Privacy Policy

1. Introduction

This Privacy Policy ("Policy") is published by the operator of toto888 ("toto888", "we", "us", "our"), the online gaming platform accessible at toto888.club ("Platform"). It applies to all personal data collected from individuals who visit, register on, or use the Platform ("Members", "you", "your").

toto888 takes the privacy of its Members seriously. We recognise that the personal data you entrust to us — financial details, identity documents, transaction history — is sensitive, and we are committed to handling it responsibly, transparently, and in accordance with applicable data protection law.

By accessing the toto888 Platform or creating an account, you acknowledge that you have read and understood this Policy and consent to the collection, use, and processing of your personal data as described herein. If you do not agree with any part of this Policy, please discontinue use of the Platform and contact us to close your account.

2. Personal Data We Collect

toto888 collects personal data in several ways — information you provide directly when registering or using the Platform, data generated automatically through your use of the Platform, and in certain cases, data obtained from third-party sources for verification purposes.

2.1 Data You Provide Directly

• Identity data: Full legal name, date of birth, nationality, gender, and government-issued identification numbers (e.g., Malaysian NRIC, passport number).
• Contact data: Email address, mobile phone number, residential address, city, and postcode.
• Account credentials: Username and hashed password. toto888 never stores passwords in plain text.
• Financial data: Bank account details, eWallet identifiers (e.g., Touch 'n Go eWallet, Boost, GrabPay account numbers), and payment card details where applicable, used solely for deposit and withdrawal processing.
• KYC documents: Copies of identity documents, utility bills, or bank statements submitted for identity verification or source-of-funds checks.
• Communications data: The content of any messages, emails, or live chat transcripts exchanged with toto888 support.

2.2 Data Collected Automatically

• Technical data: IP address, device type, operating system, browser type and version, screen resolution, and device fingerprint.
• Usage data: Pages visited, features accessed, betting and gaming activity, session duration, click paths, and referring URLs.
• Transaction data: Records of all deposits, withdrawals, bets placed, games played, bonuses claimed, and winnings received.
• Cookie data: Data collected via cookies and similar tracking technologies as described in Section 6 of this Policy.

2.3 Data from Third Parties

toto888 may receive personal data about you from third-party identity verification providers, fraud prevention agencies, payment processors, and where required, from regulatory bodies in connection with licensing compliance obligations.

3. How toto888 Uses Your Personal Data

toto888 uses your personal data only for legitimate, defined purposes. We do not sell personal data to third parties for their own marketing purposes under any circumstances. The primary purposes for which toto888 processes your data are:

• Account management: To create, maintain, secure, and administer your toto888 Member account.
• Service delivery: To provide access to the Platform's gaming and betting services, process bets, settle winnings, and maintain your MYR wallet balance.
• Payment processing: To process deposits and withdrawals via your chosen Malaysian payment method (Maybank2u, CIMB Clicks, Public Bank, DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, etc.).
• Identity verification and KYC: To verify your age, identity, and where required, the source of funds deposited into your account, in compliance with anti-money laundering regulations and our gaming licence obligations.
• Fraud prevention and security: To detect and prevent fraudulent activity, account takeover attempts, money laundering, and other prohibited conduct on the Platform.
• Legal and regulatory compliance: To comply with applicable laws, regulations, and the requirements of our international gaming authority licence, including filing mandatory reports with regulatory authorities where required.
• Responsible gaming: To identify patterns of play that may indicate problem gambling behaviour, to administer deposit limits, self-exclusion requests, and other responsible gaming tools, and to contact Members proactively where welfare concerns arise.
• Customer support: To respond to your enquiries, complaints, and requests submitted via live chat, email, or other support channels.
• Platform improvement: To analyse aggregate, anonymised usage data to improve the toto888 Platform, troubleshoot technical issues, and optimise the Member experience.
• Promotional communications: To send you information about toto888 promotions, bonuses, and relevant updates, where you have opted in to receive such communications. You may opt out at any time.

4. Legal Basis for Processing

toto888 processes your personal data on one or more of the following legal bases:

• Contractual necessity: Processing required to perform the contract between toto888 and you as a Member — including account management, payment processing, and service delivery.
• Legal obligation: Processing required to comply with applicable laws and regulatory requirements, including AML/CTF obligations, age verification requirements, and gaming licence conditions.
• Legitimate interests: Processing conducted for toto888's legitimate business interests — such as fraud prevention, platform security, and platform improvement — where those interests are not overridden by your fundamental rights.
• Consent: Processing conducted on the basis of your specific, freely given consent, such as receiving promotional communications. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

5. Data Sharing & Disclosure

toto888 does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We may share your personal data with the following categories of recipients only to the extent necessary for the purposes described in this Policy:

• Payment processors: Financial institutions, banks, and eWallet providers (including Maybank, CIMB, Public Bank, Touch 'n Go, Boost, GrabPay, and DuitNow) necessary to process your deposits and withdrawals.
• Identity verification providers: Third-party KYC and AML service providers used to verify your identity and conduct required due diligence checks.
• Gaming software providers: Certified game suppliers whose software powers toto888's slots, live casino, and other game verticals. These providers receive only the minimum data necessary to operate their games and are contractually bound to use that data only for service delivery.
• Regulatory authorities: Our gaming licence regulator and applicable law enforcement or governmental bodies, where toto888 is legally required or authorised to make such disclosure.
• Professional advisers: Lawyers, accountants, and auditors engaged by toto888 who are bound by professional confidentiality obligations.
• Corporate transactions: In the event of a merger, acquisition, or sale of substantially all of toto888's assets, your personal data may be transferred as part of that transaction, subject to equivalent data protection commitments.

