Privacy Policy toto99 —
Malaysia Personal Data Protection

This Privacy Policy is published by toto99 ("Company", "we", or "Platform") and applies to all users who access or use the toto99 platform via the official website at toto99.fun, the toto99 mobile app, or any related services we offer.

This document details how toto99 collects, uses, stores, protects, and shares your personal information when you interact with our platform — from the account registration process, deposits, and gaming activity, through to customer support communications.

By registering an account or using toto99 services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this policy, please discontinue use of our platform.

Toto99 collects several categories of personal data depending on the nature of your interaction with our platform. Below is an overview of the types of data we collect:

Toto99 only collects data that is strictly necessary to provide our services. We do not collect sensitive data such as health information or religious beliefs unless required by law.

The personal data we collect is used solely for lawful and transparent purposes. The following are the key purposes for which toto99 uses your data:

• Account Management: Creating and maintaining your account, processing registration and verifying your identity through the required KYC process.
• Transaction Processing: Processing deposits, withdrawals and all other financial transactions accurately and securely via trusted payment channels.
• Service Provision: Enabling you to access all games, sports betting and toto99 platform features smoothly and without interruption.
• Security & Fraud Prevention: Identifying and preventing fraud, money laundering, account abuse and any activity that violates applicable laws or platform policies.
• Customer Support: Answering enquiries, resolving complaints and providing the technical assistance you need efficiently.
• Marketing & Promotions: Sending you information about toto99's latest promotions, bonuses and offers — subject to your communication preferences.
• Regulatory Compliance: Fulfilling our legal obligations under applicable legislation, including anti-money laundering (AML) reporting requirements.
• Platform Improvement: Analysing usage patterns to continuously improve toto99's performance, user experience and service quality.

Toto99 only processes your personal data where there is a valid legal basis for doing so. Those bases are as follows:

• Consent: You have given explicit consent for us to process your data for specific purposes, such as receiving marketing communications.
• Contract Performance: Processing is necessary to perform the service agreement between you and toto99, for example to process transactions and manage your account.
• Legal Obligation: Processing is required to comply with applicable laws, including KYC and AML requirements mandated by the authorities.
• Legitimate Interest: Processing is necessary for the legitimate interests of toto99 or third parties, such as preventing fraud and ensuring platform security, provided those interests do not override your fundamental rights.

Toto99 does not sell or disclose your personal data to third parties for their own marketing purposes. However, we may share your data in the following limited and controlled circumstances:

• Service Providers: Payment processing companies, gaming software providers, cloud service providers, and other technology vendors that help us operate our platform — all bound by strict confidentiality agreements.
• Regulatory Authorities: Government agencies, law enforcement bodies, or regulatory authorities when we are required to do so by law or court order.
• KYC/AML Partners: Trusted third-party identity verification service providers that help us meet legal compliance requirements.
• Business Transfer: In the event of a merger, acquisition, or sale of toto99 assets, your data may be transferred to the successor entity subject to equivalent privacy protections.

Every third party that receives your data is required to handle that information with a level of protection at least equivalent to ours, and strictly for the permitted purposes only.

Toto99 uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device when you visit our website.

Types of cookies we use:

• Essential Cookies: Required for core platform functions such as login, game sessions, and security. These cookies cannot be disabled.
• Performance Cookies: Collecting information on how you use the platform to help us improve performance and user experience.
• Functional Cookies: Remembering your preferences and settings such as your preferred language and login details for your convenience.
• Analytical Cookies: Helping us understand traffic patterns and platform usage through analytics tools configured with strict privacy settings.

You can manage your cookie settings through your browser settings. However, disabling certain cookies may affect the functionality of some sections of the toto99 platform.

Toto99 only retains your personal data for as long as it is needed for the purposes stated in this policy or as required by applicable law. Retention periods vary by data type:

• Active Account Data: Retained for the duration your account is active and for a reasonable period after account closure for reference and dispute purposes.
• Financial Transaction Records: Retained for a minimum of seven (7) years in line with accounting and anti-money laundering legal requirements.
• KYC Records & Identity Verification: Retained for a minimum of five (5) years after the end of the business relationship, in accordance with regulatory requirements.
• Communication & Support Logs: Retained for three (3) years for customer service reference purposes.
• Session Data & Technical Logs: Retained for ninety (90) days for security and technical diagnostic purposes.

Upon expiry of the defined retention period, your data will be securely deleted or anonymised using recognised methods so that it can no longer be linked back to you.

As a toto99 user, you have strong privacy rights under applicable data protection laws. Below are your rights and how to exercise them:

To exercise any of the above rights, contact our Privacy Officer by email at [email protected]. We will process your request within 30 business days.

Toto99 implements comprehensive technical and organisational security measures to protect your personal data from unauthorised access, disclosure, alteration, or destruction. Key measures we maintain include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and our servers.
• Data-at-rest encryption for all sensitive information in our databases.
• Role-based access control (RBAC) ensuring only authorised personnel can access specific data.
• Regular security audits and penetration testing by qualified, independent third parties.
• A real-time threat monitoring system that operates around the clock to detect suspicious activity.
• A tested incident response plan to ensure swift action in the event of any security breach.

In certain situations, your personal data may be transferred to and stored on servers located outside of Malaysia. This may occur when we use international cloud service providers or technical service providers operating in other countries.

When your data is transferred outside of Malaysia, toto99 ensures that such transfers are carried out with adequate protections through:

• Data processing agreements compliant with international data protection standards.
• Use of approved standard contractual clauses for international data transfers.
• Ensuring the recipient country provides an equivalent or higher level of data protection.

Toto99 services are restricted to individuals aged 18 and above. toto99 does not knowingly collect or process personal data from individuals under the age of 18.

If we become aware that we have collected personal data from someone under the age of 18 without proper verification, we will take immediate steps to delete that data and close the account in question. If you have information that a minor has registered an account on toto99, please contact us immediately.

Toto99 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or technological advancements. Any material amendments will be communicated to you via a prominent notice on our platform or by email to your registered address at least 14 days before the changes take effect.

We encourage you to review this page periodically. The "Updated" date at the top of this page indicates when the latest version of the Privacy Policy took effect. Continued use of the platform after any amendments take effect will be deemed as your acceptance of the revised terms.

If you have any questions, concerns, or complaints regarding how toto99 handles your personal data, or if you wish to exercise any of your privacy rights, please contact our Privacy Officer through the following channels:

• Privacy Email: [email protected]
• General Support Email: [email protected]
• Live Chat: Available 24/7 via the toto99 platform for immediate enquiries.
• FAQ Page: Visit FAQ page for answers to frequently asked questions about privacy.

We are committed to responding to all privacy-related enquiries within 14 business days. For more complex enquiries requiring further investigation, we will keep you informed of progress within that timeframe.