Privacy Policy

This Privacy Policy is published by Kostoto ("we", "us", "our", "the Platform"), the operator of the online casino and sports betting platform accessible at https://kostoto.cam. It describes how Kostoto collects, uses, stores, shares, and protects the personal data of individuals ("you", "your", "the Player", "Data Subject") who access, register on, or use our platform and related services.

Kostoto is committed to protecting the personal data of all players, including those across Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and all other locations from which our services are accessed. We comply with applicable international data protection laws and regulatory requirements imposed by our gaming licensing authority.

By registering a Kostoto account, making a deposit, or otherwise using our platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any aspect of this Policy, please discontinue use of the platform and contact us to close your account.

For the purposes of this Privacy Policy, the following terms shall carry the meanings defined below:

• "Personal Data" means any information relating to an identified or identifiable natural person — directly or indirectly — including name, identification number, location data, online identifiers, or factors specific to the physical, economic, or social identity of that person.
• "Processing" means any operation performed on Personal Data, whether automated or manual, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" refers to Kostoto as the entity that determines the purposes and means of processing Personal Data collected through the platform.
• "Data Processor" refers to a third party that processes Personal Data on behalf of Kostoto under contract and subject to appropriate data protection obligations.
• "Sensitive Personal Data" means Personal Data revealing racial or ethnic origin, political opinions, religious beliefs, health data, biometric data, or financial account details that carry heightened privacy risk.
• "Consent" means a freely given, specific, informed, and unambiguous indication of the Data Subject's agreement to the processing of their Personal Data.

Kostoto collects Personal Data across several categories, depending on how you interact with the platform. The following table sets out the categories of data we collect and examples of the specific data points within each category:

We do not collect or store full payment card numbers. Where card payments are facilitated, card data is processed exclusively by PCI-DSS compliant payment processors. Kostoto does not have access to raw card data at any point in the transaction lifecycle.

Kostoto collects Personal Data through the following channels and mechanisms:

• Direct Provision: Data you voluntarily provide when creating an account, completing the KYC process, making transactions, contacting support, responding to surveys, or participating in promotions.
• Automated Technical Collection: Data collected automatically through cookies, web beacons, server logs, and similar tracking technologies when you access and navigate the Kostoto platform. This includes IP addresses, session data, and device fingerprinting signals used for fraud prevention.
• Payment Processors: Transaction confirmation data returned by Malaysian payment service providers including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and banking partners (Maybank, CIMB, Public Bank, RHB, Hong Leong Bank) following deposit or withdrawal processing.
• Identity Verification Partners: Confirmation signals and risk scores returned by third-party KYC and AML screening services where we engage such providers to verify your identity or screen against sanctions lists.
• Publicly Available Sources: In limited circumstances for AML and fraud screening purposes, we may reference information from official public registries or sanctions databases.

Kostoto processes your Personal Data for the following defined purposes. We do not use your data for any purpose beyond what is set out below without obtaining your prior consent or unless required by applicable law:

• Account Creation and Management: To register your account, verify your credentials, maintain your profile, and authenticate your identity when you log in.
• Identity Verification (KYC): To comply with know-your-customer obligations under our gaming licence conditions and applicable anti-money laundering regulations, and to confirm that you meet Kostoto's minimum age requirement of 21 years.
• Transaction Processing: To process your deposits and withdrawals through your chosen payment method (including Touch 'n Go eWallet, DuitNow, FPX, and major Malaysian bank transfers) in Malaysian Ringgit.
• Gaming Services Delivery: To provide you with access to casino games, live dealer tables, sports betting markets, and other platform features, and to record your gaming activity for account and bonus management purposes.
• Fraud Detection and AML Compliance: To identify, investigate, and prevent fraudulent activity, money laundering, and other financial crimes through transaction monitoring, behavioural analysis, and AML screening.
• Responsible Gambling Management: To implement and enforce deposit limits, session controls, cooling-off periods, and self-exclusion requests you have set, and to monitor gaming patterns for indicators of problem gambling.
• Customer Support: To respond to your queries, resolve account issues, and maintain records of communications for quality assurance and compliance purposes.
• Marketing Communications: Where you have opted in, to send you promotional offers, bonus notifications, sports event updates, and other marketing communications by email or SMS. You may opt out at any time through your Account settings or by contacting support.
• Platform Improvement: To analyse aggregated and anonymised usage data to improve platform performance, user experience, game selection, and security features.
• Legal and Regulatory Compliance: To comply with applicable laws, regulatory requirements, court orders, and reporting obligations imposed by our licensing authority.

