Privacy Policy toto22 — Data Protection & Personal Information

Toto22 ("we", "Platform" or "toto22") takes the privacy of our members very seriously. This Privacy Policy explains in detail how we collect, use, disclose and protect the personal information you provide to us when using the toto22 platform at toto22.wine, our mobile app, and all related services operated under the toto22 brand.

We understand that your trust is our most valuable asset. We are therefore committed to managing your personal data in a transparent, responsible manner that complies with applicable data protection laws, including Malaysia's Personal Data Protection Act 2010 (PDPA).

By registering a toto22 account or using any of our services, you consent to the collection and use of your personal information as described in this Privacy Policy. If you disagree with any part of this policy, please discontinue use of the platform and contact us to close your account.

Toto22 collects your personal information through several channels — primarily during account registration, day-to-day platform use, the identity verification (KYC) process and communications with our support team. The following are the types of information we collect:

We only collect information that is genuinely necessary to provide you with a safe and responsible service. We do not collect sensitive information such as health data or political affiliations unless required by law.

The personal information we collect is used for legitimate and necessary purposes in operating the toto22 platform. Specifically, we use your data for the following purposes:

• Account management: Create, maintain, and protect your toto22 account, including processing registration, login, and security settings.
• Transaction processing: Securely verify and process deposits, withdrawals, and all financial transactions in your account.
• KYC verification: Meet anti-money laundering (AML) legal compliance requirements and member identity verification.
• Customer support: Respond to enquiries, resolve complaints, and provide technical assistance to members who need it.
• Platform security: Detect and prevent fraud, account misuse, cyberattacks, and other unauthorised activities.
• Service improvement: Analyse usage patterns to improve the user experience, platform layout, and game selection.
• Marketing communications: Send information about promotions, bonuses, and platform updates — you can unsubscribe from marketing communications at any time through your account settings.
• Legal compliance: Fulfil reporting obligations to relevant regulatory bodies and authorities as required by law.

We will not use your data for any purpose not stated above without first obtaining your consent.

Toto22 does not sell or rent your personal information to any third party for commercial purposes. However, in operating the platform, we need to share certain information with trusted partners in the following categories:

• Payment service providers: Transaction information is shared with authorised payment processors (FPX, DuitNow, e-wallet providers) solely to process your deposits and withdrawals.
• Game software providers: Minimum technical data required to operate third-party games within the toto22 platform.
• Identity verification services: KYC information is shared with accredited identity verification providers to process legally required checks.
• Legal authorities: toto22 will disclose personal information when required by court order, regulatory authority directive or applicable law.
• Business transfers: If toto22 undergoes a merger, acquisition or asset sale, member information may be transferred to the successor entity subject to equivalent privacy protections.

All third parties that receive toto22 member data are required to sign strict data confidentiality agreements and may only use that information for specifically authorised purposes.

Toto22 uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device when you visit our website. The following are the types of cookies we use:

• Essential cookies: Required for core platform operations such as login authentication, session management, and account security. These cookies cannot be disabled.
• Functional cookies: Save your preferences such as language, display settings, and login information for a more convenient recurring experience.
• Analytics cookies: Collect anonymised data on how members use the platform to help us improve its layout and features.
• Security cookies: Help identify suspicious activity and protect your account from unauthorised access.

You can manage your cookie settings through your browser preferences. However, disabling essential cookies may affect platform functionality and your gaming experience. For more information on managing cookies, please refer to your browser's help documentation.

The security of your data is an operational priority at toto22. We implement comprehensive technical and organisational security measures to protect your personal information from unauthorised access, disclosure, alteration, or accidental destruction.

Key security measures we practise include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and toto22 servers.
• Data-at-rest encryption for all sensitive information stored in our databases.
• Two-factor authentication (2FA) is available for all member accounts as an additional security layer.
• Round-the-clock 24/7 security monitoring by the toto22 cybersecurity team.
• Regular penetration testing by independent third parties to identify and address system vulnerabilities.
• Role-based access control to ensure staff can only access the data required for their specific duties.
• Mandatory cybersecurity awareness training for all toto22 staff who handle personal data.

While we do our best, no security system can be guaranteed 100% safe. We therefore encourage you to take personal protective measures as well, such as using a strong password and enabling 2FA on your account.

Toto22 retains your personal information for as long as necessary to fulfil the purposes set out in this Privacy Policy, or for as long as required by applicable law — whichever is longer. In general, our retention guidelines are as follows:

• Active account data: Retained for the duration your account is active on toto22, plus a minimum holding period after account closure.
• Financial transaction records: Retained for a minimum of 7 years from the transaction date in accordance with Malaysia's tax and AML legal requirements.
• KYC documents: Retained for a minimum of 5 years after account closure as required by anti-money laundering legislation.
• Support communication logs: Retained for 3 years for reference and dispute resolution purposes.
• Anonymous analytics data: May be retained indefinitely as it cannot be linked to any specific individual.

Once the defined retention period has elapsed, your data will be securely deleted using industry-recognised data deletion methods. You may also request early deletion of your data subject to limitations prescribed by law.

Under Malaysia's Personal Data Protection Act 2010 (PDPA) and the data protection principles we uphold, you have the following rights regarding your personal information:

To exercise any of the above rights, please contact the toto22 privacy team through our customer support channels. We will process your request within 30 business days. In complex cases, this period may be extended to 60 days with prior notice.

The toto22 platform is a service exclusively for adults aged 18 and above. We do not knowingly collect or process personal information from individuals under the age of 18.

All new registrants are required to confirm they are 18 years of age or older during the registration process. Further age verification is carried out through the KYC process, which requires official identity documents. Should we discover that a minor's personal information has been collected without our knowledge, we will take immediate steps to delete that information and close the account in question.

Parents or guardians who believe their child under the age of 18 has registered a toto22 account are requested to contact our support team immediately so that appropriate action can be taken.

Toto22 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our privacy practices, new legal requirements or improvements to our services.

When we make material changes, we will:

• Publish an updated version on this page with a new effective date.
• Send notifications via the platform or your registered email for amendments that materially affect your privacy rights.
• Provide a minimum 14-day notice period before material amendments take effect, unless required by law to implement them immediately.

Continued use of the toto22 platform after the effective date of any amendment is considered your acceptance of the revised Privacy Policy. We encourage you to review this page periodically to stay informed of our latest privacy practices.

If you have any questions, concerns or complaints regarding this Privacy Policy or how toto22 handles your personal data, our privacy team is ready to assist you.

You can reach us through the following channels:

• Support email: [email protected] (response within 1–2 business days)
• Live chat: Available 24 hours a day, 7 days a week via the chat icon on the toto22 platform
• Help Centre: Visit the page FAQ us for answers to frequently asked questions

For requests specifically relating to data privacy rights such as access, correction or deletion, please state "Data Privacy Request" in the subject line of your message so it can be routed to the appropriate team more quickly.