sbotop Privacy Policy

1. Introduction and Scope

This Privacy Policy ("Policy") applies to all personal data collected, processed, or stored by sbotop ("the Company," "we," "us," or "our") in connection with the sbotop website located at https://sbotop.lat and all associated services, products, and features offered through that platform (collectively, "the Platform"). This Policy applies to all registered users of the sbotop Platform, including players based in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, and across Malaysia.

By registering on the Platform, completing the KYC verification process, making a deposit, or otherwise interacting with sbotop's services, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with the terms of this Policy, you must not use the Platform.

This Policy should be read in conjunction with the sbotop Terms & Conditions, which govern your overall use of the Platform.

2. Data Controller Identity

sbotop is the data controller responsible for your personal data collected through this Platform. As data controller, sbotop determines the purposes for which your personal data is processed and the means by which such processing takes place. For all data protection enquiries, you may contact us at: [email protected] (plain text — not a clickable link).

3. Personal Data We Collect

sbotop collects the following categories of personal data from users of the Platform:

• Identity Data: Full legal name, date of birth, gender, nationality, and copies of identity documents (MyKad, passport) submitted during KYC verification;
• Contact Data: Email address, mobile phone number, and residential address;
• Financial Data: Bank account details, e-wallet registration information (Touch n Go eWallet, Boost, GrabPay), cryptocurrency wallet addresses where applicable, and transaction records;
• Account Data: Username, encrypted password hash, account registration date, login history, session timestamps, and device identifiers;
• Gaming Data: Betting history, game activity logs, wager amounts, win/loss records, bonus usage, and Rewards programme activity;
• Technical Data: IP address, browser type and version, operating system, device type, referring URL, and approximate geolocation derived from IP;
• Communications Data: Records of your interactions with sbotop customer support, including chat transcripts and email correspondence;
• Responsible Gaming Data: Self-imposed limit settings, cooling-off or self-exclusion requests, and related correspondence.

4. How We Collect Your Data

sbotop collects personal data through the following means:

• Direct provision: Information you provide when registering an account, completing KYC, making deposits or withdrawal requests, contacting customer support, or participating in promotions;
• Automated technical collection: Data collected automatically when you visit or interact with the Platform, including through cookies, server logs, and analytics tools;
• Third-party payment processors: Transaction confirmation data received from payment service providers including FPX banking network operators, e-wallet platforms, and cryptocurrency gateway services;
• KYC verification providers: Identity and address verification data received from third-party document verification services engaged by sbotop to fulfill its anti-money-laundering obligations;
• Gaming data providers: Game outcome and transaction records received from licensed game content providers whose titles are hosted on the sbotop Platform.

5. Legal Basis for Processing

sbotop processes your personal data on one or more of the following legal grounds:

1. Contractual necessity: Processing required to register your account, verify your identity, process transactions, and deliver the gaming services you have requested under the sbotop Terms & Conditions;
2. Legal obligation: Processing required to comply with anti-money-laundering laws, gaming regulatory requirements, tax reporting obligations, and lawful orders from competent authorities;
3. Legitimate interests: Processing carried out in pursuit of sbotop's legitimate business interests, including fraud prevention, platform security, abuse detection, and improvement of our services, where those interests are not overridden by your fundamental rights and freedoms;
4. Consent: Processing based on your explicit consent, including for marketing communications. Where consent is the legal basis, you have the right to withdraw it at any time without affecting the lawfulness of processing conducted prior to withdrawal.

6. How We Use Your Personal Data

sbotop uses your personal data for the following purposes:

• To register and maintain your account on the Platform;
• To verify your identity and age (21+) in compliance with gaming authority requirements;
• To process deposits and withdrawals via Touch n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank, Hong Leong Connect, and USDT;
• To provide customer support and respond to your enquiries;
• To detect, investigate, and prevent fraudulent activity, collusion, money laundering, and other prohibited conduct;
• To administer promotions, bonuses, and the sbotop Rewards programme;
• To enforce responsible gaming obligations, including processing self-exclusion requests and applying account limits;
• To improve the Platform through aggregate analysis of usage patterns and technical performance data;
• To send transactional communications relating to your account, including deposit confirmations, withdrawal status updates, and security alerts;
• To send promotional communications where you have consented to receive them.