6. Cookies & Tracking Technologies

toto888 uses cookies and similar technologies (collectively "cookies") to operate the Platform, improve your experience, and support security and fraud prevention functions. The main categories of cookies used are:

• Strictly necessary cookies: Required for the Platform to function. They maintain your login session, remember your language preferences, and support security features. These cannot be disabled without impairing Platform functionality.
• Functional cookies: Remember your settings and preferences to personalise your toto888 experience across sessions.
• Analytics cookies: Collect anonymised data about how Members use the Platform — pages visited, features used, session duration — to help toto888 improve the service.
• Security cookies: Used to detect fraudulent login attempts, bot activity, and other security threats.

Most browsers allow you to control or disable cookies through their settings. Please note that disabling strictly necessary cookies may impair your ability to use the toto888 Platform.

7. Data Retention

toto888 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. In practice, this means:

• Account and transaction data is retained for a minimum of five (5) years following account closure, as required by applicable AML and gaming regulatory obligations.
• KYC documents and identity verification records are retained for a minimum of five (5) years following the completion of the relevant verification process or account closure, whichever is later.
• Customer support communications are retained for three (3) years from the date of the interaction.
• Cookie and analytics data is retained in anonymised or aggregated form and does not constitute personal data after anonymisation.

Where personal data is no longer required, toto888 will securely delete or irreversibly anonymise it in accordance with our internal data management procedures.

8. Data Security

toto888 implements robust technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, and destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your browser and toto888 servers.
• One-way cryptographic hashing of account passwords — toto888 staff cannot retrieve or read your password.
• Two-factor authentication for account logins from unrecognised devices.
• Strict access controls limiting employee access to personal data on a need-to-know basis.
• Regular security audits, penetration testing, and vulnerability assessments conducted by independent specialists.
• Data breach response procedures including Member notification protocols where a breach poses a risk to your rights.

While toto888 takes every reasonable precaution to protect your data, no system is completely impervious to risk. We encourage all Members to use strong, unique passwords and to enable two-factor authentication on their toto888 account.

9. Your Rights Over Your Personal Data

Subject to applicable law, you have the following rights in relation to the personal data toto888 holds about you:

• Right of access: You may request a copy of the personal data toto888 holds about you.
• Right to rectification: You may request correction of inaccurate or incomplete personal data.
• Right to erasure: You may request deletion of your personal data where there is no lawful basis for its continued retention. Note that statutory retention obligations (e.g., AML regulations) may prevent full erasure in certain cases.
• Right to restrict processing: You may request that toto888 temporarily restrict the processing of your data in certain circumstances.
• Right to data portability: Where processing is based on consent or contract and carried out by automated means, you may request your data in a structured, commonly used format.
• Right to object: You may object to the processing of your personal data for direct marketing purposes at any time, and to processing based on legitimate interests where your individual circumstances warrant it.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, please contact toto888 Member Support using the contact details in Section 13. We will respond to all valid data rights requests within 30 days of receipt.

10. Children & Minors

toto888 is strictly an adult platform. We do not knowingly collect, process, or retain personal data from any person under the age of 21. Age verification is a mandatory step in the toto888 account registration process, and ongoing KYC checks are conducted to identify and remove underage accounts.

If toto888 discovers that personal data has been provided by a person under 21, that data will be securely deleted, the account will be closed immediately, and any funds deposited will be returned via the original payment method where feasible. If you believe a person under 21 has created a toto888 account, please contact us immediately at [email protected] so we can investigate and act accordingly.

11. International Data Transfers

toto888 operates under an international gaming authority licence, and some of our service providers — including gaming software suppliers, KYC providers, and cloud infrastructure partners — may be located outside Malaysia. Where personal data is transferred to countries that may not have equivalent data protection laws, toto888 ensures that appropriate safeguards are in place, such as contractual clauses that require recipients to protect your data to the same standard as toto888 does under this Policy.

By using the toto888 Platform, you acknowledge and consent to the transfer of your personal data to the international service providers described in this Policy for the purposes set out herein.

12. Changes to This Privacy Policy

toto888 may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or regulatory requirements. Material changes will be communicated to registered Members via email notification to the address on file, or by a prominent notice on the Platform, no less than seven (7) days prior to the effective date of the change.

We encourage you to review this Policy periodically. Your continued use of the toto888 Platform after any amendment takes effect constitutes your acceptance of the revised Policy.

13. Contact & Data Queries

If you have any questions about this Privacy Policy, wish to exercise your data rights, or wish to raise a data-related concern or complaint, please contact the toto888 Data Protection team:

If you are not satisfied with toto888's response to a data privacy concern, you have the right to escalate your complaint to the applicable data protection supervisory authority or, where relevant, the regulatory body under toto888's gaming licence.