Toto22 Privacy Policy – Player Data Protection in Malaysia

Toto22 collects players' personal information through several channels — during account registration, during platform use, through financial transactions, and through interactions with our customer support team. Below are the categories of information we collect and the reasons why:

Registration Information:

• Full name as per identity card (MyKad)
• An active Malaysian phone number
• A valid and active email address
• Date of birth (for age verification)
• Passwords are stored in encrypted form — Toto22 does not store passwords in plain text

Identity Verification (KYC) Information:

• Front and back copy of identity card (MyKad)
• Proof of current address (utility bill, bank statement, or other official document)
• Selfie or facial photo for biometric identity verification when required

Financial Information:

• Name of payment method used (TNG eWallet, GrabPay, DuitNow, FPX, Boost, ShopeePay, Maybank2u, CIMB Clicks)
• E-wallet account number or bank account number used for deposits and withdrawals
• Records of all deposit and withdrawal transactions in Malaysian Ringgit (MYR)

Platform Usage Information:

• Sports betting activity records — bets placed, odds, outcomes, and win/loss history
• Casino game records — games played, session duration, bets placed and outcomes
• IP address of the device used to access Toto22
• Device type, operating system and web browser
• Date and time of platform access

Communication Information:

• Live Chat conversation records with the Toto22 support team
• Emails sent to and received from support@toto22-bangla.com
• Feedback, complaints, or suggestions submitted through any channel

Toto22 only uses players' personal data for legitimate purposes directly relevant to the delivery of our platform services. We do not use your data in ways you would not reasonably expect. Below are the specific uses for each category of data we collect:

Toto22 will not use your data for third-party marketing purposes or sell it to advertisers. If you do not wish to receive promotional communications from Toto22, you may withdraw your consent at any time via your account settings or by contacting our support team.

Toto22 does not sell, rent, or disclose players' personal data to any third party for their own commercial purposes. However, there are certain situations where Toto22 needs to share data with other parties to keep the platform operating securely and in compliance with legal requirements:

• Payment providers: Transaction information is shared with e-wallet and banking providers — including Touch 'n Go eWallet, GrabPay, DuitNow, Boost, ShopeePay, and Malaysian banks (via FPX) — solely for the purpose of processing deposits and withdrawals in MYR.
• Technical service providers: Companies that assist in the technical operation of the Toto22 platform — such as server hosting providers, analytics services, and game software providers — may have limited access to data required to carry out their specific functions. All such providers are bound by strict confidentiality agreements.
• Regulatory and law enforcement authorities: Toto22 will disclose player information to law enforcement agencies, financial authorities, or regulatory bodies when required to do so under Malaysian law — including investigations related to anti-money laundering (AML) or fraudulent activity.
• Business transfer: In the event of a merger, acquisition, or sale of Toto22's assets, player data may be transferred as part of that transaction. Players will be notified by email before their data becomes subject to a different privacy policy.

Toto22 continuously invests in security technologies and processes to ensure our Malaysian players' personal data is protected to the highest standards. Below are the security layers we have in place:

• 256-bit SSL Encryption: All communications between your device and Toto22's servers are protected by 256-bit SSL/TLS encryption — the same standard used by Malaysia's leading banking institutions. This ensures that data in transit cannot be intercepted or read by third parties.
• Data-at-rest encryption: All personal data stored in Toto22's databases is encrypted using modern encryption algorithms. Sensitive data such as MyKad numbers and payment details is stored in an encrypted format that cannot be read without the appropriate decryption key.
• Layered access controls: Only Toto22 staff with specific authorisation may access players' personal data, and only for legitimate purposes related to their job functions. All access is logged and regularly audited.
• Two-factor authentication (2FA): Toto22 offers two-factor authentication (2FA) for player accounts, adding an extra layer of protection beyond your password alone. We encourage all players to enable this feature.
• Continuous security monitoring: Toto22's automated threat detection system operates 24 hours a day to identify and address any unauthorised access attempts, cyberattacks, or suspicious activity in real time.
• Regular penetration testing: Toto22 conducts regular security assessments by independent cybersecurity experts to identify and address any vulnerabilities before they can be exploited.
• Incident response procedures: In the event of a data breach, Toto22 has a clear incident response procedure in place — including notification to affected players within the timeframe required by applicable law.

While Toto22 takes all reasonable steps to protect your data, no system is 100% immune to threats. You also play an important role in keeping your account secure by keeping your password confidential and not sharing your login details with anyone.

Toto22 uses cookies and similar tracking technologies to enhance the user experience, analyse platform usage, and support necessary technical functions. Below are the types of cookies we use and their purposes:

• Essential cookies: These cookies are essential for the core functionality of the Toto22 platform — such as keeping you logged in, remembering your language preferences, and ensuring bets are processed correctly. Disabling these cookies will affect the platform's ability to function properly.
• Performance and analytics cookies: Toto22 uses analytics tools to understand how players interact with the platform — which pages are visited most frequently, how long sessions last, and where players commonly encounter issues. This data is used in aggregated, anonymised form for product improvement purposes.
• Functional cookies: These cookies remember your personal preferences and settings — such as your preferred betting limits, display layout, and notification preferences — so you do not have to reconfigure them every time you log in to Toto22.
• Security cookies: These cookies help Toto22's security systems identify and block unauthorised access attempts, CSRF attacks, and automated bot activity.

