Privacy Policy nanastoo —
Data Protection Malaysian Members

Welcome to the nanastoo Privacy Policy. This document is the official agreement between you as a registered member or visitor of nanastoo.com and nanastoo as the operator of this online gaming platform. This policy explains in detail how we manage your personal information in a responsible, transparent, and secure manner.

Nanastoo understands that privacy is more than a legal obligation — it is the foundation of trust we build with every member. We are therefore committed to ensuring that every piece of data you share with us is protected by the best technology and procedures available.

By using the Nanastoo platform, you agree to the terms set out in this Privacy Policy. If you do not agree with any part of this policy, please discontinue use of our platform and contact our support team for next steps. We encourage you to read this entire document carefully before registering an account.

This policy applies to all types of personal data collected through our website, mobile app, email communications, customer service interactions, and any other communication channels provided by Nanastoo.

Nanastoo collects several categories of personal data to ensure our services operate correctly, securely, and in compliance with legal requirements. We only collect data that is genuinely necessary and do not collect excessive information.

In addition to data you provide directly, nanastoo also collects data automatically when you use our platform. This includes information about the device used, web browser, operating system, and general usage patterns that help us detect suspicious activity and improve service quality.

In certain circumstances, particularly during the identity verification process, we may request supporting documents such as a photo of your ID card, passport, utility bill, or recent bank statement. These documents are stored securely and accessed only by authorised personnel.

Every piece of data nanastoo collects has a clear and legitimate purpose. We do not use your data for unrelated purposes without obtaining your consent first. The following are the primary purposes for which your personal data is used:

• Account Management: Creating, verifying, and managing your member account, including a secure login process using two-factor authentication.
• Transaction Processing: Processing deposits, withdrawals, and other financial transactions quickly, securely, and accurately in accordance with your instructions.
• Legal Compliance: Fulfilling legal obligations under the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLATFPUAA) and related regulations.
• Fraud Prevention: Detecting, investigating, and preventing fraudulent activity, money laundering, or misuse of our platform.
• Customer Support: Responding to enquiries, resolving complaints, and providing effective technical assistance to every member.
• Marketing Communications: Sending promotional information, exclusive offers, and the latest nanastoo news — only if you have given consent to receive such communications.
• Platform Enhancements: Analysing usage patterns in aggregate to improve our platform's design, performance, and features.

We use different legal bases to process your data depending on the purpose. These include the performance of a contract (to manage your account and transactions), legal obligations (for AML and KYC compliance), our legitimate interests (for platform security), and your consent (for marketing communications).

Nanastoo does not sell, rent, or disclose your personal data to any third party for commercial purposes. However, in certain limited situations, we may need to share your information with the following parties:

• Payment Service Providers: Information required to process your deposit and withdrawal transactions is shared with payment providers that hold internationally recognised security certifications.
• Identity Verification Services: KYC data may be shared with recognised third-party identity verification service providers for background checks required by law.
• Law Enforcement Authorities: nanastoo will disclose information to the police, regulatory bodies, or courts when required to do so by law or a valid court order.
• Technology Providers: Cloud service providers, cybersecurity, and technical infrastructure partners that help operate our platform, subject to strict confidentiality agreements.
• Analytics Services: Aggregated and anonymised data may be shared with analytics services for platform improvement purposes, without revealing individual identities.

In the event of a merger, acquisition, or transfer of Nanastoo's business assets, members' personal data may be transferred as part of that transaction. In such circumstances, members will be notified in advance and your data will continue to be protected under the same or stricter privacy policy.

Protecting your personal data is nanastoo's top priority. We implement multiple layers of technical and organisational security measures to ensure your data is always protected from unauthorised access, disclosure, alteration, or destruction.

• 256-bit SSL encryption for all data transmitted between your browser and our servers.
• Encryption of sensitive data at rest using industry-leading encryption algorithms.
• Two-factor authentication (2FA) for all account logins to prevent unauthorized access.
• 24/7 security monitoring with an advanced intrusion detection system.
• Regular security audits and penetration testing by independent third parties.
• Strict access controls — only authorised staff may access members' personal data.
• Mandatory data security training for all nanastoo staff.
• A comprehensive incident response procedure to address any data breaches promptly.

