Privacy Policy

Introduction

This Privacy Policy ("Policy") issued by toto123 ("the Company", "we", "us", "our"), the operator of the online gaming and sports betting platform accessible at https://toto123.cam and all associated services (collectively, "the Platform").

This Policy describes the categories of personal data we collect from users ("you", "your") of the Platform, the purposes for which that data is processed, the legal basis for such processing, how long we retain data, with whom we may share it, and the rights available to you as a data subject.

toto123 operates the Platform primarily for the benefit of players located in Malaysia, including users based in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and throughout the country. Where Malaysian law is relevant to the processing of your personal data, we have regard to the requirements of the Personal Data Protection Act 2010 (PDPA) of Malaysia, in addition to other applicable international data protection standards.

By registering an Account, accessing the Platform, or otherwise providing personal data to toto123, you confirm that you have read and understood this Policy and that you consent to the processing of your personal data as described herein, to the extent such consent is the applicable legal basis. This Policy should be read together with our Terms & Conditions.

Definitions

The following definitions apply throughout this Policy:

Data Controller

toto123 acts as the Data Controller in respect of all personal data collected through the Platform. As Data Controller, toto123 is responsible for determining the purposes and means of processing your personal data and for ensuring that such processing is conducted lawfully, fairly, and transparently.

Where toto123 engages third-party service providers (Data Processors) — such as payment gateway operators, identity verification providers, or cloud hosting services — those parties process your data solely on toto123's instructions, under contractual data processing agreements that obligate them to apply appropriate security measures and restrict their use of your data to the agreed purposes only.

Data We Collect

toto123 collects the following categories of personal data:

4.1 Registration Data

When you create an Account on the Platform, we collect: your full legal name, date of birth, email address, mobile phone number, and chosen username. This data is required to create and maintain your Account.

4.2 Identity Verification (KYC) Data

When you request a withdrawal or where KYC is required under our compliance obligations, we may collect copies of government-issued identification documents (e.g., Malaysian MyKad or passport), selfie photographs for liveness verification, and proof of address documents (e.g., a recent utility bill or bank statement). This data is processed for identity verification and anti-money laundering compliance purposes.

4.3 Financial Data

We collect data relating to your deposits and withdrawals, including transaction amounts, payment method identifiers (e.g., masked e-wallet numbers or bank account numbers), and transaction timestamps. We do not store complete payment card numbers on our servers. Payments are processed via third-party payment processors subject to their own security standards.

4.4 Gaming Activity Data

We collect records of your gaming and betting activity on the Platform, including game history, bet amounts, outcomes, session durations, and promotional bonus usage. This data is used to administer your Account, resolve disputes, and comply with regulatory requirements.

4.5 Technical & Device Data

We automatically collect certain technical data when you access the Platform, including: IP address, device type and operating system, browser type and version, referral URL, and session logs. This data is used for security monitoring, fraud prevention, and Platform optimisation.

4.6 Customer Support Data

When you contact our customer support team — whether via Live Chat, email, or any other channel — we collect and retain records of the communication, including the content of your messages and any documents or files you provide, for the purpose of resolving your enquiry and maintaining quality assurance records.

4.7 Voluntary Data

Where you voluntarily provide additional information — for example, via surveys, feedback forms, or during responsible gambling self-assessment tools — that data is collected and used solely for the purpose for which it was provided.

Purposes of Processing

toto123 processes your personal data for the following specific, documented purposes:

Legal Basis for Processing

toto123 processes your personal data under one or more of the following legal bases, depending on the specific processing activity:

• Contractual Necessity: Processing that is necessary to perform our contract with you — primarily the operation of your Account, processing of deposits and withdrawals, and provision of gaming services.
• Legal Obligation: Processing required to comply with applicable laws, including anti-money laundering legislation, age verification requirements, and financial services regulations.
• Legitimate Interests: Processing necessary for our legitimate business interests — such as fraud prevention, platform security, and service improvement — where those interests are not overridden by your data protection rights.
• Consent: Processing activities for which we have obtained your specific, informed consent, such as the sending of marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Data Sharing & Disclosure

toto123 does not sell, rent, or trade your personal data. We may share your personal data with the following categories of recipients, strictly for the purposes described:

7.1 Payment Service Providers

We share necessary transaction data with payment processors facilitating your deposits and withdrawals via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, and USDT TRC20 networks. These providers process your data solely to execute the payment transaction.

7.2 Identity Verification Providers

We engage accredited third-party KYC and identity verification service providers to assist in verifying the identity documents you submit. These providers are bound by strict confidentiality and security obligations.

7.3 Technology and Hosting Partners

Our Platform is hosted on cloud infrastructure provided by third-party service providers who process data on our behalf under documented data processing agreements.

7.4 Regulatory and Law Enforcement Authorities

Where required by applicable law, court order, or regulatory direction, toto123 will disclose personal data to relevant governmental authorities, law enforcement agencies, or financial intelligence units. We are not able to notify you of such disclosures in all circumstances.

7.5 Fraud Prevention and AML Networks

toto123 may share data with fraud prevention organisations or participate in industry-wide AML information sharing frameworks where permitted or required by law, in order to prevent financial crime.

International Data Transfers

The operation of an international online gaming platform may require the transfer of your personal data to countries outside Malaysia. Where such transfers occur, toto123 takes steps to ensure that your personal data is afforded an equivalent level of protection to that which it enjoys under Malaysian data protection law.

