Toto22 Privacy Policy – Personal Data Protection for Malaysian Members

This Privacy Policy is issued by toto22, the operator of the online entertainment platform at https://toto22-jit.com ("Platform"). This document outlines our commitment to protecting your personal data and how we handle the information you provide to us.

toto22 understands that your trust is our most valuable asset. When you register and use our platform — whether to play slots, place bets on EPL or Liga Super Malaysia matches, play poker, or follow MLBB esports — you are entrusting us with your personal information. We take that trust very seriously.

This Privacy Policy applies to all services, products, and features available on the toto22 platform, including the website, mobile application (if available), and all official toto22 communication channels. By using the toto22 platform, you acknowledge that you have read and understood this Privacy Policy.

toto22 collects your personal data through several means — information you provide directly, information we collect automatically while you use the platform, and information from legitimate third parties.

a) Information you provide directly:

• Full name as per MyKad or passport
• Date of birth and age
• Active email address
• Mobile phone number
• Residential address
• Malaysian bank account or e-wallet details (Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, or FPX via Maybank2u or CIMB Clicks) for deposit and withdrawal purposes
• Identity document (MyKad or passport) for the KYC process
• Any information you provide when contacting customer support

b) Automatically collected information:

• IP address and general location information
• Browser type and version used
• Device type and operating system
• Your gaming and betting activity history on the toto22 platform
• Deposit and withdrawal transaction history
• Session times and duration on the platform
• Cookie data and related tracking technologies

Toto22 only collects data that is strictly necessary for the stated purposes — we do not collect excessive or irrelevant data beyond what is required to provide our services.

toto22 uses your personal data only for legitimate and specific purposes. Below is the full list of how your data is used:

• Account management: Creating and managing your toto22 account, including the registration process, identity verification, and account security.
• Service delivery: Gives you access to all toto22 games and services — from slots and Live Casino to Sports Betting and esports.
• Transaction processing: Securely processes your deposits and withdrawals via your preferred Malaysian payment method.
• Fraud prevention: Detecting and preventing fraudulent activity, money laundering, and platform abuse.
• Legal compliance: Meeting applicable legal obligations, including KYC/AML (Anti-Money Laundering) requirements and prescribed reporting obligations.
• Customer support: To provide effective support whenever you contact the toto22 team.
• Service communications: Sending important information about your account, policy updates, or relevant technical issues.
• Responsible gambling: Monitoring gameplay patterns to identify potential problem gambling and provide the necessary support.
• Platform improvements: Analysing aggregated (non-individual) usage data to improve the toto22 user experience.
• Marketing (with consent): Sending information about toto22 offers, promotions, and bonuses — only if you have given explicit consent to receive marketing communications.

toto22 does not sell, rent, or trade members' personal data to any third party for marketing or commercial purposes. Your data is shared only in the following limited circumstances:

• Service providers: Companies that help us deliver toto22 services — including payment gateway providers (for processing transactions via Touch 'n Go eWallet, GrabPay, DuitNow, FPX, and others), game providers, and technology infrastructure providers. All these providers are bound by strict data protection agreements.
• Lawful authorities: Law enforcement agencies, courts, or regulatory authorities when required by law or court order. toto22 discloses only the minimum information necessary in such cases.
• Fraud prevention and AML: Bodies or services that assist us with identity verification and anti-money laundering efforts, in accordance with applicable legal requirements.
• Business transfers: In the event of a merger, acquisition, or asset sale, member data may be transferred to the successor entity. You will be notified before any such transfer takes place.

In all of the above cases, toto22 ensures that any party receiving data is bound by data protection obligations equivalent to or stricter than those we apply ourselves.

Platform toto22 uses cookies and similar tracking technologies to improve your experience and ensure the platform runs smoothly. Cookies are small text files stored on your device when you visit the toto22 platform.

Types of cookies we use:

• Essential Cookies (Strictly Necessary): These cookies are required for the toto22 platform to function properly. They include login session cookies and security cookies. These cannot be disabled as they are essential for the platform's core operations.
• Performance Cookies: Cookies that help us understand how members use the platform — which pages are visited most frequently, where users may encounter issues, and so on. This information is used in aggregate to improve the toto22 platform.
• Functional Cookies: Cookies that remember your preferences — such as language, display settings, and other choices — to deliver a more personalised experience.
• Session Cookies: Temporary cookies that are automatically deleted when you close your browser. These are used to maintain your login session status while you are using the platform.

