Your Privacy Is Our Commitment

This Privacy Policy ("Policy") describes how CastleToto ("we", "us", "our", "the Platform") collects, processes, stores, shares, and protects the personal data of individuals ("Users", "you") who access or use the CastleToto website at castletoto.cam and all associated gaming services.

CastleToto is committed to handling personal data responsibly and in accordance with applicable international data protection standards. Our platform operates under an international gaming licence (Curaçao jurisdiction), and our data practices are aligned with the standards required by that licensing framework as well as broadly recognised data protection principles.

By creating an Account, using our Services, or continuing to browse the Platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, please discontinue use of the Platform and contact our support team to arrange Account closure.

The following definitions apply throughout this Privacy Policy:

• "Personal Data" means any information relating to an identified or identifiable natural person, including name, email address, date of birth, identification number, payment details, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" means CastleToto, the entity that determines the purposes and means of Processing Personal Data.
• "Data Processor" means a third party that processes Personal Data on behalf of CastleToto, such as a payment processor, KYC provider, or cloud hosting service.
• "Consent" means a freely given, specific, informed, and unambiguous indication of the User's agreement to the Processing of their Personal Data for a stated purpose.
• "KYC Data" means identity verification documents and related information collected as part of the Know Your Customer process, including government-issued ID, proof of address, and selfie images.
• "Cookies" means small text files placed on your device by the Platform to collect browsing and preference data.
• "Account" means a registered user account on the CastleToto platform.

CastleToto collects the following categories of Personal Data, depending on your level of interaction with the Platform:

3.1 Registration & Account Data

• Full legal name as stated on your government-issued identification
• Date of birth
• Email address
• Residential address (including city — Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, etc.)
• Mobile phone number (optional, for 2FA and account security)
• Username and encrypted password

3.2 KYC Verification Data

• Copy of valid government-issued photo identification (MyKad, Passport, or Driver's Licence)
• Proof of residential address (utility bill or bank statement dated within 3 months)
• Selfie photograph holding identification document
• Source of funds documentation (requested where AML thresholds are triggered)

3.3 Financial & Transaction Data

• Payment method details (e-wallet IDs for Touch 'n Go eWallet, Boost, GrabPay; bank account details for Maybank, CIMB, Public Bank, Hong Leong via DuitNow/FPX)
• Deposit and withdrawal history
• Transaction amounts in MYR
• Bonus and promotion redemption history

3.4 Gaming Activity Data

• Game play history, bet amounts, and outcomes
• Sports betting selections (including markets on EPL, Liga Super Malaysia, UFC, and other covered events)
• Session duration and login timestamps
• Responsible gambling tool settings (deposit limits, loss limits, self-exclusion status)

3.5 Technical & Device Data

• IP address and approximate geographic location
• Browser type, version, and language settings
• Device type, operating system, and screen resolution
• Cookie identifiers and session tokens
• Referral source (how you arrived at the Platform)

3.6 Communications Data

• Live chat transcripts and support email correspondence
• Survey responses and feedback submissions
• Records of consent to marketing communications (where applicable)

CastleToto collects Personal Data through the following channels and mechanisms:

• Directly from you: When you complete Account registration, submit KYC documents, make a deposit or withdrawal, contact support, or respond to a survey.
• Automatically via the Platform: Technical and device data is collected automatically when you visit or interact with the Platform, including via cookies and server log files.
• From third-party KYC providers: Where we engage a third-party identity verification service to validate your documentation, that provider may supply verification results and risk scores to CastleToto.
• From payment processors: Transaction confirmation data and payment method details are received from Malaysian payment partners including DuitNow, FPX, and integrated e-wallet operators.
• From fraud prevention and AML services: We may receive risk signals or watchlist match results from third-party compliance services used to screen for money laundering or fraud indicators.

