Privacy Policy — toto168

1Introduction

This Privacy Policy ("Policy") is issued by toto168 ("toto168", "we", "us", "our"), the operator of the online gaming and sports betting platform accessible at toto168.cam ("the Platform"). This Policy applies to all visitors, registered members, and prospective members who interact with the Platform in any capacity.

At toto168, we take the privacy and security of your personal data seriously. This Policy is designed to provide you with clear and transparent information about how we collect, use, disclose, store, and protect personal data in connection with your use of the Platform and its associated services.

If you have any questions about this Policy or how toto168 handles your personal data, please refer to Section 15 (Contact Us) for the appropriate contact channels.

2Definitions

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

• "Personal Data" means any information that identifies or could reasonably be used to identify a natural person, directly or indirectly, including name, identification number, location data, online identifiers, or factors specific to the physical, economic, or social identity of that person.
• "Processing" means any operation or set of operations performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, or deletion.
• "Data Controller" means toto168, the entity that determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Processor" means any third party that processes Personal Data on behalf of toto168 in accordance with toto168's instructions and this Policy.
• "Cookies" means small text files placed on your device by the Platform to facilitate functionality, analytics, and personalisation.
• "KYC Data" means identity and verification documentation collected to satisfy Know Your Customer obligations, including government-issued identification documents and proof of address.
• "Financial Data" means payment method details, transaction records, deposit and withdrawal history, and associated account information processed in connection with your use of MYR-denominated Platform services.
• "User" or "you" means any individual who accesses, registers on, or uses the Platform.

3Data We Collect

toto168 collects only the personal data that is necessary to provide our services, satisfy regulatory obligations, and maintain Platform security. The categories of personal data we collect are as follows:

3.1 Registration & Account Data

When you register an Account on the Platform, we collect: full name, date of birth, email address, mobile phone number, residential address (including city and postcode — applicable to users across Malaysia including Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru, Shah Alam, and other locations), username, and password (stored in hashed form).

3.2 KYC & Identity Verification Data

To comply with regulatory requirements and to process withdrawal requests, we may collect: copies of government-issued identification (e.g., Malaysian MyKad or passport), proof of residential address, and supporting documents confirming payment method ownership.

3.3 Financial & Transaction Data

In connection with deposits and withdrawals conducted via our accepted Malaysian payment channels — including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, and Hong Leong — we collect: payment method identifiers, transaction amounts in MYR, transaction timestamps, and transaction reference numbers.

3.4 Gameplay & Betting Activity Data

We collect records of your gaming and betting activity, including wagers placed, games played, bet amounts, outcomes, bonus usage, and session duration. This data is used for account management, regulatory reporting, dispute resolution, and responsible gambling monitoring.

3.5 Technical & Device Data

We automatically collect certain technical information when you access the Platform, including: IP address, device type and operating system, browser type and version, referring URL, pages viewed, time spent on pages, and session identifiers.

3.6 Communications Data

When you contact our support team via live chat or email, we retain records of those communications, including the content of messages, timestamps, and any attachments or documentation you provide.

4How Data Is Collected

toto168 collects personal data through the following methods:

• Directly from you: When you complete the account registration form, submit KYC documentation, make deposits or withdrawals, or contact customer support.
• Automatically: Through Cookies, web beacons, log files, and similar tracking technologies as described in Section 8 of this Policy.
• From third-party payment processors: Transaction confirmation data received from our integrated Malaysian payment partners in connection with deposit and withdrawal processing.
• From identity verification service providers: Data returned by authorised KYC verification services used to confirm the authenticity of identity documents submitted by Users.
• From fraud prevention and security services: Risk signals and device intelligence data from third-party security providers used to detect and prevent fraudulent activity on the Platform.

