Privacy Policy toto20 — Your Personal Data Protection

1. Introduction & Scope of This Privacy Policy

Toto20 is an online wagering platform operating under the domain toto20.vin. We understand that your trust is our most valuable asset, and the protection of your personal data is the foundation of that trust.

This Privacy Policy is drafted to comply with the requirements of Personal Data Protection Act 2010 (Malaysia PDPA) and outlines our practices regarding the collection, use, storage, and disclosure of your personal information.

This policy applies to all users and members who:

• Visiting or using the toto20.vin website
• Registering and holding an active account on the toto20 platform
• Using the toto20 mobile app on iOS or Android
• Contacting our customer support team through any channel

2. Personal Information We Collect

Toto20 collects your personal information through several channels. The type of information collected depends on how you interact with our platform:

Information you provide directly:

• Full name as shown on your identity document (MyKad or passport)
• Date of birth and gender
• Email address and mobile phone number
• Current residential address
• Bank account number and bank name for deposit and withdrawal purposes
• Copies of identity verification (KYC) documents when requested

Automatically collected information:

• IP address and approximate geographic location
• Device type, operating system, and browser version
• Session data including pages visited, duration of visit, and actions taken
• Wagering and financial transaction history on the platform
• Cookie and related tracking technology information

Information from third parties:

• Identity verification data from certified KYC service providers
• Fraud information and risk assessments from financial security providers
• Technical data from analytics service providers used internally

3. How We Use Your Information

Every piece of information toto20 collects is used for a specific, legitimate purpose. We do not use your data for any other purpose without notifying you first.

• Account management: Creating, verifying, and maintaining your member account so you can log in and use the platform seamlessly.
• Transaction processing: Processing deposits, withdrawals, and all financial transactions quickly and securely.
• Identity verification (KYC): Complying with Malaysian legal requirements relating to anti-money laundering and identity fraud prevention.
• Platform security: Identifying and preventing fraudulent activity, multi-account usage, and other security threats.
• Customer support: Answering inquiries, resolving complaints, and providing the technical assistance you need.
• Marketing communications: Sending promotional information, bonus offers, and platform updates — only if you have given consent to receive them.
• Platform improvement: Analyzing usage patterns to improve overall design, performance, and user experience.
• Legal compliance: Complying with lawful authority directives or court orders when required.

4. Data Sharing & Disclosure

Toto20 does not sell, rent, or trade your personal information to any third party for their own commercial purposes. However, in certain situations, your information may be shared with the following parties:

• Payment service providers: Financial institutions, payment processors, and e-wallet providers required to process your transactions.
• KYC service providers: Certified identity verification company ensuring platform security and legal compliance.
• Game providers: Third-party game software providers offering content on the toto20 platform may receive technical data necessary for game functionality.
• Legal authorities: Law enforcement agencies, courts, or regulatory bodies where there is a legal obligation to do so.
• Business transfers: Should toto20 undergo a merger, acquisition, or asset sale, member information may be transferred as part of that transaction, with continued privacy protections in place.

5. Data Encryption & Security

The security of your data is a responsibility we take very seriously. toto20 invests in layered security infrastructure to protect your information from unauthorized access, loss, or disclosure.

• 256-bit SSL encryption: All data transmitted between your browser and toto20's servers is protected by bank-grade 256-bit SSL encryption — the same standard used by leading financial institutions.
• Database security: Sensitive information such as passwords and banking details is stored in encrypted format and cannot be read by anyone, including toto20 internal staff.
• Two-factor authentication (2FA): toto20 supports two-factor authentication for an added layer of protection on your account.
• 24/7 Monitoring: Our cybersecurity team monitors the platform around the clock to detect and respond to any threats in real time.
• Periodic security audits: The toto20 platform undergoes regular penetration testing and security audits by independent third parties.

6. Cookies & Tracking Technologies

Toto20 uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device when you visit our website.

Types of cookies we use:

• Essential cookies: Required for core platform functions such as login session management and security. These cookies cannot be disabled.
• Performance cookies: Collecting information on how the platform is used to help us identify and resolve technical issues.
• Functional cookies: Remembering your preferences and settings (such as language and region) to personalize your experience.
• Analytics cookies: Helping us understand aggregate usage patterns for the purpose of platform improvement.

You can control and delete cookies through your web browser settings at any time. Please note that disabling certain cookies may affect the functionality of some parts of the toto20 platform.

7. Data Retention Period

Toto20 retains your personal information for as long as your account is active or as needed for the purposes outlined in this Privacy Policy. After that period, your data will be deleted or anonymised.

• Active account data: Retained for as long as your account remains active on the toto20 platform.
• Financial transaction records: Retained for a minimum of 7 years in compliance with Malaysia's legal requirements on anti-money laundering.
• KYC Documents Retained for 5 years after account closure or the date the documents were submitted, whichever is later.
• Customer support communication logs: Retained for 2 years for reference and dispute resolution purposes.
• Inactive account: Account data inactive for more than 3 years may be deleted or anonymised after notice has been given to the member.

8. Your Rights Under PDPA

As a data subject under Malaysia's Personal Data Protection Act 2010 (PDPA), you have rights you should know about and can exercise at any time.

9. Cross-Border Data Transfers

In the course of its operations, toto20 may transfer your personal data to servers or service providers operating outside Malaysia. Such transfers are only made when:

• The recipient country has a level of data protection comparable to or exceeding Malaysia's PDPA standards.
• Service providers have signed data processing agreements that comply with our privacy requirements.
• Such transfers are necessary to deliver the services you use, including international payment processing.

All cross-border data transfers are subject to safeguards equivalent to the security standards we enforce internally.

10. Changes to This Privacy Policy

Toto20 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or platform improvements.

When significant changes are made, we will:

• Updating the "Last Updated" date at the top of this document.
• Displaying a clear notice on the platform's home page for a minimum of 7 days.
• Sending email notifications to all registered members for changes that materially affect privacy rights.

Your continued use of the toto20 platform after any changes take effect constitutes your acceptance of the revised Privacy Policy. We encourage you to review this page periodically.

11. Contact Us About Privacy

If you have any questions, concerns, or wish to exercise any of your privacy rights as stated in this Policy, you may contact the toto20 Data Protection Officer through the following channels:

• Privacy Email: [email protected] — we are committed to responding within 72 hours.
• Live Chat: Available directly on the toto20 platform — for general enquiries requiring an immediate response.
• Customer Service Phone: Available 24 hours a day, 7 days a week through the platform.

For formal requests regarding data access, correction, or deletion, please clearly state the type of request, your toto20 account number, and your contact information so we can verify your identity before processing.