Privacy Policy toto20 – Your Personal Data Protection

Toto20 ("we", "Platform", "website") takes your privacy very seriously. This Privacy Policy explains in detail how we collect, use, store, protect, and disclose your personal information when you use the toto20.plus platform and the toto20 mobile app.

As an online entertainment platform operating in Malaysia, we fully comply with the Personal Data Protection Act 2010 (PDPA) and all applicable legislation. We believe transparency is the foundation of trust — and we want you to clearly understand what happens to your data.

This policy covers all your interactions with toto20, including browsing our website, registering a new account, making deposits or withdrawals, using live casino services, playing slots or bingo, downloading the toto20 app, and contacting our customer support team.

Toto20 collects two main categories of data: information you provide directly to us, and information collected automatically when you use our platform.

Information You Provide Directly:

• Identification Information: Full name as per identification card, MyKad number, date of birth, gender and a photo of your identification card (for the KYC process).
• Contact Information: Active email address, Malaysia mobile number and current residential address.
• Financial Information: Bank account details, e-wallet account numbers (Touch 'n Go, GrabPay) and USDT wallet addresses for payment processing purposes.
• Account Details: Username, password (stored in an unreadable hashed format), security questions and account settings.
• Communications: Messages you send to our support team via live chat, email or any other communication channel.

Automatically Collected Information:

Toto20 uses your personal data only for purposes that are lawful, relevant, and necessary. We do not use your data for any purpose other than those stated below:

• Identity Verification (KYC): Verifying your age, identity and eligibility to use the toto20 platform in accordance with legal requirements.
• Transaction Processing: Processing deposits, withdrawals and all financial transactions securely and accurately.
• Account Management: Providing access to your account, processing password reset requests and updating profile details.
• Platform Security: Detecting and preventing fraud, money laundering, unauthorised access and other illegal activities.
• Customer Support: Responding to enquiries, resolving complaints and providing effective technical assistance.
• Service Communications: Sending important notifications relating to your account, transactions, policy changes and security updates.
• Platform Improvements: Analysing usage patterns to improve the design, performance and features of the toto20 platform.
• Legal Compliance: Fulfilling reporting and compliance obligations to the relevant regulatory authorities.
• Responsible Gaming: Monitoring gameplay patterns to identify members who may need assistance and informing them about responsible gaming tools.

Toto20 does not sell or rent your personal data. However, in limited and specific situations, we may share your data with the following parties:

• Payment Providers: Payment service providers such as banks, FPX, Touch 'n Go eWallet and GrabPay receive only the minimum information necessary to process your transactions securely.
• Game Providers: Third-party game developers may receive anonymised game data for technical purposes. They do not receive your personally identifiable information.
• KYC Service Providers: Trusted third-party identity verification platforms assist us in conducting the KYC process securely and in full legal compliance.
• Legal Authorities: toto20 will disclose the required data if mandated by a court order, official authority request, or applicable legal obligation.
• Audit & Compliance: Authorised independent auditors and regulatory bodies may access certain data within the scope of scheduled security and compliance audits.

All third parties sharing data with toto20 are bound by strict data protection agreements and must comply with the security standards we set. They are prohibited from using your data for any purpose other than what has been agreed upon.

In the event that toto20 undergoes an acquisition, merger, or asset sale, user data may be transferred to the new entity — however, the same Privacy Policy will continue to apply and you will be notified in advance.

Toto20 uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device that help us recognize you and remember your preferences.

Types of Cookies We Use:

• Essential Cookies: Required for core platform functions such as login session verification, account security and transaction processing. These cookies cannot be disabled.
• Performance Cookies: Collecting data on how you use the platform — which pages are visited most frequently, where errors occur — to help us improve toto20's performance.
• Functional Cookies: Remembering your preferences such as display language, display settings and game preferences so you do not need to reset them every time you log in.
• Analytics Cookies: Usage data collected anonymously to understand overall usage patterns and improve the toto20 user experience.

You can manage and delete cookies through your web browser settings at any time. Please note that disabling essential cookies may affect the functionality of certain parts of the toto20 platform.

Toto20 implements comprehensive technical and organizational security measures to protect your personal data from unauthorized access, loss, alteration, or unintended disclosure.

Our Key Security Measures:

• 256-bit SSL Encryption: All data transmitted through the toto20 website and app is protected by advanced SSL encryption — your data cannot be read by unauthorised parties during transmission.
• Two-Factor Authentication (2FA): An additional security layer requiring verification via an OTP code sent to your mobile number each time you log in from a new device.
• 24/7 Activity Monitoring: An automated threat detection system continuously monitors all account activity and will issue an immediate alert if any suspicious activity is detected.
• Secure Password Storage: Your password is never stored in plain text — it is processed through a strong cryptographic hashing algorithm (bcrypt) before being saved.
• Internal Access Controls: Only trained toto20 staff with a legitimate job requirement are permitted to access user personal data, subject to strict role-based access controls.
• Regular Security Audits: Penetration testing and security audits are conducted periodically by independent security experts to identify and address any system vulnerabilities.

While we take all reasonable precautions, no security system can be guaranteed to be completely foolproof. In the event of any data breach affecting your information, toto20 is committed to notifying you as promptly as possible and taking immediate remedial action.

As a data subject, you have the following rights under Malaysia's Personal Data Protection Act 2010 (PDPA) and toto20's policies:

To exercise any of the above rights, please contact our Data Protection Officer team by email at [email protected] or via live chat on the platform. We will process your request within 14 business days.

Toto20 retains your personal data only for as long as necessary for the purposes stated in this Privacy Policy, or as required by applicable law.

Upon expiry of the retention period, your data will be securely deleted or fully anonymised in accordance with procedures established by toto20.

The toto20 platform is strictly for adult users aged 18 years and above only. We do not knowingly collect, process, or store any personal data from individuals under the age of 18.

Toto20 employs multiple age verification mechanisms during the registration process, including identity document checks, to ensure that only eligible adults can access our platform.

If we discover that data from an individual under the age of 18 has been inadvertently collected, we will take immediate steps to delete that data and close the relevant account. Parents or guardians who suspect their child has registered a toto20 account are encouraged to contact us immediately at [email protected].

Toto20 reserves the right to update or amend this Privacy Policy at any time in response to changes in legislation, industry practices, or our platform's operational requirements.

When there are material changes to this Privacy Policy, we will:

• Updating the "Last Updated" date shown at the top of this page.
• Displaying a clear notice on the toto20.plus homepage at least 14 days before changes take effect.
• Sending notifications to all active members via their registered email.
• In the event of highly significant changes, obtain your fresh consent before continuing to process your data.

Continued use of the toto20 platform after any Privacy Policy changes take effect will be considered your acceptance of the updated policy. If you do not agree, you have the right to close your account and request data deletion in accordance with the procedure outlined in Section 7.

If you have any questions, concerns, or complaints regarding this Privacy Policy or how toto20 processes your personal data, please contact our Data Protection Officer (DPO) through the following channels:

You may also file a formal complaint with the Department of Personal Data Protection Malaysia (JPDP) if you believe your privacy rights have been violated and toto20 has not addressed it to your satisfaction.