5Data Processing — Purposes of Use

toto168 processes your personal data for the following specific and legitimate purposes:

1. Account Registration and Management: To create, maintain, and administer your toto168 Account, including managing your balance, transaction history, bonus entitlements, and responsible gambling settings.
2. Payment Processing: To facilitate deposits and withdrawals in MYR via the accepted Malaysian payment methods, verify payment method ownership, and maintain accurate financial records.
3. KYC and Identity Verification: To verify your identity and age (minimum 21 years) in accordance with applicable regulatory requirements, prior to processing withdrawal requests or upon reasonable request.
4. Game and Service Delivery: To provide access to casino games, live dealer tables, sports betting markets, and all associated Platform features and functionality.
5. Responsible Gambling Monitoring: To identify patterns of gameplay that may indicate problem gambling behaviour, and to facilitate the application of responsible gambling tools including deposit limits, session time limits, and self-exclusion.
6. Fraud Detection and Platform Security: To detect, investigate, and prevent fraudulent activity, money laundering, multi-accounting, and other prohibited conduct as defined in our Terms & Conditions.
7. Customer Support: To respond to enquiries, resolve disputes, process complaints, and maintain records of communications for quality assurance purposes.
8. Legal and Regulatory Compliance: To comply with applicable laws, regulations, and obligations imposed by relevant regulatory authorities, including record-keeping and reporting requirements.
9. Marketing Communications (where consented): To send you promotional communications about toto168 bonuses, promotions, and new features where you have provided explicit consent. You may withdraw this consent at any time.
10. Platform Improvement: To analyse aggregate usage data to improve Platform performance, user experience, and the range of services offered to Malaysian players.

6Legal Basis for Processing

toto168 processes personal data on the following legal grounds:

• Contractual Necessity: Processing is necessary for the performance of the contract between toto168 and the User, including the provision of gaming services, payment processing, and account management.
• Legal Obligation: Processing is required to comply with applicable laws and regulatory obligations, including KYC, anti-money laundering, and record-keeping requirements.
• Legitimate Interests: Processing is necessary for toto168's legitimate business interests, including Platform security, fraud prevention, and responsible gambling monitoring, provided such interests are not overridden by your rights and freedoms.
• Consent: Where processing is based on consent (e.g., marketing communications), you have provided explicit and informed consent, which may be withdrawn at any time without affecting the lawfulness of prior processing.

7Data Sharing & Disclosure

toto168 does not sell, rent, or trade your personal data to any third party for commercial purposes. Your personal data may be shared with third parties only in the following specific circumstances:

• Payment Service Providers: Personal data necessary to process deposits and withdrawals is shared with our integrated Malaysian payment partners, including Touch 'n Go, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, and Hong Leong, solely for transaction processing purposes.
• KYC and Identity Verification Providers: Identity documentation is shared with authorised verification service providers for the sole purpose of confirming your identity and age.
• Game Content Providers: Anonymised or pseudonymised gameplay data may be shared with licensed game providers for reporting and auditing purposes in connection with the games hosted on the Platform.
• IT and Security Service Providers: Technical data may be processed by our cloud infrastructure and security service providers, who are contractually bound to handle your data in accordance with this Policy.
• Regulatory Authorities and Law Enforcement: Where required by applicable law, court order, or regulatory directive, toto168 may disclose personal data to the relevant authorities. toto168 will notify affected Users of such disclosure where legally permissible to do so.
• Fraud Prevention Networks: In cases of suspected fraud or financial crime, toto168 may share relevant data with industry fraud prevention bodies or law enforcement agencies.

8Cookies & Tracking Technologies

toto168 uses Cookies and similar tracking technologies to enhance the functionality and performance of the Platform. The categories of Cookies used by toto168 are as follows:

• Strictly Necessary Cookies: Essential for the Platform to operate correctly. These enable core functionality such as session management, secure login, and shopping cart persistence for deposit flows. These Cookies cannot be disabled without affecting core Platform functionality.
• Performance and Analytics Cookies: Used to collect anonymised data about how Users interact with the Platform, including pages visited, time spent, and error messages encountered. This data is used solely to improve Platform performance.
• Functional Cookies: Used to remember your preferences and settings, such as preferred language and display options, to personalise your Platform experience.
• Security Cookies: Used for fraud detection, device fingerprinting, and security monitoring to protect the Platform and its Users from unauthorised access and abuse.

You may manage or disable non-essential Cookies through your browser settings at any time. Please note that disabling certain Cookies may impair the functionality of the Platform. toto168 does not currently employ third-party advertising or behavioural tracking Cookies.

9Data Retention

toto168 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, and in any event for the minimum period required by applicable law and regulatory obligations.

