Privacy Policy

1 Introduction

This Privacy Policy ("Policy") sets out the data processing practices of lunastoto ("we", "us", "the Company", "the Platform") in connection with the operation of our online casino and sports betting platform accessible at https://lunastoto.cam. It applies to all personal data collected from individuals ("Players", "Users", "you") who register, access, or interact with the lunastoto platform, including players located in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and across Malaysia.

Lunastoto takes the protection of personal data seriously. We process your data only for the purposes described in this Policy and only to the extent necessary to deliver our services, meet our legal obligations, and operate a safe and compliant gaming environment. We do not sell, rent, or trade your personal information to third-party advertisers or data brokers under any circumstances.

This Policy should be read in conjunction with our Terms & Conditions, which also govern your use of the lunastoto platform.

2 Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings defined below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to names, email addresses, identification numbers, financial data, and device identifiers.
• "Data Controller" means lunastoto, the entity that determines the purposes and means of processing personal data.
• "Data Processor" means any third party that processes personal data on behalf of lunastoto in accordance with our instructions.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, erasure, or any other form of handling.
• "KYC" means Know Your Customer — the identity and age verification process applied to all Players on the platform.
• "Cookie" means a small text file placed on your device by the platform when you visit, used to enhance functionality and track usage patterns.
• "Consent" means a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your personal data for a stated purpose.
• "Sensitive Personal Data" means data revealing racial or ethnic origin, political opinions, religious beliefs, health data, biometric data, or data concerning a natural person's sex life or sexual orientation.

3 Personal Data We Collect

Lunastoto collects the following categories of personal data in connection with the operation of the platform and the provision of our services to registered Players:

Data Category	Examples	Purpose
Identity Data	Full legal name, date of birth, nationality, MyKad or passport number	Account registration, KYC verification, age compliance
Contact Data	Email address, mobile phone number, residential address	Account communications, support, promotional notifications
Financial Data	Payment method details (e-wallet IDs, bank account names), transaction history, deposit and withdrawal records in MYR	Payment processing, fraud prevention, regulatory reporting
Technical Data	IP address, device type, browser type, operating system, session timestamps	Platform security, fraud detection, technical support
Usage Data	Games played, wagering history, session duration, betting markets accessed	Responsible gambling monitoring, platform improvement
Communications Data	Live chat transcripts, support email content, complaint records	Dispute resolution, quality assurance, compliance
KYC Documents	Scanned identity documents, proof of address, payment method screenshots	Regulatory KYC compliance, fraud prevention

Lunastoto does not intentionally collect Sensitive Personal Data as defined in Section 2. If any sensitive information is incidentally contained in documents submitted for KYC purposes, it is treated with the highest level of protection and used solely for identity verification purposes.

4 How We Collect Your Data

We collect personal data through the following means:

4.1 Direct Collection

Data you provide directly to us when you:

• Complete the account registration form on lunastoto;
• Submit KYC verification documents;
• Make a deposit or withdrawal via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, or cryptocurrency;
• Contact our customer support team via live chat or email;
• Respond to surveys, promotions, or marketing communications;
• Update your account profile or preferences.

4.2 Automated Collection

Data collected automatically when you access and use the platform, including:

• Technical data via server logs, cookies, and similar tracking technologies;
• Behavioural data generated through your gameplay and betting activity;
• Device and connection information collected at login and during sessions.

4.3 Third-Party Sources

We may receive personal data from third parties including:

• Payment service providers processing your transactions (e.g., FPX, DuitNow network operators);
• Identity verification and fraud prevention service providers;
• Analytics partners providing aggregated platform performance data.

5 Data Processing

Lunastoto processes your personal data for the following specific purposes:

5.1 Account Management and Service Delivery

We process your identity and contact data to create and manage your player account, verify your eligibility to use the platform, process your deposits and withdrawals in MYR, and deliver the core services of the lunastoto platform including access to casino games, sports betting markets, live dealer rooms, and promotional offers.

