Privacy Policy

This Privacy Policy ("Policy") is issued by Bugistoto ("Company", "we", "us", "our") and applies to all personal data collected through the use of the Bugistoto online casino and sports betting platform accessible at https://bugistoto.cam ("the Platform"), including all associated features, services, promotions, and customer communications.

Bugistoto is committed to handling your personal data in a transparent, responsible, and lawful manner. This Policy describes the categories of personal data we collect, the purposes and legal basis for processing, how long we retain data, who we share it with, and the rights you hold as a data subject.

By registering an account or continuing to use the Bugistoto platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree to the terms of this Policy, you must discontinue use of the Platform and close your account.

For the purposes of this Privacy Policy, the following terms bear the meanings assigned below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, email address, phone number, identification documents, IP address, device identifiers, and financial transaction data.
• "Processing" means any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, and deletion.
• "Data Controller" means the entity that determines the purposes and means of processing personal data. Bugistoto is the Data Controller for all personal data collected through the Platform.
• "Data Processor" means a third party that processes personal data on behalf of Bugistoto under contractual instruction.
• "Consent" means freely given, specific, informed, and unambiguous agreement to the processing of personal data for a stated purpose.
• "Sensitive Data" means personal data warranting heightened protection, including financial data, identification documents, and account security credentials.
• "User" / "You" means any natural person who accesses, registers on, or uses the Bugistoto Platform.

Bugistoto is the Data Controller responsible for your personal data collected through the Platform. As Data Controller, Bugistoto determines the purposes for which your personal data is processed and ensures that all processing activities comply with applicable data protection standards.

Bugistoto operates under international gaming licences. The Platform is not regulated by any Malaysian governmental authority, including the Personal Data Protection Commission (PDPC) of Malaysia, though we voluntarily apply data minimisation and security principles consistent with internationally recognised privacy standards.

Our designated Data Protection contact may be reached at the email address provided in Section 15 of this Policy. All data protection enquiries, access requests, and complaints should be directed to this contact.

4.1 Data You Provide Directly

We collect personal data that you voluntarily provide when using the Platform, including:

• Registration data: full legal name, date of birth, email address, phone number, and residential address.
• Identity verification documents: national identity card (MyKad), passport, driving licence, or other government-issued identification.
• Proof of address: utility bills, bank statements, or other official documents dated within 90 days.
• Financial data: payment method details (partially masked where possible), transaction history, deposit and withdrawal records.
• Communications: records of your interactions with our customer support team, including live chat transcripts and email correspondence.
• Account preferences: responsible gambling settings, deposit limits, notification preferences.

4.2 Data Collected Automatically

When you access or use the Platform, we automatically collect the following technical and behavioural data:

• Device information: device type, operating system version, browser type and version, screen resolution, and device identifiers.
• Network data: IP address, approximate geolocation derived from IP, internet service provider (ISP).
• Usage data: pages visited, features used, game sessions started and completed, bet history, session duration, click patterns, and navigation path.
• Cookie and tracking data: as described in Section 10 of this Policy.

4.3 Data From Third Parties

In certain circumstances, we receive personal data from third-party sources, including:

• Payment processors: transaction verification data and fraud screening results from partners including Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, DuitNow, FPX, and cryptocurrency processing partners.
• Identity verification services: results from third-party KYC and age verification platforms.
• Fraud prevention databases: data from industry anti-fraud and anti-money laundering (AML) screening providers.

Bugistoto processes your personal data for the following specific and documented purposes:

Bugistoto processes personal data under one or more of the following recognised legal bases:

• Contract Performance: Processing is necessary to perform our contractual obligations to you — i.e., to operate your account, process transactions, and deliver the services you have requested.
• Legal Obligation: Processing is required to comply with applicable laws and regulations, including anti-money laundering (AML) regulations, age verification requirements, and fraud prevention obligations.
• Legitimate Interest: Processing is necessary for our legitimate business interests — such as platform security, fraud detection, responsible gambling monitoring, and service improvement — where such interests are not overridden by your rights and freedoms.
• Consent: Where processing is based on your consent — for example, for marketing communications — we will obtain your express consent before processing and you may withdraw that consent at any time without affecting the lawfulness of prior processing.

Where we rely on legitimate interest as a legal basis, we have conducted a balancing test confirming that our interests do not override your fundamental privacy rights. Details of these assessments are available upon request.

Bugistoto does not sell, rent, or trade your personal data to any third party for independent commercial purposes. We share your personal data only in the following limited and controlled circumstances:

7.1 Payment Processors

To process deposits and withdrawals, we share necessary financial and identity data with our payment partners including Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, DuitNow, FPX, and cryptocurrency processing services. These partners receive only the minimum data required to complete the transaction and are bound by confidentiality agreements.

7.2 Identity Verification Providers

We engage third-party KYC and identity verification services to validate the identity and age of our users. These providers process your identity documents under strict data processing agreements and are prohibited from using your data for any purpose other than verification.

7.3 Regulatory and Law Enforcement Authorities

We may be required to disclose personal data to regulatory bodies, law enforcement agencies, or financial intelligence units where we are legally compelled to do so, or where disclosure is necessary to prevent or detect fraud, money laundering, or other criminal activity.

7.4 Service Providers

We engage third-party service providers to support Platform operations, including cloud hosting providers, analytics platforms, customer support tools, and cybersecurity services. All such providers operate as Data Processors under binding contractual agreements that restrict use of your data to the specified service purpose only.