The following table summarises the primary purposes for which CastleToto processes Personal Data:

CastleToto processes your Personal Data on the following legal bases:

• Contractual Necessity: Processing required to perform the agreement between you and CastleToto — including account management, game access, and financial transactions — is carried out on the basis that it is necessary to fulfil the contract you entered into when registering your Account.
• Legal Obligation: CastleToto is required by its international licence conditions and applicable AML regulations to collect and retain certain Personal Data, including KYC documentation and transaction records. This processing is mandatory and cannot be refused without affecting your ability to use the Platform.
• Legitimate Interests: CastleToto processes certain data to protect the security and integrity of the Platform, to prevent fraud and cheating, to enforce our Terms & Conditions, and to improve our services. We have assessed that our legitimate interests are not overridden by your rights and freedoms in these cases.
• Consent: Where we send marketing communications or use non-essential cookies, we do so only with your explicit opt-in consent. You may withdraw consent at any time by updating your communication preferences in Account Settings or by contacting our support team.

CastleToto does not sell, rent, or trade your Personal Data to third parties for commercial purposes. We may, however, share your Personal Data with the following categories of recipients where it is necessary to operate the Platform or comply with our legal obligations:

7.1 Payment Service Providers

We share necessary financial and identity data with Malaysian payment partners — including operators of DuitNow, FPX, Touch 'n Go eWallet, Boost, and GrabPay — to facilitate deposit and withdrawal transactions. These providers act as Data Processors under contract with CastleToto and are bound by data protection obligations.

7.2 KYC and Identity Verification Providers

CastleToto may engage third-party KYC and identity verification services to validate the documents you submit. These providers process KYC Data strictly on our instructions and for no other purpose.

7.3 Fraud Prevention and AML Compliance Services

Personal Data may be shared with fraud detection and anti-money laundering screening services as part of our compliance obligations. This includes submission of data to relevant watchlists or sanctions screening databases where required.

7.4 Game Studios and Technology Providers

Where necessary for game delivery, limited technical data (such as session tokens and account identifiers) may be shared with licensed game studios and technology platform providers. These parties do not receive your full Personal Data profile.

7.5 Regulatory Authorities and Law Enforcement

CastleToto will disclose Personal Data to competent regulatory authorities, law enforcement agencies, or courts of law where required to do so by a valid legal obligation, court order, or regulatory direction. We will notify you of such disclosures where legally permitted to do so.

CastleToto uses cookies and similar tracking technologies to operate the Platform, personalise your experience, maintain session security, and analyse usage patterns. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication tokens, security cookies, and cookies that remember your login state. These cannot be disabled without impacting Platform functionality.
• Functional Cookies: Remember your preferences such as language settings, preferred deposit method (e.g., Touch 'n Go eWallet or DuitNow), and responsible gambling tool configurations. These enhance your experience but are not essential.
• Analytics Cookies: Used to collect aggregate, anonymised data on how Users navigate and interact with the Platform. This helps us improve usability and identify technical issues. Analytics data is not linked to your personal identity where avoidable.
• Marketing Cookies (Consent Required): Used only with your explicit consent to track your interaction with promotional materials and to deliver relevant offers. You may opt out of marketing cookies at any time via Account Settings.

You may control cookie settings through your browser's privacy settings. Note that disabling strictly necessary cookies will affect your ability to log in and use the Platform. Disabling analytics or marketing cookies will not impact core gaming functionality.

CastleToto retains Personal Data for as long as is necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods driven by legal and regulatory requirements:

• Account and KYC Data: Retained for a minimum of five (5) years following Account closure, to comply with AML record-keeping obligations under our international licence conditions.
• Transaction and Financial Records: Retained for a minimum of five (5) years following the date of each transaction, consistent with standard financial record-keeping requirements.
• Gaming Activity Logs: Retained for a minimum of three (3) years following Account closure, for dispute resolution and responsible gambling audit purposes.
• Support Communications: Retained for a minimum of two (2) years following resolution of the matter to which they relate, or longer where the matter is subject to ongoing dispute.
• Marketing Consent Records: Retained for the duration of any marketing activity and for a minimum of one (1) year following withdrawal of consent, to demonstrate compliance.
• Technical and Device Data: Retained in aggregate anonymised form after Account closure; identifiable technical data is deleted within six (6) months of the last Platform interaction.

On expiry of the applicable retention period, Personal Data will be securely deleted or anonymised. Where data cannot be immediately deleted due to technical constraints, it will be isolated from active processing until deletion can be completed.

