MSToto is committed to protecting your personal data. This Privacy Policy explains exactly what information we collect from you as a Malaysian player, why we collect it, how we use and store it, and what rights you have over it. We believe in transparency — no vague clauses, no hidden data practices.
All data transmitted between your device and MSToto servers is protected with industry-standard 256-bit SSL encryption — the same standard used by major Malaysian banks including Maybank and CIMB Clicks.
MSToto does not sell, rent, or trade your personal information to third-party marketers or data brokers under any circumstances. Your data belongs to you — we process it only to deliver the services you signed up for.
Member data is stored in segregated, access-controlled server environments. Only authorised personnel with a documented business need may access personally identifiable information, and all access is logged and audited.
You have the right to access, correct, delete, or export the personal data we hold on you. Submit a request to our support team and we will respond within 30 days — no automated refusals, no bureaucratic runaround.
We use cookies to improve your experience, maintain session security, and understand platform usage. All cookie categories are disclosed in this Policy. Non-essential cookies can be managed through your browser settings.
MSToto does not store full payment card details. Transactions via Touch 'n Go eWallet, Boost, GrabPay, Maybank2u, DuitNow, and FPX are processed through certified payment gateways. We hold only the minimum identifiers required to verify and reconcile transactions.
Contents
MSToto ("we", "us", "the Platform") operates the online gaming and sports betting platform accessible at mstoto.asia. We process personal data about registered Members and site visitors in the course of providing our services. This Privacy Policy ("Policy") describes our data practices in full — what personal data we collect, on what lawful basis, for what purposes, and how we protect it.
This Policy applies to all personal data processed in connection with: (a) registration and maintenance of a Member account; (b) use of any gaming, betting, or payment service on the Platform; (c) communication with our customer support team; and (d) general browsing of mstoto.asia.
By registering on MSToto or continuing to use the Platform after this Policy has been published, you acknowledge that you have read and understood its contents. This Policy should be read together with our Terms & Conditions, which govern your overall use of the Platform.
This Policy is published in English. If you require clarification on any clause, please contact our support team at [email protected] — we are available 24/7 to assist Members across Malaysia, including in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, and Shah Alam.
For the purposes of this Policy, the following terms shall have the meanings set out below:
| Term | Meaning |
|---|---|
| "Personal Data" | Any information that relates to an identified or identifiable natural person, including name, email address, contact number, IP address, device identifiers, and financial account details. |
| "Processing" | Any operation performed on Personal Data, whether automated or manual, including collection, recording, storage, alteration, retrieval, use, disclosure, combination, restriction, erasure, or destruction. |
| "Data Controller" | MSToto, in its capacity as the entity that determines the purposes and means of processing Personal Data obtained through the Platform. |
| "Data Processor" | Any third-party service provider that processes Personal Data on behalf of MSToto under a written data processing agreement, including payment gateways, cloud infrastructure providers, and KYC verification services. |
| "Member" | A natural person who has registered a verified account on the MSToto Platform and is aged 21 years or above. |
| "Sensitive Data" | A subset of Personal Data requiring heightened protection, including identity document numbers, payment instrument details, and any health-related information submitted in connection with responsible gambling tools. |
| "Cookies" | Small text files placed on a user's device by the Platform for the purposes of session management, preference storage, analytics, or marketing attribution. |
MSToto collects the following categories of Personal Data, depending on how you interact with the Platform:
3.1 Registration & Identity Data
3.2 KYC & Verification Data
3.3 Financial & Transaction Data
3.4 Gaming & Betting Activity Data
3.5 Technical & Device Data
3.6 Communications Data
MSToto collects Personal Data through the following means:
MSToto processes Personal Data on the following lawful bases:
| Lawful Basis | Processing Activities Covered |
|---|---|
| Contractual Necessity | Account registration, deposit and withdrawal processing, bet settlement, KYC verification, customer support, and loyalty programme administration — all necessary to perform our contract with you as a Member. |
| Legal Obligation | Identity verification (age and identity), AML screening, transaction monitoring, record-keeping for regulatory compliance, and responding to lawful requests from authorities. |
| Legitimate Interests | Fraud detection and prevention, platform security monitoring, responsible gambling risk assessment, analytics to improve Platform performance, and internal reporting. |
| Consent | Direct marketing communications (email, SMS) and non-essential analytics cookies — where consent has been obtained and may be withdrawn at any time. |
MSToto uses the Personal Data we collect for the following purposes:
MSToto will not use your Personal Data to make automated decisions that produce significant legal effects concerning you without human review, except where such processing is required to prevent clear and demonstrable fraud or account abuse.
MSToto does not sell your Personal Data. We may share it only in the following limited circumstances:
All third parties with whom we share Personal Data are required to maintain appropriate technical and organisational security measures and to process your data only in accordance with our documented instructions.
MSToto operates under international gaming licensing and may utilise cloud infrastructure, KYC verification services, and payment processors whose servers are located outside Malaysia. Personal Data may therefore be transferred to and processed in countries other than your country of residence.
Where such transfers occur, MSToto ensures that appropriate safeguards are in place, including: contractual clauses that impose equivalent data protection obligations on the recipient; use of service providers that maintain certified security standards; and, where applicable, adherence to internationally recognised data transfer frameworks.
By using the MSToto Platform, you acknowledge that your Personal Data may be transferred internationally for the purposes described in this Policy, subject to the safeguards described above.