• Account Data: Retained for the duration of the account relationship and for a period of not less than five (5) years following account closure, in compliance with applicable financial record-keeping requirements.
• KYC Documentation: Retained for a minimum of five (5) years from the date of verification, or for such longer period as may be required by applicable anti-money laundering regulations.
• Transaction Records: Financial transaction data is retained for a minimum of seven (7) years from the date of the transaction.
• Gameplay and Betting Records: Retained for a minimum of five (5) years for regulatory compliance and dispute resolution purposes.
• Support Communications: Retained for a period of three (3) years from the date of the communication.
• Technical and Log Data: Retained for a period of up to twelve (12) months.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in a manner that prevents re-identification.

10Security Measures

toto168 implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. Our security measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the Platform is encrypted using industry-standard TLS encryption protocols.
• Encryption at Rest: Sensitive data categories, including KYC documentation and financial information, are encrypted at rest using AES-256 encryption.
• Password Security: User passwords are stored using one-way cryptographic hashing algorithms. Plaintext passwords are never stored or transmitted.
• Access Controls: Access to personal data is restricted to authorised personnel on a strict need-to-know basis, with role-based access controls and audit logging.
• Regular Security Assessments: The Platform undergoes regular security testing and vulnerability assessments to identify and remediate potential weaknesses.

11User Rights

Subject to applicable law and any overriding legal obligations, you hold the following rights in relation to your personal data held by toto168:

• Right of Access: You have the right to request a copy of the personal data toto168 holds about you and to be informed of the purposes for which it is processed.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data held by toto168. You may update certain account details directly within your Account settings.
• Right to Erasure: In certain circumstances, you may request that toto168 delete your personal data. This right is subject to toto168's legal obligations to retain data for regulatory compliance purposes, which may override a deletion request.
• Right to Restriction of Processing: In certain circumstances, you may request that toto168 restrict the processing of your personal data while a complaint or accuracy dispute is being resolved.
• Right to Data Portability: Where processing is based on consent or contract, you may request receipt of your personal data in a structured, commonly used, and machine-readable format.
• Right to Object: You have the right to object to processing of your personal data carried out on the basis of toto168's legitimate interests. You also have an unconditional right to object to processing of your personal data for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing conducted prior to withdrawal.

To exercise any of the above rights, please submit a written request to [email protected], clearly identifying the right you wish to exercise and including your registered username and Account ID. toto168 will respond to all verified requests within thirty (30) calendar days.

12Minors & Age Gating

The toto168 Platform is strictly intended for individuals aged 21 years and above. toto168 does not knowingly collect personal data from individuals below the minimum age of 21. Age verification is a mandatory step in our KYC process and is enforced for all account holders.

13International Data Transfers

Your personal data is primarily processed and stored within the jurisdiction of the Platform's operating infrastructure. Where it is necessary to transfer personal data to service providers or processors located in other countries, toto168 will ensure that appropriate safeguards are in place, including contractual data protection clauses, to ensure that your personal data receives a level of protection consistent with the standards described in this Policy.

By using the Platform, you acknowledge that your personal data may be transferred to and processed in jurisdictions outside Malaysia. toto168 takes all reasonable steps to ensure that such transfers are conducted in a secure and lawful manner.

14Amendments to This Policy

toto168 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we offer. Where material changes are made to this Policy, toto168 will provide reasonable advance notice to registered members via the Platform or by email to the address associated with your Account.

Your continued use of the Platform following the publication of an updated Privacy Policy constitutes your acknowledgement and acceptance of the revised Policy. We recommend that you review this Policy periodically to stay informed of any changes.

15Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or toto168's handling of your personal data, please contact us through the following channels:

• Email: [email protected] — please include the subject line "Privacy Enquiry" together with your registered username and Account ID.
• Live Chat: Available 24 hours a day, 7 days a week, directly on the Platform. For data subject rights requests, we recommend submitting via email to ensure a documented record.
• Response Time: toto168 will acknowledge all privacy-related correspondence within 48 hours and will provide a substantive response within 30 calendar days of receipt of a verified request.
• Operating Hours: Our team operates on Malaysia Time (MYT, UTC+8) and covers all Malaysian public holidays.