Kostoto processes your Personal Data on the following legal bases, which govern each processing activity as set out below:

• Contractual Necessity: Processing required to perform the contract between you and Kostoto — including account management, transaction processing, gaming services delivery, and KYC verification — is conducted on the basis of contractual necessity. Without this processing, we cannot provide our services.
• Legal Obligation: Processing required to comply with applicable legal and regulatory obligations, including AML reporting, sanctions screening, age verification requirements, and data retention mandated by our licensing authority.
• Legitimate Interests: Processing conducted for Kostoto's legitimate business interests where those interests are not overridden by your rights and expectations, including fraud prevention, platform security, responsible gambling monitoring, and aggregated analytics for product improvement.
• Consent: Processing of your data for marketing communications and the use of non-essential cookies is carried out on the basis of your explicit, freely given consent, which you may withdraw at any time without affecting the lawfulness of prior processing.

Kostoto does not sell, rent, or trade your Personal Data to any third party for their own marketing or commercial purposes. We share your data only in the circumstances described below:

• Payment Service Providers: We share transaction-related data with your chosen payment provider (e.g., Touch 'n Go, Boost, GrabPay, Maybank, CIMB, Public Bank, RHB, Hong Leong, DuitNow, FPX) to the extent necessary to execute your deposits and withdrawals in MYR.
• KYC and AML Verification Partners: We share identity and document data with contracted third-party verification services to conduct KYC checks and screen against sanctions and politically exposed person (PEP) lists.
• Regulatory and Licensing Authorities: We disclose data to our gaming licensing authority and relevant regulatory bodies as required by our licence conditions, including periodic compliance reporting and investigation responses.
• Law Enforcement and Government Authorities: We may disclose your data to law enforcement agencies, courts, or other government bodies where we are legally compelled to do so, or where disclosure is necessary to prevent or investigate a serious crime or protect the rights and safety of others.
• Gaming Exclusion and Self-Exclusion Registries: Where required by our licensing authority, we may share necessary data with national or industry-wide self-exclusion programmes to enforce exclusion requests across participating operators.
• Professional Advisors: We may share data with legal counsel, auditors, and other professional advisors under obligations of confidentiality where necessary for business operations or dispute resolution.
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of Kostoto's assets, your Personal Data may be transferred to the acquiring entity subject to the same privacy protections described in this Policy.

All third parties with whom we share data are required to handle your Personal Data in accordance with applicable data protection laws and are bound by appropriate data processing agreements.

As Kostoto is an international platform operating under an overseas gaming licence, some of your Personal Data may be transferred to, stored in, or processed in jurisdictions outside of Malaysia. This may include the jurisdiction in which Kostoto holds its gaming licence and countries in which our Data Processors operate.

Where such international transfers occur, Kostoto ensures that adequate protections are in place, which may include:

• Standard contractual clauses approved by the relevant data protection authority;
• Binding corporate rules that impose equivalent data protection obligations on the recipient entity;
• A determination that the destination jurisdiction provides an adequate level of data protection.

You may request information about the specific safeguards applied to any international transfer of your Personal Data by contacting [email protected].

Kostoto retains your Personal Data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying any legal, regulatory, accounting, or reporting requirements. The following retention periods generally apply:

• Account and Identity Data: Retained for the duration of the Account relationship and for a minimum of five (5) years following account closure, in accordance with AML record-keeping requirements.
• Transaction and Financial Data: Retained for a minimum of five (5) years from the date of each transaction, as required under applicable AML and financial regulation.
• KYC Documentation: Retained for the duration of the Account relationship and for a minimum of five (5) years post-closure. Original document images are securely deleted once verification is complete and only verification records are retained.
• Gaming and Betting Records: Retained for five (5) years from the date of each gaming session or bet placement.
• Communications and Support Records: Retained for three (3) years from the date of the last communication, or longer where the communication relates to an unresolved dispute or regulatory inquiry.
• Marketing Data: Retained until you withdraw consent to receive marketing communications, at which point contact data is moved to a suppression list to ensure you are not re-contacted.
• Technical Logs: Retained for up to twelve (12) months for security and fraud investigation purposes, after which they are anonymised or deleted.

Kostoto uses cookies and similar tracking technologies (including web beacons and local storage) to operate the platform, improve user experience, and support security and fraud prevention functions. Cookies are small text files stored on your device when you visit the Kostoto website.