While nanastoo takes all reasonable precautions to protect your data, no security system is completely impenetrable. We encourage you to play an active role in protecting your account by using a strong password, enabling 2FA, and never sharing your login credentials with anyone.

Nanastoo uses cookies and similar tracking technologies to enhance your experience on our platform, secure your login sessions, and understand how members use our services. Cookies are small text files stored on your device when you visit our website.

• Essential Cookies: Required for core platform functions such as login session verification, security, and basic navigation. These cookies cannot be disabled without affecting platform functionality.
• Functional Cookies: Storing your preferences such as language selection and display settings to deliver a more personalised experience.
• Analytics Cookies: Collecting anonymised information about how you use our platform to help us understand usage patterns and make improvements.
• Security Cookies: Used to detect suspicious activity, prevent fraud, and ensure the integrity of your login session.

You can manage or delete cookies through your web browser settings at any time. However, disabling certain cookies may affect the functionality of the Nanastoo platform. Essential cookies cannot be disabled as they are required for security and core platform operations.

As a nanastoo member, you have a range of rights regarding your personal data that we fully respect and uphold. These rights are part of our commitment to transparency and accountability in data management.

• Right of Access: You have the right to request a copy of all personal data we hold about you at any time.
• Right to Rectification: You can request that we correct any personal information that is inaccurate or out of date.
• Right to Erasure: In certain circumstances, you may request the deletion of your personal data, subject to our legal data retention obligations.
• Right to Restriction of Processing: You can request that we restrict how we process your data in certain circumstances.
• Right to Object: You have the right to object to the processing of your data for direct marketing purposes at any time.
• Right to Data Portability: You can request a copy of your data in a structured, machine-readable format.
• Right to Withdraw Consent: You may withdraw consent previously given at any time without affecting the validity of processing carried out before the withdrawal.

Nanastoo retains your personal data only for as long as necessary for the purposes stated in this Privacy Policy or as required by applicable Malaysian law. Retention periods vary according to the type of data and compliance requirements.

• Active account data is retained for as long as your account is active and for 5 years after account closure, in line with AMLATFPUAA requirements.
• Financial transaction records are retained for a minimum of 6 years for audit and tax compliance purposes.
• Customer service communication data is retained for 2 years from the date of the last interaction.
• Security logs and technical data are retained for 12 months for fraud detection and security purposes.
• Marketing and communication preference data is retained until you withdraw consent or close your account.

Once the retention period expires, your data will be securely deleted or permanently anonymized using methods that ensure it cannot be recovered or re-linked to your identity.

The nanastoo platform is strictly for individuals aged 18 and above. We do not knowingly collect or process personal data from minors. This Privacy Policy does not apply to children, and we take active steps to prevent minors from accessing our services.

During the registration process, every prospective member is required to confirm that they are 18 years of age or older. nanastoo also conducts age checks as part of our KYC process. Any account found to have been registered by a minor will be terminated immediately and the associated data will be deleted in accordance with applicable law.

Nanastoo reserves the right to update or amend this Privacy Policy at any time to reflect changes in our practices, legal requirements, or technological developments. Any material changes will be communicated to members via an in-platform notice or registered email at least 14 days before the changes take effect.

The "Updated" date at the top of this page will always reflect the date this Privacy Policy was last reviewed. Continued use of the nanastoo platform following any changes to this Privacy Policy will be deemed as your acceptance of the updated version.

If you have any questions, concerns, or complaints regarding this Privacy Policy or how nanastoo handles your personal data, our team is here to help.

You can contact Nanastoo's Data Protection Officer (DPO) via our official email. All privacy-related enquiries will be responded to within 5 business days. For urgent matters related to account security, please use our 24/7 live chat channel for immediate assistance.

Nanastoo welcomes any feedback regarding our privacy policy. Your feedback helps us continuously improve our data protection standards and deliver a safer, more trusted experience for all members.