Privacy Policy toto20 — Data Protection & Your Personal Information

This Privacy Policy describes how toto20 collects, uses, stores and protects your personal information when you use our platform at toto20.me. We understand that privacy is a fundamental right of every individual, and we take this responsibility seriously.

By registering an account or continuing to use the toto20 platform, you agree to the terms set out in this Privacy Policy. This document applies to all services provided by toto20, including the main website, mobile app, and all our customer support channels.

Toto20 complies with the requirements of the Personal Data Protection Act 2010 (PDPA) Malaysia and international best practices in data management. We are constantly working to ensure that the information you entrust to us is handled in the most responsible and transparent manner.

Toto20 collects your personal information through several different channels as you interact with our platform. This information is divided into two main categories:

Information you provide directly:

• Full name, date of birth, and national identity card number (MyKad) or passport.
• Email address, phone number and residential address.
• Bank account details and payment methods registered for deposit and withdrawal purposes.
• Identity verification documents submitted during the KYC process.
• Information you provide when contacting customer support, including chat records and support tickets.
• Personal preferences, account settings, and profile information you voluntarily provide.

Information collected automatically:

• IP address, device type, operating system and browser information.
• Session data including login date, time and duration.
• Betting history, game activity and platform usage patterns.
• General location data based on IP address for geo-compliance purposes.
• Cookies and similar tracking technologies as described in Section 6.

The personal information we collect is used solely for lawful and necessary purposes in operating the toto20 platform. Below is a detailed breakdown of how your data is used:

Toto20 will not use your data for any purpose beyond those stated above without obtaining your consent first.

Your privacy is our priority. toto20 does not sell, rent or trade your personal information to any third party. However, there are limited situations where we may need to share your information with others:

• Payment Processors: Financial information required to process deposits and withdrawals is shared securely with approved payment processors that comply with PCI DSS standards.
• Identity Verification Services: Approved third-party KYC providers may receive identity verification documents for the purpose of verifying new members.
• Regulatory Authorities: toto20 will disclose required information to the relevant authorities when mandated by law, including court orders or official investigations.
• Technology Partners: Technical service providers such as hosting, security, and analytics companies acting as data processors under strict confidentiality agreements.
• Fraud Prevention: Information may be shared with industry bodies for fraud detection and prevention across platforms.

All third parties we work with are required to comply with data protection standards as strict as those we uphold at toto20. Formal data protection agreements are in place before any data sharing takes place.

Toto20 continuously invests in the latest security infrastructure to protect your personal information. We employ a combination of technical and organisational measures to keep your data safe at all times.

• 256-bit SSL Encryption for all data transmitted between your device and toto20 servers.
• Data encryption at rest for all sensitive information stored in our database.
• Two-Factor Authentication (2FA) available to all member accounts as an additional layer of security.
• 24/7 Security Monitoring by our cybersecurity team to detect and respond to threats in real time.
• Penetration Testing regular audits conducted by independent parties to identify and address any system vulnerabilities.
• Strict access control — only authorised personnel may access your personal data, and all access is automatically logged.
• Encrypted data backup regularly to ensure service continuity and information security.

Toto20 uses cookies and similar tracking technologies to enhance the user experience, analyse platform performance and secure your session. Cookies are small text files stored on your device when you visit our website.

Types of cookies we use:

• Essential Cookies: Required for core platform functions such as login verification, session management and security. These cookies cannot be disabled.
• Functional Cookies: Saves your preferences such as language, display settings, and previous selections to make your experience more convenient.
• Analytics Cookies: Helps us understand how members use the platform so we can continuously improve the overall user experience.
• Security Cookies: Detects suspicious activity and helps prevent unauthorized access to your account.

You can manage your cookie settings through your browser settings at any time. Disabling certain cookies may affect some platform features. Please note that essential cookies cannot be disabled as they are required for security and core website functionality.

As a toto20 member and data subject under Malaysia's PDPA, you have the following rights regarding your personal information:

Toto20 retains your personal information for as long as necessary for the purposes stated in this Privacy Policy, or as required by applicable law. Retention periods vary by type of information:

• Active account data: Retained for the duration your account is active and up to 7 years after account closure for financial regulatory compliance purposes.
• Financial transaction records: Retained for a minimum of 7 years in line with anti-money laundering (AML) legal requirements.
• KYC documents: Retained for the period required by the relevant authorities, typically no less than 5 years after the business relationship ends.
• Security and session logs: Retained for 12 months for fraud detection and security incident investigation purposes.
• Support communication records: Retained for 3 years for historical reference and quality assurance.

When the retention period expires or you request data deletion (where permitted by law), your information will be securely deleted using methods that ensure the data cannot be recovered or accessed again.

The toto20 platform is exclusively for users aged 18 years and above. We do not intentionally collect any personal information from individuals under the age of 18.

If we discover that personal information has been collected from anyone under the age of 18 without our knowledge, we will take immediate steps to delete that information from our systems and close the account in question.

Parents or guardians who believe their child has registered or provided personal information to toto20 should contact our support team immediately.

Toto20 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the technologies we use. Any amendment takes effect as soon as the latest version is published on this page.

For significant amendments affecting your privacy rights, we will endeavour to notify you via your registered email or in-platform notification before the changes take effect. It remains your responsibility to review this page periodically.

The latest update date is always displayed at the top of this document. Continued use of the toto20 platform after any amendment takes effect means you accept the updated terms.

If you have any questions, concerns or requests regarding this Privacy Policy or how we handle your personal data, our team is ready to assist you.

You can reach us via live chat available on the toto20 platform or mobile app. Our support team operates 24 hours a day, 7 days a week to ensure your queries are answered promptly and accurately.

For data-related issues requiring further attention, you may also refer to the FAQ section us or contact the support team via a ticket opened within your account. We commit to responding to all privacy-related enquiries within 72 business hours.