You can manage or disable cookies through your browser settings. However, disabling essential cookies may affect your ability to log in and fully use the features of the toto22 platform.

toto22 continuously invests in security infrastructure to ensure members' personal data remains protected at all times. The security measures we implement include:

• Data encryption: All data transmitted between your device and toto22's servers is encrypted using 256-bit SSL/TLS protocol. Data stored in our databases is also encrypted at the storage level.
• Access controls: Access to member personal data is restricted to toto22 staff who require it to carry out their duties. All access is logged and monitored.
• Two-factor authentication (2FA): We provide and encourage the use of 2FA on all member accounts as an additional layer of security.
• Real-time monitoring: Our security monitoring systems operate around the clock to detect unusual activity, intrusion attempts, and potential data breaches.
• Regular security testing: The toto22 platform undergoes regular penetration testing and security audits conducted by independent third parties.
• Disaster recovery: Member data is regularly backed up to a secure, separate location to ensure service continuity in the event of an emergency.

While toto22 takes all reasonable steps to protect your data, no system can guarantee absolute 100% security. You also play an important role — make sure your toto22 account password is strong, unique, and never shared with anyone.

toto22 retains your personal data only for as long as it is needed for the purpose it was collected, or as required by applicable law.

• Active account data: Retained for the entire duration your toto22 account remains active and in use.
• Data after account closure: After an account is closed at a member's request, toto22 will retain the necessary data for the minimum period prescribed by law (typically 5–7 years) for legal compliance, fraud prevention, and the resolution of any outstanding disputes.
• Financial transaction data: Financial transaction records are retained in accordance with legal requirements related to anti-money laundering and applicable tax reporting obligations.
• Support communication data: Customer support chat records are retained for as long as necessary to improve service quality and resolve disputes.

Once the applicable retention period expires, data will be securely deleted or anonymised so it can no longer be linked to any individual.

Under Malaysia's Personal Data Protection Act 2010 (PDPA) and toto22's policies, you have the following rights regarding your personal data:

• Right to Access: You have the right to request a copy of the personal data we hold about you. toto22 will provide this information within 21 days of receiving a valid request.
• Right to Rectification: If you find that the personal data we hold about you is inaccurate or incomplete, you have the right to request a correction. You may also update certain information directly from your toto22 account profile settings.
• Right to Erasure: You have the right to request the deletion of your personal data under certain circumstances, such as when the data is no longer needed for the purpose it was originally collected. However, this right may be limited by legal obligations that require us to retain data for a specified period.
• Right to Object to Processing: You have the right to object to the processing of your data for direct marketing purposes at any time.
• Right to Withdraw Consent: Where the processing of your data is based on consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the validity of any processing carried out prior to the withdrawal.
• Right to Lodge a Complaint: You have the right to lodge a complaint with Malaysia's Personal Data Protection Commissioner if you believe your rights have been violated.

To exercise any of the rights above, contact the toto22 team at support@toto22-jit.com stating your request type clearly. toto22 will process your request within a reasonable timeframe and notify you of the action taken.

Platform toto22 is exclusively for individuals aged 21 years and above. toto22 does not knowingly collect or process personal data from individuals under the age of 21.

Should we find that we have collected data from an individual who does not meet the minimum age requirement, the account in question will be terminated immediately and all associated data will be deleted promptly in accordance with our secure deletion procedures.

If you are a parent or guardian and believe that a minor under your care who is below 21 years of age has registered for or used the toto22 platform, please contact us immediately at support@toto22-jit.com so that we can take the appropriate action.

Platform toto22 may contain links to third-party websites or services not operated by us. Once you click those links and leave the toto22 platform, this Privacy Policy no longer applies.

Toto22 has no control over the content, privacy policies, or practices of third-party websites, and we are not responsible for their actions. We recommend reading the privacy policy of any website you visit outside the toto22 platform.

toto22 reserves the right to update or amend this Privacy Policy from time to time in line with changes to legislation, technology, or our business practices. Any changes will take effect upon publication of the updated version on the toto22 platform.

For material changes — that is, changes that significantly alter how we use or protect your data — toto22 will:

• Sending notifications to the email address you registered with
• Displaying a clear notice on the toto22 platform when you log in after the changes take effect
• Updating the "Last Updated" date at the top of this page

Your continued use of the toto22 platform after any amendment takes effect constitutes your acceptance of the updated Privacy Policy. It is your responsibility to review this page periodically for any changes.

If you have any questions, concerns, or requests regarding this Privacy Policy or how toto22 handling your personal data, please do not hesitate to contact us.

The toto22 Data Protection Team is committed to responding to all enquiries within 2–5 business days. For official requests relating to data subject rights (access, correction, deletion), please clearly state the type of request and the information we need to process it.