Privacy Policy
At toto21, your privacy is not an afterthought — it is a foundational commitment. This Privacy Policy explains what personal data we collect, why we collect it, how it is used, and the rights you hold as a toto21 player.
Key Principles of Our Privacy Commitment
Six principles guide how toto21 handles your personal data — from collection to deletion. These are non-negotiable standards that apply to every Malaysian player on our platform.
Minimal Data Collection
toto21 collects only the personal data that is strictly necessary for account operation, KYC compliance, and fraud prevention. We do not collect data for its own sake.
Encrypted Storage
All personal data stored on toto21 systems is encrypted at rest using industry-standard AES-256 encryption. Data in transit is protected by TLS 1.3 across all platform connections.
No Third-Party Sales
toto21 does not sell, rent, or trade your personal information to third-party marketers or data brokers. Your data is used solely to operate and improve the toto21 platform.
Your Rights Are Real
You have the right to access, correct, port, restrict, or request deletion of your personal data. toto21 provides a clear mechanism to exercise each of these rights directly through your account.
Transparent Processing
Every data processing activity at toto21 has a documented lawful basis — contractual necessity, legal obligation, legitimate interest, or your explicit consent. Nothing happens in the shadows.
Defined Retention Limits
Personal data is retained only for as long as it is needed for its original purpose or as required by applicable law. Upon account closure, data is subject to our structured deletion schedule.
Notice to Players: By registering an account on toto21.casa or continuing to use the platform after the effective date of this Privacy Policy, you acknowledge that you have read and understood how your personal data is processed as described herein. If you do not agree, you should discontinue use and request account closure.
Introduction
This Privacy Policy ("Policy") issued by toto21 ("toto21", "we", "us", "our"), the operator of the online casino and sports betting platform accessible at toto21.casa. It describes how toto21 collects, uses, stores, shares, and protects personal data relating to individuals ("you", "your", "User", "Player") who access or register on our platform.
toto21 provides gaming and entertainment services to players across Malaysia — including those based in Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru, and Shah Alam — and processes personal data in connection with account registration, payment processing, identity verification (KYC), customer support, and platform security.
This Policy applies to all data processing activities conducted by toto21 in connection with the platform, including data collected via the web interface, customer support channels, and payment processing integrations. It should be read alongside our Terms & Conditions, which govern the overall relationship between you and toto21.
Definitions
The following terms have the meanings set out below throughout this Policy:
Any information that directly or indirectly identifies a living individual, including name, email address, date of birth, national identification number, IP address, and payment details.
Any operation performed on personal data — including collection, storage, use, disclosure, transfer, and deletion — whether automated or manual.
toto21, in its capacity as the entity that determines the purposes and means of processing personal data collected through the platform.
A third-party service provider that processes personal data on toto21's behalf under a written data processing agreement, such as a payment gateway or cloud hosting provider.
Identity and address verification documents submitted by players, including MyKad, Passport, Driver's License, and utility bills or bank statements.
Small data files placed on your browser or device by theoto21 platform for session management, preference storage, and analytics purposes.
A freely given, specific, informed, and unambiguous indication of agreement by a User to the processing of their personal data for a stated purpose.
Data We Collect
toto21 collects personal data from you in the following categories, depending on the nature of your interaction with the platform:
| Category | Data Points Collected | Collection Method |
|---|---|---|
| Registration Data | Full name, date of birth, email address, Malaysian phone number, residential address, username, password (hashed) | Provided directly by you at account creation |
| KYC Documents | Scanned copies of MyKad / Passport / Driver's License, utility bill or bank statement, selfie with ID | Uploaded by you via the secure document portal |
| Financial Data | Payment method details (masked card/account numbers), transaction history, deposit and withdrawal records in MYR | Generated via payment processing (FPX, DuitNow, e-walets, crypto) |
| Technical Data | IP address, browser type, device type, operating system, session duration, pages visited | Automatically collected via cookies and server logs |
| Gameplay Data | Game history, bet amounts, wager outcomes, bonus usage, session timestamps | Automatically generated by platform activity |
| Support Data | Live chat transcripts, support ticket content, email correspondence with toto21 | Provided directly by you when contacting support |
| Marketing Preferences | Communication opt-in or opt-out status, preferred contact channel | Set by you in account preferences or consent forms |
toto21 does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data beyond what is inherent in standard identity document verification required for KYC compliance.