7.5 Business Transfers

In the event of a merger, acquisition, or sale of all or part of Bugistoto's business, your personal data may be transferred to the acquiring entity. You will be notified of any such transfer and your rights in relation to it in advance of completion.

Bugistoto retains personal data only for as long as necessary to fulfil the purposes for which it was collected, subject to overriding legal, regulatory, or contractual obligations. The following indicative retention periods apply:

• Account and registration data: Retained for the duration of your account plus five (5) years following account closure, to comply with AML record-keeping requirements.
• KYC and identity documents: Retained for five (5) years from the date of verification or from the date of account closure, whichever is later.
• Transaction and financial records: Retained for seven (7) years in compliance with financial record-keeping obligations.
• Customer support communications: Retained for three (3) years from the date of the interaction, unless related to an ongoing dispute.
• Usage and analytics data: Aggregated or anonymised data may be retained indefinitely. Identifiable usage data is retained for up to twenty-four (24) months.
• Marketing consent records: Retained for the duration of the marketing relationship plus two (2) years to evidence consent.

Upon expiry of the applicable retention period, personal data is securely deleted or permanently anonymised in accordance with our data disposal procedures.

Bugistoto implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security framework includes the following controls:

• 256-bit SSL/TLS encryption for all data transmitted between your device and our servers.
• AES-256 encryption for personal data stored at rest on our database infrastructure.
• Multi-factor authentication (MFA) requirements for administrative platform access.
• Role-based access controls ensuring that employees access only the personal data necessary for their specific functions.
• Regular independent penetration testing and vulnerability assessments of the Platform and infrastructure.
• Continuous monitoring of server access logs and real-time alerting for anomalous activity.
• Secure data disposal procedures for hardware decommissioning and digital records deletion.

In the event of a personal data breach that poses a risk to your rights and freedoms, Bugistoto will notify affected users without undue delay and will take all reasonable steps to contain and remediate the breach.

Bugistoto uses cookies and similar tracking technologies (such as local storage, session storage, and pixel tags) to operate the Platform effectively, improve user experience, and conduct analytics. A cookie is a small text file placed on your device when you visit the Platform.

You may manage cookie preferences through your browser settings. Note that disabling certain cookies may impair Platform functionality. Strictly necessary cookies cannot be disabled as they are integral to Platform operation. For a full list of cookies in use, please contact our support team.

Bugistoto operates on infrastructure hosted in data centres located outside Malaysia. As a result, your personal data may be transferred to and processed in countries other than your country of residence, including countries in which Bugistoto's service providers and data processors are located.

When transferring personal data internationally, Bugistoto implements appropriate safeguards to ensure that your data receives an equivalent level of protection to that afforded under internationally recognised privacy standards. These safeguards include contractual clauses with service providers, data processing agreements incorporating standard contractual protections, and due diligence assessments of recipient country data protection frameworks.

By using the Platform, you acknowledge that your personal data may be transferred outside Malaysia and processed in the jurisdictions described above. If you have questions about specific transfer safeguards, please contact our Data Protection contact as detailed in Section 15.

As a data subject, you hold the following rights in relation to your personal data held by Bugistoto. These rights may be exercised at any time by contacting our Data Protection contact at [email protected].

We will respond to all valid data subject requests within thirty (30) calendar days of receipt. In complex cases, we may extend this period by a further sixty (60) days, in which case we will notify you of the extension and reason within the initial thirty-day period.

Requests may be made via email to [email protected]. We will verify your identity before processing any request. We do not charge a fee for exercising your rights unless a request is manifestly unfounded or excessive, in which case a reasonable administrative fee may apply.

Bugistoto strictly prohibits the use of its Platform by any person under the age of 21. The Platform is not directed at, and does not knowingly collect personal data from, individuals under 21 years of age.

If we become aware that personal data has been collected from a person under 21, we will immediately close the associated account, delete all personal data relating to that individual from our active systems, return any deposited funds to the originating payment method, and void all associated transactions and winnings.

Parents and guardians are encouraged to monitor the online activities of minors and to utilise parental control software to prevent access to online gambling platforms. If you believe a minor has registered on or used the Bugistoto Platform, please notify us immediately at [email protected].

Bugistoto reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable laws, regulatory requirements, or Platform features. The date of last revision is displayed prominently at the top of this page.

Where changes are material — meaning they significantly affect how we process your personal data or alter your rights — we will provide advance notice via your registered email address and through a prominent notice on the Platform. Non-material updates (such as clarifications or formatting changes) will be reflected in the revised Policy without individual notification.

Your continued use of the Platform following the effective date of any revised Policy constitutes your acceptance of the updated terms. We encourage you to review this Policy periodically. The most current version is always accessible at https://bugistoto.cam/privacy-policy.

For all data protection enquiries, subject access requests, consent withdrawals, or privacy-related complaints, please contact our Data Protection team using the details below. We aim to acknowledge all privacy enquiries within two (2) business days and to resolve them within thirty (30) calendar days.

When submitting a data-related request, please include your registered email address, a description of your request or concern, and any relevant account details to help us locate your data accurately and respond efficiently.

If you are not satisfied with our response to a privacy concern, you have the right to escalate your complaint to the relevant supervisory authority in your jurisdiction.