Privacy Policy

This Privacy Policy ("Policy") is issued by Semitoto ("we", "us", "our", "the Company"), the operator of the online gaming platform accessible at semitoto.cam ("Platform", "Site", "Service"). This Policy governs how Semitoto collects, processes, stores, discloses, and protects the personal data of all registered members, visitors, and users ("you", "User", "Data Subject") of the Platform.

We are committed to handling your personal information responsibly and in accordance with applicable data protection laws and internationally recognised privacy standards. This Policy applies to all personal data collected through the Semitoto platform, including data submitted during registration, KYC verification, financial transactions, customer support interactions, and general use of our online services.

This Policy should be read together with Semitoto's Terms & Conditions and our Responsible Gambling Policy, which are incorporated by reference into this document.

For the purposes of this Policy, the following terms carry the meanings defined below:

• "Personal Data" means any information that identifies or can reasonably be used to identify a natural person, directly or indirectly — including name, identification number, contact details, IP address, and payment information.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, alteration, or deletion.
• "Data Controller" means Semitoto, which determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Processor" means any third party engaged by Semitoto to process Personal Data on our behalf, such as payment processors and KYC verification providers.
• "Consent" means any freely given, specific, informed, and unambiguous indication of agreement by which a Data Subject signifies their acceptance of Personal Data processing.
• "Cookie" means a small data file stored on your device by a web browser, used to remember preferences and track usage patterns on the Platform.
• "KYC" means Know Your Customer — the identity verification process required prior to the processing of withdrawal requests.

Semitoto collects only the data necessary to provide, operate, and improve the Platform. The categories of personal data we may collect are set out in the table below:

We do not collect or process special categories of sensitive personal data (such as medical records, political opinions, or biometric data) unless explicitly required by applicable law or with your express written consent.

Semitoto collects personal data through the following means:

4.1 Direct Collection

• Registration forms completed when you create a Semitoto Account.
• KYC document uploads submitted via the member portal to verify your identity and address.
• Payment information submitted when making deposits or requesting withdrawals via FPX, DuitNow, Maybank, CIMB, Public Bank, Hong Leong, or other supported methods.
• Communications you initiate with our customer support team via live chat or email.

4.2 Automated Collection

• Cookies, web beacons, and similar tracking technologies that record your interactions with the Platform.
• Server logs that capture IP addresses, access timestamps, and browser metadata for security and fraud monitoring purposes.
• In-platform analytics tools that record gameplay activity, session duration, and betting patterns.

4.3 Third-Party Sources

We may receive personal data from third-party identity verification providers, payment processors, and fraud prevention services engaged to support our KYC and AML obligations. All such third parties are contractually bound to handle data in accordance with applicable privacy standards.

Semitoto processes your personal data only for clearly defined, legitimate purposes. We do not use your data for any purpose beyond those listed below without obtaining your explicit prior consent:

• Account Management: Creating and maintaining your Semitoto Account, processing logins, managing preferences, and providing access to the Platform's services.
• Identity Verification (KYC): Confirming your identity, age (21+), and address to comply with anti-money laundering regulations and responsible gambling obligations.
• Payment Processing: Facilitating MYR deposits and withdrawals via supported Malaysian payment methods including FPX, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, and direct bank transfers.
• Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent activity, money laundering, collusion, and unauthorised account access.
• Responsible Gambling: Monitoring gameplay patterns to identify potential problem gambling behaviour and, where appropriate, making proactive contact or applying protective measures.
• Customer Support: Responding to enquiries, resolving disputes, and maintaining support records for quality assurance and regulatory compliance.
• Regulatory Compliance: Meeting legal obligations imposed by our gaming licence, tax authorities, and applicable financial regulations.
• Service Improvement: Analysing aggregated usage data to improve Platform features, game offerings, and overall user experience for Malaysian players.
• Marketing Communications (Optional): Sending promotional offers and Platform updates to members who have explicitly opted in to receive such communications. You may unsubscribe at any time.

Semitoto processes personal data only where a valid legal basis exists. The applicable legal bases for our processing activities are as follows:

• Contractual Necessity: Processing required to perform our obligations under the Terms & Conditions you agreed to upon registration — including Account creation, game access, and payment processing.
• Legal Obligation: Processing necessary to comply with applicable laws and regulatory requirements, including KYC, AML obligations, and gaming licence conditions.
• Legitimate Interests: Processing for purposes of fraud prevention, platform security, and service improvement, where such interests are not overridden by your fundamental privacy rights.
• Consent: Processing for optional purposes such as direct marketing communications, where you have given clear and informed consent. You may withdraw consent at any time without affecting prior processing.