Purpose & Legal Basis for Processing
toto21 processes your personal data only where a recognised lawful basis exists for doing so. The following table sets out the primary purposes for which your data is processed and the corresponding legal basis in each case:
| Purpose | Lawful Basis |
|---|---|
| Creating and managing your toto21 account | Performance of contract |
| Processing deposits and withdrawals in MYR and cryptocurrency | Performance of contract |
| KYC identity and age verification (21+ enforcement) | Legal obligation / performance of contract |
| Anti-money laundering (AML) and fraud detection monitoring | Legal obligation / legitimate interest |
| Providing customer support and resolving disputes | Performance of contract / legitimate interest |
| Responsible gambling monitoring and self-exclusion management | Legal obligation / legitimate interest |
| Personalising platform content and promotional offers | Consent / legitimate interest |
| Sending marketing communications (promotional emails, offers) | Consent (opt-in required) |
| Platform security, abuse prevention, and audit logging | Legitimate interest |
| Compliance with court orders, regulatory requests, or law enforcement | Legal obligation |
Where consent is the stated legal basis, you retain the right to withdraw that consent at any time by updating your preferences within your account settings or by contacting [email protected]. Withdrawal of consent does not affect the lawfulness of processing that occurred prior to withdrawal.
Data Sharing & Disclosure
5.1 Strict No-Sale Policy. toto21 does not sell, rent, or exchange your personal data with third-party marketers, data brokers, or any commercial entity for the purposes of direct marketing. This policy is absolute and applies regardless of the form of consideration.
5.2 Authorised Service Providers. toto21 may share your data with carefully selected third-party service providers who assist in operating the platform. These include:
- Payment Processors: Local payment gateways supporting FPX, DuitNow, Touch'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and Hong Leong, as well as cryptocurrency payment processors.
- KYC/Identity Verification Providers: Third-party identity verification services used to validate KYC documents submitted by players.
- Cloud Infrastructure Providers: Hosting and data centre providers who store platform data under strict data processing agreements.
- Fraud Detection & Security Services: Automated systems used to detect unusual account activity, suspicious transactions, or security threats.
- Customer Support Tools: Live chat and ticketing platforms used to manage player support interactions.
All third-party processors are contractually obligated to process data only on toto21's documented instructions, maintain appropriate security standards, and not use your data for their own independent purposes.
5.3 Legal Disclosure. toto21 may disclose personal data to law enforcement agencies, regulatory authorities, or courts where required to do so by applicable law, court order, or where we reasonably believe such disclosure is necessary to protect the rights, safety, or property of toto21, its players, or the public.
5.4 Corporate Transactions. In the event of a merger, acquisition, or sale of all or substantially all of toto21's assets, your personal data may be transferred to the acquiring entity. You will be notified of any such change in advance where reasonably practicable.
Cookies & Tracking Technologies
toto21 uses cookies and similar tracking technologies to operate the platform, maintain your session, remember your preferences, and gather aggregated analytics data. The following categories of cookies are in use:
- Strictly Necessary Cookies: Essential for the operation of the platform — including session authentication, security tokens, and language preferences. These cannot be disabled without impairing platform functionality.
- Functional Cookies: Used to remember your preferences such as preferred deposit method, display settings, and notification preferences across sessions.
- Analytics Cookies: Used to collect aggregated, anonymised data about how players use the platform — including pages visited, session duration, and navigation flows — to helpoto21 improve the user experience.
- Security Cookies: Used to detect and mitigate fraudulent activity, bot access, and session hijacking attempts.
You may manage non-essential cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of parts of the toto21 platform. toto21 does not use third-party advertising or behavioural targeting cookies.
Data Retention
toto21 retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, or as required by applicable law and regulatory obligations. Key retention periods are as follows:
- Account & Registration Data: Retained for the duration of your active account, plus minimum of five (5) years following account closure, in accordance with anti-money laundering record-keeping requirements.
- KYC Documents: Retained for a minimum of five (5) years from the date of submission or account closure, whichever is later, as required by applicable KYC and AML regulations.
- Financial Transaction Records: Retained for a minimum of seven (7) years in accordance with financial record-keeping obligations.
- Gameplay Data: Retained for five (5) years for responsible gambling monitoring, dispute resolution, and regulatory compliance purposes.
- Customer Support Records: Retained for three (3) years from the date of the interaction.
- Marketing Preferences: Retained until you withdraw consent or until eighteen (18) months of inactivity, whichever occurs first.
Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with toto21's data disposal procedures.
