Privacy Policy

SBCToto ("we", "us", "our", "the Company") operates the online gaming and sports betting platform accessible at sbctoto.cam (the "Platform"). We understand that the protection of your personal data is fundamental to the trust you place in us, and we take that responsibility seriously.

This Privacy Policy ("Policy") describes how SBCToto collects, uses, stores, shares, and protects the personal data of all individuals who access or use our Platform, including registered players, visitors, and persons who interact with our support services ("you", "your", "Data Subject").

This Policy is incorporated by reference into our Terms & Conditions and forms part of the contractual relationship between you and SBCToto. By registering an account, accessing the Platform, or submitting any personal data to us, you acknowledge that you have read and understood this Policy.

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person — including name, identification number, contact details, financial information, or location data — from which that person can be directly or indirectly identified.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, modification, disclosure, transmission, or deletion.
• "Data Controller" means SBCToto, which determines the purposes and means of processing your Personal Data.
• "Data Processor" means any third party that processes Personal Data on SBCToto's behalf, under a binding data processing agreement.
• "Consent" means a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your Personal Data for a stated purpose.
• "Cookies" means small text files placed on your device by a website to record browsing behaviour, session state, and preferences.
• "KYC Data" means identity and address verification documentation submitted pursuant to Know Your Customer procedures, including copies of official Malaysian identity documents and proof of address.

SBCToto collects Personal Data through several channels. The table below sets out the categories of data collected, the source of collection, and the primary purpose for which each category is processed:

SBCToto processes your Personal Data for the following specific, explicit, and legitimate purposes:

• Account Registration & Management: To create and maintain your SBCToto player account, authenticate your identity at login, and manage account settings and preferences.
• KYC & Compliance: To verify your identity and age in fulfilment of our anti-money laundering (AML) obligations and internal compliance requirements. KYC verification is a legal obligation.
• Financial Transaction Processing: To facilitate deposits, withdrawals, and bonus credit in MYR via your chosen payment channel (Maybank2u, CIMB Clicks, DuitNow, Touch 'n Go eWallet, GrabPay, FPX, and others).
• Platform Operation & Gaming: To provide access to sports betting markets, live casino games, and slot products; to settle wagers; and to maintain accurate gaming records.
• Responsible Gambling: To monitor gaming patterns for indicators of problem gambling behaviour, enforce deposit limits and self-exclusion restrictions, and provide appropriate support resources to at-risk players.
• Fraud Prevention & Security: To detect, prevent, and investigate fraudulent activity, account abuse, multi-accounting, and other prohibited conduct as defined in our Terms & Conditions.
• Customer Support: To respond to support queries, complaints, and disputes; to improve support quality through transcript review.
• Marketing Communications: To send promotional offers, bonus notifications, and platform updates by email or in-platform notification, subject to your communication preferences and where you have provided valid consent or where a legitimate interest applies.
• Analytics & Platform Improvement: To analyse aggregated, anonymised usage data for the purpose of improving platform performance, user experience, and product development.
• Legal Compliance: To comply with applicable legal obligations, respond to lawful requests from regulatory authorities, and fulfil data retention requirements.

SBCToto processes your Personal Data under one or more of the following lawful bases:

• Contractual Necessity: Processing required to fulfil our obligations under the Terms & Conditions, including account management, payment processing, and gaming service delivery.
• Legal Obligation: Processing required to comply with applicable laws, including AML legislation, KYC mandates, and judicial or regulatory orders.
• Legitimate Interests: Processing carried out for fraud prevention, platform security, customer support quality improvement, and internal analytics — where such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing based on your freely given, specific, and informed agreement — primarily applicable to non-essential cookies and optional marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

SBCToto does not sell, rent, or commercially trade your Personal Data to any third party. We may, however, share your data with the following categories of recipient where strictly necessary for the purposes described in Section 4:

• Payment Service Providers: Malaysian banking and e-wallet providers (including Maybank, CIMB, Public Bank, Hong Leong, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, and FPX processors) receive transaction data necessary to process your deposits and withdrawals. Each provider operates under its own privacy policy and applicable financial services regulations.
• KYC & Identity Verification Partners: Authorised identity verification service providers may process your KYC documentation under a binding data processing agreement that restricts use to verification purposes only.
• IT Infrastructure & Hosting Providers: Cloud hosting and data centre providers who store platform data under strict contractual data security obligations.
• Fraud Prevention & AML Services: Third-party risk screening tools used to detect and prevent financial crime, operating under data processing agreements compliant with applicable law.
• Regulatory Authorities & Law Enforcement: Where required by law, court order, or valid regulatory direction, SBCToto may disclose Personal Data to competent authorities without prior notice to the data subject.
• Professional Advisors: Legal counsel, auditors, and compliance consultants who are bound by professional confidentiality obligations.

SBCToto's primary operations serve the Malaysian market. Where it is necessary to transfer Personal Data outside of Malaysia — for example, to international cloud infrastructure providers or globally operated compliance services — we ensure that appropriate safeguards are in place to protect your data to a standard equivalent to Malaysian data protection requirements.

Applicable safeguards may include binding contractual clauses with data recipients, adequacy assessments of the recipient jurisdiction's data protection framework, and technical security controls applied to all transferred data. Where any international transfer is required to process your payment through an international payment network, such transfer is necessary for the performance of your contract with SBCToto.

SBCToto retains Personal Data for no longer than is necessary to fulfil the purpose for which it was collected, subject to mandatory retention obligations imposed by applicable law. Our standard retention periods are as follows:

• Account & Registration Data: Retained for the duration of your active account relationship, plus a minimum of 5 years following account closure, in accordance with standard financial record-keeping obligations.
• KYC Documents: Retained for a minimum of 5 years from the date of verification or account closure, whichever is later, in compliance with AML and counter-terrorism financing legislation.
• Financial Transaction Records: Retained for a minimum of 7 years from the date of each transaction, as required by applicable financial regulations.
• Gaming Activity Records: Retained for a minimum of 3 years from the date of each gaming session, subject to any applicable dispute resolution period.
• Support Communications: Retained for a maximum of 3 years from the date of the interaction, unless a longer period is required for an ongoing dispute or legal proceeding.
• Marketing Preference Records: Retained for the duration of your account relationship or until consent is withdrawn, plus12 months thereafter for audit purposes.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in accordance with our internal data lifecycle management procedures.

SBCToto implements a comprehensive set of technical and organisational security measures to protect your Personal Data against unauthorised access, disclosure, alteration, loss, or destruction. Our security infrastructure includes:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and our servers is encrypted using industry-standard transport layer security protocols.
• Encryption at Rest: Sensitive data fields — including identity document scans, financial data, and authentication credentials — are encrypted at rest within our database infrastructure.
• Access Controls: Access to Personal Data is restricted on a strict need-to-know basis. Staff with data access are subject to binding confidentiality obligations and regular security training.
• Multi-Factor Authentication: Administrative access to data processing systems requires multi-factor authentication.
• Security Audits: Our infrastructure undergoes regular independent penetration testing and security audits.
• Incident Response: SBCToto maintains a documented incident response procedure. In the event of a data breach affecting your Personal Data, we will notify you and applicable regulatory authorities in accordance with applicable notification requirements.

SBCToto uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small data files stored on your device that enable us to recognise your browser session, maintain your preferences, and gather aggregated analytics data.

We use the following categories of cookies:

• Strictly Necessary Cookies: Essential for Platform operation. These cookies enable core functions such as account authentication, session management, and security controls. They cannot be disabled without materially impairing Platform functionality.
• Functional Cookies: Store your language preferences, display settings, and personalisation choices to enhance your experience across sessions.
• Analytics Cookies: Collect aggregated, anonymised data on how visitors interact with the Platform — including pages visited, session duration, and navigation paths — to help us improve performance and user experience.
• Marketing & Targeting Cookies: Used, with your explicit consent, to present relevant promotional content and track the effectiveness of marketing communications. These cookies are non-essential and will only be activated upon your consent.

You may manage your cookie preferences at any time through your browser settings. Disabling non-essential cookies will not affect your ability to access or use the Platform's core gaming features. Note that disabling strictly necessary cookies may prevent you from logging into your Account.

As a data subject, you have the following rights in relation to your Personal Data held by SBCToto. To exercise any of these rights, please contact us using the details in Section 14. We will respond to all verified requests within 30 calendar days. There is no charge for exercising your data rights.

The SBCToto Platform is strictly intended for individuals aged21 years and above. We do not knowingly collect, process, or retain Personal Data of persons below the age of 21. Registration by individuals under 21 is prohibited under our Terms & Conditions and in accordance with responsible gambling obligations.

Where SBCToto becomes aware or reasonably suspects that Personal Data belonging to a person under the age of 21 has been collected — whether through registration, KYC verification, or any other means — we will:

• Immediately suspend the relevant Account pending investigation;
• Void any wagers placed and return deposited funds to the originating payment source where legally permitted;
• Permanently delete the Personal Data of the underage individual upon confirmation, subject to any overiding legal retention obligations; and
• Take appropriate steps to prevent re-registration by the same individual.

If you believe that an individual under the age of 21 has submitted Personal Data to SBCToto, please contact us immediately at [email protected].

SBCToto reserves the right to review and update this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, business operations, or data processing practices. The "Last Updated" date at the top of this Policy will be revised to reflect the date of any material change.

Where changes are material — meaning they significantly affect your rights or the manner in which we process your Personal Data — we will notify registered players by email to their registered address or via a prominent notice on the Platform at least 14 days before the changes take effect. Your continued use of the Platform following the effective date of any updated Policy constitutes your acknowledgement of the changes.

We encourage you to review this Policy periodically. The current version will always be accessible at sbctoto.cam/privacy-policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data, please contact SBCToto's Data Protection team using the details below. We are committed to resolving all privacy-related enquiries promptly and transparently.

This Privacy Policy was last reviewed and updated on 1 January 2026. SBCToto takes all privacy-related correspondence seriously and is committed to resolving your concerns in a fair, transparent, and timely manner.