Semitoto does not sell your personal data to third parties under any circumstances. We may share personal data with the following categories of recipients only where necessary and proportionate:

• Payment Processors: Banks and e-wallet providers (Maybank, CIMB, Public Bank, Hong Leong, FPX network operators, Touch 'n Go, Boost, GrabPay, DuitNow) to facilitate MYR transactions. These entities process financial data under their own privacy frameworks and are subject to Malaysian financial regulations.
• Identity Verification Partners: Third-party KYC and AML compliance service providers engaged to verify identity documents and screen users against regulatory watchlists.
• Technology Infrastructure Providers: Cloud hosting and server management providers who process data on our behalf under strict data processing agreements.
• Regulatory Authorities: Competent regulatory bodies, law enforcement agencies, and gaming licence authorities where disclosure is required by law or court order.
• Fraud Prevention Services: Third-party anti-fraud and cybersecurity platforms used to monitor for suspicious activity and protect Platform integrity.

Semitoto retains personal data for no longer than is necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligations. The following general retention periods apply:

• Active Accounts: Personal data is retained for the full duration of your Account's active status and for a minimum of five (5) years following Account closure, to comply with AML record-keeping requirements.
• Transaction Records: Financial transaction data including deposit and withdrawal records are retained for a minimum of seven (7) years from the date of the transaction.
• KYC Documents: Identity and address verification documents are retained for a minimum of five (5) years following the end of the business relationship.
• Support Records: Customer support communications are retained for three (3) years for quality assurance and dispute resolution purposes.
• Marketing Consent Records: Records of opt-in consent for marketing communications are retained for the duration of the subscription plus two (2) years.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our internal data disposal procedures.

Semitoto uses cookies and similar tracking technologies to enhance your experience on the Platform, maintain session security, and gather analytics data. The types of cookies we use include:

• Essential Cookies: Strictly necessary for the Platform to function. These enable core features such as login sessions, game state management, and security token validation. These cookies cannot be disabled without impairing Platform functionality.
• Performance & Analytics Cookies: Collect anonymised data about how users interact with the Platform, including pages visited and error events, to help us improve overall performance.
• Functional Cookies: Remember your preferences such as language settings, game filter selections, and display configurations to personalise your experience.
• Security Cookies: Used to detect and prevent fraudulent activity, bot traffic, and repeated failed login attempts.

You may manage cookie preferences through your browser settings. Please note that disabling non-essential cookies may affect certain Platform features. Continued use of the Semitoto platform following the display of our cookie notice constitutes acceptance of our use of cookies as described in this Policy.

Semitoto implements robust technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security framework includes the following controls:

• 256-bit SSL/TLS encryption for all data in transit between your device and our servers.
• AES-256 encryption for sensitive data stored in our databases, including identity documents and financial records.
• Multi-factor authentication options available for member Account access.
• Regular penetration testing and independent third-party security audits of Platform infrastructure.
• Role-based access controls limiting employee access to personal data on a strict need-to-know basis.
• Continuous monitoring of Platform systems for suspicious activity, intrusion attempts, and anomalous data access patterns.

As a Data Subject, you have the following rights in relation to your personal data held by Semitoto. These rights are subject to applicable legal limitations and may be exercised by contacting our support team at [email protected]:

• Right of Access: You have the right to request a copy of the personal data we hold about you, along with information about how it is being processed.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data we hold about you.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes it was collected, subject to overriding legal retention obligations.
• Right to Restrict Processing: You may request that we limit processing of your data in certain circumstances, such as while a dispute regarding data accuracy is resolved.
• Right to Data Portability: Where technically feasible, you may request a copy of your personal data in a structured, machine-readable format for transfer to another service provider.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
• Right to Object: You may object to processing of your personal data for direct marketing purposes at any time without giving reasons, and we will stop such processing immediately.

We will respond to all verified Data Subject requests within 30 calendar days. Complex requests may require an extension of up to a further 60 days, in which case we will notify you of the extension and reasons within the initial 30-day period.

The Semitoto platform is strictly for adults aged 21 years and above. We do not knowingly collect or process personal data from any person under the age of 21. Age verification is a mandatory component of our KYC process, and any Account discovered to belong to a person under this minimum age will be immediately suspended and all data deleted or returned to the appropriate party in accordance with applicable law.

If you believe that a minor has registered on the Semitoto platform, or that we have inadvertently collected personal data from a person under 21, please contact us immediately at [email protected] so that we can take appropriate action.

The Semitoto platform may contain references to third-party payment providers and service operators whose privacy practices are governed by their own respective policies. Semitoto does not control and is not responsible for the privacy practices of any third-party services.

We recommend that you review the privacy policies of any third-party services you interact with in connection with your use of the Platform, including but not limited to your bank, e-wallet provider, or payment processor, to understand how they handle your personal data.

Semitoto reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or our data processing practices. The "Last Updated" date at the top of this page will be revised accordingly.

Where amendments are material — meaning they significantly affect how we use your personal data or your rights as a Data Subject — we will notify registered Users by email or via a prominent in-Platform notification prior to the changes taking effect. Your continued use of the Platform following such notification constitutes your acceptance of the revised Policy.

We encourage you to review this Privacy Policy periodically to remain informed about how Semitoto protects your personal information.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by Semitoto, please contact our Data Protection team using the details below. We are committed to responding to all privacy-related enquiries promptly and transparently.

For formal Data Subject Access Requests (DSARs), please include your registered email address, Account username, and a clear description of your request to help us process it efficiently. Identity verification may be required before certain requests can be fulfilled.