Protective measures we implement for international transfers include: contractual clauses in data processing agreements with third-party processors; assessments of the adequacy of data protection frameworks in the recipient country; and, where applicable, encryption of data in transit and at rest.

By using the Platform and providing your personal data, you acknowledge that your data may be transferred to and processed in jurisdictions outside Malaysia in the manner described in this section.

Data Retention

toto123 retains your personal data for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following general retention periods apply:

• Active Account Data: Retained for the duration of your Account's active status plus a minimum of 7 years after Account closure, to meet AML and regulatory record-keeping obligations.
• KYC and Identity Documents: Retained for a minimum of 7 years following the relevant transaction or account closure, as required by applicable financial services and AML regulations.
• Transaction Records: Retained for a minimum of 7 years to comply with financial record-keeping requirements.
• Customer Support Records: Retained for up to 3 years following resolution of the relevant support case.
• Marketing Consent Records: Retained for as long as you remain subscribed to marketing communications, plus a reasonable period thereafter to evidence consent.
• Technical and Session Logs: Retained for up to 12 months for security and fraud investigation purposes.

When personal data is no longer required for any lawful purpose, it is securely deleted or anonymised so that it can no longer be linked to you as an individual.

Security Measures

toto123 implements a layered set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These include:

• 256-bit SSL/TLS Encryption: All data transmitted between your browser and the Platform is encrypted in transit.
• Encryption at Rest: Sensitive data, including KYC documents and financial records, is encrypted at rest using industry-standard encryption protocols.
• Access Controls: Internal access to personal data is restricted on a strict need-to-know basis. Staff with access to personal data are subject to confidentiality obligations and regular security training.
• Multi-Factor Authentication: Administrative access to systems holding personal data requires multi-factor authentication.
• Penetration Testing and Audits: The Platform is subject to regular third-party security assessments and penetration testing.
• Incident Response: toto123 maintains a documented data breach response procedure. In the event of a data breach that is likely to affect your rights and freedoms, we will notify you and relevant authorities in accordance with applicable legal requirements.

While toto123 takes all reasonable precautions to protect your personal data, no internet transmission can be guaranteed to be 100% secure. You are responsible for maintaining the security of your Account credentials and for notifying us promptly if you suspect any unauthorised access.

Cookies & Tracking Technologies

toto123 uses cookies and similar tracking technologies to operate the Platform, maintain your session state, prevent fraud, and — where you have consented — to analyse usage patterns and deliver relevant content. The following types of cookies are used:

You can manage your cookie preferences via browser settings. Disabling strictly necessary cookies may prevent certain features of the Platform from functioning correctly. Where cookies are set by third-party service providers on our behalf, those cookies are governed by the respective provider's cookie policy, subject to the data processing agreements we have in place.

Minors & Age Policy

The Platform is strictly intended for use by adults aged 21 and above. toto123 does not knowingly collect or process personal data from individuals under the age of 21. All users are required to confirm at registration that they are aged 21 or older, and toto123 may require documentary evidence of age at any time.

If toto123 becomes aware that personal data has been collected from a person under the age of 21, we will immediately delete that data, close the associated Account, and, where appropriate, report the matter to relevant authorities. Any deposits and winings associated with an underage Account will be handled in accordance with our Terms & Conditions.

Exercising Your Data Subject Rights

You may exercise any of the data subject rights described in this Policy by contacting toto123 via Live Chat or by sending a written request to [email protected]. To protect your privacy and security, we will require you to verify your identity before processing any data subject request.

toto123 will respond to verified data subject requests within a reasonable timeframe — typically within 30 calendar days of receipt of a verifiable request. Where the request is complex or numerous, we may extend this period by up to an additional 60 days, in which case we will notify you of the extension and the reason for it.

We will not charge a fee for processing data subject requests unless the request is manifestly unfounded or excessive, in which case we may charge a reasonable administrative fee or decline to process the request, explaining our reasons.

13.1 Limitations on Erasure Rights

Please note that the right to erasure is not absolute. toto123 may be required to retain certain personal data notwithstanding an erasure request, including where retention is required for compliance with a legal obligation (such as AML record-keeping), for the establishment, exercise, or defence of legal claims, or where the data is necessary for the performance of a task carried out in the public interest.

Complaints

If you have a complaint regarding toto123's handling of your personal data, we encourage you to contact us in the first instance so that we can attempt to resolve the matter directly. You may do so by writing to [email protected] with the subject line "Privacy Complaint" or by raising the matter with our 24/7 Live Chat team.

If you are not satisfied with toto123's response to your complaint, you have the right to lodge a formal complaint with the relevant data protection supervisory authority in your jurisdiction. For users based in Malaysia, the relevant authority is the Personal Data Protection Department (PDPD) under the Ministry of Digital, Malaysia.

Policy Amendments

toto123 reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or our data processing practices. Where a change is material — meaning it significantly affects how we use your personal data or your rights as a data subject — we will provide reasonable advance notice via the Platform or by email before the change takes effect.

The "Last Updated" date at the top of this page indicates when this Policy was most recently revised. We encourage you to review this Policy periodically to remain informed about how toto123 protects your information. Your continued use of the Platform following the publication of any amendments constitutes your acknowledgement of the revised Policy.

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy, your personal data, or your subject rights, please contact us using the details below. Our support team is available 24/7 in English, Bahasa Melayu, and Mandarin.

toto123 takes all privacy-related enquiries seriously and will respond to verified requests in a professional and timely manner. If you are unsatisfied with our response, you retain the right to escalate your complaint to the relevant data protection authority in your jurisdiction.