Privacy Policy

This Privacy Policy (hereinafter "the Policy") sets out the manner in which Kompastoto (hereinafter "the Platform", "we", "us", or "our") collects, processes, stores, discloses, and otherwise handles the personal data of individuals (hereinafter "Player", "User", or "You") who access or use the Kompastoto online betting and gaming platform available at https://kompastoto.cam (the "Website").

Kompastoto is committed to protecting your privacy and handling your personal data in an open, transparent, and responsible manner. This Policy has been drafted to align with the Malaysian Personal Data Protection Act 2010 (PDPA) and applicable international best practices in data privacy, recognising that the majority of our player base is based in Malaysia — including Kuala Lumpur, Petaling Jaya, Shah Alam, Penang, Johor Bahru, and Bangsar.

By accessing the Website, creating an account, or using any of our services, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree to any part of this Policy, you must discontinue use of the platform immediately.

This Policy should be read alongside our Terms & Conditions and Responsible Gambling Policy, all of which together constitute the complete agreement governing your relationship with Kompastoto.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

Depending on how you interact with the Kompastoto platform, we may collect the following categories of personal data:

Identity & Contact Data

• Full legal name as stated on official identification documents
• Date of birth (for age verification — 21+ requirement)
• Malaysian MyKad number or valid passport number (for non-Malaysian citizens)
• Residential address, including city (e.g., Kuala Lumpur, Penang, Johor Bahru)
• Email address and mobile phone number

Financial & Transaction Data

• Bank account details (account number, bank name — e.g., Maybank, CIMB, Public Bank, Hong Leong)
• E-wallet identifiers (Touch 'n Go eWallet, Boost, GrabPay)
• DuitNow registered mobile number or identification number
• Deposit and withdrawal transaction history in MYR
• Cryptocurrency wallet addresses where applicable (USDT TRC20)

Betting & Gaming Activity Data

• Wagering history, bet amounts, selections, and outcomes
• Casino game session data, including game type, duration, and results
• Bonus redemption history and promotional participation records
• Responsible gambling tool usage (deposit limits, self-exclusion requests)

Technical & Device Data

• IP address and approximate geolocation
• Browser type and version, operating system, and device type
• Session timestamps, page visit data, and clickstream analytics
• Cookies and similar tracking technologies as described in Section 10

Communications Data

• Records of correspondence between you and our support team via live chat, WhatsApp, or email
• Feedback, complaints, and dispute records

Kompastoto collects personal data through the following channels:

• Direct interactions: Data you provide voluntarily when registering an account, completing KYC verification, making deposits or withdrawals, placing bets, contacting support, or responding to promotions.
• Automated technologies: Data collected automatically when you access the platform, including cookies, server logs, and analytics tools that record your browsing and betting behaviour.
• Third-party sources: Data received from identity verification partners, payment processors (e.g., FPX network, bank APIs), fraud detection services, and regulatory compliance providers — solely for the purposes of verifying your identity and processing transactions securely.

Kompastoto processes your personal data for the following specific, legitimate purposes:

Kompastoto processes your personal data on one or more of the following legal bases, as applicable in each instance:

• Contractual necessity: Processing required to perform our contractual obligations to you, including account management, transaction processing, and service delivery.
• Legal obligation: Processing necessary to comply with applicable legal requirements, including KYC/AML obligations, age verification, and regulatory reporting.
• Legitimate interests: Processing undertaken for our legitimate business interests — such as fraud detection, platform security, and product improvement — where these interests are not overridden by your rights and freedoms.
• Consent: Processing for purposes such as direct marketing, personalisation, and non-essential cookies, where you have provided your explicit, informed consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Kompastoto does not sell, rent, or trade your personal data to third-party marketers. We may share your personal data in the following limited circumstances:

• Payment processors and banking partners: We share necessary financial data with Malaysian payment network providers (including FPX, DuitNow, Maybank, CIMB, Public Bank, Touch 'n Go eWallet, Boost, and GrabPay) to process transactions on your behalf.
• Identity verification providers: We engage accredited KYC and AML compliance partners to verify your identity and age using your submitted identification documents.
• Cloud and hosting infrastructure: Your data may be processed by our cloud infrastructure providers, subject to data processing agreements that require them to handle your data only as directed by Kompastoto.
• Fraud prevention services: We share device and behavioural signals with fraud detection providers to protect the platform and all players from malicious activity.
• Legal and regulatory authorities: We will disclose personal data to law enforcement agencies, regulatory bodies, or courts where we are legally compelled to do so, or where we believe disclosure is necessary to prevent fraud, protect persons, or enforce our Terms.
• Business transfers: In the event of a merger, acquisition, restructuring, or sale of assets, your personal data may be transferred to the acquiring entity, subject to equivalent data protection commitments.