5.2 Payment Processing

Financial data is processed to facilitate transactions via your chosen payment method, including Touch 'n Go eWallet, DuitNow, FPX, Boost, GrabPay, Maybank2u, CIMB Clicks, Public Bank online, Hong Leong Connect, USDT, and BTC. Transaction records are retained for regulatory compliance purposes and to resolve any payment disputes.

5.3 KYC and Regulatory Compliance

Identity and KYC documentation is processed to verify your age (21+ requirement), confirm the legitimacy of payment methods used, and comply with applicable anti-money laundering (AML) and counter-terrorism financing (CTF) obligations. KYC processing is mandatory for all withdrawal requests.

5.4 Fraud Prevention and Platform Security

Technical data including IP addresses, device fingerprints, and session logs are processed to detect and prevent fraud, bonus abuse, multi-accounting, money laundering, and other prohibited activities. This processing is necessary for the security of both the platform and our player community.

5.5 Responsible Gambling Monitoring

Usage data relating to your betting patterns, session duration, and transaction frequency is processed to identify potential indicators of problem gambling behaviour. This enables lunastoto to provide timely interventions, enforce deposit limits, and support the operation of our responsible gambling tools as described on our Responsible Gambling page.

5.6 Customer Support and Communications

Communications data is retained to handle your support queries, resolve disputes, maintain records of player complaints, and ensure the quality of our customer service. We may contact you via email or in-platform notification to provide service updates, security alerts, or responses to support requests.

5.7 Platform Improvement and Analytics

Aggregated and anonymised usage data is processed to analyse platform performance, identify technical issues, and improve the overall player experience. No individually identifiable data is used for analytical reporting purposes without your consent.

6 Legal Basis for Processing

Lunastoto processes your personal data on the following legal bases:

• Contractual Necessity: Processing necessary to fulfil our contractual obligations to you as a registered Player, including account management, payment processing, and service delivery.
• Legal Obligation: Processing required to comply with applicable legal and regulatory obligations, including KYC, AML, and CTF requirements.
• Legitimate Interests: Processing necessary for our legitimate business interests, including fraud prevention, platform security, responsible gambling monitoring, and customer support, provided such interests are not overridden by your fundamental rights and freedoms.
• Consent: Where we rely on your consent to process your data (for example, for marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of prior processing.

7 Data Sharing & Disclosure

7.1 Payment Service Providers

We share financial data with payment service providers — including FPX network participants, DuitNow operators, Touch 'n Go eWallet, Boost, GrabPay, and cryptocurrency processing partners — solely to facilitate your deposit and withdrawal transactions. These providers are contractually obligated to process your data only for payment purposes and to maintain appropriate security standards.

7.2 Identity Verification and Fraud Prevention Partners

We may share KYC documentation and identity data with specialist third-party verification service providers for the purpose of confirming your identity, age, and the legitimacy of payment instruments. Such partners are bound by confidentiality obligations and may not use your data for any other purpose.

7.3 Legal and Regulatory Disclosure

Lunastoto may disclose personal data to law enforcement agencies, regulatory bodies, or judicial authorities where required to do so by applicable law, court order, or regulatory directive. We will disclose only the minimum data necessary to comply with such requirements.

7.4 Corporate Transactions

In the event of a merger, acquisition, or sale of all or substantially all of the Company's assets, your personal data may be transferred to the acquiring entity as part of that transaction. Any such transfer will be subject to equivalent data protection obligations, and you will be notified of any material change to the data controller's identity.

8 Data Retention

Lunastoto retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or compliance obligations. The following general retention periods apply:

• Account and identity data: Retained for the duration of the account relationship and for a minimum of five (5) years following account closure, to satisfy AML and regulatory record-keeping requirements;
• Transaction and financial records: Retained for a minimum of seven (7) years in accordance with standard financial record-keeping obligations;
• Customer support communications: Retained for three (3) years following the resolution of the relevant query or complaint;
• Technical and usage logs: Retained for up to twelve (12) months and then anonymised or deleted;
• Marketing consent records: Retained for the duration of the consent and for one (1) year following withdrawal of consent, for audit purposes.

Upon the expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification.