7. Disclosure of Personal Data to Third Parties

sbotop does not sell your personal data to third parties. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection obligations:

• Payment service providers: FPX network operators, e-wallet platforms, and cryptocurrency gateway services, for the purpose of processing your deposits and withdrawals;
• KYC and identity verification providers: Third-party services engaged to verify the identity documents you submit during account verification;
• Game content providers: Licensed software providers whose games are accessible through the sbotop Platform, who receive the minimum data necessary to deliver game functionality;
• IT infrastructure and cloud service providers: Hosting, security, and technical service providers who process data on our behalf under data processing agreements;
• Regulatory and law enforcement authorities: Where sbotop is required by law, court order, or regulatory instruction to disclose personal data;
• Professional advisers: Lawyers, auditors, and consultants engaged under confidentiality obligations in connection with legal or business proceedings.

All third parties with whom sbotop shares personal data are required to implement appropriate technical and organisational security measures and to process data only for the specific purposes for which it was shared.

8. International Data Transfers

The personal data you provide to sbotop may be transferred to and processed in jurisdictions outside of Malaysia. Where such transfers occur, sbotop ensures that appropriate safeguards are in place to protect your personal data to a standard equivalent to that required under applicable Malaysian data protection law and international gaming authority standards. These safeguards include contractual data protection clauses with data processors and sub-processors located in third countries.

9. Data Retention

sbotop retains your personal data for as long as is necessary to fulfil the purposes described in this Policy, subject to the following minimum retention periods:

• Account and identity data: Retained for a minimum of five (5) years following account closure, in compliance with anti-money-laundering regulatory requirements;
• Financial transaction records: Retained for a minimum of seven (7) years following the date of the transaction, for tax and audit compliance purposes;
• Gaming activity logs: Retained for a minimum of three (3) years for dispute resolution and fraud investigation purposes;
• Customer support communications: Retained for two (2) years from the date of the last interaction;
• Marketing consent records: Retained until you withdraw consent plus one (1) year thereafter as a record of the lawful basis for prior communications.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised such that it can no longer be attributed to an identified individual.

10. Cookies and Tracking Technologies

The sbotop Platform uses cookies and similar tracking technologies to facilitate platform functionality, maintain login sessions, remember your preferences, and collect aggregate analytics data. The following categories of cookies are used:

• Strictly necessary cookies: Required for the Platform to function correctly, including session authentication and security tokens. These cannot be disabled without impairing the platform;
• Functional cookies: Remember your language preferences, display settings, and recent activity to personalise your experience;
• Analytics cookies: Collect aggregate, anonymised data about how users interact with the Platform to support ongoing performance improvement. No individual user is identified through this data.

You may control cookie settings through your browser preferences. Disabling certain cookies may affect the functionality of the sbotop Platform.

11. Security of Personal Data

sbotop implements appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include TLS 1.3 encryption for all data in transit, encryption of sensitive data at rest, access controls limiting internal data access to authorised personnel on a need-to-know basis, regular security assessments and penetration testing, and documented incident response procedures.

While sbotop takes data security seriously and invests in robust protective measures, no system is entirely immune to risk. You are responsible for maintaining the confidentiality of your account credentials and for notifying sbotop promptly at [email protected] if you believe your account has been compromised.

12. Your Rights as a Data Subject

Subject to applicable law and certain legal exceptions, you have the following rights with respect to your personal data held by sbotop:

To exercise any of these rights, please contact sbotop at [email protected]. We will respond to all valid requests within 30 days of receipt. We may require you to verify your identity before processing a data subject request.

13. Children and Minors

The sbotop Platform is strictly intended for adults aged 21 and above. sbotop does not knowingly collect personal data from any person under the age of 21. Account registration requires KYC identity verification that confirms the applicant's age. Where sbotop discovers that personal data has been collected from a person under 21, that data will be deleted immediately and the associated account will be closed. Any funds deposited to such an account will be handled in accordance with applicable regulatory requirements.

14. Changes to This Privacy Policy

sbotop reserves the right to update or amend this Privacy Policy at any time. Where changes are material — for example, where we begin processing your data for a new purpose or share it with a new category of third party — we will provide advance notice to registered users via the email address associated with their account and/or by posting a prominent notice on the Platform. The date of the most recent revision is displayed at the top of this Policy. Your continued use of the Platform following the effective date of any change constitutes your acceptance of the revised Policy.

15. Contact and Complaints

If you have any questions, concerns, or complaints regarding this Privacy Policy or sbotop's data processing practices, please contact our support team. All privacy-related enquiries should be directed to: [email protected] (plain text — not a clickable link). Our team will acknowledge receipt of your enquiry within five business days and provide a substantive response within 30 calendar days.

If you are not satisfied with our response, you have the right to escalate your complaint to the relevant data protection supervisory authority in your jurisdiction.