Kompastoto retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Account and identity data: Retained for the duration of your active account and for a minimum of five (5) years following account closure, in compliance with AML and regulatory record-keeping requirements.
• Transaction and financial records: Retained for a minimum of seven (7) years from the date of the transaction, in accordance with standard financial record-keeping obligations.
• Betting and gaming activity logs: Retained for a minimum of three (3) years for dispute resolution, responsible gambling monitoring, and regulatory audit purposes.
• Communications and support records: Retained for two (2) years from the date of the last communication, or for the duration of any ongoing dispute.
• Marketing consent records: Retained until you withdraw consent or request erasure, whichever is earlier.

Upon expiry of the applicable retention period, personal data will be securely deleted or irreversibly anonymised. Where data cannot be deleted immediately due to technical or legal constraints, it will be isolated and protected from further processing until deletion is possible.

Kompastoto implements and maintains a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, disclosure, or destruction. These measures include:

• Encryption: All personal data is encrypted at rest using AES-256 encryption. All data transmitted between your device and our servers is encrypted in transit using TLS 1.2 or higher.
• Access controls: Access to personal data is restricted to authorised personnel on a strict need-to-know basis. Role-based access controls and two-factor authentication are enforced for all internal system access.
• Intrusion detection: Continuous 24/7 monitoring systems detect and alert on suspicious activity, unauthorised access attempts, and anomalous data access patterns.
• Penetration testing: Our systems undergo regular security assessments and penetration testing by qualified security professionals.
• Incident response: We maintain a documented data breach response procedure. In the event of a breach affecting your personal data, we will notify you and relevant authorities within the timeframes required by applicable law.

While we employ industry-standard security measures, no method of electronic storage or internet transmission is completely secure. You are responsible for maintaining the confidentiality of your own account credentials and for notifying us promptly of any suspected unauthorised account access.

The Kompastoto platform uses cookies and similar tracking technologies to enhance your browsing experience, maintain your session security, and collect anonymised analytics data. The following categories of cookies are used:

• Strictly necessary cookies: Essential for the operation of the platform, including session authentication, security tokens, and user preference storage. These cookies cannot be disabled without affecting platform functionality.
• Analytics cookies: First-party analytics tools collect aggregated, anonymised data on page visits, feature usage, and navigation patterns to help us improve the platform. No personally identifiable information is contained in analytics reports.
• Functional cookies: Remember your language preferences, regional settings, and customisations to provide a more personalised experience during your session.

Kompastoto does not deploy third-party advertising cookies or cross-site tracking technologies. You may manage your cookie preferences through your browser settings. Please note that disabling certain cookies may affect platform functionality, including the ability to maintain your login session.

Subject to applicable law and certain exceptions, you have the following rights with respect to your personal data held by Kompastoto:

• Right of Access: You have the right to request a copy of the personal data we hold about you, together with information about how it is being processed.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data held by us.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
• Right to Restrict Processing: You may request that we temporarily suspend processing of your personal data in certain circumstances, for example, while a dispute is being resolved.
• Right to Data Portability: Where technically feasible, you may request a structured, machine-readable copy of the personal data you have provided to us, for the purpose of transferring it to another service provider.
• Right to Object: You have the right to object to the processing of your personal data where that processing is based on legitimate interests or is used for direct marketing purposes.
• Right to Withdraw Consent: Where we process your data based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, please contact our support team via live chat or email. We will acknowledge your request within 5 business days and complete it within 14 business days, or notify you if a longer period is required. We may ask you to verify your identity before processing your request.

The Kompastoto platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect personal data from persons under 21. As part of our registration process, all players are required to confirm their age and to submit government-issued identification for KYC verification before withdrawal facilities are enabled.

If we become aware that personal data has been collected from an individual under the age of 21, we will immediately suspend the relevant account, delete the associated personal data, and return any deposited funds to the originating payment method following identity confirmation.

In the course of providing the platform, your personal data may be transferred to, stored in, or processed by systems located outside of Malaysia. This may occur, for example, where we use cloud hosting infrastructure or specialist service providers based in other jurisdictions.

Where such transfers occur, Kompastoto ensures that appropriate safeguards are in place to protect your personal data to a standard equivalent to or exceeding that required by the Malaysian PDPA. Safeguards may include contractual data protection clauses, adequacy determinations, or other legally recognised transfer mechanisms.

You may contact us to request further information about the safeguards applied to any specific cross-border data transfer involving your personal information.

Kompastoto reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or the services we offer. Where material changes are made, we will notify registered Players via the platform or by email to the address on record.

The effective date of the most recent revision is displayed at the top of this page. Your continued use of the Kompastoto platform following any amendment constitutes your acceptance of the revised Policy. We encourage you to review this page periodically to stay informed of how we handle your personal data.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by Kompastoto, you may reach us through the following channels: