RajaSloto Privacy Policy – Data Protection Our Malaysian Members Come First

RajaSloto collects various types of information from our members during the registration process, platform usage, and financial transactions. Below are the categories of data we collect along with the purpose of each:

Registration & Identity Information

• Full name as shown on MyKad
• MyKad number or passport number (for non-citizen members)
• Date of birth (for minimum age verification of 18 years)
• Active email address
• An active Malaysian mobile number
• Account password (stored in a hashed format that cannot be read directly)

Financial & Transaction Information

• Deposit and withdrawal records, including amounts, dates, and payment methods
• Bank account or e-wallet details used (account numbers are partially masked)
• Complete transaction history for anti-money laundering compliance purposes

Platform Usage Data

• Login and logout records including date, time, and IP address
• Gaming history — game types, bet amounts, wins, and losses
• Device information including browser type, operating system, and screen resolution
• Approximate location data based on IP address (not GPS or precise location)

Data collected is used exclusively for purposes related to RajaSloto's services. The table below provides a summary of how data is used and the corresponding legal basis:

For marketing purposes — such as sending promotional emails about new bonuses or special offers from RajaSloto — we will only do so if you have given explicit consent during registration or through your account settings. You may withdraw this consent at any time via the "unsubscribe" link in our emails or through the notification settings in your account.

RajaSloto does not sell, rent, or disclose members' personal data to any third party for their own commercial or marketing purposes. However, there are limited situations where we need to share certain data with specific third parties in order for the platform to function properly:

Payment Service Providers

To process your deposit and withdrawal transactions via Touch 'n Go eWallet, GrabPay, DuitNow, FPX (Maybank2u, CIMB Clicks), Boost, and ShopeePay, the necessary transaction information is shared with the respective payment providers. All providers are bound by strict privacy agreements and comply with international PCI-DSS security standards.

Game Providers & Software

To enable you to play slots, live casino, poker, and place Sports Betting wagers, limited account information is shared with the gaming software providers we work with. This data is restricted to your unique account identifier and does not include your full financial details or MyKad number.

Regulatory Authorities & Law Enforcement

Where required by Malaysian law or a valid court order, RajaSloto may be obligated to disclose certain information to the relevant authorities. This includes investigations related to money laundering, fraud, or other financial crimes. Any such disclosure will be made strictly in accordance with the proper legal procedures.

RajaSloto continuously invests in security infrastructure to ensure members' personal data is protected to the highest achievable standard. Below are the key security measures we have implemented:

Technical Security

• Data encryption in transit: All communications between your browser and RajaSloto's servers use TLS 1.3 protocol with 256-bit SSL encryption. Our SSL certificate is issued by an internationally recognised certificate authority.
• Data encryption at rest: Sensitive data stored in our databases is encrypted using the AES-256 algorithm, which cannot be broken with current computing power.
• Intrusion detection system: Our platform is equipped with an IDS/IPS (Intrusion Detection & Prevention System) that monitors incoming traffic in real time to detect and block suspicious activity.
• Regular penetration testing: We conduct regular penetration testing carried out by independent third-party cybersecurity experts to identify and address any vulnerabilities before they can be exploited.

Access Controls & Internal Procedures

• Principle of least privilege – each staff member only has access to the data necessary for their specific role
• Two-factor authentication is mandatory for all staff access to systems containing members' personal data
• All staff actions within the system are recorded in tamper-proof audit logs
• Mandatory information security training for all staff on a regular basis

RajaSloto uses cookies and similar tracking technologies to enhance the user experience on our platform. The following are the types of cookies we use:

You can manage your cookie settings through your web browser. However, disabling essential cookies may affect the functionality of the RajaSloto platform and prevent you from logging in securely. Analytics and preference cookies can be disabled without impacting the platform's core functions.

As a RajaSloto member, you have the following rights regarding your personal data. All requests will be processed at no charge within 14 business days of receiving a valid request:

• Right to Access: You have the right to obtain a copy of all personal data we hold about you.
• Right to Rectification: If any of your data is inaccurate or out of date, you have the right to request an immediate correction.
• Right to Erasure: Under certain circumstances, you have the right to request that we delete your personal data. Please note that some data may need to be retained for a specified period in order to fulfil legal obligations.
• Right to Restrict Processing: You may request that we restrict how we use your data in certain situations, such as during the investigation of a dispute.
• Right to Data Portability: You may request a copy of your data in a machine-readable format for transfer to another service if desired.
• Right to Object: You may object to the processing of your data for direct marketing purposes at any time.

To submit any request relating to these rights, please send an email to support@rajasloto.site with the subject line "Data Privacy Request – [Your Account Number]" or contact us via live chat within the platform.

RajaSloto retains members' personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable Malaysian law. Below is our data retention policy by category:

• Active account data: Retained for the duration your account remains active and for 5 years following account closure, in compliance with financial and anti-money laundering legal requirements.
• Financial transaction records: Retained for 7 years from the date of transaction in compliance with Malaysia's accounting and tax legal requirements.
• Security and access logs: Retained for 2 years for security incident investigation purposes if required.
• Customer support communication data: Retained for 3 years to assist in resolving any disputes that may arise during that period.
• Marketing data (where consent has been given): Retained until you withdraw consent or request deletion.

Once the relevant retention period has ended, data will be permanently deleted or fully anonymised so that it can no longer be linked to any specific individual. The deletion process follows procedures that ensure the data cannot be recovered.

If you have any questions, concerns, or requests regarding how RajaSloto handles your personal data, we encourage you to reach out to us directly. We are committed to providing clear, accurate, and helpful responses within a reasonable timeframe.

You can reach our data privacy team via:

• Email: support@rajasloto.site – Use the subject line "Data Privacy Inquiry" to ensure your request is handled by the right team. We aim to respond within 2 business days.
• Live Chat: Via the live chat icon within the RajaSloto platform — for urgent enquiries, this is the fastest option, with an average response time of under 2 minutes.

For formal requests relating to data protection rights — such as access, rectification, or deletion requests — please submit via email, including your account number and a copy of your identification document for verification purposes. This is not intended to be burdensome, but to ensure that we only disclose or modify data to the rightful account holder.