention standards:

• Account and Transaction Records: Retained for the full duration of Account activity and for a minimum of five (5) years following permanent Account closure, in accordance with AML and international licensing compliance obligations;
• KYC Documentation: Retained for a minimum of five (5) years from the date of verification or Account closure, whichever is later, in accordance with regulatory requirements;
• Customer Support Records: Retained for three (3) years from the date of the relevant interaction, to support dispute resolution and quality assurance;
• Marketing Preference Data: Retained until you withdraw consent or until your Account is permanently closed, whichever occurs first;
• Technical and Device Data: Retained for up to twenty-four (24) months for fraud prevention and platform performance monitoring purposes.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in accordance with Asupantoto's data disposal procedures. Where anonymisation is applied, the resulting data no longer constitutes personal data and may be retained indefinitely for analytical purposes.

Asupantoto uses cookies and similar tracking technologies on the Platform to deliver a functional, personalised, and secure user experience. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for the Platform to function correctly, including session management, login authentication, and security features. These cookies cannot be disabled without rendering the Platform unusable;
• Functional Cookies: Store your preferences such as language selection, preferred display settings, and promotional pop-up dismissal status to enhance your experience across sessions;
• Analytics Cookies: Collect anonymised usage data, including pages visited, time on site, game categories browsed, and click-through behaviour, to help us understand how the Platform is used and where improvements are needed;
• Fraud Prevention Cookies: Used to identify and block suspicious access patterns, bot traffic, and device fingerprinting anomalies in real time.

Asupantoto does not use third-party advertising or behavioural tracking cookies for external retargeting purposes. You may manage your cookie preferences through your browser settings. Blocking strictly necessary cookies will impair Platform functionality and may prevent Account access. For other cookie categories, your preferences may be updated via the cookie consent tool displayed on your first visit to the Platform.

The processing of payment data and KYC documentation is subject to heightened security standards given the sensitivity of financial information. Asupantoto does not store complete card numbers or full bank account credentials on its own systems; payment data is handled by PCI-DSS compliant payment processing partners.

When you process a deposit via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, or FPX bank transfer, your payment credentials are transmitted directly to and processed by the relevant payment service provider. Asupantoto receives only a transaction confirmation and a reference identifier for reconciliation purposes.

KYC documentation submitted for identity verification is transmitted via encrypted channels to our verification infrastructure and, where applicable, to authorised third-party KYC service providers. Documents are not used for any purpose other than identity and age verification and are not made accessible to unauthorised personnel.

Where you have explicitly consented to receive marketing communications from Asupantoto, we may contact you by email, WhatsApp, or in-Platform notification with information about promotions, bonuses, new games, and events that may be of interest to you. Marketing messages may reference upcoming EPL fixtures, Liga Super Malaysia matches, seasonal promotions, or festival-themed campaigns relevant to Malaysian players.

You may withdraw your consent to marketing communications at any time by:

• Updating your communication preferences in your Account settings;
• Clicking the unsubscribe link included in any marketing email;
• Contacting our customer support team via live chat or email with a request to be removed from marketing lists.

Withdrawal of marketing consent does not affect your ability to continue using the Platform or to receive transactional communications necessary for Account operation (such as deposit confirmations, withdrawal notifications, and security alerts).

Asupantoto does not share your personal data with third-party marketers or data brokers for their own promotional purposes.

Subject to applicable law and regulatory constraints, you have the following rights in relation to your personal data held by Asupantoto:

To exercise any of these rights, please submit a written request to our Data Protection contact as detailed in Section 18. We will acknowledge your request within five (5) business days and respond in full within thirty (30) calendar days, or such longer period as may be permitted by applicable law. We may require proof of identity before processing a data subject request.

Please note that certain rights may be subject to limitations where processing is required for compliance with a legal obligation, for the establishment, exercise, or defence of legal claims, or where your request conflicts with our AML or licensing obligations.

Asupantoto implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, disclosure, alteration, and destruction. These measures include, but are not limited to:

• End-to-end encryption of all data in transit using TLS 1.2 or higher;
• Encryption of sensitive data at rest using AES-256 or equivalent standards;
• Role-based access controls ensuring that personal data is accessible only to authorised personnel with a documented operational need;
• Multi-factor authentication requirements for all administrative access to systems containing personal data;
• Regular third-party penetration testing and vulnerability assessments;
• Real-time intrusion detection and security information and event management (SIEM) monitoring;
• Documented incident response and data breach notification procedures.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, Asupantoto will notify you without undue delay and in accordance with applicable notification requirements, providing details of the nature of the breach, the data affected, and the steps taken or proposed to address it.

While Asupantoto takes all reasonable steps to secure your personal data, no transmission over the internet or electronic storage system is entirely free from security risk. You are encouraged to protect your Account by using a strong, unique password and enabling two-factor authentication.

The Asupantoto Platform is intended exclusively for adults aged 21 years and above. Asupantoto does not knowingly collect personal data from individuals under the age of 21. Registration is strictly prohibited for minors, and all accounts are subject to age verification through the KYC process.

If Asupantoto becomes aware that personal data has been collected from an individual under the age of 21 without verifiable parental consent, that data will be deleted promptly and the associated Account will be closed. If you are a parent or guardian and have reason to believe that your child has registered on the Platform, please contact us immediately via the details in Section 18. 21+ Only

The Platform may, from time to time, reference third-party services or payment providers (such as links to e-wallet top-up portals or banking interfaces). This Policy applies solely to data processed by Asupantoto. Once you navigate to a third-party website or application — including payment gateways operated by Touch 'n Go, Boost, GrabPay, or banking portals of Maybank, CIMB, Public Bank, or Hong Leong — you are subject to that party's own privacy policy and data practices.

Asupantoto accepts no responsibility for the privacy practices of third-party websites or services. You are encouraged to review the applicable privacy policies before submitting personal data to any third-party platform.

Asupantoto reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, our data processing practices, or Platform functionality. The effective date of the current version is displayed at the top of this Policy.

Where material changes are made to this Policy — particularly changes that expand the categories of data collected, alter the purposes of processing, or affect your rights as a data subject — Asupantoto will provide advance notice via email or a prominent Platform notification at least fourteen (14) days before the changes take effect.

Your continued use of the Platform following the effective date of any revised Policy constitutes acceptance of the updated terms. If you do not agree with any amendment, you may exercise your right to close your Account as described in our Terms and Conditions and request deletion of your personal data pursuant to Section 13 above.

The current version of this Policy is always accessible at asupantoto.cam/privacy-policy. We recommend reviewing this Policy periodically to remain informed of how your personal data is managed.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by Asupantoto, please contact our Data Protection team through the following channels:

When submitting a data subject request, please include your registered email address, Account username, and a clear description of the data and right you wish to exercise. We may request a copy of a government-issued identity document to verify your identity before processing the request.