The categories of cookies we use are as follows:

• Strictly Necessary Cookies: Essential for the operation of the platform, including session authentication, account security, and fraud prevention. These cookies cannot be disabled without impairing your ability to use the platform.
• Functional Cookies: Enable enhanced platform functionality and personalisation, including remembering your language preferences, device settings, and responsible gambling configuration.
• Analytics Cookies: Collect aggregated and anonymised data about how players use the platform, which pages are visited most frequently, and where errors occur. This data is used to improve platform performance and usability. These cookies are only placed with your consent.
• Security and Fraud Prevention Cookies: Used by our fraud detection systems to identify and flag unusual access patterns, account takeover attempts, and suspicious transaction behaviour.

Non-essential cookies are only placed on your device following your explicit consent, which is requested via the cookie preference centre displayed when you first access the platform. You may review and update your cookie preferences at any time through your Account settings.

Please note that disabling functional or analytics cookies may affect the quality of your experience on the Kostoto platform but will not prevent you from accessing core gaming and betting services.

Subject to applicable law and certain exceptions, you hold the following rights in relation to your Personal Data held by Kostoto. These rights may be exercised by contacting us at [email protected] with a clear description of your request. Kostoto will respond within 30 calendar days of receipt.

The Kostoto platform is strictly prohibited for use by individuals under the age of 21. We do not knowingly collect Personal Data from any person under the age of 21, nor do we permit such persons to register an account or access our Gaming Services.

Kostoto employs age verification procedures as part of the account registration and KYC process to enforce this requirement. Where Kostoto becomes aware that Personal Data has been collected from an individual under the age of 21, it will immediately suspend the relevant Account, delete the data in question to the extent permitted by law, and report the matter to relevant authorities where required.

If you are a parent or guardian and believe that a minor in your care has registered a Kostoto account or submitted personal data to our platform, please contact us immediately at [email protected]. We will investigate and take appropriate action promptly.

Kostoto implements a comprehensive set of technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• Encryption in Transit: All data transmitted between your device and the Kostoto platform is encrypted using TLS 1.2 or higher (256-bit SSL), protecting your credentials, transaction data, and communications from interception.
• Encryption at Rest: Sensitive Personal Data stored in Kostoto's databases is encrypted at rest using industry-standard encryption algorithms.
• Access Controls: Access to Personal Data within Kostoto's internal systems is restricted on a need-to-know basis. Staff with access to player data are subject to confidentiality obligations and role-based access restrictions.
• Infrastructure Security: Kostoto's platform infrastructure is hosted in secure data centres with physical access controls, redundancy, and regular penetration testing conducted by independent security professionals.
• Fraud Detection Systems: Real-time transaction monitoring and behavioural analysis systems flag unusual activity for investigation by our compliance team.
• Incident Response: Kostoto maintains a documented data breach response procedure. In the event of a breach affecting your Personal Data, we will notify you and the relevant supervisory authority within the timeframes required by applicable law.

While Kostoto takes every reasonable precaution to protect your data, no internet-based platform can guarantee absolute security. You are also responsible for maintaining the confidentiality of your account credentials. We strongly recommend using a unique, strong password and enabling any available two-factor authentication features.

Kostoto reviews and updates this Privacy Policy periodically to reflect changes in our data processing practices, regulatory requirements, or the services we offer. The most current version of this Policy is always available at https://kostoto.cam/privacy-policy.

Where we make material changes to this Policy — meaning changes that meaningfully affect how we collect, use, or share your Personal Data — we will notify you by email to your registered address and through a prominent notification on the Kostoto platform, no less than 14 days before the changes take effect.

Your continued use of the Kostoto platform after the effective date of any updated Privacy Policy constitutes your acknowledgement of the changes. If you do not agree with any updated terms, you should discontinue use of the platform and contact us to close your account.

The version date at the top of this Policy ("Last Updated") reflects the date on which the most recent substantive changes were made. Minor corrections and clarifications that do not affect your rights may be made without separate notification.

If you have any questions about this Privacy Policy, wish to exercise any of your data protection rights, or have a concern about how Kostoto has handled your Personal Data, please contact our Data Protection team:

• Email: [email protected] — please include "Privacy Request" or "Data Protection" in the subject line so your enquiry is routed appropriately.
• Live Chat: Available 24/7 on the Kostoto platform for general privacy queries and opt-out requests.
• Response Time: We will acknowledge all privacy-related requests within 5 business days and provide a substantive response within 30 calendar days of receipt.

Where you remain dissatisfied with how Kostoto has responded to your privacy concern after following our internal process, you have the right to escalate your complaint to the relevant data protection supervisory authority in your jurisdiction. In Malaysia, data protection matters may also be directed to the relevant national consumer protection body.