Nanastito Privacy Policy – Malaysia Member Personal Data Protection

Nanastito collects various types of personal data when you register, use the platform, or contact our support team. This data collection is necessary to provide complete and secure services to every member.

Data collected by nanastito used solely for purposes related to platform operations and to deliver the best experience to members. The following are the primary purposes of data use:

• Identity verification & KYC — Verify member identities to meet anti-money laundering (AML) and know your customer (KYC) compliance requirements.
• Transaction processing — Process deposits, withdrawals, and all financial transactions in your account securely and accurately.
• Customer support — Provide relevant assistance when you contact the nanastito support team, including account history reviews where necessary.
• Platform security — Detect and prevent fraudulent activity, account abuse, and any security threats to the platform.
• Service improvement — Analyze usage data in aggregate (without identifying individuals) to understand usage patterns and improve the platform.
• Important communications — Send account-related notifications, policy updates, security information, and promotions you have opted in to receive.
• Legal compliance — Comply with reporting and disclosure obligations required by law and the relevant authorities.

Nanastito does not sell, rent, or disclose members' personal data to outside parties for marketing purposes. However, there are limited situations where we need to share data with certain third parties to keep the platform operating properly:

• Payment service providers — Providers such as FPX, DuitNow, Touch 'n Go eWallet, Boost, and GrabPay receive the transaction details necessary to process your payments. These providers have their own privacy policies and are subject to the same data protection laws.
• Game providers — Game providers partnering with nanastito may receive the session information required to ensure games run correctly. This data is limited and does not include personal financial information.
• Legal authorities — nanastito will disclose required data to authorities such as the police or regulatory bodies if mandated by law or a valid court order.
• Technical service providers — Cloud service and technical infrastructure providers that process data on behalf of nanastito. All such providers are bound by strict data protection agreements.

Nanastito continuously invests in security infrastructure to ensure your personal data remains protected at all times. Our security measures cover multiple layers of protection:

• 256-bit SSL/TLS Encryption — All communications between your browser or app and nanastito's servers are encrypted using the latest industry standards.
• Data encryption at rest — Sensitive data such as passwords and financial information is stored in encrypted form, not as plain text.
• Layered access controls — Access to member data is restricted using a role-based access control (RBAC) system. Staff can only access data necessary for their duties.
• 24/7 security monitoring — Automated monitoring systems operate around the clock to detect intrusion attempts, suspicious access, or abnormal activity.
• Regular security testing — nanastito conducts regular penetration testing and security audits to identify and address vulnerabilities before they can be exploited.

Nanastito uses cookies and similar technologies to keep the platform running smoothly and deliver a better experience to users. The following are the types of cookies we use:

• Essential Cookies — Required for core platform functions such as login authentication and session security. These cookies cannot be disabled as they are necessary for the platform to operate.
• Performance Cookies — Collect information on how pages are used, such as which pages are visited most frequently. This data helps us improve platform performance.
• Functional Cookies — Remember your preferences such as language, display settings, and login information for a more convenient experience on future visits.

You can manage or delete cookies through your web browser settings. However, disabling essential cookies may affect the functionality of the nanastito platform and cause some features to not work properly.

Under Malaysia's Personal Data Protection Act (PDPA) 2010 and best privacy practices, you have the following rights regarding your personal data held by nanastito:

Nanastito does not retain your personal data longer than necessary. Retention periods are determined based on the purpose of data collection and applicable legal requirements:

• Active account data — Retained for as long as your account remains active and for a reasonable period after account closure, for customer support purposes and to resolve any disputes that may arise.
• Financial transaction records — Retained for a minimum of seven (7) years from the transaction date, in line with Malaysia's financial and accounting legal requirements.
• KYC & identity verification records — Retained for a minimum of five (5) years after the end of the business relationship with you, in accordance with anti-money laundering legal requirements.
• Support communication log — Retained for two (2) years for quality monitoring purposes and for reference should you contact us again about the same issue.
• Technical log data — Retained for 90 days for security purposes and technical troubleshooting.

When data is no longer needed and there is no legal requirement to retain it, nanastito will securely delete or anonymise that data.

Nanastito reserves the right to amend this Privacy Policy from time to time to reflect changes in our privacy practices, technology used, current legal requirements, or changes to the services we offer.

When a material amendment occurs — meaning a change that significantly affects how we use your data or your rights — nanastito will:

• Updating the "Last Updated" date at the top of this document.
• Sending notifications to members via their registered email address and/or in-platform notifications.
• Displays a banner or notice within the platform for an appropriate period after any amendments are made.

Continued use of the nanastito platform after amendments take effect constitutes your acceptance of the amended Privacy Policy. If you disagree with the changes made, you have the right to close your account.

If you have any questions, concerns, or requests regarding this Privacy Policy or how nanastito handles your personal data, please contact our support team:

• Live Chat: Available 24/7 on the nanastito platform — the fastest way to get a response.
• Email: [email protected] — for written inquiries that require documentation or a written response.

Our team is ready to assist in both Bahasa Melayu and English. For data rights requests, please provide your account number and identity verification details to facilitate the process.