MSToto retains Personal Data only for as long as is necessary for the purposes for which it was collected or as required by applicable legal and regulatory obligations. The following general retention periods apply:
| Data Category | Retention Period | Rationale |
|---|---|---|
| Account & Identity Data | Duration of membership + 5 years | Contractual and regulatory obligations; AML record-keeping requirements. |
| KYC Documents | Duration of membership + 5 years | International AML and financial crime prevention standards. |
| Financial Transaction Records | 7 years from transaction date | Standard financial record retention requirements. |
| Gaming & Betting Activity Logs | 5 years from date of activity | Dispute resolution, responsible gambling monitoring, regulatory compliance. |
| Support Communications | 3 years from closure of interaction | Quality assurance and dispute resolution purposes. |
| Marketing Consent Records | Until consent is withdrawn + 1 year | Evidence of consent basis for direct marketing communications. |
| Technical Logs & IP Records | 12 months | Security monitoring, fraud investigation. |
Upon expiry of the applicable retention period, Personal Data will be securely deleted or anonymised. Anonymised data (which cannot be used to identify you) may be retained indefinitely for statistical and analytical purposes.
MSToto uses cookies and similar tracking technologies to operate the Platform, improve your experience, and understand how users interact with our services. The following categories of cookies are in use:
| Category | Type | Purpose & Description |
|---|---|---|
| Session & Security | Maintain your login session, enforce security measures such as CSRF protection, and remember your authentication state across pages. These cookies are strictly necessary and cannot be disabled without preventing the Platform from functioning. | |
| Preferences | Remember your language, display, and notification preferences so you do not need to reconfigure them on each visit. | |
| Analytics | Collect aggregate, anonymised data about how pages are used — including which games are most popular, where users navigate, and how long sessions last — to help us improve the Platform. | |
| Marketing Attribution | Track which promotional channel (e.g., a referral partner or affiliate) introduced you to MSToto, used to correctly attribute bonuses and calculate affiliate commissions. Only activated where consent has been given. |
You can manage non-essential cookies by adjusting your browser settings. Please note that disabling certain cookies may affect the functionality of the Platform. For detailed instructions on managing cookies in your specific browser (Chrome, Safari, Firefox, etc.), please consult your browser's help documentation.
MSToto does not currently respond to browser "Do Not Track" signals. However, our use of analytics cookies is subject to your consent and can be managed as described above.
As an individual whose data is processed by MSToto, you have the following rights, subject to applicable law and any overriding legal retention obligations:
Request a copy of the Personal Data we hold about you, together with information about how and why it is processed.
Request correction of inaccurate Personal Data or completion of incomplete data held by MSToto.
Request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to legal retention obligations.
Request that we temporarily halt processing of your data while you contest its accuracy or the legal basis for processing.
Receive a copy of Personal Data you have provided to MSToto in a structured, commonly used, machine-readable format.
Object to processing of your Personal Data based on legitimate interests, including profiling for responsible gambling assessment, subject to MSToto demonstrating compelling grounds.
To exercise any of the above rights, please submit a written request to [email protected] with the subject line "Data Rights Request" and include your registered email address and a clear description of the right you wish to exercise. MSToto will acknowledge receipt within 5 business days and provide a substantive response within 30 days.
We may be required to verify your identity before processing certain requests to prevent unauthorised access to another person's data. Where identity verification is required, we will advise you of the specific documents needed.
MSToto strictly prohibits access to and use of the Platform by persons under the age of 21. We do not knowingly collect or process Personal Data from individuals below this age threshold. If we become aware that a person under the age of 21 has submitted Personal Data through the registration process, we will delete that data and close the account without delay.
If you believe a minor has registered on the Platform using false date-of-birth information, please contact us immediately at [email protected]. We treat reports of underage access with the highest priority and will take immediate action to investigate and remedy the situation.
Parents and guardians are encouraged to use parental control software to prevent minors from accessing online gambling platforms. The effective enforcement of age restrictions is a shared responsibility between the Platform and the household.
MSToto maintains a comprehensive set of technical and organisational security measures designed to protect your Personal Data against unauthorised access, disclosure, alteration, and destruction:
While we take all reasonable precautions, no internet transmission or electronic storage system is 100% secure. Members are responsible for maintaining the security of their own login credentials and for notifying us immediately of any suspected unauthorised access.
The MSToto Platform does not contain links to third-party websites for general browsing purposes. Any third-party integrations on the Platform — such as payment gateways and KYC services — are accessed via embedded APIs and do not redirect users to external sites for data collection purposes.
To the extent that any third-party content or service is accessible through the Platform, MSToto is not responsible for the privacy practices of those third parties. We encourage you to review the privacy policies of any external service you interact with.
MSToto reserves the right to update or replace this Privacy Policy at any time. The "Last updated" date at the top of this page will reflect the date of the most recent version. For material changes — defined as changes that significantly affect how we process your Personal Data or your data rights — we will provide at least seven (7) days' advance notice via the email address registered to your account.
Minor changes (such as clarification of existing practices, correction of typographical errors, or administrative updates) will be reflected in an updated Policy on this page without separate notification. We encourage you to review this Policy periodically to stay informed of our current data practices.
Your continued use of the Platform after the effective date of any revision constitutes your acknowledgement of the updated Policy. If you do not accept the revised Policy, you must cease using the Platform and request account closure.
If you have any questions, concerns, or requests relating to this Privacy Policy or to the processing of your Personal Data by MSToto, please contact us using one of the following channels:
Data Privacy Enquiries
[email protected]
Subject line: "Privacy Policy Enquiry" or "Data Rights Request"
Response within 5 business days
Live Chat Support
Available 24/7 via the live chat widget
For urgent data security concerns
Average response: <2 minutes
MSToto processes data rights requests within 30 days of receipt. Complex requests may require an extension, for which we will notify you in advance.
Our support team is available around the clock to help you understand your rights, process data requests, and address any privacy concerns. Transparency is not just a policy at MSToto — it is a practice.