CastleToto implements a range of technical and organisational security measures designed to protect your Personal Data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and our servers
• Encryption of sensitive stored data, including KYC documents and payment details, at rest
• Access controls ensuring that Personal Data is accessible only to CastleToto personnel or processors with a legitimate operational need
• Two-factor authentication (2FA) options for player Account security
• Regular penetration testing and vulnerability assessments conducted by independent security professionals
• Incident response procedures, including breach notification protocols aligned with our licensing obligations

While we take all reasonable steps to protect your Personal Data, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your own Account credentials. If you believe your Account has been compromised, please contact CastleToto support immediately via live chat.

Subject to applicable legal limitations and our regulatory obligations, you have the following rights in relation to your Personal Data held by CastleToto. To exercise any of these rights, please contact our support team via live chat or by emailing us at the address in Section 15.

• Right of Access: You have the right to request a copy of the Personal Data we hold about you and to receive information about how it is being processed.
• Right to Rectification: You have the right to request correction of inaccurate or incomplete Personal Data. For Account data such as your name or address, please update via Account Settings or contact support.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, subject to any overriding legal retention obligations (see Section 9).
• Right to Restriction of Processing: You may request that we restrict the processing of your Personal Data in certain circumstances — for example, while a dispute over accuracy is being resolved.
• Right to Data Portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you may request your Personal Data in a structured, machine-readable format.
• Right to Object: You may object to processing based on our legitimate interests, including any use of your data for direct marketing purposes. We will cease processing upon receipt of a valid objection unless we can demonstrate compelling grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

CastleToto will respond to all data rights requests within thirty (30) days of receipt. Where a request is complex or voluminous, we may extend this period by a further 30 days, with notice to you.

CastleToto is strictly an adults-only platform. We do not knowingly collect Personal Data from persons under the age of 21. Our Account registration process includes age verification steps, and our KYC process requires documentary proof of age before any withdrawal can be processed.

If CastleToto becomes aware, at any stage, that a registered Account belongs to a person under the age of 21, that Account will be immediately suspended, all gaming activity voided, and the matter referred to our responsible gambling compliance team. Any deposited funds not tainted by bonus abuse or fraud will be returned to the verified payment source.

If you are a parent or guardian and believe that a minor may have registered an Account on CastleToto, please contact our support team immediately. We will investigate and act promptly.

CastleToto operates globally and may store or process your Personal Data on servers or through service providers located outside of Malaysia. Where Personal Data is transferred to a jurisdiction outside of your own, we take steps to ensure that appropriate safeguards are in place to protect your data in accordance with applicable data protection standards.

Safeguards for international data transfers may include: contractual clauses binding Data Processors to equivalent data protection standards; reliance on adequacy decisions where the receiving jurisdiction is recognised as offering adequate protections; or other legally recognised transfer mechanisms.

For Malaysian Users: CastleToto notes that Malaysia's Personal Data Protection Act 2010 (PDPA) governs the processing of personal data in commercial transactions. While CastleToto's primary licensing and operational framework is international, we are committed to handling Malaysian Users' data with care, transparency, and respect for their rights.

CastleToto reserves the right to amend this Privacy Policy at any time. Where changes are material — such as changes to the categories of data collected, new third-party recipients, or changes to how we use your data — we will provide advance notice via email to your registered address or via a prominent notice on the Platform, at least 14 days prior to the changes taking effect.

Where changes are minor — such as clarifications, corrections, or administrative updates — we may update the Policy without prior notice. In all cases, the effective date displayed at the top of this Policy will reflect the most recent revision.

Your continued use of the CastleToto Platform following the effective date of any amendment constitutes your acceptance of the updated Policy. We recommend reviewing this page periodically. The current version is always available at castletoto.cam/privacy-policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data by CastleToto, please contact us through the following channels:

• Live Chat: Available 24/7 via the support widget on the CastleToto Platform. This is the fastest route for urgent matters.
• Email: [email protected] (plain text — not a clickable link)

When submitting a data rights request or privacy-related enquiry, please include your full name, registered email address, and a description of your request. This information helps us verify your identity and respond accurately to your enquiry.

CastleToto endeavours to respond to all privacy-related correspondence within thirty (30) calendar days. For complex requests, we may require additional time and will notify you accordingly.