Security Measures
toto21 implements a comprehensive set of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:
- AES-256 encryption for all personal data stored at rest on toto21 servers.
- TLS 1.3 encryption for all data in transit between your browser and the toto21 platform.
- Role-based access controls (RBAC) restricting employee access to personal data to those with a documented business need.
- Two-factor authentication (2FA) enforced for all toto21 internal system administrators.
- Regular third-party security audits and penetration testing of the platform infrastructure.
- Automated intrusion detection and real-time alerting for anomalous access patterns.
- Secure, dedicated KYC document upload portal — toto21 staff will never request documents via live chat, email, or messaging apps.
Security Reminder: While toto21 employs robust security measures, no platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your own login credentials. toto21 will never ask you for your password via any channel. If you receive a request for your password claiming to be from toto21, treat it as fraudulent and contact [email protected] immediately.
Your Data Rights
As a data subject, you hold the following rights with respect to your personal data held by toto21. These rights may be exercised by submitting a written request to [email protected], subject to applicable legal exemptions and identity verification.
Request a copy of all personal data toto21 holds about you.
Request correction of inaccurate or incomplete personal data.
Request deletion of your data, subject to legal retention obligations.
Request that processing of your data be temporarily limited.
Receive your personal data in a structured, machine-readable format.
Object to processing based on legitimate interest, including direct marketing.
Withdraw consent for consent-based processing at any time.
Request human review of decisions made by automated systems that affect you.
toto21 will respond to data rights requests within thirty (30) calendar days of receipt. Where a request is complex or involves a high volume of data, this period may be extended by a further sixty (60) days, with written notification provided to you within the initial thirty-day window.
Please note that certain rights — particularly erasure and restriction — are subject to mandatory legal retention obligations. Where toto21 is required by law to retain your data (e.g., AML record-keeping), an erasure request cannot be fulfilled for the affected data categories during the applicable retention period.
Minors & Age Restrictions
The toto21 platform is strictly restricted to individuals aged 21 years and above. toto21 does not knowingly collect or process personal data relating to individuals under the age of 21. Where toto21 becomes aware that personal data has been collected from a person under 21, that data will be deleted promptly and the associated account permanently closed.
If you have reason to believe that a minor has registered an account on toto21, please contact us immediately at [email protected] so that we may investigate and take appropriate action. All deposits made by such an account will be returned to the source payment method.
toto21 enforces a mandatory KYC process that includes date-of-birth verification against government-issued ID. This process acts as toto21's primary mechanism for preventing underage access to the platform. For players aged 21 and above only.
International Data Transfers
Some of toto21's third-party service providers — including cloud infrastructure, KYC verification, and fraud detection partners — may process data in jurisdictions outside Malaysia. Where such transfers occur, toto21 ensures that appropriate safeguards are in place, which may include:
- Standard contractual clauses approved by relevant data protection authorities.
- Binding corporate rules where the processor is part of a group with approved internal data transfer policies.
- Processing restricted to jurisdictions deemed to provide an adequate level of data protection.
toto21 maintains an internal register of international data flows and conducts transfer impact assessments for all data processing relationships involving cross-border data movement. Details of the safeguards applicable to specific transfers are available upon written request.
Amendments to This Policy
toto21 reserves the right to update this Privacy Policy from time to time to reflect changes in our data processing practices, legal obligations, or regulatory requirements. Where amendments are material, toto21 will provide not less than fourteen (14) days' advance notice via a notice displayed prominently on the platform or by email to your registered address prior to the effective date of the change.
The "Last Updated" date at the top of this Policy reflects the date on which the most recent revision was made. Your continued use of the platform following the effective date of any updated Policy constitutes acceptance of the revised terms. If you do not accept the updated Policy, you should cease using the platform and request account closure.
Contact & Complaints
If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or have a concern about how toto21 has handled your personal information, please contact our dedicated privacy team:
toto21 is committed to resolving all privacy-related enquiries and complaints promptly and fairly. If you are dissatisfied with toto21's response to a privacy complaint, you retain the right to escalate the matter to the applicable data protection authority in your jurisdiction.
For broader legal queries relating to toto21's operations, Terms & Conditions, or responsible gambling policies, please also visit the Terms & Conditions and Responsible Gambling pages.
Explore toto21 with Confidence
Now that you understand how toto21 protects your data, head to the homepage to explore our casino games, sports betting markets, and current promotions. Your privacy is always in good hands.
For players aged 21 and above only. Play responsibly. Visit our Responsible Gambling page for tools and support resources.