You can manage your cookie settings through your web browser. However, blocking essential cookies may affect the functionality of the Toto22 platform. Most modern browsers offer options to accept all cookies, reject third-party cookies, or receive notifications before cookies are stored.

As a Toto22 player whose personal data we process, you have certain rights regarding your information. Toto22 fully respects and facilitates the exercise of these rights:

• Right to access data: You have the right to request a copy of all personal data Toto22 holds about you. This request can be submitted by email and will be processed within 30 days.
• Right to rectify data: If any personal information in your Toto22 account is inaccurate or out of date, you have the right to request a correction. Basic information can be updated directly in your account settings or by contacting customer support.
• Right to erasure ("right to be forgotten"): You may request the deletion of your personal data, subject to legal retention requirements. Toto22 is required to retain financial transaction records for the period prescribed by Malaysian law for AML compliance purposes.
• Right to restrict processing: In certain circumstances, you may request that Toto22 restrict how we process your data — for example, while a dispute regarding data accuracy is being resolved.
• Right to object to processing: You may object to the processing of your data for direct marketing purposes at any time. Once an objection is raised, Toto22 will immediately cease using your data for that purpose.
• Right to data portability: You have the right to receive the personal data you have provided to us in a machine-readable format, for transfer to another service provider of your choice.
• Right to withdraw consent: Where data processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of any processing that took place prior to the withdrawal.

To submit any request relating to your data rights, contact the Toto22 privacy team by email at support@toto22-bangla.com with the subject line "Personal Data Rights Request". Please include your full name and Toto22 account number to facilitate processing.

Toto22 retains players' personal data only for as long as necessary to fulfil the purposes set out in this policy, or as required by applicable law. The following is a general guide to our data retention periods:

• Active account data: For as long as your account remains active, Toto22 retains all account information and activity records necessary to provide uninterrupted service.
• Financial transaction records: In accordance with Malaysia's financial compliance regulations, transaction records are retained for a minimum of 7 years from the date of the transaction, even after an account has been closed.
• KYC and identity verification records: Identity verification documents are retained for a minimum of 5 years after account closure in accordance with anti-money laundering (AML) legal requirements.
• Support communication records: Live Chat conversations and support emails are retained for 3 years for reference and support team training purposes.
• Security log data: Access logs and security activity records are retained for 12 months to support investigations into security incidents if required.
• Following voluntary account closure: Personal data not subject to legal retention requirements will be deleted or anonymised within 90 days of confirmed account closure.

When data is no longer needed and there is no legal requirement to retain it, Toto22 will securely delete or anonymise that data using industry-recognised data disposal procedures.

The Toto22 platform is intended exclusively for individuals aged 18 and above. We do not knowingly collect or process personal data from anyone under the age of 18.

If Toto22 discovers that personal data of individuals under 18 has been collected inadvertently, we will take immediate steps to delete that data and close the account in question. Parents or guardians who suspect their child has registered or used the Toto22 platform are encouraged to contact us immediately at support@toto22-bangla.com.

Toto22 applies an age verification process at registration — including date of birth checks and MyKad verification — to ensure our platform is only accessible to eligible individuals. However, we acknowledge that these measures are not entirely foolproof and rely on accurate information being provided by users.

The Toto22 platform may contain links to third-party websites or applications from time to time — for example, links to payment providers or official sports bodies for match schedule information. This Privacy Policy applies to the Toto22 platform only.

Toto22 is not responsible for the privacy practices or content of third-party websites linked from our platform. We encourage you to read the privacy policy of each website you visit separately to understand how your data is handled there.

If you are redirected to a payment provider's website — such as the FPX portal to complete a deposit via Maybank2u or CIMB Clicks — you are entering an environment operated by that third party and their own privacy policy applies for the duration of that payment session.

Toto22 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, technologies used, legal requirements, or other legitimate operational reasons. Here is how we manage policy changes:

• Notice of changes: Any material changes to this Privacy Policy will be communicated to players via their registered email address and in-platform notifications at least 14 days before the changes take effect.
• Effective date: Each version of the Privacy Policy will display its effective date. This page always shows the latest version currently in force.
• Acceptance of changes: Continued use of the Toto22 platform after a policy change takes effect constitutes acceptance of the updated policy. If you do not agree, you have the right to close your account before the effective date.

For any questions, concerns, or requests relating to this Privacy Policy or the way Toto22 handles your personal data, please contact us via:

• Email: support@toto22-bangla.com — with the subject line "Privacy Policy Enquiry"
• Live Chat: Available 24 hours a day, 7 days a week within the Toto22 platform

We are committed to responding to all privacy-related enquiries within 48 business hours.