9 Cookies & Tracking Technologies

9.1 What Are Cookies

Cookies are small text files placed on your device when you access the lunastoto platform. They enable certain platform functionality, remember your preferences, and provide information about how the platform is being used. Lunastoto uses the following categories of cookies:

• Strictly Necessary Cookies: Essential for the platform to function. These cookies enable login session management, security functions, and basic navigation. They cannot be disabled without affecting core functionality.
• Functional Cookies: Used to remember your preferences and personalise your experience, such as language settings and display preferences.
• Analytical Cookies: Used to collect anonymised information about how Players use the platform, enabling us to improve performance and identify technical issues.
• Session Security Cookies: Used to detect and prevent fraudulent sessions and to verify that interactions originate from legitimate registered accounts.

9.2 Managing Cookies

You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies may impair your ability to use certain features of the platform, including logging in and completing transactions. Lunastoto does not use cookies for third-party advertising or behavioural profiling for commercial purposes.

10 Data Security

Lunastoto implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the lunastoto platform;
• Encryption of sensitive stored data, including identity documents and financial records;
• Two-factor authentication (2FA) available for all player accounts;
• Role-based access controls limiting staff access to personal data on a strict need-to-know basis;
• Regular security audits and penetration testing of platform infrastructure;
• Incident response procedures to address and report any data security breach in accordance with applicable obligations.

11 Your Data Rights

As a registered player on the lunastoto platform, you have the following rights with respect to your personal data. To exercise any of these rights, please contact us using the details provided in Section 15.

• Right of Access: You have the right to request a copy of the personal data lunastoto holds about you, along with information about how it is being processed.
• Right to Rectification: You have the right to request that any inaccurate or incomplete personal data held by lunastoto be corrected or updated.
• Right to Erasure: In certain circumstances, you have the right to request the deletion of your personal data. This right is subject to applicable retention obligations and may not apply where processing is required by law.
• Right to Restriction: You have the right to request that lunastoto restrict the processing of your personal data in certain circumstances, for example while a correction request is being verified.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity, you have the right to receive a structured, commonly used copy of your personal data for transfer to another service provider.
• Right to Object: You have the right to object to processing based on legitimate interests. Where processing is for direct marketing purposes, this right is absolute.
• Right to Withdraw Consent: Where we rely on your consent as the legal basis for processing, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

All rights requests will be acknowledged within five (5) business days and addressed within thirty (30) days of receipt. In cases of complexity, we may extend this period by a further thirty (30) days, with prior notification.

12 Minors & Age Policy

Age verification is conducted during the KYC process for all registered accounts. Players who have not yet completed KYC will have their withdrawal capabilities suspended until age verification is confirmed. This policy is applied universally to all players regardless of their location within Malaysia.

13 International Data Transfers

In the course of operating the lunastoto platform, your personal data may be transferred to and processed in countries outside of Malaysia, including jurisdictions where data protection laws may differ from those applicable in Malaysia. Where such transfers occur, lunastoto ensures that appropriate safeguards are in place to protect your personal data, including:

• Data processing agreements with all third-party service providers incorporating binding data protection obligations;
• Transfer mechanisms providing equivalent levels of protection to those applicable in Malaysia;
• Contractual restrictions preventing third-party processors from using your data for any purpose other than those specified by lunastoto.

14 Policy Amendments

Lunastoto reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory requirements. Where material changes are made, we will notify registered Players via the email address on file or through an in-platform notification prior to the changes taking effect.

The version of this Policy published on this page constitutes the current and binding version. The "Last updated" date at the top of this page reflects the date of the most recent revision. Your continued use of the lunastoto platform following any amendment constitutes your acceptance of the updated Policy.

15 Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact the lunastoto data team through the following channels:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available on-site 24 hours a day, 7 days a week
• Subject Line: Please include "Privacy Request" in the subject of any written communication to ensure prompt routing to the relevant team
• Response Time: All privacy-related queries acknowledged within 48 hours; substantive responses provided within 30 days

For account-specific matters such as self-exclusion, deposit limit requests, or responsible gambling tools, please visit our dedicated Responsible Gambling page.